Privacy Policy

Last updated: June 8, 2026

At SomaStack, we respect your privacy and are committed to protecting the personal data you share with us. This Privacy Policy details how we collect, store, and utilize your information.

1. Information We Collect

To provide personalized vitamin stack algorithms, we collect the following metrics:

• Onboarding Profile Answers: Age, gender, physical activity level, and general notes/goals regarding recovery.
• Strava Account Data (Optional): If you connect your Strava account, we read your profile identification and recent physical activity statistics (distance, heart rate, and duration).
• Account Identifiers: If you sign up, we store your email address and profile name.
• Usage Statistics: We keep privacy-minimized counts of registrations, plan and checklist activity, integrations, subscriptions, affiliate clicks, and AI reliability/cost metadata. We never put prompts, AI responses, health or supplement details, IP addresses, or full user-agent strings in analytics.

2. How We Store Your Information

Your profile metrics, account configuration, and checked supplement lists are safely stored in our secure database instance (PostgreSQL / SQLite) deployed within our isolated hosting environment on Railway. We do not distribute, share, or sell your health metrics to third-party advertising companies.

3. API Integrations and Data Sharing

• Google Gemini API: To calculate your custom supplement stack, we send your anonymized profile summary (age, gender, workout description) to the Gemini model API. No personal identifiers (like email or password hashes) are ever sent to the AI service.
• Strava & Google OAuth: All tokens for login services are secured in cryptographically signed, HTTP-only session cookies. You can terminate integrations at any time from your settings panel.

4. Cookies

We use secure, HTTP-only cookies for authentication. With your consent, we also use signed, first-party anonymous visitor and 30-minute session cookies. They are stored as one-way hashes, expire on a bounded schedule, honor Global Privacy Control and Do Not Track, and are never used for cross-site tracking or advertising. Privacy-minimized event rows are retained for 90 days and aggregate statistics for up to 760 days.

5. Affiliate Links

Supplement shopping links inside the app point to partner stores (Amazon, iHerb). When you follow one of these links we record an anonymous click event (the supplement name and store) to understand which recommendations are useful. We may earn a commission on resulting purchases at no extra cost to you.

6. Contact Us

If you have any questions regarding data usage or wish to delete your account data, please contact us at [email protected] or follow the steps on our User Data Deletion page.