Privacy Policy

Last updated: October 6, 2026

Flarely ("we," "our," or "us") is operated by Low Latency Labs LLC. This Privacy Policy explains what information we collect, how we use it, and how we protect it when you use the Flarely mobile app and the flarelyapp.com website. If you live in Washington, Nevada, or another state with a consumer health data law, also see our Consumer Health Data Privacy Policy. Sections 12 to 16 cover the extra rights you have depending on where you live.

1. Your Logs Stay on Your Device

What you log in Flarely stays on your device, stored with Apple's SwiftData framework. That includes bowel movements, meals, stress, fasting, your 14-day plans and what you wrote at the end of them, the summaries and recaps the app makes, and your answers when you set up the app (such as your diagnosis and how long ago it was). We don't keep a copy on our servers. The only time any of it leaves your device is when you use an AI feature (Section 2) or when you share something yourself, such as a PDF summary.

2. Data Sent to AI Services

When you use Flarely's AI features, the data described below is sent to our server (hosted on Cloudflare), which passes it to OpenAI and returns the result to your device.

Your permission is required: The app asks for your permission before sending anything to AI services. You can turn this off at any time in the app (Profile, then AI & privacy).

Meal photo analysis: When you ask Flarely to analyze a meal photo, the photo is resized on your device and sent to our server, which forwards it to OpenAI to identify the foods and ingredients. The food names and ingredients are then sent the same way to be sorted into meal tags. Photos are sent without their location or other photo metadata. A photo may happen to show other things, such as a kitchen or a hand.

AI summaries and recaps: When you ask for an AI summary or recap, the app sends the entries from the days you pick: for each bowel movement, its time, pain level, whether there was blood and how much, whether it was urgent and how urgent, mucus, and stool type, if you recorded them; each stress check-in's time and level; your fasting entries; how often each meal tag appeared; and your time zone. It does not include your name, email address, or any notes you've written. (Older versions of the app send fewer of these details.)

Device identifier: A random identifier created by the app (not your Apple ID or your device's advertising identifier) is sent with AI requests, only so we can limit how many requests each device makes.

Genuine-app check: Each AI request also carries a short-lived pass from Apple's App Attest, checked through Google Firebase App Check, which confirms the request comes from a real copy of Flarely. It contains no health data, name, or email.

IP address: Our server uses your IP address to limit requests. It is held only briefly in the server's memory, never written to storage, and never sent to OpenAI.

Because this data comes with a device identifier and passes through a server that sees your IP address, we describe it as not including your name or email, rather than as anonymous.

3. How AI Requests Are Handled

Meal photos

1. Your device: The photo is resized and sent to Flarely's server over an encrypted connection (HTTPS/TLS).
2. Flarely's server (Cloudflare): Forwards the photo to OpenAI. No copy of the photo or any health data is stored or logged on our server.
3. OpenAI: Identifies the foods and returns the result. OpenAI does not use API data to train its models. It may keep API data for up to 30 days to monitor for abuse, then deletes it (longer only if required by law).
4. Back on your device: The meal is saved on your device.

AI summaries and recaps

1. Your device: Prepares the entries described in Section 2 and sends them over an encrypted connection.
2. Flarely's server (Cloudflare): Counts days and totals, then sends the entries and counts to OpenAI. Nothing is stored or logged on our server.
3. OpenAI: Writes the summary and returns it. Same terms as above: not used for training, kept up to 30 days for abuse monitoring.
4. Back on your device: The summary is saved on your device.

In short:

• No health data is stored on Flarely's servers
• We don't use your data to train AI models, and neither does OpenAI (per its current API data usage policy)
• All data is sent over encrypted connections (HTTPS/TLS)

4. Email Communications

We may send you these emails:

• Welcome email, after you create an account, sent through our email provider, Resend
• Verification and password reset emails, sent by Firebase if you use an email and password to sign in
• A note before your free trial ends, if you start a free trial
• A one-time question if you cancel a free trial, asking why. If you tap an answer, it is saved with your account
• Updates about Flarely, if you sign up on our website

You can stop the welcome email, the cancellation question, and website updates in the app (Profile, then Emails from Flarely), with the unsubscribe link in any email, or by contacting us at [email protected]. Verification, password reset, and the note before a trial ends are about your account or money, so they are sent regardless.

To send emails at the right time, we receive your trial dates and subscription events from RevenueCat, and the app saves your time zone with your account.

5. Usage Stats and Crash Reports

Usage stats: We use Google Analytics for Firebase to see how the app is used, so we can improve it. The app records:

• Which setup screens you reach, whether you try logging during setup, and whether you finish setup
• How you signed in, and whether you allowed notifications and AI features
• Steps on the subscription screen: which plan you picked, whether you subscribed, and your reason if you tell us why you're not ready
• Your 14-day plan: when you start, continue, or restart one, how many questions it has, whether you end it early and on which day, whether you open its halfway and final summaries or compare two plans, what you choose to do next, and whether you wrote down takeaways (never the text)
• Whether you make an AI recap, and whether you preview or share a PDF summary

These never include what you logged (such as pain, blood, or what you ate) or anything you type. Google Analytics also records when the app is first opened, sessions, app updates, and in-app purchases, with an app instance identifier, your operating system, and your country and region (from your IP address). We don't use any of this for advertising.

Crash reports: When the app crashes, Firebase Crashlytics records what went wrong in the code, your device model and operating system, and an installation identifier. Crash reports contain no health data. Crashlytics keeps them for 90 days.

Turning it off: Usage stats and crash reports are on when you install Flarely. You can turn them off at any time in the app (Profile, then AI & privacy, then Usage and crash reports). When they're off, the app sends no usage events and no crash reports to Google. It changes nothing else in the app. Google processes this data only for us: we've turned off Google's data sharing and advertising features, and Google has agreed to data processing terms that stop it from using the data for its own purposes.

On our website: flarelyapp.com uses Cloudflare Web Analytics to count visits and see which pages people read. It doesn't set cookies or follow you to other websites.

Server logs: Our server keeps short technical logs (such as errors, which feature was requested, and whether the genuine-app check passed) for up to 7 days. They do not include health data, photos, names, or email addresses.

6. Account Information

You can create an account with Sign in with Apple or with an email address and password. We store the following in Google Firebase:

• Your name and email address (with Sign in with Apple, you choose whether to share your real email)
• Your Apple user ID, if you use Sign in with Apple (an identifier Apple issues only for Flarely)
• How you signed in, when your account was created and updated
• Your email preference, whether the welcome email was sent, and your time zone
• For free trials: when the trial ends, its price and length, which emails were sent, and your answer if you told us why you cancelled

Firebase also keeps sign-in records, including IP addresses, for a few weeks for security. We never share your account information for advertising.

7. Subscriptions

Subscriptions are sold through Apple. We use RevenueCat to check your subscription status. RevenueCat receives your Flarely user ID, your purchase and receipt information, and your device type and operating system. No health data is shared with RevenueCat.

8. What We Don't Do

• We don't show ads, and we don't use advertising tools in the app
• We don't use your device's advertising identifier or track you across other companies' apps and websites
• We don't sell your data or share it for advertising
• We don't collect your precise location, and we don't use geofences
• We don't read Apple Health or data from other apps

9. Service Providers

Flarely uses the following companies to run the app and website. Each handles your data only for us, under a data processing agreement that stops it from using the data for anything else:

See also: OpenAI API data usage policy, Firebase privacy and security, Google Privacy Policy, RevenueCat Privacy Policy, Cloudflare Privacy Policy, Resend Privacy Policy.

We may also disclose information if the law requires it, for example to comply with a valid court order. If Flarely is ever sold or merged, your information would pass to the new owner under this policy, and we would tell you first.

10. Where Your Data Is Processed

Flarely is available in the United States, the United Kingdom, Canada, Australia, and New Zealand. Your data is processed mainly in the United States; our server runs on Cloudflare's network, which handles requests in data centers around the world. If you live outside the United States, your information is transferred to and processed in the US, where it may be accessed by courts and authorities under US law. Our service providers protect these transfers with Standard Contractual Clauses (with the UK Addendum for UK data) or other approved safeguards.

11. Data Security and Breaches

All data is sent over encrypted connections. No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities as the law where you live requires, including, in the US, the Federal Trade Commission's Health Breach Notification Rule, and in the UK, notifying the Information Commissioner's Office within 72 hours where required.

12. United Kingdom (and EU/EEA users of earlier versions)

If you are in the United Kingdom, the UK GDPR gives you these rights. They also apply if you are in the European Economic Area or Switzerland and still use Flarely from before it stopped being offered there.

• Access: get a copy of the personal data we hold about you
• Rectification: have inaccurate data corrected
• Erasure: have your data deleted
• Restriction: ask us to limit how we use your data
• Portability: get your data in a portable format
• Objection: object to how we use your data, including usage stats (which you can also turn off yourself, Section 5)

Legal basis:

• Contract (Article 6(1)(b)): your account, your subscription, and the AI features you ask for.
• Legitimate interests (Article 6(1)(f)): security, limiting requests, preventing fraud, crash reports, and understanding how the app and website are used so we can improve them.
• Explicit consent for health data (Article 9(2)(a)): the data sent for AI features is "data concerning health". We send it only with the permission you give in the app, which you can withdraw at any time (Profile, then AI & privacy). Withdrawing doesn't affect what was sent before.

Usage stats: They are on by default under the UK's exception for analytics used only to improve a service, and you can turn them off at any time (Section 5).

Because your logs are stored on your device, you can view, change, export, or delete them yourself at any time. To exercise any other right, email [email protected]. We'll answer within one month. You can also complain to the Information Commissioner's Office or your local data protection authority.

Representative: We have not appointed a representative in the UK or EU. You can contact us directly at [email protected].

13. Canada

If you are in Canada, we handle your information under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Quebec, the Act respecting the protection of personal information in the private sector.

• Consent: We ask for your express consent before sending health information to AI features. You can withdraw it at any time in the app, and you can turn off usage stats and crash reports (Section 5).
• Access and correction: You can ask for the personal information we hold about you and have it corrected. We'll answer within 30 days.
• Outside Canada: Your information is processed in the United States (Section 10).
• Privacy officer: The person responsible for personal information at Low Latency Labs LLC can be reached at [email protected].

If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or in Quebec, the Commission d'accès à l'information.

14. Australia

If you are in Australia, we handle your information in line with the Australian Privacy Principles. You can ask for the personal information we hold about you and have it corrected, and we'll answer within 30 days. Your information is disclosed to our service providers in the United States (Section 9 and Section 10). To make a complaint, email [email protected]; we'll reply within 30 days. If you're not satisfied, you can contact the Office of the Australian Information Commissioner.

15. New Zealand

If you are in New Zealand, the Privacy Act 2020 gives you the right to ask for the personal information we hold about you and to have it corrected. We'll answer within 20 working days. Your information is sent to our service providers in the United States, which protect it under contracts comparable to New Zealand's privacy law (Section 10). If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner.

16. United States

Consumer health data: If you live in Washington, Nevada, or another state with a consumer health data law, see our Consumer Health Data Privacy Policy for your rights and how to use them.

California: You can ask to know what personal information we have collected about you and to have it deleted. We don't sell your personal information or share it for cross-context behavioral advertising, and we won't treat you differently for using your rights. The categories we collect are: identifiers (name, email address, Apple user ID, Flarely user ID, the app's random device identifier, app instance ID); commercial information (subscription and trial status, purchases); internet or network activity (how the app and website are used, IP address); approximate location (country and region); health information (only what you choose to send to AI features, which we don't keep); and your answer if you tell us why you cancelled a trial.

To use any of these rights, email [email protected] or delete your account in the app.

17. How Long We Keep Data

• Your logs: On your device until you delete them or delete your account.
• Account data: Kept while your account exists, and deleted when you delete your account. If a technical problem leaves anything behind, we remove it within a day. Firebase removes the sign-in account from its systems within 180 days.
• Subscription records: Kept by RevenueCat while your account exists, and deleted when you delete your account. Apple keeps its own records of your purchases.
• AI requests (our server): Not kept. They pass through our server and are not stored or logged.
• AI requests (OpenAI): Up to 30 days for abuse monitoring, then deleted (longer only if required by law).
• Usage stats: 2 months.
• Crash reports: 90 days.
• Server logs: Up to 7 days.
• Emails: Resend keeps sent emails and delivery logs for 30 days.

18. Data Storage and Backups

Your logs are stored on your device using Apple's SwiftData framework. If you use iCloud Backup, your device backup may include them, subject to Apple's Privacy Policy. You can manage iCloud Backup in your device's Settings app.

19. Deleting Your Account

You can delete your account at any time in the app (Profile, then Delete account). After a two-step confirmation, this permanently removes:

• Everything you've logged, from your device
• Your account record and your sign-in account in Firebase
• Your subscription record at RevenueCat
• Your usage stats in Google Analytics

It doesn't remove Apple's records of your purchases, crash reports (which aren't linked to your name or email and expire after 90 days), or emails already sent. Copies held for a limited time by OpenAI and Resend expire on their own (Section 17). If you delete your account from an older version of the app, your account and subscription records are removed within a day, and your usage stats expire within 2 months.

Deleting your account doesn't cancel your subscription. To stop being charged, cancel it in your Apple account settings. To ask us to delete anything else, email [email protected].

20. Age Requirement

Flarely is for adults 18 and over. We don't knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it. Parents or guardians can contact us at [email protected].

21. Changes to This Policy

If we change this Privacy Policy, we'll update the "Last updated" date at the top of this page. For a material change, such as collecting a new kind of data or changing how AI data is handled, we'll tell you in the app or by email before it takes effect, and ask for your consent where the law requires it.

22. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Email: [email protected]

Low Latency Labs LLC
2501 Chatham Rd Suite N
Springfield, IL 62704
USA