Privacy Policy

CRAVELESS — PRIVACY POLICY

App: CraveLess: GLP-1 Shot Tracker

Effective date: 18 June 2026 

Last updated: 18 June 2026

1. INTRODUCTION & WHO WE ARE

This Privacy Policy explains how CraveLess (the "App," "we," "us," or "our") collects, uses, stores, shares, and protects information when you use the CraveLess mobile application and related services (together, the "Service").

CraveLess is operated by Khandker Tafiqul Islam, an individual developer based in Bangladesh (the "Developer"). For the purposes of the EU and UK General Data Protection Regulation ("GDPR") and similar laws, the Developer is the "data controller" for personal information processed through the Service.

CraveLess is an informational companion for people taking GLP-1 medications. It helps you log doses, weight, nutrition (including protein and hydration), and side effects, and provides estimates and insights based on the information you record. CraveLess is not a medical device, does not provide medical advice or diagnosis, and is not a substitute for your healthcare provider. Please also read our Terms & Conditions, which include important medical disclaimers.

If you are a Washington State resident (or your consumer health data is otherwise covered by the Washington My Health My Data Act), please also see our separate Consumer Health Data Privacy Policy at https://sites.google.com/view/cravelesss/health-data.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Service.

2. PRIVACY AT A GLANCE

This summary is for convenience only; the full policy below governs. In plain language:

• Your health data stays on your device. The information you log in CraveLess is stored locally on your device only. It is not synced to the cloud, not uploaded to our servers, and not backed up by us. We, the Developer, cannot see or access it.

• No cloud sync, no backup by us. Your logged data does not move between your devices and cannot be recovered by us. If you delete the App or lose your device, your data is permanently lost (see Section 4 and Section 10).

• We collect very little ourselves. We use limited, mostly aggregated analytics and crash data to keep the App working and improve it, and we receive subscription status from Apple's payment system.

• Optional AI features send only a summary. If you use AI insights, a condensed, minimized summary of your recent activity is sent to our AI processor to generate text. We do not send more than is needed, and the feature is capped.

• We do not sell your personal information and we do not use your health data for advertising.

• You are in control. You can edit or delete your data, including deleting all of it from within the App, at any time.

3. INFORMATION WE COLLECT

The categories of information involved in the Service, and where each is stored, are described below.

3.1 Health & wellness information you provide To deliver its core features, CraveLess lets you record information such as:

• Medication details you choose to enter (e.g., medication type, dose amounts, schedule/cadence, and injection-site rotation);

• Weight entries, height, and goal/target information;

• Food and nutrition logs (e.g., protein, fiber, calories) including items added manually or by barcode;

• Hydration logs;

• Side-effect logs (e.g., type, severity, notes you write);

• Goals, preferences, units, and reminder settings.

This information may relate to your health and is treated as sensitive. It is stored locally on your device only. It is not synced, uploaded, or backed up to the cloud or to the Developer's servers; the Developer does not receive a copy of this content. It is collected and processed on your device solely to provide the features you use.

3.2 Apple Health (HealthKit) information If you enable the optional Apple Health integration, CraveLess can read from and/or write to Apple Health (HealthKit) data such as body weight and dietary information (e.g., protein and water). CraveLess only accesses the specific HealthKit data types you authorize, and only for the in-app features you choose to use (for example, syncing your weight or protein intake between the App and Apple Health on your device). You can review and revoke these permissions at any time in the iOS Settings app under Privacy & Security > Health. HealthKit data is handled in accordance with Apple's requirements described in Section 6.

3.3 Account, purchase & subscription information CraveLess does not require you to create a username-and-password account with the Developer. When you purchase a subscription or start a free trial, the transaction is processed by Apple through the App Store using StoreKit. We do not receive your full payment details (such as your card number). We use RevenueCat and Qonversion to manage and verify subscription entitlements and to understand subscription performance; these tools provide us with subscription status and related events (for example, trial started, subscription active, renewed, or cancelled) associated with a pseudonymous identifier, so the App can unlock Premium features.

3.4 Device, usage & analytics information To keep the App reliable and to improve it, we use third-party analytics and crash/diagnostic tools — specifically Google Firebase (app analytics and crash diagnostics), Sentry (error and crash monitoring), and Microsoft Clarity (usage and interaction analytics) — together with the subscription analytics noted above. These tools may process information such as: app events you trigger (for example, "dose logged" or "paywall viewed"), feature usage, interaction and session metrics, app version, device model and operating-system version, language/region, and diagnostic/crash data. We use this information in aggregated or pseudonymous form to understand how the App is used and to fix problems. We configure these tools so that the content of your health logs (such as your weight values, dose amounts, foods, or side-effect notes) is not transmitted to them; the events we record describe that an action occurred, not the underlying health details.

3.5 AI feature inputs If you use the optional AI insight features (a Premium feature), a condensed, pre-summarized snapshot of your recent activity (for example, weekly trends in weight, protein adherence, and side-effect patterns) is transmitted through our secure serverless proxy to a third-party AI provider to generate a short, plain-language summary. We minimize what is sent — the feature is designed to transmit only the summarized data needed to produce the insight, not your full history or directly identifying details — and usage is rate-limited and capped. You enable this feature yourself; if you do not enable it, no such data is sent. See Section 7 for details and limitations.

3.6 Information we do not collect We do not knowingly collect your name, postal address, or precise location through the App, and we do not collect payment-card numbers. We do not require social-media logins. We do not use your health information for advertising, and we do not sell your personal information.

4. HOW AND WHERE YOUR INFORMATION IS STORED

CraveLess is built "local-only." The data you enter is stored on your device using Apple's on-device database. It is not synced through iCloud or any other cloud service, it is not uploaded to or stored on the Developer's servers, and the Developer does not operate a server that holds your health logs and cannot read them.

Because there is no cloud sync, your logged data does not move automatically between your devices, and neither the Developer nor any cloud backup operated by us can restore it. If you delete the App, reset or replace your device, or clear the App's data, your logged information will be permanently lost. You are responsible for your own device security and for any backups you choose to create using tools available to you.

The limited information that is processed by the Developer's service providers — for example, pseudonymous analytics events, crash diagnostics, subscription status, and the summarized inputs to the AI feature — is processed and stored by those providers as described in Sections 3, 7, and 8. Sensitive data is protected with encryption in transit and at rest as described in Section 11.

5. HOW WE USE YOUR INFORMATION

We (and the on-device App) use information for the following purposes:

• To provide the Service — logging, reminders, charts, estimates (such as the informational medication-level curve), and insights you request;

• To process and manage subscriptions, trials, and entitlements;

• To generate optional AI insights when you use that feature;

• To maintain, secure, debug, and improve the App (analytics and crash reporting);

• To communicate with you about the Service if you contact us, and to respond to your privacy requests;

• To comply with legal obligations and enforce our Terms.

Legal bases (EEA / UK users) If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR/UK GDPR:

• Providing core App features you choose to use: performance of a contract (our Terms) and/or your consent.

• Processing health-related information: your explicit consent (Art. 9(2)(a)), which you may withdraw at any time.

• Managing subscriptions and entitlements: performance of a contract.

• Analytics, crash reporting, and product improvement: our legitimate interests in maintaining and improving the Service (balanced against your rights), and/or consent where required.

• Optional AI insights: your explicit consent (when you choose to enable and use the feature).

• Legal compliance: compliance with a legal obligation.

6. APPLE HEALTH (HEALTHKIT) — OUR COMMITMENTS

Where you enable HealthKit, we comply with Apple's requirements for apps that access Health data. Specifically:

• We use HealthKit data only to provide health and fitness features within the App that you have chosen to use;

• We do not use HealthKit data for advertising, marketing, or other use-based data mining, and we never sell it;

• We do not disclose HealthKit data to third parties without your explicit permission, and we do not share it with third parties for their own purposes;

• Information read from HealthKit is not used beyond the features you enable, and you can revoke HealthKit permissions at any time in iOS Settings.

7. AI-POWERED INSIGHTS

The optional AI insight feature uses third-party large-language-model services — Anthropic (Claude) and Google (Gemini) — accessed through a secure serverless proxy hosted on Cloudflare. When you use the feature, a minimized, pre-summarized snapshot of your recent activity is sent to one of these providers to generate a short natural-language summary. We design the feature to:

• Send only summarized data needed for the insight — not your full logs and not directly identifying information such as your name;

• Cap and rate-limit usage (a limited number of AI generations per user per period);

• Append a clear disclaimer to AI output and restrict it to summarizing your own logged data — it does not provide diagnosis or dosing/medical advice.

The AI provider processes the submitted text to return a response in accordance with its applicable enterprise/API terms. We use these providers under their API/business terms, under which they do not use the data submitted through the API to train or improve their general models. AI output can be incomplete or inaccurate and must not be relied upon as medical advice (see our Terms & Conditions). If you do not wish to use AI features, simply do not enable them; the rest of the App functions without them.

8. THIRD-PARTY SERVICES & SUB-PROCESSORS

We rely on a small number of reputable service providers to operate the Service. Each processes information only as needed for its function. You should review their privacy policies for details.

• Apple (App Store, StoreKit, HealthKit): app distribution, payments, and Health integration; involves purchase transactions and, if you enable it, authorized HealthKit data accessed on your device.

• RevenueCat: subscription management & analytics; involves pseudonymous subscription identifiers and entitlement/event data.

• Qonversion: subscription management & analytics; involves pseudonymous subscription identifiers and entitlement/event data.

• Google Firebase: app analytics & crash diagnostics; involves pseudonymous app-usage events, device/OS info, and crash data (configured to exclude health-log content).

• Sentry: error & crash monitoring; involves diagnostic/crash reports and technical metadata.

• Microsoft Clarity: usage & interaction analytics; involves pseudonymous interaction/usage metrics (configured to exclude health-log content).

• Anthropic (Claude) & Google (Gemini): optional AI insight generation; involves the minimized, summarized activity snapshot you submit when using AI features.

• Cloudflare: secure serverless proxy that routes AI requests; involves transient processing of the summarized AI request.

We may add, change, or remove providers over time; we will update this policy to reflect material changes. We do not authorize these providers to use your information for their own independent purposes except as described or as required to provide their service.

9. WHEN WE SHARE INFORMATION

We do not sell your personal information, and we do not share your health information for advertising. We disclose information only as follows:

• Service providers / sub-processors — as described in Section 8, to operate the Service;

• With your direction — for example, when you export a report (such as a PDF for your doctor) or otherwise choose to share your data;

• Legal reasons — if required to comply with applicable law, legal process, or a lawful government request, or to protect rights, safety, and security;

• Business transfer — if the App or its assets are transferred to another party (for example, a sale), in which case we will require the recipient to honor this policy or notify you of any material changes.

10. DATA RETENTION

Your logged data persists on your device for as long as you keep the App installed and choose to retain it; you control it and can delete it at any time (Section 12). Because it is stored only on your device, deleting the App or your device data removes your logs, and they cannot be recovered by us. Pseudonymous analytics and crash data are retained by our analytics providers for limited periods consistent with their retention settings and our configuration. Subscription records are retained as needed for billing, tax, and legal compliance. AI requests are not retained by us as a persistent record of your health history; the on-device App may cache a generated insight so you can re-read it.

11. SECURITY

We take reasonable and appropriate technical and organizational measures to protect information, including encryption of sensitive data at rest on the device and encryption in transit (HTTPS/TLS) for network requests. The AI proxy is designed to avoid exposing secrets in the app binary. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. Because your logged data lives only on your device, its security depends significantly on you: keep your device secure (for example, with a passcode, biometric lock, and up-to-date software).

12. YOUR PRIVACY RIGHTS & CHOICES

12.1 Controls available to everyone

• Access & edit: view and edit your logged data directly in the App at any time;

• Delete: delete individual entries or use the in-app option to delete all of your data; you may also remove the App, which deletes its on-device data;

• Permissions: grant or revoke HealthKit and notification permissions in iOS Settings;

• Subscriptions: manage or cancel subscriptions in your Apple ID account settings.

12.2 EEA / UK rights (GDPR) If you are in the EEA or UK, you have the right to access, rectify, erase, restrict, or object to processing of your personal data, the right to data portability, and the right to withdraw consent at any time (without affecting prior processing). Where we rely on consent for health data, you may withdraw it by discontinuing the relevant feature and deleting the data. You also have the right to lodge a complaint with your local data-protection authority.

EU / UK representative [TO BE COMPLETED] If we are required to appoint a representative under Article 27 of the EU GDPR and/or the UK GDPR, our representative is: [Name], [Address], [Email]. If you are in the EEA or UK, you may contact our representative regarding the processing of your personal data. (See note to the Developer: appoint an EU/UK Art. 27 representative or document the basis for an exemption before publishing.)

12.3 California rights (CCPA/CPRA) If you are a California resident, you have the right to know what personal information we collect and how we use it, the right to access and delete it, the right to correct inaccurate information, and the right to limit the use of sensitive personal information, as well as the right not to be discriminated against for exercising your rights. We do not sell or share personal information for cross-context behavioral advertising. The categories of personal information involved are:

• Identifiers (pseudonymous/device IDs): collected (limited) — for analytics, crash reporting, and subscription entitlements.

• Health / medical-related information (sensitive): you provide it; stored only on your device; used to provide the core features you use. The Developer does not receive a copy.

• Commercial information (subscription status): collected — to manage subscriptions and trials.

• Internet/usage activity (in-app events): collected — to maintain and improve the App.

• Precise geolocation: not collected.

• Sale or sharing for advertising: none — we do not sell or share for advertising.

12.4 Washington / consumer health data If you are a Washington resident or your data is otherwise covered by the Washington My Health My Data Act, additional rights and disclosures apply. Please see our separate Consumer Health Data Privacy Policy at https://sites.google.com/view/cravelesss/health-data.

12.5 Other regions Residents of other jurisdictions (for example, Canada, Australia, Brazil, and others) may have similar rights under local law. We will honor valid requests as required by applicable law.

12.6 How to exercise your rights Many controls are available directly in the App and iOS Settings. For other requests, contact us at info.drongo@gmail.com. We may need to verify your request, and we will respond within the timeframes required by applicable law. You may use an authorized agent where the law permits. Because your health logs are stored only on your own device and are not accessible to us, certain requests (such as producing a copy of that content) are fulfilled through the in-app tools rather than by us retrieving it.

13. INTERNATIONAL DATA TRANSFERS

The Service is available globally and is operated from Bangladesh. Our service providers may process information in countries other than your own, including the United States and the European Union. Where personal data is transferred internationally, we rely on appropriate safeguards required by applicable law (such as the European Commission's Standard Contractual Clauses and equivalent UK mechanisms) and on the safeguards offered by our providers. By using the Service, you understand that your information may be processed in these locations. (Your on-device health logs are not transferred internationally by us, because they are not transmitted off your device except for the minimized AI snapshot when you use AI features.)

14. CHILDREN'S PRIVACY

The Service is intended for adults (18 years and older) and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided information through the Service, please contact us so we can take appropriate action.

15. "DO NOT TRACK" AND GLOBAL PRIVACY CONTROL

Some browsers and devices offer "Do Not Track" or Global Privacy Control (GPC) signals. The App does not use cross-site tracking for advertising. Where required by law, we will treat recognized opt-out preference signals as a valid request to opt out of any "sale" or "sharing," though as noted we do not sell or share personal information for advertising.

16. DATA BREACH

If we become aware of a personal-data breach that affects information we process and that is likely to result in a risk to your rights, we will take reasonable steps to investigate and mitigate it, and we will notify affected users and the relevant supervisory authorities where and within the timeframes required by applicable law (for example, under the GDPR/UK GDPR). Because your logged health data is stored only on your own device and is not held on our servers, it is not exposed by a breach of our systems.

17. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, provide additional notice (for example, within the App). Your continued use of the Service after an update means you accept the revised policy.

18. HOW TO CONTACT US

If you have questions, requests, or complaints about this Privacy Policy or your information, contact:

Khandker Tafiqul Islam 

Developer of CraveLess 

Email: info.drongo@gmail.com 

Location: Bangladesh