Privacy Policy

The short version

Almost everything you record in Sagoma — your logs, weights, measurements and progress photos — is encrypted on your device before it is sent to us. We hold it as ciphertext and we cannot decrypt it. What we can see is the small amount of account information needed to sign you in, take payment, and keep the service running.

What we collect

Account

Your email address, a password verifier (we never store the password itself), the date you confirmed you are eighteen or older, and your consent records with their timestamps.

Devices

A device name and platform for each phone you sign in on, so you can see the list and revoke any of them. We also store a wrapped encryption key per device, which we cannot unwrap.

Encrypted content

Your training and nutrition history, body measurements and photos, stored as opaque encrypted blobs together with the version of the key that sealed them. We can tell you how many items you have and when they changed. We cannot tell you what is in them.

Subscription

Your plan, its status and renewal dates, and the identifiers the app store gives us. Card details go to the app store, never to us — we never see or store a card number.

Operational records

Sign-in attempts, API request metadata, rate-limit counters and error logs. These exist to detect abuse and to fix faults, and they are the reason we can tell you if someone tried to get into your account.

What we do not do

• We do not sell your personal information, and we never have.
• We do not run advertising in Sagoma and we do not share data with ad networks or data brokers.
• We do not build profiles of you for anyone else's purposes.
• We do not train models on your content. We could not, in any case, read it.

Why we hold what we hold

Account and device records exist to authenticate you and to let you cut off access from a phone you no longer have. Subscription records exist to give you the service you paid for. Operational records exist for security and for diagnosing failures. Encrypted content exists so that your history survives a lost phone. There is no category collected "just in case".

Who else touches it

We use a small number of processors: a cloud database and application host, an email provider for account messages such as password resets, and the Apple App Store for payment. Each receives only what its function requires, and none of them receive your encryption keys or anything that would let them read your content.

We will disclose information if we are legally compelled to. Because of how the encryption works, what we are able to produce in that situation is account and billing records and ciphertext.

How long we keep it

Account and encrypted content are kept while your account is open. Delete your account and both are erased within thirty days, other than records we are required to retain for tax or fraud purposes. Operational logs are kept on a rolling window measured in months, not years.

Your choices

You can export your data, delete individual entries, revoke any device, withdraw a consent, or delete your account outright from inside the app. If you would rather ask us, write to privacy@sagoma.app and we will act within thirty days.

Health data

Some of what you record in Sagoma is consumer health data as defined by Washington's My Health My Data Act and comparable laws elsewhere. That data is covered by a separate document with additional disclosures and rights: the Consumer Health Data Privacy Policy.

Children

Sagoma is for adults. You must confirm you are eighteen or older to create an account, and we do not knowingly collect information from anyone under that age. If you believe a minor has an account, tell us and we will remove it.

Changes

If this policy changes in a way that materially affects you, we will tell you in the app before the change takes effect rather than quietly updating the date at the top.

Contact

Whitetowers Group — privacy@sagoma.app