Privacy Policy
Effective October 12, 2026. Applies to half-lyfe 1.1.0 and 1.1.1, including TestFlight. Optional analytics described below begins with 1.1.1. Version 1.0.1 keeps AI, connected agents and server purchase verification unavailable; those optional update flows do not apply to 1.0.1.
half-lyfe keeps caffeine tracking and local planning on your device. Optional AI ranking and connected-agent features use the separate data flows described below; they require their respective opt-in or connection approval. iCloud tracking sync, friend Groups and the acquisition survey remain unavailable in this update. There are no advertising, analytics or tracking SDKs. Version 1.1.1 offers optional, consent-based product analytics through our backend APIs, as described below; it does not use advertising identifiers or session recordings.
Data stored on your device
- Drink names, caffeine amounts, portions, opened and finished times, favorites and your usual drink.
- Age band, sleep schedule, caffeine habits, optional profile details and health-related answers such as sensitivity, smoking, pregnancy and medication. These seed local estimates, not diagnosis.
- Self-reported drink effects, check-ins, optional reaction tests, model parameters, tracking streaks and break preferences.
- Selected calendar identifiers, manual time windows, intended drinks, plans, selected cafés and reminder preferences. Calendar event details are read locally from calendars you authorize.
- Connected-agent names and access scopes, last successful sync time and pending disconnect status. Authentication and deletion recovery credentials are protected in the device-only Keychain.
- Up to 120 nights of imported Apple Health sleep and, when separately enabled, overnight readings.
The app and its extensions share a protected App Group container. Sensitive tracking files and preferences are marked as excluded from automatic backups; operating-system exclusions are advisory, so we cannot guarantee every backup tool honors them. There is no app-managed iCloud tracking upload in this release. Export CSV or JSON under Profile > Export data. An export can contain sensitive information; you control its destination and deletion.
Calendar
Calendar is optional. The app reads only your selected calendars through Apple's EventKit and never changes events. Google calendars appear only when synced into the iPhone's Apple Calendar database. Manual planning works without access. Calendar titles, locations, attendees and descriptions are not sent to our server, an AI provider or a connected agent. If you opt into AI ranking, generic relative time windows derived from your schedule are shared as described below. A café search you choose can send a meeting location or address to Apple, as described under Café search and Maps. Disconnect or change calendars under Profile > Plan your day.
Optional AI ranking
If you enable AI planning, half-lyfe sends generic relative time windows, random request and window identifiers and candidate windows to our Cloudflare-hosted service. The service asks OpenAI to rank generic windows. It does not send drink names or doses, age, medical answers, Apple Health values, calendar event details, consumed-drink history or locally calculated eligibility to OpenAI. Local eligibility and dose checks remain authoritative; a ranked suggestion does not log a drink. You can turn AI planning off under Profile > Plan your day and continue planning locally.
OpenAI receives the minimized ranking inputs, not StoreKit receipts, App Attest identifiers or authentication proofs. We request store:false for responses, but that does not mean zero retention. Under OpenAI's standard API data controls, abuse-monitoring logs may retain request and response content for up to 30 days, and longer where required for legal or security reasons. No approved Zero Data Retention arrangement is assumed for this service. See OpenAI's API data controls. Cloudflare processes requests and stores our service records as described below.
Optional product and subscription analytics (1.1.1)
Adults may choose whether to share analytics during onboarding or in Profile. Sharing is off until you explicitly allow it. Declining does not restrict purchases, restore or app features. We do not collect analytics for users who declare an age under 18, and we do not record app-usage events from before consent.
When enabled, our Cloudflare service sends PostHog US a random device-enrollment identifier, event identifier and time, app version/build, test-or-production environment, and limited app interactions: app visits, onboarding completion, paywall views and plan selection, purchase and restore outcomes, and setup-guide openings. The events do not include drink information, caffeine amounts, Health records, medical answers, calendar information, location, names or email addresses. Client-IP storage and geographic enrichment are disabled for these analytics. Random identifiers make the data pseudonymous, not anonymous.
With the same consent, our service sends verified Apple subscription transaction proofs to RevenueCat under a separate random identifier. These proofs contain Apple purchase information, such as product and transaction identifiers, purchase and expiration dates and app-account information. RevenueCat uses Apple services to maintain subscription status and report revenue, trials, renewals and cancellations. Apple may return earlier transaction periods and products associated with the submitted subscription, so RevenueCat subscription history can include purchases from before you allowed sharing. Apple StoreKit remains the authority for your access; RevenueCat analytics does not control your subscription. We do not share one provider's analytics identifier with the other or connect their reporting systems. Our service retains the separate identifiers together only to manage consent and deletion. This data is not used for advertising.
The app protects pending events, purchase proofs and deletion credentials in device-local storage excluded from backup. Pending delivery records expire after seven days; server deduplication records expire after the retry window. Provider event and purchase history is retained under the configured provider retention terms until it expires or your deletion request is processed. See PostHog data storage and RevenueCat privacy.
Turn sharing off in Profile to stop new collection immediately and request deletion of previously shared analytics from this enrollment. Account deletion also requests analytics deletion. Pending uploads are discarded; erasure retries do not restart collection. Provider deletion may be asynchronous, so the app displays pending status until the service verifies completion. Keep the app installed and open it online to retry, or contact support about a pending request. We retain minimal deletion receipts, revoked-enrollment records, and a keyed, non-reversible Apple-owner marker with a consent-order marker to prevent delayed requests or another already-consented device from recreating erased reporting. These safeguards contain no event history or raw purchase proof and do not cancel your Apple subscription.
Optional connected agents
Connecting an agent is a separate choice from AI ranking. Before approving a connection, you review its name and access: read shared plans, or read plans and suggest coffee where that scope is requested. Connected agents can read the future intended drink IDs and names, portions, planned times and status that you share, plus selected café names, coordinates and addresses. These are intended plans, not consumed intake. Our Cloudflare-hosted service stores this shared snapshot and the agent's drafts, which may include a note. Medical answers, Health records, sleep and vitals, calendar event details, location history, reaction check-ins and consumption history are not shared with agents.
Open half-lyfe to receive and check agent drafts. Suggestions require on-device validation and your approval; they never log a drink automatically. Manage individual connections or disconnect all under Profile > Plan your day > Your agent. Disconnect all stops further sharing from this phone immediately; remote removal remains pending until the server confirms it. A connected service may keep its own conversation or other copies under its privacy policy even after disconnect or deletion in half-lyfe.
Café search and Maps
When you choose a café search, Apple's MapKit processes the search area or address and walking-route endpoints needed to find cafés and estimate travel time. The area may come from a meeting location, an address you enter or your current location when you request it and grant permission. Opening directions hands the selected destination to Apple Maps. half-lyfe does not track your location in the background. A selected café becomes part of a local plan and is included in shared future plans only if you enable an agent connection; it is not part of the OpenAI ranking payload.
Apple Health and Apple Watch
Apple Health is optional and requested through a feature connection or settings, not required for onboarding. With permission the app writes logged drinks as dietary caffeine and reads sleep for local estimates and comparisons. Overnight vitals require a separate opt-in: heart rate, heart-rate variability, respiratory rate, blood oxygen, wrist temperature, environmental sound, exercise, active energy and workouts help compare nights and identify confounding conditions. Each purpose is listed before authorization.
Raw Health records and medical answers stay on your iPhone. A directly paired Apple Watch can receive drink logs, schedules and tracking estimates through Apple's WatchConnectivity, including model parameters derived on the iPhone. Those copies stay locally on the Watch, not in CloudKit or a developer server. Revoke Health access in the Health app; disable overnight vitals in Profile > Manage Apple Health. Comparisons and experimental model adjustments do not measure caffeine clearance or prove that caffeine caused a sleep change.
Notifications
Reminders are scheduled locally after permission. Settings are optional and editable in Profile > Reminders. Proposals never log a drink automatically.
Subscriptions
Apple processes subscriptions through StoreKit. We do not receive payment cards or Apple Account credentials. The app locally checks verified purchase transactions, renewal and trial eligibility, and caches Pro access. For online paid features, purchase binding, verification and Restore can also send Apple-signed transaction or app proofs and pseudonymous installation authentication to our Cloudflare-hosted service. The service checks Apple subscription status and associates a verified owner with the installation. StoreKit's device-verification identifier stays on your device. Owner and transaction identifiers used for server lookups are protected with keyed hashes; this is pseudonymous operational data, not a promise of anonymity.
Sandbox and production purchases are verified in separate service environments. Local Pro access remains available when remote verification or restoration fails; online planning may require a retry. A subscription restore does not restore drink history. Apple handles its own processing under its privacy policy.
Service authentication and abuse prevention
Our service receives an App Attest installation key identifier and public verification evidence, expiring sessions and request proofs to authenticate requests, prevent replay and enforce usage limits. It also keeps hashed request, subscription and abuse-control records. Network requests pass through Cloudflare infrastructure; our application stores day-scoped keyed hashes for IP-based limits rather than raw IP addresses. This operational data is not used for advertising tracking and is not sent to OpenAI as part of ranking inputs.
Support
When you voluntarily send a support email, we receive your email address, message and attachments you include; an in-app draft may include app and operating-system versions. Nothing is sent until you send it. We use this information to respond and retain it only as needed for support or legal obligations. Do not send medical records. Request deletion at halflyfesupport@gmail.com.
Retention and deletion
Tracking data stays on your device until deletion or app removal; imported sleep and vitals are limited to the latest 120 nights. Profile > Delete account clears this iPhone's local records and preferences and is also available from the paywall. Remove the app from the Watch and other devices separately. Samples saved to Apple Health remain there; manage them in Health. Exports and backups are separate copies. Deleting data does not cancel an Apple subscription; cancel in Settings > Apple Account > Subscriptions.
- Shared agent snapshots expire after two days without refresh. Connections expire after 30 days. Drafts expire one day after their planned time, up to about 31 days after creation. Server-confirmed disconnect removes sharing records; an external agent controls its own retained copies.
- Authentication challenges expire after two minutes, sessions after 15 minutes and request replay hashes after one day. Installation authentication and installation-linked subscription records remain until applicable deletion. Verified owner memberships expire after 30 days unless renewed; they do not by themselves grant paid access. Owner and transaction mappings are removed once no installation memberships remain.
- After account deletion, hashed deletion acknowledgements and deleted-key abuse guards remain for 30 days. Hashed paid-owner daily usage counters may remain for up to two days so deletion cannot reset the shared allowance. Separate subscription revocation records have no automatic expiry in the current service and remain to reject invalidated purchases. Anonymous aggregate referral totals from earlier versions are not deleted; old referral retry hashes expire after 30 days. Other request-limit counters expire according to their short-lived limits.
Account deletion attempts erasure from all retained backend service environments, including older registered identities retained after a device key became unusable, even if AI features are disabled. Server deletion remains visibly pending until every required erasure and local credential cleanup completes. Keep the app installed and open it online to retry. No replacement identity or new sharing upload is created to erase old data. A lost or unusable registered key without a valid deletion acknowledgement may prevent us from confirming erasure; elapsed time is not proof. Unresolved recovery evidence has no automatic local expiry. Contact support if retries cannot finish.
For a known earlier iCloud identity, the app requests erasure and retries online only after freshly verifying the original account. A different account, offline state or error leaves a separate iCloud deletion status pending. Keep the app installed until erasure finishes. It does not guess at unknown ownership: manage unidentified previous copies in iCloud storage settings or contact support. This deletion-only CloudKit access does not restart tracking uploads. Backend confirmation does not clear unresolved iCloud erasure. Provider processing and external copies remain subject to the retention terms described above.
Earlier versions and development testing
Earlier builds offered private CloudKit sync and optional Groups. They could store manually logged drinks, favorites, schedules and settings in the user's iCloud, and share a chosen name, member identifier and caffeine totals with invited members. Earlier snapshots could contain model parameters. This update keeps those tracking and Groups uploads disabled; stopping sync does not delete prior copies. The legacy erasure path described above remains available. Development testing also used Cloudflare installation verification and optional referral/AI requests. Retained development identities are included in the app's backend deletion attempts. Contact support about unresolved development records; anonymous aggregate referral totals cannot be tied back to a person.
Young users
The app is not directed at children under 13 and onboarding blocks that age band. Users aged 13-17 can track and preview intake. Local planning applies lower intake limits and excludes energy-drink recommendations; these limits are not an endorsement that caffeine is appropriate or risk-free for teens. Use with a parent or guardian's permission and seek professional guidance. Pediatric guidance recommends avoiding caffeinated drinks. No exact birth date is required. Calendar event details and Apple Health records are not sent to a developer server, AI ranking or connected agents for any age band.
Your rights and changes
Review, export and delete local information in the app, and manage optional AI planning and agent sharing in their settings. Contact us about privacy rights, prior-version data, pending erasure or support records. Additional data uses require updated disclosures and any necessary consent before activation; a coming-soon label is not consent. Changes are posted here with an effective date.
Website launch notifications
If you sign up on this website, your email address is sent to MailerLite to manage the half-lyfe launch list and send confirmation and launch emails. This website signup is separate from data stored in the app. You can unsubscribe using the link in our emails or request removal at halflyfesupport@gmail.com.