Privacy

What we store

Only what the product needs to work. In practice that is four kinds of thing.

• Who you are. A display name, your timezone, the tone you asked to be spoken to in, and what time you want to be nudged. If you signed in with Google, the email address and name Google returned.
• What you committed to and whether you did it. Your commitments, your daily check-ins, your goals, and any measurements you chose to log.
• What you wrote or recorded. Moments, messages, and any clip you made or saved, including its audio.
• Who you are connected to. Your spotters, the people you spot, invites you sent, and what you granted each of them.

Your steps

The Android app can read your step count, and nothing else, from Health Connect on your phone. It asks first, Android decides, and you can take the permission back at any time in Health Connect without uninstalling anything.

• Steps per day, and no other health data. Not your heart rate, your sleep, your weight, your workouts or your location. The app declares one permission . The right to read steps. And Android will not give it any more than it asked for.
• A daily total, not a trail. One number per day is stored. Where you walked, when you walked, and how fast are never read and never kept.
• Where it goes. Onto your own screen, and into the total of any crew you joined. Only for the days after you joined it, and only for a crew counting steps. A crew’s public page shows the crew’s total and how many of you there are. It carries no individual’s figure and cannot: the view it reads from has no person in it at all.
• Never sold, never advertised against, never used to decide anything about you. Not for insurance, not for employment, not for a credit decision. It is a number about your own walking and it is treated as one.
• Stopping it. Turn the permission off in Health Connect and the app stops reading. Delete your account and the stored days go with it, as everything else does.

If you never install the Android app, none of this applies to you. Steps you type in yourself are marked as estimates wherever they appear, so a number nobody measured is never passed off as one that was.

What a spotter can see

This is the part worth reading twice, because it is the only place your information deliberately reaches another person.

• Only the pillars you granted. Nothing outside them, and you can change the grant or end it whenever you want.
• Whether, not what. They get your status, your trend and your streak inside those pillars. They never get the specific commitment you missed, and they never get anything you kept private.
• A moment only if you send it. What you write after a check-in is yours until you tap to show it.
• That you went quiet. This is the point of the product, and it is worth saying out loud: a spotter is told when you stop, not only when you show up.

These are enforced in the database rather than on a screen, because a privacy rule that lives in the view layer is one refactor away from not existing.

What we never collect

• Your phone number. There is no field for one. Everything stays in the app, because a number cannot be un-shared.
• Your device’s location. The app never asks Android or your browser for it, so there is no location permission and no prompt to accept. Nothing here reads GPS. That includes the walking: a step count is a number, not a route, and the app never reads where any of it happened. We do count visits by approximate city . That is described in full below, and it is not tied to you.
• Any health data beyond your step count. No heart rate, sleep, weight, blood pressure, workouts or anything else Health Connect can hold. The app declares one health permission and Android enforces it.
• Your browsing anywhere else. There are no advertising pixels, no session recorder and no third-party tracker here. Not configured off. Not present. Nothing you do in this product is sent to Google, Meta, or an analytics company, because none of them are wired in. What we count, we count ourselves, and it is described below.
• Anything about you from a data broker. We do not buy information about you, and we do not enrich what you gave us.

What we count

We need to know whether this is spreading, and where. So when you open a screen, the server writes down four things: roughly which city the request came from, which screen it was, whether it was the website or the app, and the date.

The city is worked out from the network address your request arrives with. The same thing every website on the internet can see about you. Your device is never asked where it is.

Three things about that row are worth stating precisely, because they are the point:

• It does not have your account on it. Not encrypted, not hashed. There is no column for it. Nothing in that table can be narrowed to a person, including by us, because the fact required to do it was never written down.
• We never receive your address. It is turned into an unreadable token before the database sees it, and the database has no way back. The token is what lets us count people rather than page loads.
• The token changes every day. Deliberately, so that even we cannot line up yesterday’s visits with today’s to make a trail of where somebody has been. We can tell you how many people opened the app in Dallas on Tuesday. We cannot tell you whether any of them were the same person who opened it on Monday, and we built it that way on purpose.

Counting like this is not a compromise we are apologising for. It is the version that lets us run a business without holding a map of where our users live.

Who else touches it

Running this needs other companies. Here is the complete list, and what each one can actually see.

Nobody on this list may use your information for their own purposes, and none of them is paid for access to it. We do not sell your data, and there has never been an arrangement under which somebody could buy it.

How long we keep it

Your history is the product. A streak you cannot look back on is not worth keeping . So we hold it while your account is open.

• Delete anything, any time. A moment, a clip, a commitment, a connection.
• How to delete your account, on its own page. The steps, what goes, and what does not.
• Delete the account and it all goes. Your profile, your history, your clips and your connections are removed. This is not a hidden flag on a row we keep.
• What survives. Messages you sent another person stay in their copy of the conversation, the way a letter does. And if somebody reported you, the report survives, or reporting would be pointless.
• Backups. Deleted data can persist in encrypted backups for up to 30 days before those roll off.

What you can ask for

Wherever you live, and regardless of whether your local law grants it: you can ask what we hold about you, ask for a copy, ask us to fix something wrong, and ask us to delete it. Write to the address below and you will get a real answer.

If you are in the UK or EU, the lawful basis is performance of the contract for the parts that make the product work, and your consent for anything optional. If you are in California, the rights to know, delete, correct and opt out are already granted above, and there is nothing to opt out of because nothing is sold or shared for advertising.

Age

MyLifeSpotter is for adults. It pairs people privately around personal difficulty, and that is not a room to put a minor in. We do not knowingly collect anything from anybody under 18, and if we learn an account belongs to one, we remove it.

Changes

If this changes in a way that affects what is collected or who can see it, you will be told in the app before it takes effect. Not by a silently updated date at the top of a page.

Reaching a person

MyLifeSpotter is operated by Eric Ellis. Privacy questions, requests and complaints go to info@mylifespotter.com.