Privacy Policy

Weekwell app and website. Last updated 21 October 2026.

This policy explains what happens to your information when you use the Weekwell app, visit weekwell.app or write to us.

In short

• Your health records stay on your phone. We never see them.
• You don’t need an account. If you create one for backups, your backups are encrypted on your phone before they leave it, and we can’t read them.
• There are no ads, analytics, tracking or cookies in the app or on the website.
• We never sell your information or use it for advertising.

Who we are

Weekwell is run by 18Chai Ltd, a company registered in the Republic of Cyprus (registration number HE 454100) with its registered office in Paphos. 18Chai Ltd is the controller of the information described here. For anything about privacy, write to privacy@weekwell.app.

The app: what stays on your phone

Everything you enter stays on your phone:

• treatments and plans;
• the doses you log, with amounts, units, injection sites and notes;
• supplies;
• weight, body measurements (such as waist, hips or body-fat percentage) and goals;
• check-ins and side effects;
• meals and activity;
• reminders.

The app keeps it in its own database on your device, protected by your phone’s built-in encryption, and you can add an app lock with Face ID, Touch ID or your passcode. We don’t receive any of it.

All of these are included when you export or back up your records. You can export your records as JSON or CSV, or delete them all, from within the app at any time. Deleting the app also deletes them from your phone. If your phone’s own backup (for example iCloud Backup) is turned on, your phone may include the app’s data in it under your phone maker’s terms.

When you confirm that you are 18 or over and accept the Terms and this policy, the app saves which version you accepted and when. It saves this on your phone and in your encrypted backups.

If you create a report for your doctor, the PDF is made on your phone. It leaves your phone only if you share it yourself through the share sheet, and nothing is sent to us.

Reminders are scheduled by your phone, and nothing about them is sent to us. By default, notifications don’t show what you take; you can choose to show more detail.

If you use the Apple Watch app, your phone sends your next planned doses (treatment names, planned times and amounts) to the Apple Watch paired with it, over Apple’s encrypted connection between the two, and records the doses you log there. The watch keeps only the latest copy, and nothing is sent to us.

The app: what leaves your phone, and only if you choose it

• An account (optional): if you sign in, we store your email address. If you sign in with Google, we also store the name and the link to the profile photo that Google shares, and Google knows that you used it to sign in to Weekwell. Sign-in codes and links are sent to your email address from hello@weekwell.app through our email provider.
• Encrypted backups (optional): when you are signed in, the app uploads encrypted copies of your records. They are encrypted on your phone before upload, with a key kept in your iCloud Keychain and in your recovery code, so we can’t read them. We also store technical details about each copy: its size, a checksum, the app and format version, when it was made, and the device type (for example “iPhone”).
• Sign-in protection: when you sign in, our backend provider processes your IP address to limit repeated attempts and prevent abuse.
• Purchases: Weekwell Pro is bought through Apple’s App Store, and on Android through Google Play. Apple or Google handles the payment and the receipt, and we never see your payment details. The app checks your subscription on your phone through the store, with no other purchase or analytics service involved.

The app: what it doesn’t do

The app contains no analytics, crash-reporting or advertising tools and doesn’t track you across apps or websites. It doesn’t read or write Apple Health, and it doesn’t ask for your location, contacts, photos, camera or microphone. If we add something like crash reporting or Apple Health in the future, we will update this policy first and ask for your permission where the law requires it.

The website

When you visit weekwell.app, your browser sends technical data such as your IP address, browser type and the page requested. Our hosting provider, Cloudflare, uses it to deliver the page and protect the site from abuse. We don’t keep visitor logs and don’t use this data to identify you. The website has no cookies, no analytics and no advertising pixels, and it loads nothing from third-party servers.

Emails

If you write to us, we receive your email address and your message and use them only to reply. If you mention something about your health, we use it only to answer you and keep it confidential.

Health information

Information about your health is especially sensitive. We designed Weekwell so that we never receive your health records in a readable form. If you turn on account backups, you ask us to store encrypted copies of your records. We rely on your explicit consent for that, and you can withdraw it at any time by deleting your backups or your account. We never use health information for advertising and never sell it.

Legal bases

• Providing the features you choose (accounts, backups, purchases): the agreement between you and us. For encrypted backups of health records, also your explicit consent.
• Keeping Weekwell secure, preventing abuse, delivering the website and answering your emails: our legitimate interests.
• Keeping records the law requires: our legal obligations.

Who else handles your information

We use a few service providers. Each acts on our instructions under a data processing agreement:

• Supabase, Inc. runs accounts and encrypted backups. The data is stored in the European Union (Stockholm, Sweden).
• Resend, Inc. sends sign-in emails. It processes the address an email goes to, the email itself (the one-time code or link), and delivery and bounce details. It never receives health records.
• Cloudflare, Inc. hosts and protects the website and forwards emails sent to weekwell.app addresses.
• Our mailbox provider receives the emails you send us.

Some services act under their own privacy policies:

• Google, only if you choose Google sign-in.
• Apple and Google, for app downloads, purchases and your phone’s keychain and backups.

We don’t share your information with anyone else unless the law requires it.

International transfers

Supabase stores our data in the EU. Supabase, Resend, Cloudflare and Google are based in the United States and may process some data there, for example for support or security. Where information from the EU, UK or Switzerland is transferred, these providers rely on the EU–U.S. Data Privacy Framework (and its UK and Swiss extensions) or the European Commission’s standard contractual clauses.

How long we keep it

• Records on your phone: until you delete them or the app.
• Account: until you delete it. You can delete your account from within the app at any time; this deletes your backups too. Sign-ups whose email address is never confirmed are deleted after 7 days.
• Backups: the latest 3 copies per account. Older copies are replaced automatically, and all of them are deleted with your account.
• Sign-in security records, including IP addresses: deleted after 90 days. Our backend provider’s own platform logs expire on its schedule.
• Sign-in email delivery records: kept by our email provider, Resend, for a limited time on its own schedule.
• Emails to us: as long as we need to deal with your message, and no more than 24 months after our last reply.
• Website request data: we keep none. Cloudflare holds it only briefly to deliver and protect the site.

Your rights

You can ask us to show you the information we hold about you, correct it, delete it, limit how we use it or give you a copy. You can also object to how we use it, and withdraw consent at any time. You can delete your account and backups yourself in the app. Your records on your phone are always in your hands: export or delete them in the app. For anything else, write to privacy@weekwell.app; we reply within one month.

You can also complain to a data protection authority:

• Our lead authority is the Commissioner for Personal Data Protection in Cyprus.
• In the EU, you can also complain to the authority in the country where you live.
• In the UK, the Information Commissioner’s Office.
• In Israel, the Privacy Protection Authority.

If you live in the United States, the same requests are open to you wherever you live. We don’t sell or share personal information, use it for targeted advertising, or use health information for anything other than the features you choose.

Children

Weekwell is for adults aged 18 and over and isn’t directed at children. If you believe a child has given us personal information, write to us and we will delete it.

Security

We protect what we hold in several ways:

• backups are encrypted on your phone before upload;
• connections use encryption;
• sign-in attempts are limited;
• access is restricted to the people who run Weekwell.

No system is perfectly secure, but we keep what we hold to a minimum.

Changes to this policy

If we change this policy, we will update the date at the top. For important changes, we will also tell you in the app before they take effect.

Back to the home page