Privacy Policy

Milo is a calm health journal: you write naturally about what you ate, how you trained, and how you felt, and Milo turns it into structured insight. Your journal is personal, and this policy explains — in plain language — exactly what we collect, why, and the control you have over it. The short version: we never sell your data, and we never use it for advertising.

Device and diagnostic information

Our analytics and crash providers may receive an installation identifier, account identifier, app interactions and diagnostic information. Network addresses may be used to derive approximate location. We do not record screen sessions or send journal text as analytics properties, and we do not use these data for advertising tracking.

Who we are

Milo (the “app,” “we,” “us”) is operated by Nathan Bekele (the data controller). If you have any question about this policy or your data, reach us at support@milohealthjournal.com.

What we collect

We collect only what the app needs to work. Account and journal records are linked to your account. Voice audio is processed on device and discarded. None of this data is used for cross-app tracking or advertising.

Account details: Your email address (and name, if you provide one), account identifier, and sign-in credentials — to create and secure your account and personalize the app. For Sign in with Apple, we securely retain encrypted authorization tokens so we can revoke Milo’s access when you delete your account.
Profile details: Your birthday, gender (if you provide it), height, weight, activity level, goals and settings. We use your birthday to check the 18+ requirement and your profile details to calculate your daily goals and personalize the app.
Your journal entries: The text you write — food, workouts, sleep, mood, notes — and the calorie/macro estimates Milo derives from it.
Fitness information: Workout entries (exercise, duration, sets/reps) and the weight / body-measurement history you log.
Health data: If you connect Apple Health, the metrics you authorize (active energy, steps, weight, sleep, workouts). See Apple Health.
Audio: If you use voice logging, audio is captured temporarily for transcription and then discarded — we store only the resulting text, not the recording.
Photos: If you log a meal by photo, a copy is stored on this device with the entry. With your permission, the image is sent to our AI services to generate a description. If you upload a profile photo, we store it with your account so it can appear on your profile.
Purchase history: Your subscription status and transaction events, via RevenueCat, for receipt validation and access to premium features.
Diagnostics & usage: Crash reports and performance data (via Sentry) and product-interaction analytics (via PostHog) — to keep the app stable and understand which features help.

We do not use App Tracking Transparency, set advertising identifiers, or link your data to third-party data for advertising or measurement.

Optional website analytics

The website demonstration runs locally using fixed sample data. It does not accept or send your health information. Website analytics are off unless you choose “Allow analytics” in the footer. With permission, we send PostHog page visits, fixed demo-action identifiers, App Store link clicks, a broad screen-size category and performance measurements. A random identifier links events within that page visit; it is not your Milo account identifier. We do not send page URLs, referring URLs, journal text or sample health values, and we do not enable session recording or automatic interaction capture on this website. PostHog necessarily receives the request's network address; our project is configured to anonymize IP addresses.

Your analytics choice is saved in browser storage. You can turn analytics off in the footer; that stops new events and does not recall events already sent. We honor supported Global Privacy Control and Do Not Track preferences. Performance is measured locally even with analytics off; those measurements are sent only with your permission. Local development previews never send analytics.

Previous website email signups

If you previously requested launch updates on our website, your email address was sent to Kit to manage those emails. The website no longer accepts launch notification signups. Kit handles signup confirmation and unsubscribe links. You can unsubscribe through those emails or contact support@milohealthjournal.com. This signup does not create a Milo account or include journal or health data.

How we use your data

To run the app — store your journal, compute calorie/macro estimates, surface patterns, and sync across your sessions.
To personalize — tailor targets and insights to the basics you provide (age, height, weight, goals).
To keep it working — diagnose crashes and performance issues, and understand which features are useful so we can improve them.
To secure and delete your account — verify your sign-in with your chosen provider and revoke retained Apple authorization when you delete your Milo account.
To process your subscription — validate purchases and unlock premium features.

We never sell your personal data, and we never use your journal, health, or fitness data to advertise to you.

Apple Health (HealthKit)

Connecting Apple Health is optional. When you do, Milo reads only the data types you explicitly authorize (such as active energy, steps, weight, sleep, and workouts) to show your calorie balance and surface patterns, and — if you grant it — can write workouts or nutrition you log back to Health.

Health readings used for on-device insights stay on your device. If you choose to import a Health workout, its activity and duration become a journal entry stored in your Milo account and may be processed by AI if you allow it.

Health data is never used for advertising, never sold, and never shared with third parties for their own use. You can revoke Milo’s Health access at any time in the Apple Health app or iOS Settings.

Voice & photos

Voice: transcription runs on your device. Audio is processed to produce text and then discarded — we don’t keep the recording.

Photos: photos you log are stored on this device and are not synced with your Milo account. With your permission, the image is sent to our AI services to generate a food description. Deleting the entry on this device removes its saved photo.

Analytics & crash reporting

We use these service providers to keep Milo stable and useful:

PostHog — product analytics (which features are used, funnel and retention). Event data is keyed to your user id; we don’t send your journal text or health data as analytics properties.
Sentry — crash and performance diagnostics, so we can fix problems quickly.
RevenueCat — subscription and entitlement management.

These are service providers acting on our behalf, not advertising networks.

We don’t sell your data and we don’t share it for advertising. We share it only with the infrastructure and service providers that make the app function — our backend host (Supabase), the AI services that produce your estimates, and the analytics/crash/subscription providers named above — each acting under contract and only to provide their service. Apple receives the authorization information needed to validate Sign in with Apple and revoke Milo’s access. We may also disclose data if required by law or to protect rights and safety.

Where your data lives

Your account and journal are stored on our backend provider, Supabase, hosted in the United States, with row-level security so each account can only access its own data. With your explicit permission, journal text, transcribed voice text, selected photos, parsed details and relevant past-entry information are processed by Google Gemini, Anthropic Claude, Cerebras, OpenAI and Voyage AI, depending on the feature and fallback needed. Exa receives search queries for supporting information. You can allow or revoke this processing in Settings → AI & privacy; revocation stops new requests and does not recall data already sent.

How long we keep it

We retain encrypted Apple authorization credentials while needed to secure your account and complete account deletion. We remove those records with your Milo account after revocation. If an older or interrupted sign-in left no usable credential, we still delete your Milo account and explain how to remove Milo’s Apple authorization manually.

We keep your data while your account is active so your journal stays available. Deleting your account removes your profile and journal entries from Milo’s active database. It does not immediately remove every record held by analytics, diagnostics, and subscription providers. Those records require separate deletion or expire under the provider’s retention rules.

We aim to process analytics, diagnostics, and subscription deletion requests within 30 days. This is a processing target, not a guarantee that every provider record or backup is erased within 30 days. Where a status receipt is saved, it stays on your device so you can check progress without signing in. It shows completion only after the tracked provider deletion requests have been verified. You do not need to contact support for deletion processing to continue.

Diagnostic retention can take longer. On our current Sentry Developer plan, errors and performance traces are retained for 30 days after ingestion. Sentry’s backups expire 30 or 90 days after creation, depending on data type. Records ingested under earlier plans can have longer retention. These periods run from ingestion or backup creation, not necessarily from your deletion request. See Sentry’s retention periods and backup policy. Applicable legal requirements still govern how we handle deletion requests and any required retention.

Your rights & choices

Delete your account — anytime, in the app: Settings → Account → Delete account. This permanently removes your profile and journal entries from Milo’s active database. Provider records are handled separately as described above.
Access or export — use Settings → Export my journal in the app, or email us for help accessing your data.
Correct — edit your entries and profile directly in the app.
Apple Health — revoke access anytime in Health / iOS Settings.

Depending on where you live, you may have additional rights (access, correction, deletion, portability, objection). To exercise any of them, contact support@milohealthjournal.com.

Children

Milo is for adults aged 18 and older. We do not knowingly collect personal data from anyone under 18. You must confirm that you meet this age requirement before using Milo. If you believe someone under 18 has used Milo, contact us so we can investigate and delete their account and personal data.

Changes to this policy

If we make a material change, we’ll update the date above and, where appropriate, notify you in the app. Continuing to use Milo after a change means you accept the updated policy.

Contact

Questions, requests, or concerns? Email support@milohealthjournal.com and a real person will get back to you.