Privacy policy · Allheard

Who we are

Allheard is operated by Node Logic L.L.C-FZ, a company registered in the Meydan Free Zone, Dubai, United Arab Emirates, licence number 2647188.01. Node Logic is the controller of the personal data described in this policy. “We” and “us” mean Node Logic.

This policy covers the Allheard apps for iPhone and Android, the service behind them, and this website, allheard.app.

What we collect

Your account

Your name and email address from Sign in with Apple or Google (with Apple you can choose to hide your email), your settings and the targets you set, such as calories and protein, and the status of your plan as the store reports it. We never receive your card details.

What you log

Meals, foods, portions, calories and macros, notes, the text you type, photos you take of a meal, the text of what you say (after your phone has turned it into text), and the questions you ask Allheard with their answers.

Health and fitness data

From the sources you connect: weight, body composition, blood pressure, heart-rate variability, sleep, activities and steps.

Technical data

App version, device model and operating system, crash and error reports, sign-in tokens, and IP addresses in our server logs, which we use to keep the service secure.

Usage analytics, only if you agree

If you switch on analytics in the app, we learn which screens and features are used, so we can improve them. Analytics never receives your health values or what you log. It is off unless you turn it on.

This website

The site sets no cookies and runs no analytics. Our hosting and network provider processes IP addresses to deliver the pages and protect them from abuse. If you sign up for launch news, we also keep your email address.

Most of what you log and measure is health data under article 9 of the GDPR: weight, body composition, blood pressure, heart-rate variability, sleep and, combined with these, your meals and calories. We process it only with your explicit consent.

Where your data comes from

From you, when you create your account, log a meal, ask a question or write to us.
From the sources you connect: Garmin Connect, Apple Health (HealthKit), Health Connect on Android, and Withings. We receive data from a source only after you connect it, and only the types you allow. You can disconnect any source at any time.
From Apple and Google, when you sign in with them or buy a subscription through their stores: your sign-in identity and your plan status.

How we use your data, and on what basis

What we do	Legal basis (GDPR)
Run your account, save what you log, sync your sources, show Today and your history	Contract (art. 6(1)(b)); for health data, your explicit consent (art. 9(2)(a))
Turn what you type, say or photograph into a meal, and answer your questions about your data	Contract; for health data, your explicit consent
Answer your messages to support	Contract, or our legitimate interest in helping you (art. 6(1)(f))
Keep the service secure, prevent abuse, find and fix errors	Legitimate interests (art. 6(1)(f))
Product analytics	Your consent (art. 6(1)(a)), only if you switch it on
Send launch news, if you sign up on this website	Your consent (art. 6(1)(a)), which you confirm with the link in our email
Meet legal obligations, such as answering lawful requests	Legal obligation (art. 6(1)(c))

We ask for your explicit consent to process health data when you create your account and again when you connect each source. You can withdraw it at any time by disconnecting a source or deleting your account. Withdrawing does not affect what was done before, but without it we cannot provide the parts of Allheard that rely on health data.

We do not make decisions about you that have legal or similarly significant effects based only on automated processing.

Data from Apple Health and Health Connect

Data we read from Apple HealthKit and from Google Health Connect is used only to provide the features you see in Allheard: showing it on Today and in your history, putting it next to your meals, and answering the questions you ask about it.

It is never used for advertising, marketing or similar data mining, and never sold.
It is never shared with third parties, except the service providers we need to run these features (listed below, all bound by contract), or when the law requires it.
It is never used to train AI models, by us or by anyone else.
No person at Allheard reads it, unless you ask us to in a support request, or it is needed for security or to comply with the law.

Allheard's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.

AI processing

When you type, say or photograph a meal, or ask a question, the text or photo is sent to Claude, an AI model made by Anthropic, which we use through Amazon Web Services (AWS) Bedrock in the Frankfurt region (eu-central-1). AWS is our processor, and the request is processed in the EU.

Bedrock does not keep your input or the answer after it is returned, and does not use them to train models.
We send no account identifiers: no name, email address or user ID. To answer a question about your data, we send only the values that question needs, such as the sleep and meal times for the days you asked about.
The AI's answer is an estimate. You see it as an editable meal and confirm it before anything is saved.

Voice input

When you say a meal, your phone's own speech recognition (Apple Speech on iPhone, Android speech recognition on Android) turns your voice into text on the device. No audio is sent to us, to the AI model or to any other processor. Only the resulting text is processed, like a meal you typed.

Launch news

If you enter your email address on this website, we send you a link to confirm it. Once you click it, we write to you when Allheard launches and send occasional updates about it. We ask for nothing else: no name, and we do not store your IP address with your signup.

Unsubscribe any time. Every email has a link, or you can write to privacy@allheard.app. Unsubscribing deletes your address and does not affect what was sent before.
How long we keep it. If you do not click the link, we delete your address after 7 days. If you do, we keep it until you unsubscribe or we stop sending these emails.
Where it goes. Your address is in our database in the EU. Resend sends the emails from the EU and keeps addresses and delivery records in the United States (see International transfers).
Clicks. Links in our news emails pass through Resend, so we can see which links were clicked. We do not track whether you open an email, and the confirmation email has no tracking.

Who processes data for us

We use these service providers. Each one processes data only on our instructions, under a data processing agreement.

Provider	What for	Where
Hetzner	Servers, database and backups	EU
Amazon Web Services (Bedrock)	AI processing, with no retention	Frankfurt, EU
PostHog	Product analytics, only if you switch it on	EU
Sentry	Crash and error reports	EU
Resend	Emails: service messages, such as sign-in and account messages, and launch news	Sent from the EU; records stored in the US
Cloudflare	Domain name service, content delivery and protection from attacks for this site and the service	Global network

Apple and Google handle sign-in and payments as independent controllers, under their own privacy policies. Garmin, Withings and the other sources you connect keep their own copy of your data under their own policies.

International transfers

Your account and health data are stored and processed in the EU. Node Logic is based in the United Arab Emirates, and the people who run Allheard may access data from there to operate the service and answer support requests. That access is covered by the European Commission's Standard Contractual Clauses (Decision 2021/914), with additional safeguards: access only when needed, and encrypted connections.

Resend stores the email addresses it sends to, and its delivery records, in the United States. Some of our providers are US companies. Where a provider or its parent company could access data from outside the EU, the transfer relies on the EU-US Data Privacy Framework where the provider is certified, or on Standard Contractual Clauses. You can ask for a copy of the safeguards at privacy@allheard.app.

How long we keep your data

While your account exists, we keep what you log and the data from your sources, so your history stays complete.
When you disconnect a source, we stop receiving data from it. What was already imported stays in your history until you delete your account, or ask us to remove it earlier at privacy@allheard.app.
When you delete your account, we delete your account and everything linked to it within 30 days, including from backups. Delete your account explains how.
Launch news: 7 days if you do not confirm your address, otherwise until you unsubscribe or we stop sending these emails.
Server logs and error reports are kept only as long as needed to keep the service secure and fix problems, then deleted.
We keep a record that you asked for deletion, and anything else the law requires us to keep, for as long as the law requires it.

Your rights

Under the GDPR and similar laws you can ask us to:

give you a copy of your data (access), and give it to you in a portable format (portability);
correct it (rectification) or delete it (erasure);
restrict how we use it, or object to processing based on our legitimate interests;
withdraw your consent at any time, without affecting what was done before.

Write to privacy@allheard.app from the email address of your account, so we can tell the request is yours. We answer within one month.

You have the right to complain to a data protection authority, in particular in the EU country where you live or work.

Security

Data travels encrypted between your phone, our servers and our providers. Access to the servers is limited to the people who run the service, and only when needed. If a breach puts your data at risk, we will notify the competent authority within 72 hours and tell you without undue delay when the law requires it.

To report a security issue, write to security@allheard.app.

Notices for people in the United States

California (CCPA and CPRA)

In the last 12 months we collected these categories of personal information: identifiers (name, email address), sensitive personal information (health data), commercial information (your plan status), and internet or device activity (technical data, and analytics if you switch it on). We collect them from the sources and for the purposes described above.

We do not sell or share personal information, as the law defines those words, and we do not use it for cross-context behavioral advertising. We use sensitive personal information only to provide the service you asked for. You have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for using these rights. Write to privacy@allheard.app; an authorized agent can write on your behalf with your written permission.

Consumer health data (Washington, Nevada and similar laws)

This section is our consumer health data privacy policy under the Washington My Health My Data Act and similar state laws.

What we collect: the health and fitness data and the meal data described in “What we collect”.
Why: only to provide the features you use, as described in “How we use your data”.
Where it comes from: from you and from the sources you connect.
Who we share it with: only the processors listed in “Who processes data for us”, to run the service. We do not sell consumer health data, and we do not use geofencing.
Your rights: you can confirm whether we collect your consumer health data, see it, get a list of the processors who received it, delete it, and withdraw your consent. Write to privacy@allheard.app. If we decline a request, you can appeal by replying to our answer.

Health Breach Notification Rule

If a breach of security exposes your identifiable health information, we will notify you, the Federal Trade Commission and, where required, the media, as the FTC Health Breach Notification Rule requires.

Age

Allheard is for adults aged 18 and over. It is not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a child has given us data, write to privacy@allheard.app and we will delete it.

Changes to this policy

When we change this policy, we update the date at the top. If a change is significant, we tell you in the app or by email before it takes effect, and we ask for your consent again where the law requires it.

Contact

Privacy questions and requests: privacy@allheard.app
Controller: Node Logic L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates. Legal notice