1. Using Haftra without an account
On first launch you can choose to continue without creating an account. In that mode your injections, weight, side effects, blood glucose readings, daily tracking and settings are stored only in your phone's own storage. That data is never transmitted to us or to any server. Deleting the app deletes it.
2. Data processed when you create an account
If you want your records backed up across devices, or you want to use the anonymous community feature, you can create an account with Apple, Google or an email address. Only then is the following processed: your e-mail address, to create your account and verify sign-in; your name and gender selection, both optional, to greet you and to give body composition readings context; and your health records, meaning injections, weight, blood glucose, side effects, meal notes (including the protein and calorie estimates you accept), daily tracking and treatment settings, so they can be backed up and synced, whether you entered them or imported them from the Health app or Health Connect.
These records are protected in the database by row-level security: technically, only your own session can read your own rows. No other user can query your records.
Progress photos are never uploaded. Even with an account they stay on your device only; they are not part of the backup.
3. Sign in with Apple or Google
When you sign in with Apple, Apple sends us only a user identifier scoped to our app and an email address. That identifier is generated for Haftra alone, so it cannot be used to track you across apps.
- If you choose Hide My Email, the address we receive is an Apple-generated alias and we have no access to your real one.
- Apple does not send us your name, your device model, or any other Apple account information.
When you sign in with Google, Google sends a token that verifies your account, and your email address. We ask for no further permission: we do not reach your contacts, calendar, files or any other Google data. Your password stays on Google's screen; the app never sees it.
4. Technical data kept for session security
Our authentication layer records your IP address and a client identifier containing your app version and operating system version each time you sign in, so we can spot unauthorised attempts to reach your account.
- It contains no device model and no device identifier; the app never reads such an identifier from your phone.
- It is never used for profiling, advertising or analytics, and is not linked to your health records.
- It is deleted automatically after a limited period.
5. The Health app and Health Connect
With your permission, on iPhone Haftra reads weight, blood glucose, body fat, exercise time, active energy and sleep from the Health app. On Android it reads weight, blood glucose, body fat and exercise sessions from Health Connect. That way you do not have to re-enter what your smart scale or another app already recorded, and the cards on screen can show it.
- Haftra never writes to the Health app or Health Connect; it only reads.
- Imported weight and blood glucose readings are kept like your other records. Exercise, active energy, sleep and body fat are used only on your device, for the cards on screen, and are not backed up.
- You can revoke this at any time in Settings › Health › Data Access & Devices on iPhone, or in the Health Connect settings on Android.
- This data is never used for advertising or marketing; Apple and Google prohibit this outright.
6. Anonymous community signals
If you choose to share a side effect with the community, its name, severity and date are recorded alongside your medication.
- The community screen shows counts and average severity only; nobody can see individual entries.
- A side effect does not appear until at least 3 different people have reported it.
- Other users cannot see your identity, your email, or any of your other records.
- Only the medication name, the symptom name, a severity from 1 to 5, and the date rounded to the day are sent.
- You can remove all of your community reports from Settings.
To be explicit: your report is stored in the database linked to your account identifier. This is necessary; otherwise one person could skew a summary by reporting the same symptom over and over. The anonymity comes not from the row being identity-free but from that table granting no read access to any user.
7. Progress photos
Progress photos are stored on your device only, with file protection enabled. Even with an account, these photos are not synced, not uploaded, and cannot be seen by us.
8. Meal estimates and barcodes (Haftra+)
With Haftra+ you can photograph a meal, or describe it in a few words, and get a protein and calorie estimate. It runs only when you ask for it; the app never reaches for your camera or your library on its own, and you can always log a meal by hand instead.
- What is sent: a downscaled copy of the photo you took or chose, or the short description you typed, and your account's session credential (to confirm the request is yours and that you subscribe to Haftra+). No other health record, note or name is attached to the request.
- Where: the request first reaches our server in the European Union (Supabase), which passes the photo or description to Google's Gemini API to produce the estimate. The model is confined to identifying the food and estimating portion, calories and protein; it answers no other question.
- What is not kept: the photo and the description. No copy is retained on your device, on our server, or stored on our behalf at Google; once the answer is produced the request is over. Google processes the request under its own API terms.
- What is kept: a monthly scan count tied to your account (to enforce the quota; a number, nothing else), and the protein and calorie figure you accept, as part of the meal note. Those figures are backed up like any other health record and deleted with your account.
- An estimate is not a measurement; you can correct every figure before saving, and what you write is what is saved.
- Barcodes: if you scan a packaged food's barcode, only the barcode number and the app's language are sent to Open Food Facts, a public food database. The request carries no account, no device identifier and none of your records. Barcode lookup is free and does not need Haftra+.
9. Ask Haftra AI (Haftra+)
Ask Haftra AI lets you learn what your logs show, with ready-made questions or one you write yourself. It works only if you have an account, subscribe to Haftra+ and have granted the Gemini consent in the app; you can withdraw that consent from the app at any time. Answers are not medical advice, and on health questions the app points you to your doctor.
If your iPhone supports Apple Intelligence, questions are answered first by the model on your phone, and then nothing leaves the device. What follows applies when a question goes to Gemini.
- What is sent: if you pick a ready-made question, a few sentences the app worked out from your logs (for example your average over the last 7 days). If you type your own question, the question (at most 200 characters) and a short summary of your logs: medication, dose and injection history (with sites), medication changes, weight entries, height, goal weight, BMI, figures worked out from your weight trend, symptoms, daily check-ins (mood, food noise, water, protein, movement), meal tags and glucose. Your name, email, account id, the free-text notes you wrote in your records, photos and exact dates (only "how many days ago") are not part of that summary. Your session credential goes to our server only to confirm the request is yours and that you subscribe to Haftra+.
- Where: the request first reaches our server in the European Union (Supabase), which passes it to Google's Gemini API to produce the answer. The model is confined to answering from the records you give it and does not suggest dose changes.
- What is not kept: your question, your log summary and the answer. They are not stored on our server or written to its logs. Google processes the request under its own API terms.
- What is kept: a daily question count tied to your account (to enforce the limit of 10 questions a day; a number, nothing else).
- If you do not grant the Gemini consent, or withdraw it, no part of your records goes to Google; ready-made questions keep being answered by the app from your own records.
10. Reminders
Injection, hydration and weigh-in reminders are scheduled on your phone and fire on your phone. We do not use remote (push) notifications, so we hold no notification token for you, and your reminder times are never sent to a server in order to be delivered.
11. PDF and CSV exports
The doctor summary (PDF) and the data export (CSV) are generated on your device and never pass through our servers. The file goes only where you send it.
Report links. If you choose to share the doctor summary as a link instead of a file, the PDF is uploaded to a private folder on our server that belongs to your account alone. The link stops working after seven days; you can revoke it sooner, which deletes the file at once. Expired reports are deleted the next time you open the report list, and all of them are deleted with your account.
12. Who your data is shared with
We do not sell your data and we do not share it with anyone for marketing. We use the service providers below, each processing data on our behalf and only for its own job.
Supabase
Authentication, database and file infrastructure. When you create an account, your email address, your name, your health records, the reports you share as a link and the side-effect reports you share are held in a PostgreSQL database managed by Supabase and hosted in the European Union (Frankfurt, eu-central-1). Supabase processes this data solely to provide the service.
So we can see where the app is hard to get through, we record short, fixed event names against your account, such as onboarding_reached_dose or injection_logged. The name, the time it happened and the app version are all that is stored. What is never stored: your dose, your weight, your symptoms, your notes, your blood glucose, or any text you typed yourself. If you use Haftra without an account, no events are recorded at all. Deleting your account deletes them too.
We may have to disclose data where legally compelled, for example a court order. If such a request arrives we will inform you, unless the law forbids it.
Google (Gemini API)
Only when you ask for a meal estimate, and when you ask Haftra AI a question after granting the Gemini consent. For a meal estimate the one thing Google receives is the downscaled photo or the description you typed. For Ask Haftra AI it receives your question and an anonymous summary of your logs; not your identity, your email, your account or your notes. Details in sections 8 and 9. If you sign in with Google, Google also acts as an identity provider (section 3).
RevenueCat (subscription status)
Haftra+ purchases are handled by Apple's and Google's stores; RevenueCat keeps track of which of your devices the subscription is valid on. It receives your account identifier and the purchase receipt issued by the store; not your health records, your name or your email. When you request a photo estimate, your subscription is verified server-side against this record.
Open Food Facts
A public food database. Only when you scan a barcode, the barcode number and the app's language are sent (section 8).
Crash reports
On our own server, only if you have an account, and only on iPhone. When the app crashes or freezes, we keep the report Apple prepares on your device so we can find the fault: the call stack (code locations), the kind of error, the app and iOS version, and the device model. The error message, the one part of a report that could carry a value from your records, is removed before the report leaves your phone. These reports are never sent to a third party and are deleted with your account.
The app contains no advertising SDK and we do not read the advertising identifier (IDFA). That is why Haftra never asks for tracking permission. Beyond that, no tracking or third-party analytics service is used.
13. Retention and deletion
- Without an account your records live only on your device, so removing the app deletes them.
- With an account, Settings › Permanently delete account removes your account, your email, your name, every backed-up health record, the meal-scan counter, the Haftra AI question counter, the reports you shared as a link, crash reports and every community report from the database.
- This is irreversible, requires no approval from us, and takes effect immediately.
- If you leave your account in place, your records are retained until you delete them.
- Step-by-step instructions and the email route are on the delete account page.
14. Exercising your rights
Depending on where you live, you may have rights under the GDPR and Turkey's Law No. 6698 (KVKK) to access, correct, delete, restrict the processing of, and port your data. For access and deletion the app itself is the fastest route. For anything else, write to destek@haftra.app.
15. Children
Haftra is intended for tracking a prescribed treatment and is not designed for users under 18. We do not knowingly collect data from anyone under 18.
16. Changes to this policy
If we update this policy we will change the date on this page, and we will notify you in the app for any significant change. You can request the previous version from the support address.
17. Contact
For anything privacy-related: destek@haftra.app
Medical notice. Haftra is not a medical device. It does not diagnose, treat or recommend any dose, and it does not replace a healthcare professional.