Privacy Policy

Short version

We collect what is needed to run an account, take payment when you subscribe, and send the updates you have asked for. We do not run advertising pixels, session replay, or cross-context ad sharing. We do not sell personal information.

A previous version of this page said we ran no third-party analytics. That was not accurate while Vercel Web Analytics was mounted. See Analytics (current vs intended) below for what currently loads and what we intend to remove.

A public privacy or support email has not been designated. Until one is published here, do not treat any from-address on outbound mail as that inbox. We will not invent one.

1. What we collect

When you create an account today (legacy signup): your email address, a display name, a password (stored hashed by our authentication provider — we never see it), and a research focus. The current form requires that focus and defaults the selector to weight management. Optional gender, age, and weight, if you enter them, are stored in authentication metadata.

Your research focus, and any demographics you enter, can be sensitive. Linked to your account, those fields can indicate a health interest. Some laws — including Washington's My Health My Data Act — treat this as consumer health data. We therefore:

• collect those fields only because the current signup form asks for them, to tailor which records we surface;
• never sell or share them;
• never disclose them to advertisers or data brokers;
• delete the local account record when you delete your account (see Retention below).

You may change or clear research focus from your account page. Optional demographics in authentication metadata have no dedicated clear control in the current interface other than account deletion.

A planned report-acquisition signup (not enabled as of this update) is specified to ask only for email, password, and optional display name, plus the existing age/terms acknowledgment. It is specified not to collect gender, age, weight, medications, conditions, or a health-interest focus. If a database constraint still requires a focus value, an internal sentinel such as other is not a health-interest claim and is not consent. That flow is not live until separately enabled.

When you pay for Senzu Pro: Stripe processes checkout. We store Stripe customer and subscription identifiers, status, price identifier, and period end in order to mirror entitlement. Card numbers are not stored in Senzu's application.

When you complete the optional research profile (quiz): structured selections such as age band, sex, peptides, medications, conditions, and goals, plus an explicit consent timestamp and notice version (2026-08-quiz-v1). There is no free-text medical-history field on that form.

When you enroll in optional updates:

• price or certificate alerts — an opt-in watch you create from your account;
• a profile-matched research email — only after the quiz consent above, and only when you are an active consented subscriber;
• a legacy email-only newsletter signup, where it still exists, records the address you submitted.

A general research-brief email preference (notice version 2026-09-general-brief-v1) is specified for a later product. It is not stored today. Web access is not gated on email opt-in.

When you use the research assistant (a Pro inclusion): the question text and retrieved public-record context are sent to an inference provider so a model can generate an answer. We store a usage meter (user identifier, time, token counts, refusal reason). That meter is not a transcript. On some withheld or ungrounded paths the application currently also writes question text to server logs.

Automatically: standard request logs (IP address, user agent, requested URL, timestamp) for security and abuse prevention.

2. What we do not do

• We do not run Google Analytics, Meta Pixel, Conversion API, TikTok Pixel, or any other advertising or retargeting tag.
• We do not run session replay or keystroke logging.
• We do not sell personal information, and we do not share it for cross-context behavioural advertising.
• We do not promise advertising pixels, and we do not intend to add them.
• Senzu does not train its own models on your questions or account data. Assistant prompts are sent to an inference provider; we have not independently verified that provider's training or retention settings, so we do not claim the provider never uses prompts to train.

3. Analytics (current vs intended)

Current (observed 12 September 2026 on production, and in this application's root layout): Vercel Web Analytics is mounted. Production serves the client script from a first-party path and accepts pageview collection. The collection is cookieless product analytics operated by Vercel. It is not an advertising pixel. It is third-party analytics processing, which is why the older “no analytics” sentence was wrong.

Intended: remove that optional analytics mount. Do not replace it with advertising tags, session replay, or a new event pipeline. After the removal is deployed and a network check shows the script and collection endpoints are gone, this section will be updated. Until then, this page describes what currently loads — not the hoped-for state.

4. Cookies and local storage

We set session cookies that are strictly necessary to keep you signed in (our authentication provider).

The age/terms acknowledgment is stored in the browser as localStorage key senzu-terms. That stamp is not sent to our servers as consent for health data or email.

The research-profile prompt may also store small postponement timestamps in localStorage. Those are interface state, not a marketing opt-in.

Vercel Web Analytics, while mounted, does not set an advertising cookie on a guest visit. There are still no advertising cookies to consent to. If we ever load a non-essential tracker, we will ask for opt-in consent before it loads, and this page will be updated first.

5. Consent is several layers, not one click

Agreeing “I am 18 or older and I agree” on the terms gate, or creating an account, is not:

• health-data consent;
• quiz or research-profile consent;
• enrollment in alerts, a weekly digest, or any general research-brief email;
• marketing consent.

Mechanism	What it records	Satisfied by terms/age agreement?
Terms gate	Age/terms version in the browser	That is all it records
Quiz notice 2026-08-quiz-v1	Explicit profile/newsletter-activation consent	No
Alert watches	An opt-in you create or delete on the account page	No
General-brief notice 2026-09-general-brief-v1	Not implemented; not stored	No

Unsubscribed, bounced, or complained email statuses are not revived because you signed up, purchased, signed in, revisited a page, or retook the quiz.

6. Legal bases (UK/EU visitors)

Contract — to operate your account and a paid membership you buy. Consent — to send optional updates you enroll in, and to process research-focus / quiz fields you submit. Legitimate interests — security, abuse prevention, and maintaining the accuracy of our records. You may withdraw consent at any time for processing that relies on it.

7. Who processes your data

These parties process personal data to run the Site. Each is used for the purpose named. We do not disclose personal information to anyone else except where legally compelled, and we will notify you where we are permitted to.

• Supabase — authentication, database hosting, and account-mailer delivery of confirmation and reset messages.
• Vercel — application hosting and delivery. While Web Analytics is mounted, Vercel also processes pageview telemetry as described above.
• Stripe — payment, invoices, tax calculation shown at checkout, and the customer portal used to change cards or cancel.
• Resend — delivery of Pro welcome mail, optional alerts, and the profile-matched digest.
• OpenRouter — inference gateway for the research assistant (member questions plus retrieved public-record context). Pipeline jobs may also call the same gateway on published documents; that is operational processing of public sources, not your account.

We do not name a mailing address, company jurisdiction, or support inbox here because none has been designated.

8. Retention

Local account data is kept until you delete the account from the account page, which deletes the authenticated user; the profile is specified to cascade. Stripe, Resend, OpenRouter, Vercel, and Supabase Auth mailer logs follow those providers' own retention. We have not independently verified each provider's admin retention window.

A previous version of this page stated that server logs are retained for 90 days. That figure has not been independently verified against the hosting provider's current settings, so we do not treat it as a confirmed limit. Logs are used for security and abuse prevention.

Deleting the Senzu account does not cancel a Stripe subscription by itself. Cancel billing in the Stripe customer portal first (from the account page), then delete the account if you also want the local login removed. Otherwise billing may continue with no local record.

9. Your rights

Depending on where you live you may request access, correction, deletion, portability, or restriction of your data, and may object to processing. California residents have rights under the CCPA/CPRA, including the right to know, delete, correct, and to opt out of sale or sharing — we do neither. Washington residents have rights under the My Health My Data Act, including withdrawal of consent and deletion of consumer health data. UK/EU residents have rights under the UK GDPR/GDPR and may complain to their supervisory authority.

The fastest deletion path that exists today is Delete account on the account page (type DELETE to confirm). A public email for rights requests has not been designated; see Contact below. We will not invent one. That gap blocks public commercial launch, not the accuracy of this description.

10. Children

The Site is not directed to children and accounts require you to be 18 or older. We do not knowingly collect data from anyone under 13.

11. International transfers

Our infrastructure is operated in the United States. If you access the Site from outside the US, your data will be processed there. We have not published a separate transfer-contract summary on this page.

12. Changes

Material changes will be posted here with a new Last updated date and, where required, we will ask for renewed agreement or consent. This 12 September 2026 update corrects processors, analytics, membership, and consent. It does not add advertising.

13. Contact

A public privacy, support, or legal email has not been designated. No phone number, mailing address, or legal-entity name is published here. Until an operator-provided address appears on this page, outbound from-addresses are not that inbox.