Your privacy, our responsibility

Aphrodite Go collects only what is necessary to provide you with personalised diet and wellness coaching. Here's the complete picture:

Account information

Order ID, phone number, name, and email address. These are required to verify you as an enrolled Aphrodite client and authenticate your account.

Health & activity data

Daily step counts (from your device activity), weight logs, meal entries, water intake, and manually logged goals. We read step data from your device's activity recognition system — we do not access raw motion data or gyroscope readings.

Consultation data

Audio, video, and transcripts from your consultations with diet coaches. These are stored securely on our Chatwoot servers for 1 year to allow you to review past conversations and recommendations.

Chat & support messages

Text messages exchanged with our support team or your assigned coach. These are retained to provide continuity of care and support.

Device & usage data

Device type (iPhone/Android), OS version, app version, language settings, and feature usage analytics (which screens you visit, which features you use most). Crash logs that include device info but not your personal data. We use Firebase Analytics to understand app performance and which features help you succeed.

Push notification tokens

Device-specific tokens (Expo push token, and — for call delivery specifically — an Apple PushKit VoIP token on iOS or Firebase Cloud Messaging token on Android) used to deliver your personalised reminders (water intake, step goals, appointment alerts) and incoming consultation call notifications. These tokens are device-specific and cannot be used to identify you personally.

Call & VoIP data

A device-specific call notification token — Apple PushKit on iOS, Firebase Cloud Messaging on Android — used solely to alert your device when a diet coach starts a consultation call, including when the app is closed or your device is locked.

Photos

When you set a profile picture, Aphrodite Go uses your device's system photo picker — we do not request access to your entire photo library. Only the photo you explicitly select is used.

Aphrodite Go requests device permissions only when needed to provide specific features. Each permission has a clear purpose and can be revoked at any time in your device settings.

We use your data for one core purpose: to help you achieve your health goals. Here's the breakdown:

Service delivery

Operating your account, authenticating you, storing your data, and delivering the features you requested (coaching, tracking, reminders).

Personalisation

Tailoring diet plans, step goals, and hydration targets specifically to your profile, weight, activity level, dietary preferences, and progress. The more data we have, the better we can help.

App improvement

Analysing anonymised, aggregated data to understand which features help users succeed. This helps us fix bugs faster and build features that matter to you.

Communications

Sending transactional emails (password resets, appointment confirmations, service announcements). We do not send marketing emails or promotions without your explicit consent.

Safety & compliance

Detecting and preventing fraud, abuse, or security threats. Complying with legal obligations if required by law or court order.

We never sell, lease, or share your personal data with advertisers or data brokers — ever. Your health data is yours alone.

We share your data only where necessary to operate the service. Here's exactly who has access:

We do not share your data with any other third parties without your explicit, written consent.

Your data is protected with industry-standard encryption and security practices:

Encryption in transit

All communication between the app and our servers uses TLS 1.2+ encryption. No data travels over unencrypted HTTP.

Encryption at rest

Health data, consultation recordings, and personal information are encrypted in our database using AES-256 encryption. Only decrypted when accessed by authorised personnel or the app.

On-device storage

Step counts and activity data are cached locally on your device using iOS Keychain / Android Keystore (secure storage). Data syncs to our servers every 30 minutes when online. If offline, data queues locally and syncs when you reconnect — no data is ever lost.

Access controls

Only authorised Aphrodite team members with a legitimate business need can access user data. All access is logged and audited for compliance. Coaches see only the data relevant to your care plan.

Call delivery security

Incoming call notifications are delivered directly through Apple's and Google's push infrastructure using industry-standard, signed push credentials. Call audio and video are transmitted over encrypted connections during active sessions.

Authentication

Your login uses secure password hashing (bcrypt). Session tokens expire after 30 days of inactivity. Sensitive operations (like deleting data) require re-authentication.

Your responsibility: keep your password private and secure. Never share your login credentials with anyone, including Aphrodite staff.

We retain your data only as long as necessary:

Account data

Retained while your account is active. Upon account deletion, personal data (name, phone, email) is removed within 30 days. Order ID is retained for 7 years for financial/legal compliance.

Health & activity data (steps, meals, weight)

Retained for up to 2 years to provide you with historical insights and progress tracking. You can request deletion of specific entries or all data anytime.

Consultation data (audio, video, chat)

Retained for 1 year so you can review recommendations and coaches can reference your history. After 1 year, consultations are archived (still available on request but not actively accessible). Deleted after account termination.

Analytics & crash data

Aggregated and anonymised data (no personal information attached) may be retained indefinitely to improve the app. Individual crash reports are retained for 90 days.

Backup & compliance

We maintain automatic daily backups for disaster recovery. Your data may exist in backups for up to 30 days after deletion (to allow recovery if accidentally deleted). Legal holds may extend retention if required by law.

You can request data deletion anytime: email [email protected] with your Order ID and specify what you want deleted (all data, specific entries, etc.). We'll process it within 30 days.

You have full control over your data:

To exercise these rights: email [email protected] with your Order ID and request. We'll respond within 30 days.

Aphrodite Go is not intended for anyone under 13 years old. We do not knowingly collect personal information from children under 13. If you believe we have, please contact us immediately at [email protected] and we will delete it promptly.

For parents/guardians: if your child has an account, you can request its deletion or a review of the data we hold.

If we discover that your personal or health data has been breached or compromised, here's what we do:

1. 1 Investigate immediatelyWe'll identify what data was accessed and who was affected.
2. 2 Notify you within 72 hoursVia email and push notification. We'll explain what happened, what data was exposed, and the steps you should take.
3. 3 Provide protective measuresPassword reset recommendations, credit monitoring (if financial data was exposed), and fraud alerts.
4. 4 Comply with the lawReport to authorities as required (GDPR requires reporting to data protection authorities).
5. 5 Improve securityImplement measures to prevent the same breach from happening again.

Report security concerns: if you discover a vulnerability or suspicious activity, please report it immediately to [email protected]. Do not post it publicly.

If you're in the EU, California, or other regions with strong privacy laws, these rights apply to you:

Other regions: the rights in "Your rights & choices" above still apply. Contact us to exercise them.

To exercise international privacy rights: email [email protected] with your name, Order ID, and specific request. We'll respond within 30 days (45 days for complex requests under GDPR/CCPA).

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or technology. Here's how we'll notify you:

Minor changes

Clarifications and typo fixes are updated without notice.

Material changes

New data sharing or retention policy changes: we'll send a push notification and in-app banner at least 7 days before the change takes effect.

Continued use

If you keep using Aphrodite Go after the effective date, you accept the updated policy. If you disagree, you can delete your account.

The effective date at the top of this page always shows the latest revision date. Check back periodically to stay informed.

Have questions about your privacy, or want to exercise your rights? We're here to help:

Data subject requests

For access, deletion or portability, include your Order ID in your email.

Response time

30 days (or 45 days for complex GDPR/CCPA requests).

Address

Aphrodite Go, Kathmandu, Nepal

Privacy team: our dedicated team handles all privacy requests personally. We don't auto-process or ignore privacy inquiries. You'll hear directly from us.

This section is for app developers and compliance auditors. It declares all data types collected by Aphrodite Go and third-party SDKs.

Third-party SDKs & their data collection

NSPrivacyTracking: set to false — Aphrodite Go does not use IDFA or cross-app tracking. SKAdNetwork: not implemented — we do not use attribution networks.