Privacy Policy

Last updated: October 2, 2026

This policy explains what Dahlia — the website at dahliawell.com and the Dahlia app — collects, how it is used, and the choices you have. The short version, and our promise: we never sell your personal information, and we never share your health answers for advertising.

What we collect

• Your quiz answers. The information you choose to share while building your plan — such as which medication you use, your dose and shot day, symptoms, age, height, weight, goals, and habits. Some of this is health-related information, and we treat it that way.
• Your email address, if you provide it, so we can send you your plan, information about your subscription, and the codes that let you sign in to the app.
• Purchase information. When you subscribe: the plan you chose, its price, your subscription’s status and renewal dates, the email address you paid with, and reference numbers from our payment providers.
• Identifiers. A visitor ID and a session ID, stored in cookies on your device, so your plan stays connected to you between visits. Your in-progress answers are also kept in your browser’s local storage on your device.
• Usage and device information. Pages viewed, interactions with the Service, approximate location derived from IP address, and browser and device details — including analytics sessions that record how the pages were used.

What we never collect: your card details. Your card number and security code go straight from the payment form to Stripe (or, if you pay with PayPal, stay with PayPal). They never reach our servers or our database.

How we use it

• To build and show you your personalized plan.
• To save your plan with your email address and send it to you.
• To process and manage your subscription, prevent fraud, and help you when you contact us.
• To operate, secure, and improve the Service.
• To measure whether our advertising works, using event counts and hashed identifiers — for example, that a purchase happened and its value — never your quiz answers.

What we never do

• We never sell your personal information.
• We never share your quiz answers or other health information with advertisers, and we never use them for ad targeting.

Who we share information with

We use a small number of service providers who process information on our behalf and under our instructions:

• Google (Firebase) hosts the Service and stores the information described above, and receives crash reports from the Dahlia app (Crashlytics) — with no account ID attached.
• OpenAI processes meal photos, voice clips and your Ask Dahlia messages, only with your permission — see “In the Dahlia app” below.
• RevenueCat manages subscriptions bought inside the Dahlia app.
• Resend sends the codes that let you sign in to the app.
• Typesense hosts our food search. It receives only the words you search for.
• Stripe processes card, Apple Pay, and Google Pay payments and manages subscriptions bought on our website. It receives your payment details directly from you, along with your email address and the plan you choose.
• PayPal processes payments you make with PayPal and manages those subscriptions.
• Meta receives advertising-measurement events (such as a page being viewed, a step being completed, or a purchase and its value) together with technical identifiers and a hashed version of your email — never your quiz answers — so we can tell whether our ads work.
• PostHog and Microsoft Clarity provide product analytics and usage-session recordings that help us understand and improve how the Service is used.

We may also disclose information where the law requires it, or to protect the rights, safety, or property of Dahlia or others.

In the Dahlia app

Meal photos, voice clips and your Ask Dahlia messages are processed by OpenAI to estimate your meal or answer you. They’re never used to train AI; OpenAI may keep them up to 30 days to guard against abuse, then deletes them. Dahlia deletes voice clips as soon as they’re transcribed; meal photos stay in your account until you delete the entry or your account; chats stay in your account until you delete your account. Deleted photos and voice clips stay in our cloud provider’s recovery store for 7 days, then are erased for good. A barcode missing from our index is looked up on Open Food Facts from your phone — they see the barcode, never your account details.

Before you first use photo or voice logging or Ask Dahlia, the app asks your permission to send them to OpenAI, along with the logs Dahlia needs to answer you. You can turn these features off at any time in Settings → Privacy → AI features.

Subscriptions bought inside the app are processed by Apple (App Store) or Google (Google Play), and managed for us by RevenueCat.

Apple Health and Health Connect

If you allow it, the Dahlia app connects to Apple Health (on iPhone) or Health Connect (on Android).

• What it reads: steps, weight, body fat and lean body mass.
• What it writes: your weigh-ins (with body fat and lean body mass when you log them), the nutrition of the meals you log, and the water you log.

Readings Dahlia imports are kept in your account, with the rest of your logs. They’re never used for advertising or marketing, and never sold. They’re shared with OpenAI only when you use Ask Dahlia, with your permission. You can change what Dahlia may read and write at any time in Apple Health or Health Connect.

Cookies and local storage

Dahlia sets a visitor cookie (kept for about a year) and a session cookie, keeps your in-progress answers in your browser’s local storage, and uses the measurement tools above, which set their own cookies. Our payment providers set their own cookies on the payment form to keep payments secure. You can clear or block these in your browser settings — parts of the Service, like resuming a plan in progress or paying, may stop working without them.

How long we keep information

We keep the information described above for as long as it is needed for the purposes in this policy — including keeping records of purchases for as long as the law requires — and delete it when it no longer is, or when you ask us to.

Deleting your account

You can delete your Dahlia account in the app (Settings → Privacy → Delete account) or by email — see Delete your Dahlia account. Deleting removes your account, logs, meal photos and voice clips, chats and settings. Deleted photos and voice clips stay in our cloud provider’s recovery store for 7 days, then are erased for good. Deleting your account doesn’t cancel a subscription — here’s how to cancel.

Your choices

• Email support@dahliawell.com to access, correct, or delete the information we hold about you. You can also delete your app account yourself — see Delete your Dahlia account.
• Any marketing email we send you will include a way to opt out.
• Clearing your browser’s cookies and site data removes the identifiers and answers stored on your device.

Security

We use reasonable technical and organizational safeguards to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Children

The Service is for adults. It is not directed at anyone under 18, and we do not knowingly collect information from them.

Changes to this policy

If we make material changes, we will update the date at the top of this page. Your continued use of the Service after a change means you accept the updated policy.

Contact

Questions about privacy: support@dahliawell.com