Privacy Policy

The short version

Almost everything you record in Sagoma — your logs, weights, measurements and progress photos — is encrypted on your device before it is sent to us. We hold it as ciphertext and we cannot decrypt it. What we can see is the small amount of account information needed to sign you in, take payment, and keep the service running.

What we collect

Account

Your email address, a password verifier (we never store the password itself), the date you confirmed you are eighteen or older, and your consent records with their timestamps.

Devices

A device name and platform for each phone you sign in on, so you can see the list and revoke any of them. We also store a wrapped encryption key per device, which we cannot unwrap.

Encrypted content

Your profile — including the name you give us — along with your training and nutrition history, body measurements, photos and coach conversations, stored as opaque encrypted blobs together with the version of the key that sealed them. We can tell you how many items you have and when they changed. We cannot tell you what is in them.

Subscription

Your plan, its status and renewal dates, and the identifiers the app store gives us. Card details go to the app store, never to us — we never see or store a card number.

Operational records

Sign-in attempts, API request metadata, rate-limit counters and error logs. These exist to detect abuse and to fix faults, and they are the reason we can tell you if someone tried to get into your account.

What we do not do

• We do not sell your personal information, and we never have.
• We do not run advertising in Sagoma and we do not share data with ad networks or data brokers.
• We do not build profiles of you for anyone else's purposes.
• We do not train models on your content, and the AI provider behind the coach is contractually barred from training on what we send it.

Why we hold what we hold

Account and device records exist to authenticate you and to let you cut off access from a phone you no longer have. Subscription records exist to give you the service you paid for. Operational records exist for security and for diagnosing failures. Encrypted content exists so that your history survives a lost phone. There is no category collected "just in case".

Who else touches it

We use a small number of processors: a cloud database and application host, an email provider for account messages such as password resets, the Apple App Store for payment, and a third-party AI provider that generates the coach's replies. Each receives only what its function requires, and none of them receive your encryption keys or anything that would let them open your encrypted content.

We will disclose information if we are legally compelled to. Because of how the encryption works, what we are able to produce in that situation is account and billing records and ciphertext.

The coach, and the one thing that is not encrypted

The coach is an AI, and it cannot answer questions about your day without being told about your day. So when it runs, this is sent in readable form to a third-party AI provider, which generates the reply: your message, and a summary of where you stand — sex, age, height, weight, body fat if you recorded it, training experience, your goal and deadline, and what you have eaten and trained today and over the past week. If you connected Apple Health, that summary carries the figures you allowed us to read, which can include sleep, resting heart rate and heart rate variability. Photograph a meal for analysis and the photograph goes the same way.

This is the only part of Sagoma where your information leaves us in a form somebody could read. There is no version of an AI coach that works without it, so rather than bury it, here are the limits:

• We relay it. Neither the prompt nor the reply is stored on our servers.
• The conversation itself is encrypted on your device and synced as ciphertext, like everything else. What is readable is readable in transit, not at rest.
• The provider is contractually barred from training on it.
• It runs when you message the coach, when it writes your weekly review, and — only if you switch them on — when it prepares a proactive nudge. Nothing else triggers it.
• We ask for your consent to this separately when you create your account, not folded into the terms, and you can withdraw it.

The provider is a specialist AI company, bound by a written agreement covering confidentiality and the bar on training. If we move to another, the same terms apply, and we will tell you in the app before the change takes effect.

How long we keep it

Account and encrypted content are kept while your account is open. Delete your account and both are erased within thirty days, other than records we are required to retain for tax or fraud purposes. Operational logs are kept on a rolling window measured in months, not years.

Your choices

You can export your data, delete individual entries, revoke any device, withdraw a consent, or delete your account outright from inside the app. If you would rather ask us, write to privacy@sagoma.app and we will act within thirty days.

Health data

Some of what you record in Sagoma is consumer health data as defined by Washington's My Health My Data Act and comparable laws elsewhere. That data is covered by a separate document with additional disclosures and rights: the Consumer Health Data Privacy Policy.

Children

Sagoma is for adults. You must confirm you are eighteen or older to create an account, and we do not knowingly collect information from anyone under that age. If you believe a minor has an account, tell us and we will remove it.

Changes

If this policy changes in a way that materially affects you, we will tell you in the app before the change takes effect rather than quietly updating the date at the top.

Contact

Whitetowers Group LLC — privacy@sagoma.app
PO Box 463, Loxahatchee, FL 33470