Privacy is the
whole product.

NOTANOTR works with no account at all. Three things of yours are then stored on our side and nothing else. A count of what your coach messages cost, kept against a random id that is not a name and cannot be traced back to you. A dated line saying that a sample ran out of turns, if yours ever does, kept against that same random id for ninety days. And, if you came from an advertisement and left the counts switch on, the single line Apple's attribution report produced, which section 11 describes in full.

An account exists for three things: an encrypted copy of your file, a new phone that picks that copy up, and access for your own tools (section 12). You choose it, on a screen of its own, and you can delete it. This is the whole list of things that can ever leave your phone.

• 01A message you send the coach. The message, any photo on it, and the summary of what you track that makes it a coach instead of a chatbot. Section 03 sets out exactly what that summary holds.
• 02An anonymous usage count. The name of an action, unless you switch the counts off on the You tab, where they start on. Never the content of what you log, and never an account, a name or an advertising identifier.
• 03An email address you hand over. Only if you type one in: the waitlist field on this website, the optional field on a feedback note, the account you create, or the address you give for the weekly report. Used for the purpose you gave it and nothing else.
• 04A feedback report you send. The note you wrote, the category you picked and the app version. No row of your file goes with it, and there is no name on it.
• 05An invite code, when you redeem one. The code word and a one-way device token, of which only a hash is kept, so one phone cannot redeem the same code over and over. Nothing about your body, and nothing you have logged.
• 06A gym's id, when you install its pack. The app asks our relay for a gym's pack when you install one. That request carries the gym's id and nothing about you, and no location is read at any point.
• 07A copy of your file, if you create an account. Every row and photo you have logged, encrypted, kept in Zurich, refreshed each time you use the app, deleted when you delete the account. Never a conversation with the coach.
• 08Your sign-in, and the receipt that proves you paid. Your email address, or the id Apple gives us when you sign in with Apple, and Apple’s signed receipt so the coach knows your membership is live. No row of your file rides with either.
• 09Your week, if you ask for it by mail. Only with the switch on: the seven-day summary your phone builds and the coach’s answer to that check-in, handed over for one send and kept nowhere afterwards. Never a conversation, never a photo. The same switch stops it.
• 10The id the app made for itself, alongside your account. A random number the app invents on its first run and keeps for itself, sent beside your token on the requests your account makes so that an ad can be tied to a membership without a tracker. It is not a device identifier, only a salted one-way hash of it is kept, and nothing about your body or your training rides with it.
• 11Apple’s attribution report, once per install. Only while the counts are on: one report from Apple naming the campaign, the ad group, the keyword and the country that led to the install. It carries no advertising identifier, it does not name you, and it goes out exactly once.

Your food logs, weight, workouts, programs, supplements, blood work, measurements, vitals, photos and chat history are stored on your iPhone. If you use Apple Health sync, data moves between NOTANOTR and Apple Health on your device, under the permissions you grant in iOS. Delete the app and your data goes with it, unless you kept an export or created an account.

Your conversations with the coach never leave the phone except as the messages you send. There is no chat database on our side and there is not going to be one.

The coach is an AI model. Each message you send travels with a summary of what you track (recent weight and its trend, food and macros, training and lifts, your supplement stack and dose adherence, blood work with its reference ranges, measurements, vitals, sleep and steps from Apple Health, and the notes the coach has kept about you), plus the text and photos in that message. That summary is what makes it a coach instead of a chatbot. Your whole file is never sent, and your name and your email are never sent.

It goes first to our relay, which runs on Cloudflare. Cloudflare runs it in whichever of its data centres is nearest you, anywhere in the world, so that is where your message is held while it is handled; the call onward to the model is the part that is pinned to western Europe. The relay checks that your membership or trial is active, counts what the month has cost, and keeps no messages. From there:

• Daily messages are answered by DeepSeek V4.1 Flash, from DeepSeek, a company in the People's Republic of China, on that company's servers. Sending your message means your data is transferred to and processed in the PRC. DeepSeek sees what is in the request. It is handled under DeepSeek's own terms as well as this page.
• Your weekly check-in is answered by Claude, from Anthropic, a company in the United States, on that company's servers. Anthropic sees what is in the request.
• Google's Gemini answers instead for the few accounts that may pick their own model: founders, comped partners and testers. If that is not you, Google receives nothing.

We do not tell you that these companies cannot see your data. They can: that is how a model answers. What we can tell you is what we send, which is the message and the summary above, and that none of it carries your name.

Development builds can be pointed at other models for testing. The build you buy talks to the three named here.

If you create an account:

• Sign-in. Sign in with Apple. Apple hands us one address, your own or its private relay address if you hide yours, and that is the address we hold. We write to it about the account, and about nothing else unless you have said yes to the weekly mail.
• The weekly mail, if you ask for it. With your yes, we mail you the weekly summary your phone produces; the switch is the unsubscribe. It is off until you turn it on, and it is offered twice: once during the first run, under the sign-in button, and again on the You tab. The letter carries the same seven days the app's own "Send this week" produces, with the coach's answer to that check-in above it, and never a conversation or a photo. Your phone builds it and hands it to us for one send; we keep no copy of it.
• The copy. Every row you have logged and every check-in photo, and never a conversation with the coach. It is encrypted before it reaches storage with a key of your own, which is itself wrapped by a key held on our server. We do not read it. Our infrastructure could, technically, unwrap it, which is why this page says "we do not" rather than "we cannot".
• Where it is. With Supabase, in Europe: Zurich, Switzerland. Switzerland has an EU adequacy decision, so a transfer there needs no further safeguard.
• Versions. We keep your last ten copies plus one a month for a year, so a bad restore is recoverable. Older ones are swept weekly.
• Deleting. Delete the account in the app or on the web. Everything is put beyond use at once and held for thirty days in case you change your mind, then erased.
• If you go quiet. No sign-in and no copy for eighteen months and we write to you, again at twenty-three months, and delete the account at twenty-four.
• Access logs for your own tools and assistants: ninety days, then gone (section 12).
• If you lose both your email and your Apple ID, we cannot give you the account. There is no support path that hands an account to whoever asks for it, because that path is the takeover.

The app counts how it is used: a screen opened, a meal logged, a check-in run. Names of actions and small labels, never the content of what you log. No weight, no calorie, no lab value, no dose, no photo, no word of what you told the coach.

They are on when you install the app. You switch them off on the You tab and off is off: the software that sends them is not started at all. They carry no account, no name and no advertising identifier. They go to PostHog on its EU cloud, which is set to discard your IP address.

An email address reaches us in five ways, and only if you give it: the waitlist field on this website, a partner or coach application on this website, the optional field on a feedback note, your account, and the address you give for the weekly report. Where it then sits depends on which of the five it was.

• A waitlist address is kept by Cloudflare, in the same store as the rest of the waitlist record, for a year. Once you confirm it, it is also a contact at Resend, the service that sends our mail.
• An application address is kept by Cloudflare beside the rest of the application, and it is used to answer it and for nothing else. It is not added to the waitlist and it is not mailed anything else. If we do not work together, we delete the application and the address with it.
• A feedback address is kept by Cloudflare beside the note for 90 days, and Resend carries the copy of the note that reaches a person. The note is free text and a person reads it, so do not put health details in it; the screen that sends it says the same.
• An account address is kept by Supabase in Zurich, which is what your sign-in is checked against. If you switched the weekly report on and gave no report address, Resend carries that letter to this one, once a week at most and never when it is Apple's forwarder, and we keep no copy of what was in it.
• A report address is the one you give for the weekly report, in the first run or on the You tab. It is kept by Supabase in Zurich in the same row as your account, and used for that report and for the six-digit code that confirms it is yours, and for nothing else.

The address for your weekly report, in more detail. You give it yourself: the app asks once when you set it up, and you can skip that and add one later, or never. You can change or remove it at any time on the You tab.

Why we confirm it. An address with a typo in it swallows every report in silence, so we send a six-digit code to the address you gave, and the report only starts once you type that code back into the app. The code is good for fifteen minutes and we keep only a one-way hash of it, never the digits.

Apple's forwarding address is never used without your say. If you signed in with Apple and hid your mail, the only address we have is Apple's forwarder, and a report sent there arrives somewhere most people never read. So we do not send one. The app tells you plainly that the report needs an address you read, and until you give one the weekly report stays off.

How it ends. Removing the address on the You tab deletes it at once, and the weekly report stops unless your account's own address can still carry it. Deleting your account deletes the address with everything else at the end of the 30-day window. It is never written to a log and it is not part of the encrypted copy of your file.

Wherever it sits, it is used for the purpose you gave it, and never sold, shared or used to build a profile.

Every mailing carries an unsubscribe link. You can also write to privacy@notanotr.com and we delete the address.

Apple takes the payment; we never see a card. To know that your membership is live, the app sends Apple's signed receipt to our relay, and the relay checks it with Apple. What comes back is whether you are entitled and until when. Apple also tells the relay directly when a membership renews, lapses or is refunded. One subscription service, named in the table below, can be asked the same question about an account, and what it receives is the account's id and nothing else.

A free trial is by invitation: fourteen days, from the moment you redeem, on our clock. To hold the line of one trial per person we check Apple's DeviceCheck bits for your device and store one-way hashes of the identifiers you already have with us: your Apple sign-in id, your email, and the device token. Hashes, not the values, and nothing about your body or your training.

The company behind an assistant you connect yourself is not in this table: it receives what that assistant reads under your own agreement with it, as section 12 explains.

Loaded AG, in Switzerland, is the controller for all of it.

Ask for a copy of what we hold, a correction, or deletion: privacy@notanotr.com, and the export button in the app gives you the whole file without asking anyone. Without an account we hold no name of yours and no file of yours, but we do hold the records sections 10 and 11 describe, against a random id your phone made for itself. Write to the address above, say roughly when you installed the app and where you were, and we will look. You can complain to the Swiss FDPIC or to your own data protection authority.

Running a paid product means keeping a service record of what happened, and it is worth saying plainly what that record holds and how long it lives.

We write a dated line when an account is made, when a trial starts and when it ends, when a membership starts, renews, lapses or is refunded, when a backup lands, when a letter goes out, and when you move a switch. Each line is a word from a fixed list, a date and a small number. Never a message, a food, a weight, a photo or a lab value. Those lines are kept for thirteen months and then deleted.

One mark says only that an account was used on a given day, and nothing else about that day. It is kept for ninety days and then deleted, and it is how we see whether people come back.

What our mail service reports back about a letter we sent you, that it was delivered, that it bounced, that it was opened or that a link in it was followed, is kept for thirteen months beside that letter's id. The letter itself is not kept.

Reviews you write on the App Store are public, and we read them in our own tools the way anyone reads them in the store. We keep a copy of the rating, the text, the country and the nickname Apple publishes with it, so that we can answer them and see whether a release helped. We keep that copy while the app is on the store.

Who inside Loaded AG may see any of this depends on their job. Every change anyone makes is written down with their name and their reason, and that written record is kept for twenty-four months. The screen we read all of it on shows counts, dates and states. It never opens your file, and none of the records above holds a message, a photo or a value you logged. The one thing a person here reads in your own words is a note you choose to send us from inside the app, which section 06 describes.

We buy ads, so we have to know which ad brought somebody here. Two things do that, and neither of them is a tracker.

The app makes one random id for itself the first time it runs. It is not a device identifier and no framework has ever seen it; it is a number the app invented. It rides along with the requests your account makes, and it is sent once with Apple's attribution report. Our relay never stores it. It stores a salted one-way hash of it, which cannot be turned back into the id.

We keep that hash, and the line beside it, for thirteen months, and then both are deleted. Deleting your account does not delete that line. The account comes off it and the hash stays for the rest of the thirteen months, so that a count of what a campaign brought in does not change when somebody leaves. The id itself lives in your phone's keychain and survives deleting the app, so if you install again you arrive with the same hash.

Apple's attribution report names the campaign, the ad group, the keyword and the country that led to an install. Apple builds that report, it carries no advertising identifier, and it does not name you. It is sent once per install, after you have chosen a file, and only while the counts switch on the You tab is on. Nothing at all goes out from the welcome screen.

Apple also sends a single number between one and three, some days later, when somebody first writes to the coach, redeems a trial or buys a membership, together with the id of the campaign it belongs to. Apple decides when it goes. It comes to our relay, which checks that it really came from Apple and keeps it as one line beside the campaign for thirteen months; a copy it cannot check is counted and thrown away. That number and that campaign id are all there is: no identifier, no person.

Beyond those two: no advertising identifiers, no cross-app tracking, no data brokers, no fingerprinting, and no advertising software inside the app. This website is static and sets no cookies.

With an account, you can let an assistant of your own, such as Claude or ChatGPT, read your file and propose changes to it, and you can give a coach a code for their assistant. Nothing is connected until you make a code in the app, behind Face ID, on the You tab under Claude & ChatGPT. When you make it, you choose what it may do (look, or look and propose) and how long it lasts. The assistant asks for the code once. From then on it reads the encrypted copy of your file that your account keeps (section 04), through our relay, which opens the copy for that one call and keeps nothing of the answer.

• What a connection reads. Your training (the program, sessions and sets, how your lifts are moving), food, weight and tape measurements, your targets, sleep and recovery, habits, and your notes. That is what every code carries by default.
• Three items, only if you switch them on. Blood work, your supplement stack and the dates of your check-in photos are off for every code. You switch each one on by itself, for one code, when you make it, and a code made without one never gains it later. The photos themselves are never served to anything, and neither are your conversations with the coach in the app.
• Where it goes. What the assistant reads goes to the company that runs it: Anthropic for Claude, OpenAI for ChatGPT, or whoever runs the assistant a coach uses. That happens under your own account and agreement with that company, not ours, and its privacy policy and your settings there decide what it keeps and for how long. We see the calls the assistant makes to NOTANOTR, never your conversation with it.
• Proposals. If the code may propose, the assistant can send a program, a meal plan, targets, a change to one exercise, or a note. Each one is stored with us in Zurich, with the reason the assistant gave, and waits in the app until you apply it or dismiss it. Nothing in your file changes before you apply it. One still open after fourteen days expires. Applied, dismissed or expired, it is deleted ninety days later.
• The access log. Every call is written down: which code, which tool, which of the three items it used if it used one, how many rows came back, whether it worked, and when. Never what was read and never what it said. You see this log in the app. It is kept ninety days and then deleted.
• Ending it. Revoke the code in the app and the next call is refused, for every assistant connected with that code. Revoking cannot un-read what was already read, and it does not delete what the assistant's company already holds; ask that company for that. Removing NOTANOTR in the assistant's own settings stops it asking; the code itself ends when you revoke it or when it runs out.
• After the first week. For the first seven days of your account a connection works without a membership, so you can set up. After that it works while your membership is active. Without one, the assistant is told that the membership is needed, and it reads and proposes nothing. To know which, the relay checks your account's membership on each call, as it does for the coach.

Deleting your account takes the codes, the proposals and the log with it, on the schedule section 04 sets out. Questions about a connection: privacy@notanotr.com. How to connect, and what to ask first, is on the Claude page and the connect page.

Tracking your supplement stack and the health records you enter yourself (blood work, vitals, appointments) is an organisational and educational tool. It is not medical advice and not a medical device. Dosing and treatment decisions stay between you and your doctor.

If any of the above ever changes, we will update this page before it does. Questions: privacy@notanotr.com. The terms cover the membership itself.