Privacy Notice

This is Neta's full privacy notice (aviso de privacidad integral). It tells you who processes your data, which data, what for, who we share it with, and how to exercise your rights. It also exists in Spanish. If the two versions differ: if you are in Mexico, the Spanish version prevails; anywhere else, the version in the language you accepted prevails.

Neta is offered in almost any country (Section 13). This notice applies the same standard to everyone (the strictest among the laws that reach us), and Section 13 has a short part for your region: the European Union and the European Economic Area, the United Kingdom, the United States, Brazil and Mexico. The law cited at the foot of each section is the one behind what it says.

Our name. Neta was called CysterSync until September 2026. Only the name changed: the same person runs the same service, and your data stayed where it was.

1. Who is responsible for your data

Neta is an AI-assisted companion for women living with PMOS (Polyendocrine Metabolic Ovarian Syndrome, the new name for polycystic ovary syndrome, PCOS).

Data controller (responsable): Pablo Gabriel Campos Cordero, an individual.

Address for notices: Avenida Progreso 40, interior 502, Col. Escandón, Alcaldía Miguel Hidalgo, CDMX, CP 11800

Person who handles your privacy requests and your rights: Pablo Gabriel Campos Cordero, at privacy@tuneta.app. He is also the data protection officer (encarregado) for the purposes of Brazilian law (Section 13.4).

If you live in the European Union, the European Economic Area, the United Kingdom or Switzerland, the law asks us to name someone to represent us there before we open an account for you. We have not named them yet: until then, the only data of yours we process is the email you leave on the waitlist (Sections 2 and 13).

2. The data we collect

We collect only data that you give us or that the service generates to help you, and that we can give back to you. We do not collect data "just in case." The list below is the whole list. Data the law treats as sensitive personal data (health data; "special category data" under European law; "consumer health data" under Washington law) is marked as such.

Your account

• If you create your account with an email and a password: the address you typed, kept apart from your account until you confirm it with the six-digit code we send there, and used for nothing else until then (Section 5.2); the code itself only as a one-way code, for one hour. Also the last time you typed your password again to confirm it was you (only the time), and, while your email is not confirmed, whether a browser session of yours is locked after the quick exit (only that session and the time).
• If you sign in with Google or Apple (Section 5.6): the address the company confirms, that it verified it, and its identifier for your account with it. Never the name or photo it sends; we delete them as they arrive.
• Your email address and the invite code you used. For referral rewards, the temporary referral attribution is consumed after the first qualifying payment. We keep your own referral code, if you asked for one to share, your reward balance and access date, and private transaction fingerprints to prevent duplicate awards and handle refunds. The reward ledger does not retain an invited woman's account identifier. We do not show a list of friends, their health information, or whether they remain subscribed.
• Your first name, and a display name if you set one.
• Your age. It is required, and you must be 18 or older.
• Your language and time-zone preferences, and the country you told us you live in. Your country decides which currency you see prices in, which help lines we show you and which section of this notice is yours. It decides whether you may open an account in one case only: in the European Union, the European Economic Area, the United Kingdom and Switzerland, until we name our representatives there (Section 13).
• Which version of this policy and of the Terms you agreed to, and when.
• Your consent decisions: one record per purpose we ask you about (keeping your record, AI processing, and helping improve Neta with your steps), whether you granted or declined it, when, how it was captured, and which version of this notice it was given against. A decline is recorded as explicitly as a grant.
• Your steps in Neta: only if you choose "Help improve Neta with my steps" (Section 3), and only while that decision stands, the first time your account reached each step (the account was created, your first entry, your first, third, seventh and twelfth days with both things on record, your first reading, seeing the subscription page, subscribing, a renewal, a cancellation, your first message to your companion), as the step's name and the time. Never a value you recorded (Section 4 says why).
• Your first question, while you confirm your email: if you write your question before you confirm your email, we keep it (stored encrypted), with the proposal you accepted and your language, so you find it waiting on any device. It is deleted as soon as it is saved in your account, or when you delete your account; one that is never used is deleted by a daily cleanup once it is more than 48 hours old, so it is gone within three days at most. It is not sent to the AI from here: once saved, it is your question below.

What you tell us about your cycle and your health (sensitive personal data)

• Your cycle baseline from onboarding: your typical cycle length and period length, how regular your cycles are, when your last period was, what you expect of ovulation, whether you have a PMOS diagnosis, and whether you are trying to conceive.
• The history of those answers: when one of your cycle-baseline answers changes (how regular your cycles are, your cycle and period lengths, a PMOS diagnosis, whether you are trying to conceive) or your endometriosis or adenomyosis answer changes, we keep the earlier value with the dates it held, so a past reading uses what was true then. It appears in the summary for your doctor. This history is never sent to the AI.
• Your contraception: which methods you use, which is primary, and the dated history of when each arrangement started and ended, including a hormonal method and the date you stopped it.
• Daily logs: mood, energy, hours of sleep, sleep quality, stress, symptom flags, and anything you write in the free-text note.
• Bleeding days: the date, the intensity, and anything you write in the note.
• Cycle events: the event, its date, flow, and anything you write in the note.
• Check-in observations: the values you record against the things you have chosen to track (numbers, yes/no answers, text, dates), with the day they belong to and how they were captured.
• Things you have named yourself: labels you invent for something you want to track, with the scale, unit and range you give them. The labels are stored encrypted, and your companion receives them when they are part of what you watch or try (Section 5.1).
• Why each thing is on your list: for each thing you track, the reason it is there (Neta always tracks it, you chose it when you joined, it answers your question, an experiment needs it, or you added it yourself). Never sent to the AI.
• What you are testing: your question, in your words, and what Neta proposed to watch to answer it; and when you name a thing you want to watch against an outcome, what you named, on what basis, and when.
• Your experiments: when you run one to test whether something changes an outcome: what you are testing and the outcome you watch, its plan (how many days each part lasts), the dates it started and ended and how it ended, your question and the dose in your own words (stored encrypted), each pause with its dates, its reason and your note (stored encrypted), the notes you write on it (stored encrypted), and what you thought of the result (helped, no change, worse or not sure). Paused days are left out of its analysis. For a finished experiment your companion receives what was tested, the outcome, the dates and your question in your words (Section 5.1); your dose, your notes and your verdict never reach the AI, and your pauses only change which days are counted.
• Life changes: a change you report in your life (an illness, travel, a stressful period, disrupted sleep, a change in diet, exercise or work schedule, surgery, a new diagnosis, starting to try to conceive, a pregnancy, the months after a birth, a vaccination, or something else), when it started and when it ended, and the note you add (stored encrypted, like your other notes). Neta uses them only to mark a stretch of time that crosses a change, never to explain one. Your companion receives the kind of change and its dates, never your note (Section 5.1).
• Medication: what you are taking, what you call it, the dose if you give one, and the dates each arrangement started and ended. You choose what to enter; we do not ask for a prescription or verify anything with a pharmacy or a clinician.
• Lab results: values you type in from your own laboratory reports: what was measured, the number and its unit, your lab's own reference range, the date on the report, and any note you add. We store what your report says, and we never use it in the patterns the app looks for, with one exception: if you turn on ovulation tracking, a progesterone result of 5 ng/mL (≈ 16 nmol/L) or more, taken on day 8 of your cycle or later, is read as confirming that you ovulated in that cycle (Section 4). No other result is interpreted.
• Ovulation tracking, if you turn it on: that you turned it on, and whether you chose to log LH tests and cervical mucus (mucus only while your intimate-health permission is on). Your waking temperatures, LH results and cervical mucus are stored as check-in observations.
• Hair and intimate health, only if you turn each on: each is its own permission, off until you turn it on, and we keep when you turned it on and, if you did, off. With hair on, once a month: how much unwanted hair growth and scalp hair loss you noticed (1 to 5), and whether you removed hair since your last note. With intimate health on: pain with sex (1 to 5), whether sexual activity happened, and how you felt about it. These hair and intimate-health entries are kept apart from the rest of your record: they are never sent to the AI, never used in research or in any count, and never in the summary for your doctor unless you choose to add them to that summary when it is made. They are in your own data download, and you can delete each area's entries on its own. Turning a permission off stops the questions; what you recorded stays until you delete it. Your intimate-health permission also decides your cervical mucus: only while it is on can Neta ask about it, keep it or send it to your companion.
• Pelvic health, only if you turn it on: its own permission, off until you turn it on, and we keep when you turned it on and, if you did, off. With it on you can keep a day record: how strong your pelvic pain was (0 to 10), what bothered you, where you felt it and what it felt like, whether passing a bowel movement or urine hurt, how much it got in the way of your day, the year you first noticed these symptoms, and a note in your own words (stored encrypted, like your other notes). These records are never sent to the AI. You see them beside your cycle, and they go into the summary for your doctor: its first page can say how often pain got in the way and how many of your pain days fell on bleeding days, and the day-by-day rows, with your note, are in it only if you add your full record when you make it. When you make a summary you can also leave your pelvic health out of that copy: then it carries none of your pelvic-health records, none of the pelvic-pain answers from your daily check-in and not your answer about endometriosis or adenomyosis, and we do not read them to make it. They are in your own data download; you can delete an entry from the pelvic-health page, which lists your latest ones, or ask us to delete any other, and deleting your account deletes them all. Turning the permission off keeps what you recorded until you delete it. A pelvic-pain answer in your daily check-in is a check-in observation, like the others above. Whether you told us you have endometriosis or adenomyosis (suspected or diagnosed), when you signed up or on the pelvic-health page, is kept with your profile: it appears in the summary for your doctor (unless you leave your pelvic health out of that copy) and reaches your companion (Section 5.1).
• Remedy reports: something you tried, what you were trying to affect, the dates you started and stopped, your own assessment of it, and your notes.
• Your messages to the coach, in full, and the rating you give a reply.
• Replies you saved: when you save one of your companion's replies as a note, or ask to be reminded about it in seven days: which reply, which of the two, and the date. Never sent to the AI.
• Feedback you send us: the category, your message, and the screen you sent it from.

What the service generates about you

• The coach's replies, stored alongside your messages.
• Facts. An AI process reads your logs, your notes and your own messages and writes down short statements about you (a category, a subject, and the statement itself) so the coach does not make you repeat your history. Each fact records which of your entries it came from.
• Conversation titles, cut from the first line you wrote in that conversation. No AI is involved.
• The patterns and derived views the app shows you: cycle state, counts, windows, associations and readings computed from what you logged, and, if you turned on ovulation tracking, each cycle's ovulation status (confirmed, probable, estimated or no signal) and what supports it, computed each time from your waking temperature, your LH tests, your progesterone results and your bleeding dates. It is not stored.
• Readings you were shown: each reading Neta showed you about your question or a relationship in your record: where and when you saw it, what it said (the sentence and the points it rested on, stored encrypted) and how many days it used, so a reading does not change after you have seen it and you can look back at your history. A summary for your doctor that is no longer updated, after your free period, shows the readings you had been shown by then. Never sent to the AI.
• Forecasts you were shown: each window Neta gave you for your next period, the day it was made and how many cycles it rested on, and later the day your period actually started, so we can check honestly how often the windows were right. You see this on your year page. Never sent to the AI.
• Reading positions: how far the fact process has read through each of your sources.
• Rate-limit counters: how many times you used an expensive AI feature today.
• An audit record of significant account actions (signing up, giving consent, exporting, deleting), with the action, the time and which record it concerned. It does not contain your messages or your health content.
• Service records: for each AI call made for you, which feature it served, which model, how much text went in and out (counted in tokens, never the text itself), whether it was a retry and how long it took, which we use for cost, speed, your monthly companion allowance and the safety limits; background tasks waiting to run for your account (identifiers only, deleted 30 days after they finish); a lock of at most 90 seconds so only one companion reply runs at a time; any feature turned on or off for your account alone; and, only if your account belongs to someone who runs Neta, the record that it may open the operator pages, which show figures about no one in particular. None of these is sent to the AI. The AI-call records and your feature settings are in your data download; the background tasks, the lock and the operator record are left out of it.

Your plan, if you pay. We keep your subscription's status, whether it is monthly or yearly, the price you joined at, your billing-period dates, and the identifiers the payment provider gives your purchase. We do not ask for or store your address, your phone number, your government ID, or your card number: when you pay, the payment provider collects your card, and we never see it (Section 5.3).

• Payment records: your plan's record with the web payment provider (Paddle) or with the App Store or Google Play (its status, the product, the renewal price and dates, and whether it was refunded or revoked); a record of each notice a payment provider or store sent us about it (identifiers, amounts, currency and dates, never your name, email, address or card); each notice we sent you before an automatic renewal (the date, the amount and whether it went out), which consumer law requires; a short hold on the email saying your plan ended, so it is not sent if a failed-payment notice follows; and any extra companion time you bought (how much and when). Never sent to the AI: they only decide whether you have access and how much companion time you have left. They are in your data download, except the providers' and stores' notices and the email hold, whose facts are in your plan's record; deleting your account deletes them all (Section 7).

The waitlist, if you live in the European Union, the European Economic Area, the United Kingdom or Switzerland. Until we name our representatives there (Section 13), if you tell us you live in one of those countries we ask you nothing else: we ask for your email so we can tell you when we open. We keep only your email, your country and the date (no other data, no account, no identifier) and use them only to tell you. We delete them as soon as we tell you or after 12 months, whichever comes first (Section 7).

If you write to us. If you write to support@tuneta.app or privacy@tuneta.app, we receive your email address and whatever you choose to tell us. We use it only to answer you (Section 7 says how long we keep it). We do not add it to any list.

What we do not collect. We do not ask for contacts, photos, or anything from your device's sensors. We do not read your precise location and we use no geofences. Today the app does not read or store Apple Health or Health Connect data. There is no advertising or analytics identifier.

Visit counts, before you have an account. When someone opens the home page, starts the question or finishes it, we add one to a count for that day, language, approximate country and step. Nothing else is kept: no identifier, no cookie, nothing that links one visit to another or to an account. If you do not choose "Help improve Neta with my steps", these counts are all we measure.

Your approximate country and your language. When you visit the site, we use your approximate country, derived from your IP address (our hosting provider, Vercel, supplies it with each visit), and your browser's language only to show you prices in your currency, the app in your language and, when we ask where you live, to suggest an answer that you confirm or change. We do not store it, we do not link it to your account or your record, and we build no location profile. It never decides for you: the country of your account, the one for crisis resources and the section of this notice that applies to you is the one you tell us. If you choose another country to see prices for, we remember it only in your browser (Section 12). Paddle, which charges on the web, detects your location itself at checkout to apply tax and currency (Section 5.3).

Protecting account creation. When you create an account, Cloudflare Turnstile checks that a person, not a script, is doing it (Section 5); for that check it sees your IP address and technical characteristics of your browser, and we receive only a pass or a fail. We also count sign-up attempts per network for a short window, under a one-way code derived from your IP address that changes every day and cannot be turned back into it; those counts are deleted within a day. For fifteen minutes before the account exists we keep a one-way code of a random ticket that only your sign-up holds, so that only the sign-up that passed these checks can go through; it is deleted as soon as the account exists. In the app, we also count the accounts created from your phone in the last hour, under a one-way code of a random identifier the app creates on your phone (it names nothing about you, and in our records it changes every day); those counts are deleted within a day.

Before you confirm your email. You are inside Neta from the moment you create your account, and confirming your email can wait until it suits you. Until then, your account lives only in the browser or phone where you created it: you cannot sign in from another device or set a new password by email, because we do not yet know the address is yours. If you leave with the quick exit on the web, Neta locks instead of signing you out, and your password opens it again; we note that lock on our server for that browser session (only the session and the time), so it holds even if the browser's cookies are cleared, and we delete the note when you type your password. Signing out yourself would leave no way back, so Neta asks you to confirm your email first. Instead of the code, you can connect Google or Apple: your account then uses the email they confirm, and we delete the address you typed.

Session and connection records. Our own database tables hold no IP address (only the one-way daily code above) and no browser user-agent string. Our providers do keep operational records that necessarily include them: Supabase's authentication service records sign-in attempts with the originating IP, and Supabase and Vercel keep server access logs. We do not read those logs to profile you, and we do not join them to your health data. The sign-in logs kept by Neta's providers sit outside Neta's database and are deleted automatically after a short time. Deleting your account removes everything Neta holds.

We distinguish, where we can, between what you entered and what the service inferred or generated about you.

3. Your sensitive data and your consent

Most of what Neta handles is information about your reproductive and metabolic health: sensitive personal data. We process it only with your express, explicit, written consent, which you give inside your account (already authenticated by your email and password, or by Google or Apple) as separate decisions, never one box:

• Keep my record (needed to use Neta). Without it we cannot keep anything you log, so there is no app.
• Let my companion use my record (optional). What you log and write is sent to Anthropic, the company whose AI drafts your companion's replies (Section 5.1). Saying no turns the companion off and nothing else.
• Help improve Neta with my steps (optional, off until you turn it on). We keep, linked to your account, the first time you reached each step in Section 2 (the step's name and the time, never a value you recorded) to see where people stop and fix it. Because using an app for PMOS already says something about your health, we treat your steps as health data and ask you separately. Saying no changes nothing in the app: without this decision we keep none of your steps, and all that exists is the anonymous visit counts in Section 2.

No box is pre-ticked. Each decision is recorded on its own, against the version of this notice you saw, with a timestamp taken on our server rather than your device, and stays on your account as evidence. Every screen where you decide names, beside your decisions, the law of your region that stands behind them.

These decisions are the legal basis for processing your health data under every law that reaches us: express consent (Mexico), explicit consent (European Union, United Kingdom), specific and highlighted consent (Brazil), and consent to collect consumer health data (Washington). No other legal basis replaces your consent for this data. The same holds for your steps in Neta: their only legal basis is your decision "Help improve Neta with my steps": express consent in Mexico (LFPDPPP, arts. 7 and 8), explicit consent in the European Union and the United Kingdom (GDPR art. 9(2)(a)), consent to collect in Washington (RCW 19.373.030), and specific and highlighted consent in Brazil (LGPD, art. 11, I).

How to change or withdraw your consent. You can change any of these decisions at any time under Your permissions on your profile, or by writing to privacy@tuneta.app. Withdrawing is as easy as giving. Withdrawing AI processing stops it: your entries and messages stop being sent to the AI, and the companion stops answering. Withdrawing your steps stops recording them and deletes the ones we had from your account. Withdrawing the first decision is the same request as deleting your account, so that control takes you to deletion (Section 8). Withdrawal applies going forward: it does not un-write what was already drawn from what you wrote before (those notes still appear in your data download, and deleting your account removes them), and it does not make unlawful what was processed while your consent stood.

If we make a material change to this notice, we ask you to confirm your decisions again (Section 11). Your earlier decisions are shown as you left them.

4. What we use your data for

Purposes needed to provide the service (they are the basis of our relationship with you; without them there is no service). Their legal basis is the contract you accept when you create your account and, for health data, your consent under Section 3:

• Creating and keeping your account, letting you in, and restoring access.
• Keeping your record and showing you your own patterns: the check-in screens, the cycle view, your readings.
• Preparing a summary you can take to a clinician, from your own data. If you turned on ovulation tracking, it includes your recent cycles' ovulation status and what supports each one. Your cervical mucus entries are not in it unless you choose to include them when you make it. If you keep pelvic-health records, its first page can count how often pain got in the way and how many pain days fell on bleeding days, and the day-by-day rows travel only if you add your full record (Section 2). You can also leave your pelvic health out of a copy when you make it: that copy then carries none of your pelvic-health records, your pelvic-pain answers from the daily check-in or your answer about endometriosis or adenomyosis.
• Charging for your plan, if you choose to pay, through the payment provider.
• Sending your account's emails (Section 5.2).
• Keeping the service working and safe: rate limits, the audit record, error reports, and checking that a person creates each account (Section 2). Where the law distinguishes legal bases, this purpose rests on our legitimate interest in protecting the service and its users, and touches no health data.
• Understanding where people stop, so we can fix it: only the visit counts in Section 2, which are about no one: no identifier, no cookie and no health data. Where the law distinguishes legal bases, this purpose rests on our legitimate interest. Your steps in Neta are not here: they need your consent (below).
• Showing you prices in your currency and the app in your language, from your approximate country and your browser's language, without storing them (Section 2).
• Telling you when we open in your country, if you left your email on the waitlist (Section 2): you asked for it, and it is the step before the contract you want to enter into. Nothing else is done with that email.

Purposes that need your consent, which you can decline and keep the service:

• AI processing: your companion answering you and remembering what you tell it (Section 5.1).
• Helping improve Neta with your steps: keeping, linked to your account, the first time you reached each step (Section 2) to understand where people stop and fix it: names and times, never a value you recorded, never used to advertise to you or to decide anything about you. It starts off; its legal basis is your consent (Section 3), and declining it takes nothing from you.

We do not use your data to advertise to you, to build a profile for anyone else, or to train anyone's AI model. We do not make decisions with legal or similarly significant effects on you by automated means. Neta does not diagnose you and does not classify you into a type.

How to limit the use or disclosure of your data. Beyond your permissions, you can stop tracking anything you do not want to (each variable can be switched off from your profile), delete specific entries and facts, turn notifications off, or write to us to ask that we stop processing something specific. We send no advertising or newsletters, so there is no list to unsubscribe from.

5. Who we share data with

We do not sell your personal data. We do not show advertising. We do not use your individual data to market third-party products to you. We do not permit any provider to train models on your data. These are binding commitments, not aspirations.

Six service providers ("processors") process your data on our behalf, on our instructions and under a data-processing contract, and are not permitted to use it for their own purposes:

• Supabase: the database, sign-in, and storage of your account and your record.
• Vercel: hosting and serving of the application.
• Anthropic: the AI provider. It receives what Section 5.1 describes, and only if you gave AI-processing permission.
• Resend: delivers your account's emails (Section 5.2). It receives your email address and the text of each message; no health data.
• Sentry: receives error reports from the app so we can fix them. They are configured to carry no identity, no IP address, no message content and no health data, and they are processed in the European Union.
• Cloudflare: Turnstile, which checks that a person is creating an account. It receives your IP address and technical characteristics of your browser at that moment only; no email and no health data. It is used nowhere else in Neta.

When you pay, your payment is handled by a company acting on its own account as the seller, not as our processor (Section 5.3): Paddle on the web, Apple on the App Store, and Google Play on Android. When you choose to sign in with Google or Apple, that company confirms your email to us, also on its own account and not as our processor (Section 5.6).

There is one further outbound call, on which no data of yours travels:

• Have I Been Pwned: when you choose a password, we check whether that exact password already appears in a public breach. Your password is not sent. Your browser turns it into a code and sends us only its first five characters; we ask the service for every known code beginning with them, and your browser compares on your device. Five characters say nothing about you.

We share nothing with affiliates: there are none. We share health data with no one but the processors on this list, and none of them may use it for itself.

5.1 What goes to Anthropic, and when

If you gave AI-processing permission, Neta sends data to Anthropic's API (api.anthropic.com) at five points. The companion conversation and the words shown with immediate help use Anthropic's Claude models; the other three use the current Claude Haiku model.

1. When you write to your companion. We send: not the name you signed up with, but the name you asked us to call you, if you chose one; your age range, not your age (18-24, 25-34, 35-44, 45+); the name you gave your companion; your language; today's date and your time zone; what Neta remembers about you (the most sensitive items only go if you raise them in that message); your daily records and what we read in them; your question, your goals and what you are trying; your medications in your own words, with their dates, and the life changes you recorded; whether you told us you have endometriosis or adenomyosis; if you turned on ovulation tracking, your current cycle's ovulation status and phase (how sure it is and, in general terms, what supports it), and when tracking is off, or paused because of your contraception, nothing about it, not even why; and the text of the last ten messages of that conversation, plus the one you just wrote.
2. When we check whether your message is about a crisis. Before replying, a second model reads your message and, if the conversation already holds messages of yours from the last 24 hours, up to eight of them, to decide whether to show you immediate help. It answers with a single letter.
3. When the fact process runs. We send: your first name (the one call that still carries it); every fact currently recorded about you; and up to twenty rows each from your chat messages and the notes on your daily logs, cycle events and bleeding days, as you wrote them, with their dates.
4. When your companion's words are checked before you see them. We send the statement being checked, the evidence it used, and the text of your recent messages in that conversation. It can run more than once per reply.
5. When we show you immediate help. If the check in point 2 decides to show you immediate help, your companion's model writes the few words shown with it, from the message you just wrote and nothing else, so they can answer what you said. The emergency number and the lines below them are ours; the model never writes them. Neither your message nor those words are saved.

Your content is stored encrypted in our database with a key the database does not hold. That protection ends at these five calls: to be processed, the text is decrypted first. This is inherent to using an AI provider, and it is the single most important thing to understand about how this product handles your health information. We do not send Anthropic your email address, your account identifier, your contraception history, your consent records, your feedback, or your audit record. We have no other AI provider.

You always know you are talking to an artificial intelligence: your companion says so, and the app says so in every conversation.

5.2 Your account's emails

We write to you only about things that happen in your account, never to sell you something or to remind you to come back. They are:

• the six-digit code to confirm your email, which you can enter whenever it suits you. Until you confirm it, that code is the only thing we send to that address: no other email, no link to sign in or to set a password, and nobody can use that address to sign in or to reach your account;
• the link to set a new password when you cannot sign in, once your email is confirmed;
• the note that your first reading, or a month's reading, is ready, or that a reading changed;
• the note that your reading arrived and the free stretch is closing;
• your subscription notes: that it started, that it renews soon, that a payment failed, and that it ended;
• the security notes: that your password or your email changed;
• if someone tries to create an account with your address, a note to you, and only to you, that you already have one, with the way to sign in. The screen they see is the same one anyone sees, so it never tells them you use Neta.

They are delivered by Resend, which receives your email address and the text of each message. No email carries health values or findings, and no subject line names anything about your health.

Two deliberate things about password recovery: we answer the same way whether or not an account exists for that address (otherwise a stranger could learn you use a PMOS app by typing your address into the form), and we do not log the address the request was about.

5.3 Payments

If you choose to pay, the charge is made by the seller of the platform you choose: Paddle (Paddle.com, selling as merchant of record) on the web, Apple on the App Store, or Google Play on Android. Each receives your payment details directly from you and handles them as a controller in its own right, under its own privacy notice. We never see or store your card. When you pay on the web, Paddle detects your location itself (for example from your IP address) to calculate tax and currency, under its own privacy notice.

What they send us, and all we keep, is your subscription's status, period, price and purchase identifiers. We give Paddle your account identifier, so the payment is tied to you, and your email address if you want the receipt to reach you. To confirm a Google Play purchase we send Google only the purchase code Google itself gave you. Apple purchases arrive signed by Apple and are verified on our server without sending Apple anything.

5.4 Legal requirements

We disclose data only when a law, or a reasoned order from a competent authority, requires it. We will not volunteer it, and where the law allows, we will tell you first.

5.5 Aggregate and de-identified data

Apart from the visit counts and, if you chose it, your steps in Neta (Section 4: names and times, never a value you recorded), we do not use your data for research or for statistics about our users. If we ever want to use data for a specific study, we will tell you which study, who runs it and what for, and ask you separately. If you do not answer, the answer is no.

5.6 Signing in with Google or Apple

You can create your account, and sign in, with Google or with Apple instead of a password. It is your choice: the email and password are always there, and nothing reaches either company unless you use its button. (Sign in with Apple is not available yet; this section applies to it as soon as it is.)

What they learn. When you use the button, the company learns that you have an account with Neta and, each time you use it again, that you are signing in to Neta. On a product like this one, having an account can say something about your health, which is why we tell you here and next to the button. Google always knows your email address. Apple lets you hide it: with "Hide My Email", Apple gives us a relay address and forwards our emails to you.

What we receive and keep. Your email address as the company confirms it, that the company has verified it, and the company's identifier for your account with them (a code, not your name), so the same button finds the same account. Google also sends us your name and your photo, and Apple your name the first time; we delete them as they arrive and never store them. If you want Neta to call you by a name, you type it in Neta. We ask neither company for anything else, and we send them nothing about you or your health.

One account. If an account already exists for the address the company confirms, the button opens that same account, with its history; we never create a second one. An address the company has not confirmed is never joined to an account, and no account is created with it. An account whose email has not been confirmed yet is never joined to a Google or Apple account by someone signing in: whoever signs in with Google or Apple using that address gets a separate, new account, with nothing of yours in it.

Connecting Google or Apple yourself. From inside your account (the confirm card, or your profile), you can connect Google or Apple to it. Only the account you are in is connected, never another one. If your email was not confirmed yet, your account then uses the email Google or Apple confirms, and we delete the address you typed. If that Google or Apple account is already connected to another Neta account, or its email already has one, nothing is joined: we tell you so, and nothing changes.

Without a password. If you created your account with Google or Apple, you have no password with us. To confirm it is you before deleting your account, we send a six-digit code to your email. You can add a password at any time with "Forgot your password?", which sends a link to your email.

Apple's relay address. Our emails to you (Section 5.2) go to the relay address and Apple forwards them to you; we never learn your real address. If you turn off forwarding in your Apple account, our emails stop reaching you, including the one to get back into your account.

Each company treats what it learns as a controller in its own right, under its own privacy notice (policies.google.com/privacy, apple.com/legal/privacy).

6. Where your data is processed, and international transfers

Your data is processed in the United States and in the European Union, wherever you live. Supabase, Vercel, Anthropic, Resend and Cloudflare operate in the United States or other countries where they have servers; Sentry processes in the European Union (Germany); Paddle, Apple and Google process your payments in the countries where they operate, and Google and Apple, if you sign in with them, confirm your email from the countries where they operate. Every message you send your companion leaves your country before it is answered.

Sending data to our processors is not a transfer to a third party deciding for itself: each one processes your data under a contract that forbids any other use. The only transfers to independent controllers are to the seller of the platform you choose to pay through, because it is necessary for the contract you enter; to Google or Apple when you choose to sign in with them, because it is necessary for the sign-in you asked for; and to an authority when the law requires it. We make no transfer that requires a separate consent; if we ever wanted to, we would ask you first, with the option to say no.

For the laws that require a safeguard before data leaves their territory, the safeguard is this: with every processor we hold a data-processing contract that incorporates the European Commission's standard contractual clauses (with the United Kingdom's addendum where it applies) or, where the processor is certified under the EU-US Data Privacy Framework (and its UK and Swiss extensions), that certification; and for Brazil, the ANPD's standard contractual clauses. You can ask us for a copy of the clauses at privacy@tuneta.app. Sections 13.1, 13.2 and 13.4 say which articles require it.

7. How long we keep your data

We keep your data for as long as your account exists. There is no fixed expiry: a log you wrote two years ago is still yours and still exportable.

When you delete your account, everything in Section 2 is deleted permanently and in one operation: your profile, your logs, your observations, your conversations, your facts, your feedback, your consent records, your plan and your rewards. Your login is deleted with it. We do not keep a shadow copy or an anonymized profile of a deleted user.

Two things survive, and we would rather say so:

• The record of the deletion itself: that an account was deleted, and when. It is detached from your identity and holds no email and no health content, so we can show we honoured your request.
• Our providers' operational logs (Section 2), which age out on their own schedules.

The visit counts in Section 2 are not about anyone, so there is nothing of yours in them to delete; your steps in Neta are deleted when you withdraw that decision or when you delete your account.

Anything already sent to Anthropic to answer you is subject to Anthropic's own retention, and payment and tax records are kept by the seller that processed your payment under the laws that apply to it. Deleting your account does not reach into them. When you delete your account, or ask us to delete something, we ask the processors that still hold it to delete it too, within the time Section 8 gives you.

An account whose email was never confirmed is deleted, with everything in it, after twelve months without a visit. From the eleventh month Neta tells you on its first screen, with the date; confirming your email keeps the account. A daily process deletes the ones that reach twelve months.

Emails you write to us are deleted no later than twelve months after your last message, or sooner if you ask. Your email on the waitlist is deleted as soon as we tell you we have opened in your country or twelve months after you left it, whichever comes first; a daily process deletes the ones that reach twelve months.

Deletion from the app is immediate and irreversible: there is no blocking period in which we keep your health data, because we need it for no liability. Export your data before you delete if you want a copy.

8. Your rights, and how to exercise them

Wherever you live, you have these rights over your data, and you can exercise the core ones yourself, at once, with no need to write to us:

• Access and portability. You can download all of your data at any time from your profile ("Your data"), in a machine-readable file (JSON) and a human-readable file (HTML). The JSON file is the complete record, in a structured, commonly used format you can take wherever you want.
• Rectification. You can correct what you entered in the app.
• Cancellation, erasure and being forgotten. You can permanently delete your account and all associated data at any time from your profile. It is immediate.
• Objection and restriction. You can switch off AI processing or your steps under Your permissions, switch off any variable, or object to any other processing or ask us to restrict it by writing to us.
• Withdrawing your consent, at any time (Section 3), without affecting what was processed before.
• Knowing who we share your data with: Section 5 is the whole list, and you can ask us to confirm it in writing.
• Not being subject to automated decisions with legal or similarly significant effects: we make none (Section 4).
• Lodging a complaint with the authority in your country (Section 13 names it).

In Mexico these rights are called ARCO (Access, Rectification, Cancellation and Opposition); in the European Union and the United Kingdom they are those of articles 15 to 22 of the GDPR; in Brazil, those of article 18 of the LGPD; in Washington, those of Section 13.3. You exercise them the same way in every case.

By email. For any request you cannot make in the app, write to privacy@tuneta.app from your account's email address (that is how we confirm it is you) or, if someone acts for you, with the document that proves their authority. Your request should state: your name and a way to reply to you; which right you want to exercise; which data, clearly (except for access); and, for a rectification, what should change and the document that supports it.

Deadlines. We answer within 20 business days of receiving your request and, where it applies, carry it out within the 15 business days that follow. Where your law gives you a shorter deadline, that one applies: in the European Union and the United Kingdom, one month; in Brazil, 15 days for a full answer; in Washington, 45 days. Where the case justifies it, we may extend the deadline once by the same length, and we will tell you why. Exercising your rights is free.

If you are not satisfied with our answer, or we do not answer, you can go to the authority in your country. In Mexico it is the Secretaría Anticorrupción y Buen Gobierno, within 15 business days of our answer, or once our deadline to answer has passed. The other authorities are in Section 13.

9. How we protect your data

We use administrative, technical and physical measures proportionate to the sensitivity of your data: encrypted connections (HTTPS); encryption at rest of your free text and your messages, with a key held in the application environment and never in the database; row-level access controls so that each woman's data is only accessible to her; security headers; rate limits; and a practice of never writing your content or your health details into our system logs. Anyone who works with your data is bound to confidentiality, including after their relationship with Neta ends.

Two honest limits: someone with access to our application servers could read your content, because that is where the key lives; and no system is perfectly secure.

If there is a security breach that significantly affects your rights, we will tell you immediately, by email and in the app: what happened, which data was compromised, what we recommend you do to protect yourself, what we corrected, and where to learn more. Where the law sets a deadline to notify the authority (72 hours in the European Union and the United Kingdom), we meet it. If you live in the United States, we also notify the Federal Trade Commission (FTC) and each affected woman under its Health Breach Notification Rule (16 C.F.R. Part 318): you, without unreasonable delay and no later than 60 calendar days after we discover it, and the FTC within that rule's deadlines (Section 13.3).

10. Children

Neta is intended for adults. You must be 18 or older to use it. Age is a required field at sign-up: you cannot create an account if you tell us you are under 18, and an account that has not recorded an age cannot be used. Accounts created before 31 July 2026 may have no age on file. We do not knowingly collect data from anyone under 18; if we learn that we have, we delete the account and its data.

We never contact emergency services on your behalf, and we could not: Neta has no phone line, no access to your location, and no route to any emergency service. Only the crisis lines on the resources page can do that, and each one's own policy is stated beside its number.

11. Changes to this notice

The "last updated" date at the top says which version is in force, and the version you agreed to is recorded on your account. A new type of data, a new purpose, a new provider, a new place your data is sent, keeping your data for longer, or a narrower right is a material change, and the notice changes before the product does.

How you find out. When we make a material change, the next time you open Neta you see a screen with what changed, marked "New", and your decisions as you left them, to confirm or change. A change that only corrects the wording, or that only reduces what we do with your data (keeping it for less time, protecting it more, or giving you one more choice), updates the date at the top and the version history on this page, and we do not ask you again: what you agreed to still covers everything we do. We do not process your data for a new purpose without your consent. The notice in force is always on this page.

12. Cookies and similar technologies

Neta uses only functional cookies, needed for the site to work, which is why it asks no consent for them. We use no tracking, advertising or analytics cookies. The only measurement is the visit count in Section 2, which the page sends with no cookie and no identifier. During sign-up only, Cloudflare Turnstile runs in a frame served by Cloudflare. If you sign in with Google or Apple, their sign-in page is theirs, with their own cookies under their own notices.

You can delete or block them in your browser's settings. If you block the session cookies you cannot sign in; blocking the others only means we ask again what they remembered.

What stays on your device. If you save an entry and there is no connection, or our server does not answer, we keep it in your browser's storage on that device so it is not lost, and send it as soon as the connection is back; once it arrives, we delete it from there. While it waits, it is only on that device. If you sign out, we try to send it first and tell you if anything is still pending; quick exit deletes it from the device without sending it, because your safety comes before your record.

13. Where Neta is offered, and which law protects you

Neta opens accounts in almost any country, with no invitation. Before you write your question we ask where you live: your answer decides which currency you see prices in, which help lines we show you, which variant of your language we speak to you in, and which of the parts below is yours. Everything above applies to everyone. What follows adds what your law requires on top.

The European Union, the European Economic Area, the United Kingdom and Switzerland, not yet. Their laws ask a service offered from outside to name someone to represent it there (GDPR and UK GDPR, art. 27; the Swiss Federal Act on Data Protection, art. 14). We have not named them yet, so in those countries accounts open as soon as we name them and their name and address are in this notice. Until then, the only data we process from people who live there is the email they leave on the waitlist (Section 2). Sections 13.1 and 13.2 say what will apply from that day.

13.1 European Union and European Economic Area

You are protected by the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), because we offer you the service although we are not established in the Union (art. 3(2)(a)).

• Legal bases. Your account and the service: performance of the contract (art. 6(1)(b)). Your health data: your explicit consent (art. 9(2)(a)), given as Section 3 says and withdrawable at any time (art. 7(3)). Your steps in Neta: your explicit consent (art. 9(2)(a)), in a decision of its own, off until you turn it on, and withdrawable at any time (art. 7(3)); without it we keep none of your steps. The service's security and the anonymous visit counts, without identifiers: our legitimate interest (art. 6(1)(f)), which touches no health data.
• Representative in the Union (art. 27): not yet named. That is why accounts in the European Union and the European Economic Area open as soon as we name them and their name and address are here; until then, the only data we process from people who live here is the waitlist email (Section 2), on the basis of your request, as a step before the contract (art. 6(1)(b)).
• Data protection officer (art. 37). Neta is run by one person; we have not designated a data protection officer. If the scale of processing comes to require one, we will designate one and say so here.
• Your rights (arts. 15 to 22): access, rectification, erasure, restriction, portability, objection, withdrawing consent and not being subject to automated decisions. You exercise them as Section 8 says; we answer within one month (art. 12(3)).
• International transfers (arts. 44 to 49): your data is processed in the United States with the safeguards in Section 6: standard contractual clauses (art. 46(2)(c)) or the processor's certification under the EU-US Data Privacy Framework, which has an adequacy decision (art. 45).
• Breaches (arts. 33 and 34): we notify the authority within 72 hours and you without undue delay when the risk is high.
• Complaint (art. 77): with the supervisory authority of your country of residence. The list is at edpb.europa.eu.
• Artificial intelligence. You always know you are talking to an AI (Regulation (EU) 2024/1689, art. 50(1)).

13.2 United Kingdom

You are protected by the UK GDPR together with the Data Protection Act 2018, because we offer you the service although we are not established in the United Kingdom (art. 3(2)(a)). Everything in 13.1 applies, with these differences:

• Representative in the United Kingdom (art. 27 UK GDPR): not yet named. That is why accounts in the United Kingdom open as soon as we name them and their name and address are here; until then, the only data we process from people who live here is the waitlist email (Section 2).
• Transfers: the clauses in Section 6 carry the United Kingdom's International Data Transfer Addendum, or the processor is in the UK Extension to the EU-US Data Privacy Framework.
• Complaint: with the Information Commissioner's Office (ico.org.uk).

13.3 United States

There is no federal privacy law for health data that reaches an app like Neta, and state laws vary. For everyone who lives in the United States we apply the strictest one: Washington's My Health My Data Act (RCW 19.373). You also have a Consumer Health Data Privacy Policy of your own, written as that law asks (RCW 19.373.020).

• Consent to collect your health data, separately and with no pre-ticked boxes (RCW 19.373.030(1)(a)): it is your "Keep my record" decision in Section
  3. We share health data with no one who is not a processor under contract (RCW 19.373.030(1)(b)), and we never sell it (RCW 19.373.070).
• Your steps in Neta are collected only with your separate consent, your "Help improve Neta with my steps" decision (RCW 19.373.030), off until you turn it on.
• Breaches (the FTC's Health Breach Notification Rule, 16 C.F.R. Part 318): if a breach reaches your health data without your authorization, we notify you without unreasonable delay and no later than 60 calendar days after we discover it, and we notify the Federal Trade Commission within that rule's deadlines (at the same time as you if 500 people or more are affected; if fewer, in its annual log) and, where the rule requires it, the media in your state.
• Your rights (RCW 19.373.040): to confirm which data we hold and who we share it with, to withdraw your consent, and to delete your data, including from our processors. We answer within 45 days; you can appeal our answer by writing to us, and if the appeal does not satisfy you, go to the Washington Attorney General (atg.wa.gov).
• No geofencing (RCW 19.373.080): we do not read your precise location.

13.4 Brazil

You are protected by the Lei Geral de Proteção de Dados Pessoais (LGPD, Lei n.º 13.709/2018), because we offer you the service in Brazil (art. 3, II).

• Legal basis. Your health data is sensitive data (art. 5, II) and we process it with your specific and highlighted consent for specific purposes (art. 11, I), given as Section 3 says and revocable at any time (art. 8, § 5). Your steps in Neta also rest only on your specific and highlighted consent (art. 11, I), in a decision of their own.
• Officer (encarregado, art. 41): Pablo Gabriel Campos Cordero, privacy@tuneta.app.
• Your rights (art. 18): confirmation of processing, access, correction, anonymisation, blocking or deletion, portability, information on who we share with, information on the possibility of not consenting and its consequences, and revocation. We answer within 15 days (art. 19, II).
• International transfer (art. 33): your data is processed in the United States and the European Union under the ANPD's standard contractual clauses (art. 33, II), or with your specific and highlighted consent when we ask for it (art. 33, VIII), telling you first about the international nature of the operation.
• Complaint: with the Autoridade Nacional de Proteção de Dados (gov.br/anpd).

13.5 Mexico

You are protected by the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), in force since 21 March 2025. This notice is written as it asks (arts. 14 to 16), your health data is sensitive (art. 2, fr. VI) and we process it with your express consent (arts. 7 and 8). Your ARCO rights and their deadlines are those of Section 8, and the authority is the Secretaría Anticorrupción y Buen Gobierno.

13.6 Any other country

This whole notice applies just the same. If your law gives you a right that is not named here, write to us: we will honour it. The authority you can complain to is your country's data-protection authority.

14. Contact

Questions, requests, or concerns about your privacy: privacy@tuneta.app.

See also the Terms and Conditions, the Consumer Health Data Privacy Policy and the Medical Disclaimer.

15. Legal basis

Mexico. Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP, DOF 20 March 2025, last amended DOF 14 November 2025) and its Regulations (DOF 21 December 2011) where they do not contradict it.

• Full notice and its contents: arts. 2 fr. I, 14 and 15.
• Section 1 (identity and address; person handling requests): art. 15 fr. I; art. 29.
• Section 2 (data, identifying sensitive data): art. 2 fr. VI; art. 15 fr. II.
• Section 3 (express, written consent for sensitive data; withdrawal): arts. 7 and 8; Regulations arts. 15 and 16.
• Section 4 (purposes; those needing consent; limiting use or disclosure): arts. 11, 12 and 15 fr. III and IV; Regulations art. 14.
• Section 5 (processors; transfers; authority requests): arts. 2 fr. XII and XX, 9 fr. VII, 35 and 36; Regulations arts. 49 to 55.
• Section 6 (international remisiones and transfers): arts. 35 and 36; Regulations arts. 53, 74 and 75.
• Section 7 (retention, deletion and blocking): arts. 2 fr. III, 10, 12 and 24.
• Section 8 (ARCO rights, requirements, deadlines, no charge, authority): arts. 21 to 34 and 40; Regulations arts. 90 and 91.
• Section 9 (security, confidentiality, breaches): arts. 18, 19 and 20; Regulations art. 65.
• Section 11 (how changes are communicated): art. 15 fr. VI; art. 11.
• Section 12 (technologies that collect data automatically): Regulations art. 14, last paragraph.
• Section 2, "Your approximate country and your language" (data collected automatically, and its purpose): art. 15 fr. II and III; Regulations art. 14, last paragraph.
• Short notice on the screen where your data is collected, pointing here: art. 16 fr. II.

European Union and European Economic Area. Regulation (EU) 2016/679 (GDPR): scope, art. 3(2)(a); legal bases, arts. 6(1)(b), 6(1)(f) and 9(2)(a); conditions for consent, art. 7; information we must give you, arts. 13 and 14; rights, arts. 15 to 22, and deadline, art. 12(3); representative, art. 27; processors, art. 28; breaches, arts. 33 and 34; data protection officer, art. 37; transfers, arts. 44 to 49; complaint, art. 77. Regulation (EU) 2024/1689 (the AI Act), art. 50(1). Directive 2002/58/EC, art. 5(3) (strictly necessary cookies).

United Kingdom. UK GDPR (the same articles) and the Data Protection Act 2018; Privacy and Electronic Communications Regulations 2003, reg. 6 (strictly necessary cookies).

Switzerland. Federal Act on Data Protection (FADP, SR 235.1), art. 14 (representative of a controller established abroad).

United States (Washington). My Health My Data Act, RCW 19.373: consumer health data privacy policy, .020; consent to collect and to share, .030; rights, deadlines and appeal, .040; security, .050; no sale without authorization, .070; geofencing, .080. United States (federal). The FTC's Health Breach Notification Rule, 16 C.F.R. Part 318 (notice to affected individuals, to the FTC and, where applicable, to the media, §§ 318.3 to 318.6).

Brazil. Lei n.º 13.709/2018 (LGPD): scope, art. 3; sensitive data, arts. 5, II and 11; consent and revocation, art. 8; information, art. 9; rights, arts. 18 and 19; international transfer, art. 33; officer, art. 41; incidents, art. 48.