Privacy Policy

Last updated: September 28, 2026

At SomaStack, we respect your privacy and are committed to protecting the personal data you share with us. This Privacy Policy details how we collect, store, and utilize your information.

1. Information We Collect

To organize and track the routines you enter, we collect the following information:

• Profile and routine information: Your declared age and the time you confirm you are at least 18, gender, activity level, routine notes, product names and label directions, schedules, settings, and checklist progress. SomaStack is for adults aged 18 and older.
• Strava Account Data (Optional): If you connect your Strava account, we read your profile identification and recent physical activity statistics (distance, heart rate, and duration).
• Account Identifiers: If you sign up, we store your email address and profile name.
• Usage Statistics: We keep privacy-minimized counts of registrations, plan and checklist activity, integrations, subscriptions, affiliate clicks, and AI reliability/cost metadata. We never put prompts, AI responses, health or supplement details, IP addresses, or full user-agent strings in analytics.

2. How We Store Your Information

Your profile metrics, account configuration, and checked supplement lists are safely stored in our secure database instance (PostgreSQL / SQLite) deployed within our isolated hosting environment on Railway. We do not distribute, share, or sell your health metrics to third-party advertising companies.

Chat history is saved in this browser’s local storage for your account and recent messages are sent with subsequent AI requests. Clearing browser storage removes this local copy; it does not delete data already processed by Google or your saved account profile and schedule.

3. API Integrations and Data Sharing

• Google Gemini API: When you create a draft schedule or chat with Ana, we send relevant profile details (age, gender, activity level and routine notes), product names and label directions, schedule/settings, checklist context, your message and recent conversation to Google. We do not automatically include your account name, email, password hash or login/access tokens in model requests. However, names, contact details or other personal information you enter in messages, notes or product/activity fields will be included; this information is not guaranteed to be anonymous. Do not enter confidential information or unnecessary identifiers. We use a project with active Cloud Billing: under Google’s Paid Services terms, prompts and responses are not used to improve Google’s products, but Google may retain them for a limited time for safety, security and legal purposes. See the Gemini Paid Services terms.
• Strava & Google OAuth: We use Google for optional sign-in and Strava for optional activity imports. App sessions are stored on the server; your browser receives a signed, HTTP-only session cookie. Strava access and refresh tokens are stored on the server, not in the Gemini prompt. You can disconnect Strava in settings and revoke Google access through your Google Account.

4. Cookies

We use secure, HTTP-only cookies for authentication. With your consent, we also use signed, first-party anonymous visitor and 30-minute session cookies. They are stored as one-way hashes, expire on a bounded schedule, honor Global Privacy Control and Do Not Track, and are never used for cross-site tracking or advertising. Privacy-minimized event rows are retained for 90 days and aggregate statistics for up to 760 days.

5. Affiliate Links

Supplement shopping links lead to partner stores (Amazon, iHerb). We record the product and store clicked, the time, and your account ID if you are signed in. These records are not anonymous when linked to your account. We may earn a commission on resulting purchases at no extra cost to you.

6. Contact Us

If you have questions about data use or want to delete your account data, contact [email protected] or see User Data Deletion.