KāyūPrivacy Policy
Effective November 8, 2026
This policy explains how the Kāyū app for iPhone, the Kāyū web app at app.kayu.health, and this website (together, “Kāyū”) handle your information. Kāyū is published by Ossium LLC (“we”, “us”).
The short version
- Kāyū stores what you log in your account so you can see it on your iPhone and on the web. That includes health information you choose to record.
- Your records are private to your account. We don’t look at them except when you ask for help with a specific problem or when the law requires it.
- No ads and no tracking, and we never sell or share your data. The iPhone app and the web app have no analytics at all. Only this website counts visits, with Cloudflare Web Analytics, which uses no cookies.
- Reminders are set on your iPhone. We don’t run a server that sends you notifications.
- You can export everything to a CSV file, and delete your account and everything in it, at any time.
Your account
Kāyū needs an account so your logs can be saved and shown on your devices. You can sign in two ways:
- Email and password. We store your email address. Your password is stored by our sign-in provider as a secure hash; we never see it.
- Sign in with Apple (iPhone). Apple shares a user identifier and an email address with us, and your name if you choose to share it. If you choose “Hide My Email”, we only receive a private relay address. We never see your Apple ID password.
What we store
| Data | Why |
|---|---|
| Email address and account identifier (including your Apple user identifier, if you use Sign in with Apple) | To create your account, sign you in, and send password-reset emails |
| Your profile: display name, timezone, and daily water and sleep targets | To greet you, work out when each Kāyū day starts, and measure your day against your targets |
| What you log: sleep, energy changes, activities, symptoms, medication doses, water and notes, each with its time and any note you add | To show your days, charts and export, on iPhone and on the web |
| Your lists: medications with dosage and frequency, medication groups, symptoms and the medications you associate with them, and activities with their usual energy cost | So you can log from them quickly |
| Sign-in records kept by our backend provider, such as the time of sign-in and IP address | To keep accounts secure and prevent abuse |
Some of what you log is health information. We use it only to provide Kāyū to you. Kāyū is a consumer app, not a medical service, and is not covered by HIPAA.
What stays on your iPhone
- Your sign-in session, kept in the iOS Keychain.
- Your settings: appearance, reminder times, and the last email you signed in with.
- A summary of today for widgets, such as your energy, water, last night’s sleep and today’s doses, so widgets can show them without opening the app. Logs you make from a widget are kept here until Kāyū next opens and saves them to your account.
- Reminders, scheduled as local notifications by iOS. They are worked out on your iPhone from your settings and today’s logs, and never pass through our servers.
Signing out clears your session, today’s widget summary and your scheduled reminders.
Exporting
When you export, Kāyū builds a CSV file of everything you’ve logged. On iPhone it’s built on your device and handed to the iOS share sheet; on the web your browser downloads it. It goes only where you send it, and their privacy practices apply from there.
Who processes your data
We use a small number of service providers, only to run the features described above:
- Supabase hosts our database and handles sign-in, including sending password-reset emails. It stores your account and your records on our behalf. See the Supabase privacy policy.
- Apple provides Sign in with Apple and the App Store, and delivers the reminders your iPhone schedules. See Apple’s privacy policy.
- Cloudflare hosts this website and the web app, and may process IP addresses to deliver pages and protect against attacks. On this website only, it also provides the visit counts described under Analytics.
These providers may store data in the United States or other countries. We don’t sell your personal information, share it for advertising, or use it to track you across other apps and websites.
Analytics
The iPhone app and the web app have no analytics. They contain no advertising, no analytics and no tracking SDKs, and nothing about how you use them is measured or sent anywhere.
This website (kayu.health) uses Cloudflare Web Analytics to count visits, so we can see which pages people read. It uses no cookies and doesn’t store anything in your browser. It records things like the page you visited, the site that sent you, your browser and device type, your country, and how quickly the page loaded. It doesn’t follow you to other sites, isn’t used for advertising, and isn’t linked to your Kāyū account. See Cloudflare Web Analytics and the Cloudflare privacy policy.
This website sets no cookies.
Keeping and deleting your data
We keep your records for as long as you have an account. Anything you delete in Kāyū is deleted from our database.
To delete your account, open More → Account → Delete account in the iPhone app, or Account in the web app. This permanently deletes your account, your profile and everything you’ve logged from our servers, and signs you out. It can’t be undone, so export first if you want a copy. Deleted data may remain in our provider’s encrypted backups for a short time until those backups expire.
You can also ask us to delete your account by emailing [email protected] from the address on your account.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal information, or to object to how we use it. You can view, edit, export and delete your records in Kāyū at any time. For anything else, email [email protected] and we’ll respond within 30 days. We won’t treat you differently for using these rights. If you are in the EU or UK, you can also complain to your local data protection authority.
Security
Data travels between Kāyū and our servers over encrypted connections (HTTPS). Database access is restricted so that each account can only read and change its own records. No system is perfectly secure, but we work to protect your information and keep only what Kāyū needs.
Children
Kāyū is not directed to children under 13 (or the minimum age in your country), and we don’t knowingly collect their personal information. If you believe a child has created an account, contact us and we’ll delete it.
Changes to this policy
If we change this policy, we’ll update the date at the top of this page. If a change significantly affects how we use your data, we’ll also let you know in the app before it takes effect.
Contact
Questions about privacy? Email [email protected].
Ossium LLC
Florida, United States