Privacy Policy

1. What We Collect (and Why)

We only collect information when we have a reason to — usually because the service can't work without it. You give some of it to us directly when you:

• Analyze supplement combinations on our platform
• Create an account
• Add what you take to your list — supplements, medications, and the food and drink you have regularly
• Add optional health details (conditions, medications, allergies, age range, sex, and any concerns you type in) to personalize your analysis
• Type in lab results, one report at a time, with a consent box for each (section 4)
• Keep notes, if you turn them on: the reasons you give when you change or stop something, notes on how you have been, and your check-in answers (section 4)
• Upload a raw DNA file for the optional DNA report
• Photograph a supplement label for scanning
• Contact us for support

Like nearly every website, we also collect some information automatically when you visit:

• IP address and device information
• Browser type and version
• Pages visited and time spent
• Supplement queries and analysis interactions

2. How We Use Your Information

We use what we collect to:

• Provide and improve our supplement analysis services
• Use the health details you chose to save to decide which warnings apply to your list, and show where the gene results you chose to save touch your list
• Keep your notes, show them to you and print them when you ask; and count, on our own servers and without reading any note, how often check-in cards are shown and answered, how often notes are printed, how many changes on lists get a reason or a notes window, how people answer whether notes are useful, and how often notes are turned on, turned off or cleared, so we can decide whether to keep, change or remove the feature
• Understand how the site is used so we can make it better
• Respond to your inquiries and support requests
• Send important updates about our services, and the emails you opted into
• Prevent fraud and keep the platform secure
• Comply with legal obligations

That's the whole list. We don't use your information to sell you supplements, and we don't run ads.

3. Who Else Sees Your Data — Our Processors

We do not sell or trade your personal information, and we never share it for advertising. We do use a small number of outside companies to run the service. They process data on our instructions only, and are not allowed to use it for their own purposes. This is the complete list, by kind of company. We will tell anyone who asks which companies these are (write to hello@canistackthis.com).

About the AI processor specifically. The check on your list is decided by our own rules on our own servers, not by a model: every finding, every severity, and the spacing on My day. Running a check sends nothing to an outside AI provider, with AI switched on or off. What a model hosted by that provider does is read a label photo you scan and re-check a stack you saved on the old version of this site. There is no way to produce those without sending the provider the inputs listed above, so each of the two reads your AI setting before anything leaves our servers, and turning AI off in Account stops both. Your DNA report uses no model: nothing from your DNA file or DNA results is sent to an outside AI provider. Three things we can tell you plainly:

• Under the AI provider's API terms, data sent through the API is not used to train its models. The provider may retain API data for a limited period for abuse monitoring.
• We never send your name, your email, your account id, or your raw DNA file.
• We never sell this data, and it is never used for advertising, by us or by them.

If you would rather no AI vendor received anything from you, turn AI off in Account. The check on your list still runs, on our own rules. Your lab values are never sent to an AI vendor, and nothing from your DNA file or DNA results is sent to one either way.

Companies you deal with directly. Two more companies see some of your data, under their own privacy policies rather than only on our instructions. Apple sells and bills any purchase you make in the iPhone app, through the App Store; we never see your card. And if you sign in with Apple or with Google, that company confirms who you are, gives us your email address, and may give us your name and profile picture.

Public label lookups. When you look up a product's label, our server searches the NIH Dietary Supplement Label Database, a free public service of the US government, for that product's name. It sends the name only, never anything about you.

Saying what you take. The “Say it” button uses the speech recognition built into your browser or phone. Depending on which you use, your voice may be sent to its maker, such as Google for Chrome or Apple for an iPhone, to be turned into text, under that company's own privacy policy. We receive only the text.

Beyond the processors above, we share information only:

• With your explicit consent
• When required by law or to protect our rights

If the company ever changes hands: if CanIStackThis is ever acquired or merges with another company — we have no plans for that, but we'd rather be straight with you — your data would move with the service. Two things would not change: any new owner would still be bound by the genetic-data promises in this policy, and, where the law allows, we would notify you before any transfer so you can delete your data first.

4. Your DNA Data, Your Lab Values and Your Notes

DNA (genetic information)

Our optional DNA report never keeps your raw file. If you choose to use it:

• Processed in memory, never stored: When you upload a raw DNA file, it is parsed in server memory to extract nutrition-relevant genetic variants. The raw file itself is never written to disk or long-term storage and is discarded as soon as processing completes.
• What we keep: what was read from your file (the variants we read and your genotype at each), the notes written from those results, the file's name, and when you agreed to the upload. Never your complete raw genome file.
• Nothing from your DNA file or DNA results is sent to an outside AI provider. The report's findings come from our own rules and the sources they cite.
• Explicit consent: DNA analysis only runs after you actively consent at upload time, and the moment of that consent is recorded.
• Your right to delete: You can permanently delete your genetic results at any time from the DNA report page, or delete your whole account from Account (Delete my account). Deletion is immediate and removes the derived data from your account.
• No sale, and no sharing beyond the processors above: We never sell your genetic data, never share it for advertising, and never disclose it to insurers, employers or data brokers. The only companies that handle it are the ones described in section 3: our hosting provider, whose servers read the file you upload, and our database provider, which stores what we keep.

Lab values you type in

The Labs screen keeps lab results you type in yourself, one report at a time. There is no upload: we never receive the report itself, a file, or a photo of it.

• What is kept, for each report: the date the sample was collected (the day only); the lab's name, if you type one; and for each result you enter, the test (matched to a fixed list of tests), the value and its unit (when we convert a unit, the value and unit you typed are kept beside it), and the lab's own reference range and flag, if you type them. We also keep the moment you ticked the consent box for that report.
• What is not kept: no file or image, no notes, and nothing from the report that identifies you — no name, date of birth, or patient or account number. A result whose test is not on our list is dropped, not stored.
• Consent for every report: a report is saved only after you tick its consent box, and the time you did is stored with it. There is no account setting that stands in for it.
• Nothing is sent to a model: lab values are never sent to an AI provider. The only companies that handle them are the ones that run the service: our database provider, which stores them in your account, and our hosting provider, which hosts the application. They are used only to show them to you, beside your list and on your DNA screen.
• How many: we keep your twelve most recent reports; saving a thirteenth drops the oldest.
• Deleting them: deleting your account removes every report. The Labs screen does not yet have a button to remove a single report; email us and we will remove it for you.

Your notes

Notes are off until you turn them on. If you do:

• What is kept: the reasons you give when you change or stop something on your list (a choice such as “My doctor changed it”, and up to 200 characters of your own words); notes on how you have been compared with your usual (better, worse or just a note; up to three areas such as sleep or mood; how much it got in the way; up to 200 characters of your own words; the day it is about and when you wrote it); your check-in answers; the stretches of weeks you chose to keep notes for; and when you turned notes on, with the wording you agreed to, and when you turned them off or cleared them.
• Please leave out names and numbers that identify you when you write in your own words. The note box asks this too.
• Who sees them: you. No other account can see them: they are written only by our servers, every request is checked against your account, and our database's row-level security stops any other account from reading them. We do not read or monitor your notes.
• Never sent anywhere: notes are never sold or shared, and never sent to an AI provider, an analytics service, an advertiser or our email provider. The check on your list never reads them, so a note never changes a warning.
• What we count: on our own servers, without reading any note, how often check-in cards are shown and answered, how often notes are printed, and your answer if you choose to answer “Is keeping notes useful to you?”. These are kept with your notes and deleted with them. We also count how often notes are turned on, turned off or cleared, from the record of when you did each, which stays until you delete your account. We also count, across all accounts and from the dates and kinds of list changes only, how many changes get a reason or a notes window.
• About someone else: if your notes are about someone else, such as a parent, make sure they are OK with you keeping them.
• Deleting and downloading: delete one note, reason, check-in or notes window on Your notes; clear all of them, download them or turn notes off on Your notes or in Account. Clearing them keeps only a record of when you turned notes on or off and cleared them, which goes when you delete your account. Deleting your account deletes everything.

5. How Long We Keep Things

Plainly: we keep what is in your account until you delete it. There is no automatic expiry job — your list and its history, your notes, health profile, lab values and derived gene results stay until you remove them or delete your account, and then they are deleted from our live database immediately. The one limit is on lab reports: we keep your twelve most recent.

• Raw DNA files and label photos: we never store them. On our servers they exist only in memory for the seconds it takes to process them.
• Anonymous analysis cache: analyses of supplement combinations are kept, and the one behind each public pair guide is shown to everyone who opens it. It is keyed by the combination, not by you, and contains no account data.
• Payment records: website purchases are held by our payment processor, and purchases in the iPhone app by Apple and by our in-app purchase provider. Deleting your account does not delete them. The payment processor and Apple keep them because tax and accounting law requires it, and the in-app purchase provider keeps the purchase history tied to your account id.
• Server and analytics logs: kept on our providers' standard retention schedules.
• Backups: we may keep an encrypted backup copy of our database. A copy that holds something you deleted is replaced or deleted within six months of your request, and if a backup is ever restored, every deletion made since it was taken is applied again before anything else.

6. How We Protect Your Data

Honest truth first: no method of transmission or storage is 100% secure, and we won't pretend otherwise. Here is what we actually do:

• Encryption in transit: all traffic to and from the site uses HTTPS/TLS.
• Row-level security: our database enforces row-level security rules, so other users cannot read your records, except a saved stack you share by link: anyone who has that link can open its report.
• In-memory DNA design: raw DNA files are processed in memory and never written to disk — there is no stored raw genome to breach.
• What we keep from a DNA file: what was read from it, the notes written from those results and the file's name, never the file itself.
• Notes are written only by our server: your browser can read your own notes but cannot write, change or delete them directly; every change goes through our server, which checks it is yours.

If we ever have a data breach that affects you, we will tell you quickly and plainly.

7. Cookies, Analytics and Your Opt-Out

We use cookies and similar technologies to:

• Keep you signed in and remember your preferences
• Measure site traffic and which features get used

Google Analytics. We use Google Analytics 4 on the website's general pages, such as the home page, pricing and the articles. We do not load it inside the iPhone app. It sends nothing from the pages that show your health information: your list and the checker, your notes, your day view, lab results, DNA pages, your account and shared lists. It also sends nothing from the sign-in and sign-up pages, because their addresses can name the page you were heading to. On the general pages it sets cookies and sends Google your page views, device and browser details, approximate location derived from your IP address, and events describing what you did — for example that you ran a check or opened a tool. Those events carry counts and categories, never the supplement or medication names you type. We do not send Google your name, email or account id, we do not use Google Analytics for advertising, and we do not run ads.

How to opt out: install Google's Analytics Opt-out Browser Add-on, or block analytics cookies in your browser or with a content blocker. The site works exactly the same either way — nothing is gated on analytics.

8. Your Rights

Your data is yours. You have the right to:

• Access and export it. Email us from the address on your account and we will send you everything we hold about you as a JSON file.
• Delete it. In the iOS app, Account → Delete account permanently removes your login, your list and its history, your notes, health profile, lab values, recent checks, gene results and anything saved before September 2026, and cancels a subscription bought on the website (an App Store subscription is cancelled in your Apple settings). On the website, Account → Delete my account does the same, or email us and we will do it for you. There is no waiting period. A backup copy is handled as section 5 says. To delete only your gene results, use the DNA report page; to remove a single lab report, email us.
• Your notes. Delete any note on Your notes; clear them all, download them, or turn notes off at any time, on Your notes or in Account.
• Correct anything inaccurate — edit it on your list or in Account, or email us
• Opt out of marketing email (every marketing email has a working unsubscribe link)
• File a complaint with a regulatory authority

If any of that fails, or you want us to do it for you, email hello@canistackthis.com and we'll take care of it. If you are in Washington, Nevada or Connecticut, see the Consumer Health Data Policy for the additional rights those laws give you.

9. Children's Privacy

Our services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us information, email us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page with an updated date — and we won't weaken the genetic-data promises above without telling you clearly first.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at: