Privacy Policy
Last updated: July 3, 2026
Overview
SupplementHub helps a household track supplements, dosages, schedules, and dose history. The app works fully offline with no account, and in that mode none of your data ever leaves your device. You only share data with us if you choose to turn on CloudSync and sign in. This policy explains what we collect in that case, why, and your choices.
The two modes
- Local-only mode (default; Free and Pro): all of your data is stored only on your device, in encrypted on-device storage. We do not receive, transmit, or store any of it, and no account is required.
- CloudSync mode (optional): when you sign in and enable CloudSync, your supplement data is synced to our servers so it can be shared across your devices and with the members of your family group.
Information we collect (CloudSync only)
We collect the following only when you enable CloudSync and sign in:
- Account information — your email address and a user identifier (and, if you use Google Sign-In, your Google account identifier), used to create and manage your account.
- Your supplement data — the family members, supplement names, dosages, schedules, notes, and dose/refill history you enter. Because this reflects a person’s supplement regimen, we treat it as health-related information. Used solely to provide sync and family-sharing.
- Purchase records — the purchase tokens and entitlement status for your Pro purchase and CloudSync subscription, used to verify and grant access. We never receive or store your payment-card details — all payments are processed by Google Play.
- A device identifier — a random identifier we generate for your app installation (not your hardware ID or an advertising ID), used to route the encryption keys that secure your synced data. It is not used for tracking or advertising.
We do not collect: location, phone number, contacts, calendar, messages, audio, files, browsing history, or advertising identifiers. Photos you choose as an avatar are stored only on your device and are never uploaded. We do not use analytics, crash-reporting, or advertising SDKs.
End-to-end encryption (Secure sync)
You can enable Secure sync, which encrypts the sensitive text in your data (such as names, notes, and schedules) on your device before it is sent. When Secure sync is on, we cannot read that content — it is stored on our servers only as encrypted text that can be decrypted by your family’s devices. Your recovery code, which can restore access, is held on your device, never by us.
How we use information
We use the information above only to operate CloudSync and family sharing, manage your account and sign-in, verify your purchases and entitlement, secure your data, and provide customer support. We do not sell your information or use it for advertising.
Sharing
We do not share your information with third parties for their own purposes. We use a hosting/infrastructure provider (Mosaic) to run our backend on our behalf as a service provider/processor; they process data only to provide that hosting. If you use Google Sign-In, Google authenticates you and provides us your email and account identifier, subject to Google’s Privacy Policy.
Where your data is stored
Your synced data is processed and stored on servers located in Canada (operated by our hosting provider, Mosaic). If you use the app from outside Canada — for example, the United States — your data is transferred to and stored in Canada. Canada is recognized by the European Commission and the United Kingdom as providing an adequate level of data protection, which is the legal basis we rely on for any such transfers. Data held only on your device (local-only mode) is not transferred anywhere.
Data retention and deletion
- Your data is retained while your account and family group are active.
- You can delete your account and its data at any time from within the app (“Delete account & data”), or via our account deletion page. This removes your account and the family data you own from our servers.
- If a family owner’s CloudSync ends, the shared family is frozen and then permanently deleted from our servers after a grace period; the owner retains their local copy.
- Data stored only on your device is removed when you delete the app or clear its data.
Your rights
Depending on your location, you may have rights to access, correct, export, or delete your personal information, and to withdraw consent. You can exercise the core of these directly through in-app account deletion, or by contacting us at wedancprod@gmail.com. We will respond consistent with applicable law (e.g., GDPR, UK GDPR, PIPEDA, and CCPA/CPRA where they apply).
Children
SupplementHub is intended for adults managing a household. It is not directed to children, and we do not knowingly collect personal information from children. A parent may record information about a child’s supplements, but the account holder is an adult.
Security
We protect your data in transit with TLS/HTTPS, store credentials in your device’s secure storage, and offer optional end-to-end encryption (Secure sync). No method of transmission or storage is perfectly secure, but we take reasonable measures to protect your information.
Changes to this policy
We may update this policy from time to time. We will post the updated version with a new effective date and, where appropriate, notify you in the app.
Contact
Questions or requests about this policy? Email us at wedancprod@gmail.com.