Privacy

Only what you enter, plus what is needed to sign you in.

• Your account — email address, a display name, a profile picture if you add one, and a friend code.
• What you log — challenge days and whether each task was done, workouts and their sets, focus sessions, books and reading progress, day notes and journal entries, the tasks you plan, and any items you make yourself.
• Health-adjacent measurements — where a challenge asks for them: weight, water, calories, diet adherence, and progress photos. These are stored because you chose a challenge that tracks them, and are covered in more detail below.
• Social — friend connections, posts you write, comments and reactions you leave, nudges you send, and a question a friend asks about one of your entries. Items you add to a shared challenge as your own extras are seen by the people in it (in a public challenge, only by your friends).
• Safety — reports you make, the people you block, and a short record of wrong invite codes tried from your account, kept for a day so codes can't be guessed.

There is no location tracking, no contacts access, no advertising identifier, and no background collection of any kind. Nothing is recorded while you are not using the app.

Progress photos are private by default. They are kept in private storage and reached through short-lived signed links, not public URLs, so a photo is not viewable by anyone who happens to have an address.

A photo becomes visible to other people in a challenge only if you turn sharing on — either for that challenge or for the individual photo. A shared challenge shows co-participants what you logged for the days you shared; it never exposes anything from outside that challenge.

Weight, water and calorie entries follow the same rule as everything else: yours, unless you are in a shared challenge that tracks that measurement and you have chosen to share it.

Annela can read a few figures from Apple Health on iPhone and Health Connect on Android, so a challenge that counts steps or workouts does not have to be typed in by hand. This is off until you turn it on. iOS asks once, on one screen that lists each type, and you choose which to allow. The app works without it.

What is read. On iPhone: steps, walking and running distance, active energy, workouts, and heart rate during a workout. From version 1.0.1, and only if you allow it, also your weight, date of birth and sex, used on your phone to estimate calories (below) and never sent anywhere. On Android, when it launches: steps, distance, exercise sessions, hydration, and heart rate during a workout. Nothing else — not sleep, not location, not clinical records, not anything about medication or conditions, and no heart rate outside a workout.

Workouts your watch recorded. With the switch on, workouts from the last two weeks that Apple Watch or another trusted fitness app saved to Apple Health appear in your history: their activity, start and end time, distance, active energy, and the name of the device that recorded them. Workouts this app wrote are not read back.

Heart rate specifically. It is read only for the span of a workout — one you record here, or one your watch recorded, when you open it and allow heart rate — and only if you wear something that measures it: an Apple Watch, or a chest strap. Your phone has no heart-rate sensor, so without one of those there is nothing to read. The readings are thinned to one every five seconds, stored against that workout, and used to show you the average, the peak and the line between them. They are not used to infer anything about your health, and they are deleted with the workout.

Calories, estimated. If a challenge counts calories and Health has no active energy for the day — a band that syncs only steps, say — Annela works out an estimate on your phone from the day's steps, your workouts and the heart rate during them, and your weight: from Apple Health if you have allowed it (with your age and sex, which make the heart-rate estimate closer), otherwise the last weight you logged here. Only the estimate is stored, marked as estimated — never your weight, age or sex — and a figure from your watch replaces it when one arrives.

What is written. The workouts and the weights you log here, so they count in the rest of your health data too. Nothing is written that you did not enter.

Where it goes. A figure read from Health is stored in your account the same way a typed one is, alongside a note of which app recorded it and whether the platform reported it as recorded automatically or entered by a person. That note exists so a shared leaderboard can tell a watch reading from a hand-typed number; it is shown to you and, on a challenge you have joined, to the people in it.

What it is never used for. Health data is not used for advertising, not sold, not shared with data brokers, and not shared with anyone outside the service providers listed below. It is not used to build a profile of you for any purpose other than showing you your own progress and your standing in challenges you chose to join.

Turning it off. Revoke the permission in iOS Settings → Health → Annela, or in Health Connect on Android, and reading stops immediately. Figures already saved to your account stay until you delete them — see below — because they are part of the days and challenges you logged.

Log the day in words turns a line you type, like “ran 5k, read 10 pages”, into entries. It reads the line on your phone, and it writes nothing until you press the button to save.

You can also download an optional language model, sized to your phone (about 230 MB or 730 MB), to read lines the built-in rules can't. It is fetched from Hugging Face, the model's public host, which sees an ordinary download request and nothing you type. Once downloaded it runs entirely on your phone. What you type there is never sent to us or to anyone else.

Ask Nella answers questions about your challenges, and can set things up for you. She runs entirely on your phone, on the language model above plus a small file of her own training (about 22 MB) that we serve from annela.app. Neither download carries anything about you.

To answer, the app builds a short summary on your phone from what it already shows you: your running challenges and items, your figures for the last two weeks, your friends' names, and how many days the people sharing a challenge with you met each goal. The summary, your questions and her answers stay on the phone. They are never sent to us or to anyone else, and the conversation is gone when you close it.

When Nella proposes something, such as starting a challenge, logging a figure, setting a reminder or nudging a friend, the app shows you all of it first and does nothing until you confirm. A nudge uses the app's usual wording; Nella never writes to anyone for you.

The short line from Nella on Today is written the same way, on your phone, or filled in from your own figures when the model isn't downloaded. Our usage analytics record only that Nella was asked and which kind of proposal was confirmed, never what was asked or said.

These service providers, and no one else. Each processes data on our behalf under its own terms, and none is permitted to use it for anything else:

• Supabase — the database, the file storage and sign-in. Everything you log lives here.
• Resend — sends the account emails: the code that confirms a new account and the password-reset link. For each one it receives your email address and the message itself.
• Cloudflare — serves this website and annela.app.
• Vercel — hosts the console Annela Support uses (see below), so it handles what that console shows.
• Expo — delivers push notifications. To send one to your phone we give Expo a device token and the text of the notification. They are about you and the people you do challenges with — a friend request, an invitation, a reply, a nudge — and now and then news about the service itself, never a promotion. Turn notifications off and nothing is sent.
• RevenueCat — keeps track of Pro subscriptions. If you buy Pro, Apple takes the payment; we never see your card, and neither does RevenueCat. RevenueCat receives the purchase record Apple issues, together with your account's ID in this app, so it can tell us whether your subscription is active. If you never buy Pro, it holds nothing about you.
• PostHog (EU) — counts how the app is used; see Usage analytics.

Share links are the one thing you can make public. Opening a share link shows the day or challenge you chose to share, to anyone with the link. That is the purpose of the link, and it holds only what the card shows. Sharing a card to Instagram Stories hands the image to the Instagram app on your phone; nothing about you goes to Meta from us.

The iPhone app tells PostHog, hosted in the EU, when certain things happen: a screen opened, an account created, a challenge started or joined, a friend invited, a day logged, a post or a cheer, a focus block or a workout finished. Each event carries only a kind, a count or a duration — for example “focus block, 25 minutes, finished”.

It never includes your name, email, posts, comments, captions, photos, challenge titles, health values or anyone else's details. Events are tied to your account's ID in this app, and to a random ID the app makes for this install, so we can see how many people come back, and your IP address is discarded. There is no session recording, and nothing is used for advertising or shared with anyone. Only the App Store and TestFlight builds send events.

Deleting your account does not delete the events already sent: they stay tied to an ID that no longer leads to anybody. Write to us and we will delete them too.

If you joined the waitlist on annela.app, we hold the email address you gave, when you joined, which form you used, and the invite code that came with it (and whose code you used, if you used one), so we can tell you when Annela opens. Nothing else, and it is not shared. Ask and it is removed.

Annela Support uses an admin console, behind a password and a second sign-in step, to answer support requests, review reports, and give testers a Pro trial. It can see account details and what was reported, and it can keep a short note about a support conversation, which is deleted with the account. Every action taken in the console is recorded: which account it was about, what was done and when, so it can be checked later. Nobody looks at an account for any other reason.

Under UK and EU data protection law every use of your data needs a lawful basis. Ours:

• To provide the service (performance of a contract) — your account, what you log, your challenges, and anything you share with people you connect to. Without this there is no app.
• Because you asked (consent) — reading from Apple Health, push notifications, and progress photos. Each is off until you switch it on, and switching it off withdraws it.
• To keep it working and safe (legitimate interests) — sign-in security, abuse reports, and stopping people gaming a public leaderboard, and the usage counts above, which tell us what to fix and what to build. Weighed against your interests, and limited to what that needs.

Health and fitness data gets extra protection in the UK and EU. We rely on your explicit consent for it, which is what the Health permission prompt is asking for — and you can withdraw it in Settings or in iOS at any time.

Shubham Raghav is the data controller. Write to 1037/29B, Gali no. 10, Krishna Colony, Sector 7 Extension, Gurgaon, Haryana 122001, India, or [email protected].

You can complain to the UK Information Commissioner’s Office (ico.org.uk) or your local supervisory authority. We would rather you told us first.

Export. Settings → Your data writes everything you have logged to a single readable JSON file. It leaves out other people’s words.

Deletion. Settings → Delete account removes your profile and everything attached to it — every challenge day, workout, focus session, note, book, photo, friendship and post — along with your sign-in. It happens immediately and it is not recoverable. There is no waiting period and nothing to email anyone about.

Two things survive deletion, and neither identifies you: posts you wrote inside a shared challenge are removed, but another person’s record that they completed their own day is theirs and stays. And if someone joined through your invite, the fact that they joined remains on their account with the link to you removed.

Backups are kept by our database provider for a short period for disaster recovery and are overwritten on their own schedule.

Annela is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and it will be removed.

If this policy changes in a way that affects what is collected or who it is shared with, the date at the top changes and the change is described here. This document lives in the app’s source repository and is updated in the same change as the code it describes.

Questions about any of this, or a request about your data, go to [email protected].