Privacy policy
Draft for early access. Items in [brackets] are still to be filled in before public launch.
Anlo is built so that your health record stays with you. This page says exactly what that means today, and labels what is planned but not shipped yet.
Short version
- Your log (meals, photos, weight, labs, medications, water, notes) is stored on your phone.
- When you ask the AI to read a photo or a sentence, that content is sent to our server only to be read. We don't keep it, and we don't use it to train models.
- An Anlo account is a cryptographic key, not an email address or a name.
- This website has no analytics, no ad trackers and no cookies.
Who we are
Anlo is operated by [legal entity name], [address] ("Anlo", "we"). Contact: hello@anlo.app.
The app
Stored on your phone
Everything you log lives in the app's storage on your device: meals and their photos, nutrition estimates, weight and body measurements, lab results, medications and doses, water, notes, your profile (height, weight, age, sex, activity level, goals) and what the app has learned from your corrections. We can't see it.
Backups are files you export yourself (for example to iCloud Drive). They are not sent to us. If you include photos, the file contains them; keep it somewhere you trust.
Sent to the AI, only to be read
These features send content to our server, api.anlo.app, which passes it to an AI model and returns the answer:
| Feature | What is sent |
|---|---|
| Photo recognition | The meal photo, and a short list of your own food names to improve matching |
| Text or voice logging | The words you typed or dictated (as text) |
| Nutrition estimates | Food names and amounts |
| Label and lab-report reading | The photo of the label or report |
| Day and period summaries, coach | The relevant part of your log (meals, totals, targets, and health values you chose to track) and your question |
| Medication and supplement notes | The note or photo you added |
The models run on Cloudflare Workers AI. We don't store the photos, text or answers on our servers, and our request logs record only technical details (which feature, which model, how long it took, success or failure), never food names, photos, questions or health values. We don't use your content to train models.
You don't need the AI to use Anlo: without an account, text is parsed on the phone and nothing is sent.
Voice
Speech is turned into text by your phone's own speech recognition. When iOS can do this on the device for your language, audio never leaves the phone; otherwise iOS may send it to Apple under Apple's privacy policy. Anlo receives only the text.
Your Anlo account
Turning on AI creates a key pair on your phone. Our server stores:
- your account ID and public key, and when the account was created;
- which invite code was used (stored as a one-way hash);
- per-day usage counters, so we can apply fair-use limits;
- random request IDs for about 10 minutes, to block replayed requests.
We don't ask for your name, email or phone number. The 24-word recovery phrase never leaves your phone unless you copy it; we can't recover it for you.
Encrypted sync (planned)
Sync across devices is not available yet. When it ships, your data will be encrypted on your phone with a key derived from your recovery phrase before it is uploaded, so our servers store only data they can't read. This policy will be updated before it launches.
This website
- No analytics, no ad trackers, no cookies. Fonts are served from anlo.app, not from a third party.
- Your language and light/dark choice are remembered in your browser's local storage and never sent to us.
- Like any website, our host (Cloudflare) processes your IP address and request details to deliver pages and protect against abuse, and keeps standard logs for a short time.
Early-access list
If you join the early-access list, we store your email address, the site language you used, and when you signed up. We send one email asking you to confirm. Unconfirmed addresses are deleted after 7 days. Confirmed addresses are kept until we send your invite, then deleted [N] days later unless you create an account, and you can delete yours at any time with the link in our email or by writing to us. We use it only to send your invite and important updates about early access, never for advertising, and we don't share it.
What we don't do
- We don't sell, rent or share personal data with advertisers or data brokers.
- We don't run analytics, ad trackers or crash-reporting services in the app or on this website.
- We don't keep your meal photos, notes, questions or health values on our servers.
- We don't use your content to train AI models.
Security
Requests from the app are signed with your account key and checked by our server, so nobody can use the AI service in your name without your phone or recovery phrase; replayed requests are rejected. Everything travels over HTTPS. Your recovery phrase is kept in the phone's secure storage (the iOS Keychain). Waitlist confirmation links contain a random token of which we store only a one-way hash. No system is perfectly secure; if something goes wrong that affects you, we'll tell you.
International transfers
Cloudflare runs our servers and the AI models on its global network, so a request may be processed in a country other than yours, including the United States. Where the GDPR applies, transfers rely on Cloudflare's data processing terms and the European Commission's standard contractual clauses. [Confirm with counsel before launch.]
Service providers
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, the API, AI models (Workers AI), databases, sending email | Global network |
| Apple Inc. | App distribution; speech recognition when not done on the device | Under Apple's own policy |
We don't sell or rent personal data, and we don't share it with advertisers or data brokers.
Your choices and rights
- Access and delete your log: it's on your phone. Deleting the app deletes it (remember your backups).
- Delete your account: in the app, Settings → Anlo account → Remove from this phone removes the key from your phone. To also remove the public key and counters from our server, write to us with the first characters of your account ID shown in that same card.
- Early-access list: use the delete link in our email, or write to us.
- Depending on where you live (for example the EU/UK under the GDPR, or California), you may have rights to access, correct, delete or port your personal data and to object to processing. Write to hello@anlo.app; we'll answer within 30 days. You can also complain to your data-protection authority.
Legal bases (GDPR): providing the features you ask for (contract), your consent for the early-access list, and our legitimate interest in keeping the service secure.
Health data
Anlo is a tracking and coaching tool, not a medical device, and it doesn't give medication advice. Because your health data stays on your phone, we don't receive it except as described under "Sent to the AI, only to be read", and then only for the moment it takes to answer.
Children
Anlo is not intended for children under 13 (or the minimum age in your country), and we don't knowingly collect their data.
Changes
We'll post changes here and update the date above. For significant changes we'll also tell you in the app.