Privacy Policy

Last updated: September 29, 2026

In plain terms

• We collect what you put into the app — tasks, goals, habits, reflections, mood, workouts, body measurements, food and water logs, finances, and your conversations with the AI coach. Some of this is sensitive.
• We use it to run the app and coach you. We do not sell it.
• We send some of it to other companies that help us operate — including Anthropic (the AI), Supabase (the database), Stripe (payments), Resend (email), and Google (analytics and fonts). The full list is below.
• We use Google Analytics, which sets cookies and tracks how you use the site — but only if you accept the cookie banner shown on your first visit. You can change your choice at any time in Settings.
• You can export a copy of your data (everything you have put into the app, with two narrow exclusions noted below) or delete your account instantly, both from Settings. Emailing [email protected] works too — we action deletion requests within 48 hours.

1. Who we are and what this covers

Discipline AI ("we", "us", "our") runs the website and app at disciplinecoachapp.com. This policy explains what personal information we collect, why we collect it, who we share it with, and the choices and rights you have. It applies to our website, the web app, and the Android app.

This is a plain description of what the app actually does today — not a generic template. Where something is not settled yet, we say so rather than gloss over it.

2. What we collect, and our legal basis

We only hold information tied to features you use. Under UK and EU data protection law (the GDPR), we need a legal basis to process your data. We rely on these:

• Contract — to create your account and provide the features you signed up for.
• Consent — when you choose to enter sensitive information (health, body, mood, finances) or use optional features.
• Legitimate interests — to keep the service secure, reliable, and improving.
• Legal obligation — to keep records we are legally required to keep, such as payment records.

Here is what we collect, grouped by type:

Account and login

Your email address, your password (stored encrypted and hashed — never in plain text), and your display name. If you sign in with Google, we receive your email and basic profile from Google. Legal basis: Contract — we need this to create and secure your account.

Profile and schedule

Your work and sleep hours, wake time, commute, energy windows, chronotype, goal categories, preferred units, and notification preferences. If you choose to add them, your date of birth and gender. Legal basis: Contract — these personalize your schedule and coaching.

What you track day to day

Tasks, goals and milestones, habits and streaks, focus sessions, and any calendar events you create. Legal basis: Contract — this is the core of the app.

Health, fitness and body data (sensitive)

Workouts and sets, personal records, body measurements including weight and body-fat percentage, food and water logs, nutrition goals, and fasting sessions. Legal basis: Consent — you provide this by choosing to use the fitness and nutrition features. This is sensitive ("special category") data, so we only use it to give you those features.

Reflections, journal and mood (sensitive)

Daily reflections including your mood score, biggest win and biggest challenge, free-text journal entries, and voice reflections (audio and transcripts). Legal basis: Consent — you choose to write or record these.

Finances (sensitive)

The income and expense transactions you log, your budgets, and your savings goals. This is your own personal tracking — it is not payment or card data. Legal basis: Consent — you provide this by using the finance tracker.

AI coaching conversations (sensitive)

Your messages to and from the AI coach, plus AI-generated summaries and insights about your progress. To answer you, the coach is given a snapshot of your recent goals, reflections, mood, body metrics, nutrition, finances, energy, and schedule. Legal basis: Contract — this is the coaching feature you signed up for. See "AI processing" below for what is sent to Anthropic.

Accountability circles

If you join a circle, your check-ins, encouragements, and progress are shared with the other members of that circle. Legal basis: Contract — you choose to join. Remember that what you share in a circle is visible to its members.

Usage, analytics and device data

How you use the app (events, energy logs, discipline and momentum scores) and technical data such as your IP address, device and browser type, and pages visited. Google Analytics collects some of this — see "Analytics and cookies". Legal basis: Legitimate interests for first-party product analytics and security; consent for third-party web analytics (Google Analytics).

Payments

When you subscribe, you give your card details directly to Stripe — we never see or store your card number. We keep your email, your Stripe customer and subscription IDs, and your plan and trial status. Legal basis: Contract (to take payment) and legal obligation (Stripe keeps payment records for tax and accounting).

Referrals

If you arrive through a referral link, we record the referral code and link your signup to it. Legal basis: Legitimate interests — to run our referral program.

3. How we use your information

We use your information to:

• Create and run your account.
• Generate your schedule, tasks, and personalized coaching.
• Track your progress and show you analytics like streaks and completion rates.
• Keep the service secure and working.
• Process payments and manage your subscription.
• Send you account messages and, unless you opt out, a weekly recap email.
• Understand how the app is used so we can improve it.

We do not sell your personal data. We do not use it to show you third-party advertising.

4. AI processing

Our AI coach is powered by Anthropic's Claude models. When you use coaching, scheduling, task generation, or the weekly recap, we send relevant parts of your data to Anthropic's API. Depending on the feature, this can include your messages, goals, reflections and mood, body measurements, nutrition, finances, energy levels, and calendar event titles.

Anthropic does not use data sent through its commercial API to train its models. Anthropic may keep this data for a limited time to operate the service and detect misuse, under its own terms. Once data has been sent to Anthropic, we cannot reach in and delete it. See Anthropic's privacy policy for details.

5. Analytics and cookies

We use Google Analytics 4 to understand how people use Discipline AI. It loads on every page and records things like which pages you visit and how you move through the app. To do this, Google Analytics sets first-party cookies in your browser (named _ga and _ga_…) and sends Google your IP address and how you use the site. These analytics cookies are not essential to run the app.

When you first visit, we show a cookie banner asking you to accept or decline analytics cookies. Google Analytics only loads if you accept. You can change your choice at any time in Settings → Data → Analytics cookies, or by installing Google's opt-out browser add-on, or by blocking cookies for this site.

We also record first-party usage inside the app — for example, which features you use — to improve it. This stays with us and the providers listed below.

Essential storage: to keep you logged in and remember basic settings such as your language, we store some information in your browser. This is necessary for the app to work. We do not use advertising cookies.

6. Who we share your data with

We share data with the companies that help us run Discipline AI. Each one only receives what it needs, and each has its own privacy policy.

Supabase

Our database, login, and back-end hosting. Holds your account and app data. supabase.com/privacy

Anthropic

The AI behind the coach (see "AI processing" above). anthropic.com/legal/privacy

Stripe

Subscription payments. Handles your card details directly; we never store them. stripe.com/privacy

Cloudflare

Hosting and content delivery for the website and app. Sees your IP address and request data as traffic passes through. cloudflare.com/privacypolicy

Google

Three things: Analytics (above); web fonts (your browser loads our fonts from Google, which sees your IP address); and optional "Sign in with Google" (we receive your email and basic profile). policies.google.com/privacy

Resend

Sends our emails — account messages, the weekly recap, and replies when you contact support. resend.com/legal/privacy-policy

Sentry

Error monitoring, so we can find and fix crashes. Configured not to collect personal information by default. sentry.io/privacy

Open Food Facts and USDA FoodData Central

When you search for a food or scan a barcode, we look it up in these public food databases. They receive your search term or the barcode — not your identity. openfoodfacts.org

Browser push services

If you turn on notifications, your browser registers with its own push service (for example Google, Mozilla, or Apple), and we send notifications through it.

7. International data transfers

Several of the companies above are based in the United States, and others operate globally. If you use Discipline AI from the UK, EU, or another region, your data is transferred internationally so we can provide the service.

Where the law requires it, international transfers must be protected by appropriate safeguards, such as Standard Contractual Clauses. We are reviewing our agreements with each provider to make sure these are in place. If you have questions about this, contact us.

8. How long we keep your data

We keep your personal data for as long as your account is active.

Deleting your account in Settings → Data removes your data from our systems immediately. If you email us to request deletion instead (for example if you cannot sign in), we action it within 48 hours.

A few honest caveats:

• Backups: our database backups may keep a copy of deleted data for a limited period, until those backups are overwritten.
• Payments: Stripe keeps your payment records (amounts and dates) for as long as the law requires, even after you delete your account. These are held by Stripe, not in the app, and do not include your in-app finance tracking.
• AI and other providers: companies like Anthropic keep data under their own retention rules, which we cannot override.

We do not currently delete dormant accounts automatically.

9. Your privacy rights

Wherever you live, you can ask us to:

• Access your data — get a copy of what we hold about you.
• Correct it — fix anything that is wrong (you can edit most things in the app).
• Delete it — remove your account and your data.
• Port it — get a machine-readable copy to take elsewhere.
• Restrict or object to how we use it.
• Withdraw consent — for example, unsubscribe from the weekly email or block analytics in your browser.

You can delete your account instantly in Settings → Data. For anything else — access, correction, portability, or if you cannot sign in — email [email protected] from the address on your account. We action deletion requests within 48 hours and other requests as soon as we can, within one month at the latest.

The in-app "Export All Data" button in Settings gives you a copy of everything you have put into the app, as a single JSON file — every table we hold data in for you, including a record of every AI call made on your behalf and its cost. Two things are deliberately left out: encouragements other circle members sent you (only what you sent them is included), and an internal daily-total table we use only to enforce AI usage caps — not the per-call record itself, which is included. If you would rather we send your copy to you, or want those daily totals too, email us instead.

If you are in the UK or EU, you also have the right to complain to your data protection authority.

10. Data security

We protect your data with:

• Encryption in transit (HTTPS) and at rest.
• Row-level security and access controls designed so you can only reach your own data.
• Hashed passwords — we never store them in plain text.
• Ongoing security reviews of our infrastructure and code.

No system is perfectly secure, but we take protecting your data seriously and fix issues when we find them.

11. Children's privacy

Discipline AI is for people aged 16 and over. We do not intend it for children under 16, and we do not knowingly collect their data. If we learn that someone under 16 has created an account, we will delete it.

We ask you to confirm that you are 16 or older when you accept our Terms, but we do not currently verify age at signup.

12. Communications and marketing

We send you essential account emails — things like password resets, confirmations, and important service notices. You cannot opt out of these while you have an account.

We also send a weekly recap email summarizing your progress. This is on by default. Every one of these emails has an unsubscribe link, and you can turn it off at any time.

13. Changes to this policy

We will update this policy when our practices change. The "Last updated" date at the top shows when. For significant changes, we will let you know by email or in the app.

Change history

• September 29, 2026 — Analytics now load only after you accept the cookie banner. Signup requires an explicit Terms/Privacy and age (16+) acknowledgement. "Export All Data" covers every table that holds your data, not a partial set (see "Your privacy rights" for the two narrow exclusions). Account deletion in Settings → Data is now instant and server-side, including cancelling any active subscription — the email path is now a fallback for people who cannot sign in. Checked that every processor link below still resolves.
• June 1, 2026 — Rewrote the policy to describe our actual data practices: named every company we share data with (including Google, Resend, Sentry, and the food databases), listed the specific and sensitive data we collect (mood, body metrics, finances, chat), corrected the cookies section to disclose Google Analytics, set account deletion to within 48 hours, and added legal bases and international-transfer information.
• March 25, 2026 — Previous version.

14. Contact

Questions, concerns, or requests about this policy or your data? Email us at [email protected].