Version 1.5. Effective 10 October 2026.
This policy covers the Diet Discipline Coach app: the web version you open in a browser and the Android app. The dietdiscipline.com website has its own separate policy, and it does not describe this app.
The short version
- This is a coaching app, and I am your coach. I can see what you share with me. That is the product, not a leak.
- Your journal, your tasks and your trackers start private. They stay private until you choose to share them.
- No other student can ever see your data. The database enforces that, not just the screen.
- There are no ads, no analytics, no tracking and no data sales. There is no advertising identifier in this app and no third party measurement code of any kind.
- Notifications never contain your details. A reminder says “a tracker is waiting for an entry”. It never says your weight, the tracker’s name, or a message’s text.
- You can export everything and delete your account from inside the app.
1. Who I am
I am Reese. I run Diet Discipline, a one person health education and coaching practice in New York State, United States, and I am the coach in this app. In this policy, “I”, “me” and “my” refer to Diet Discipline, which I run and speak for. I am also the person who answers privacy questions.
Contact: reese@dietdiscipline.com
2. The most important thing: there is a coach in this app, and it is me
Most privacy policies are about a company watching you. This one is mostly about one person you let into your progress on purpose.
The app pairs exactly one coach with the students that coach has invited, and here that coach is me. You joined because I sent an invitation to a specific email address. That relationship is the reason the app exists, so the honest headline is this:
In the app, I see the work you submit, the messages you send me, and anything you have marked as shared. I do not see anything you have kept private: the database refuses it to my coach account. The encrypted backup copies described in section 7 hold everything, private entries included. My tools open a copy only to prove it restores, to test a change, or to repair the app, and they never display your content.
3. What the app collects
3.1 Your account
- The email address you were invited at, and your password, both held by the app’s authentication provider. I never see or store your password.
- Your name, as you type it.
- Your time zone and whether you want weight in pounds or kilograms.
- “My Why”, your own statement of what you are doing this for, if you write one.
- Your notification preferences, including the times you asked to be reminded.
3.2 What you write and what you log
Everything in this list is something you typed or tapped yourself. None of it is inferred, purchased, or collected in the background.
- Homework: your written answers, checklist ticks, acknowledgements, and any file you attach to a submission.
- Messages: what you send me, and what I send you, including broadcasts I send the whole group.
- Journal entries: title, body, the date you assign them, and any tags or links you add, plus any comment I leave on an entry you have shared. Private by default.
- Tasks: the habit, how often, and every check in, plus the note you attach to a check in.
- Trackers and their entries: weight, mood, a number, a rating, a yes or no, or free text, plus a note and the time you recorded it. Weight is stored in kilograms and shown back in your unit.
Health information. Weight, mood, sleep, energy and digestion are health information in ordinary language. I treat them as the most sensitive thing in the app. See section 6 and section 10.
3.3 Notifications, your device and your browser
If you turn push notifications on, the app stores:
- a push token issued by Expo’s notification service,
- your platform (iOS or Android),
- your device model name, for example “Pixel 8”,
- the app version you are running.
That is the whole device footprint. There is no advertising ID, no IDFA, no GAID, no fingerprinting, and no location. The app never asks for your location, contacts, camera roll, microphone or calendar.
In a browser. If you use the web version, your browser keeps four things on your computer or phone, and nowhere else:
- your sign in session, so you stay signed in,
- an invitation code you opened, for up to 7 days or until you finish joining,
- a journal entry you have not saved yet, so a reload does not lose it,
- a small marker with your account number (not your name or email), so other open tabs of the app know which account is signed in. Signing out empties it. If you delete your account, that browser keeps the old account number until someone signs in again, so a forgotten tab cannot reopen the deleted account.
Signing out clears the session, the marker and any unsaved journal drafts in that browser, and the drafts are also cleared if a different account signs in on it. The app’s own code sets no cookies. On a shared computer, sign out when you are done.
3.4 A record of decisions that affect you
The app keeps an audit record of privileged actions so that nothing important happens silently. Those records hold who did what, to which record, and when: an invitation being created (with the invited email address), homework being assigned, a submission being approved or sent back, a student being archived, an account being deleted.
Two honest details. When I ask you for a revision or archive a student, the app stores the note I wrote explaining why, because you are entitled to know the reason. And an audit record stores statuses and counts, never the content: not journal text, not message bodies, not a weight value.
3.5 What the app does not collect
Verified by reading the app’s own dependency list and source, 2026-09-01 (the cookie line re-checked 2026-10-08):
- No analytics or product measurement SDK of any kind.
- No crash or error reporting service.
- No advertising, ad networks, or ad identifiers.
- No location, no contacts, no photo library scanning, no microphone.
- No cookies set by the app’s own code. Section 3.3 lists what a browser keeps.
- Nothing is sold, rented, or shared for anyone else’s marketing. Ever. There is no business model here that would pay for it.
4. Who can see what
| You | Me (your coach) | Other students | Anyone else | |
|---|---|---|---|---|
| Your name, time zone, units, “My Why” | yes | yes | no | no |
| Homework you submitted | yes | yes | no | no |
| Messages between you and me | yes | yes | no | no |
| Journal entries you kept private | yes | no | no | no |
| Journal entries you shared | yes | yes | no | no |
| Tasks and trackers you kept private | yes | no | no | no |
| Tasks and trackers you shared | yes | yes | no | no |
| Your password | no, nobody | no | no | no |
Sharing is a decision, and it is reversible. A journal entry, a task, or a tracker carries a visibility setting that starts at private. Nothing moves from private to shared without you doing it.
Student isolation is enforced by the database. Every table denies access by default and then permits only your own rows and your own coaching relationship. It is not a filter applied by the app screen, so a bug in a screen cannot expose another student’s data. This is covered by an automated security test suite that runs on every change.
5. Where your data lives, and who else touches it
Everything is stored in the United States. The app runs on four service providers, and each one gets the narrowest slice that lets it work.
| Provider | What it does | What it can see |
|---|---|---|
| Supabase | The database, sign in, file storage and server functions. Hosted in the US East region. | All stored app data, as the hosting provider. |
| Resend | Sends sign in, account confirmation and password reset emails. | Your email address and the text of that email, including its one-time link. Resend stores its records in the United States. |
| Expo (650 Industries) | Relays push notifications to your phone, and hosts the web version: it delivers the app to your browser. | Your push token, the generic text of a notification, and its routing details: the kind of notification, internal record numbers the app uses to open the right screen, and for some kinds a count, the days overdue or a review outcome (approved or sent back for revision). None of it is your content. See section 6. When you open the web version, your IP address and browser type, which every web host receives. |
| Google Firebase Cloud Messaging | Final delivery of a notification to an Android phone. | The same generic text and routing details. |
If the app ever ships on iPhone, Apple’s push service takes Google’s place in that last row on those devices.
Email. Sign in, account confirmation and password reset emails are sent through Resend, named in the table above. If that provider is ever replaced, the new one will be named here before the change ships.
Backup copies. I also keep encrypted copies of the app’s database on my own computer in New York State, normally for no more than 7 days. Section 7 says when they are taken, what they hold and when they are deleted.
No data brokers, no advertising partners. Your data is never sold or shared for anyone else’s marketing.
6. Notifications are deliberately vague, and that is a feature
A notification arrives on a lock screen, where anyone standing nearby can read it. So the app is built so that a notification carries a category and a count, and nothing else.
Real examples of every notification the app can send:
New homework · Homework submitted · Homework completed · Homework due soon: one
assignment is due soon · Homework overdue: 2 assignments are past their due date · Task
reminder: a task is still open for this period · Tracker reminder: a tracker is waiting
for an entry · New message from your coach · Your homework was reviewed · New message:
You have a new message.
Verified 2026-10-03 by reading the code of every function in the live database that creates a notification. Not one of them puts a journal entry, a message body, a weight value, an assignment title, or even a tracker’s name into a notification. A reminder about your weight tracker says “a tracker”, never “Weight”.
You can receive an alert when I send you a message, and while my coaching account is active I can receive an alert when you send me one. Each new private message creates a separate alert, so these alerts have no once-per-day limit. Broadcast alerts are separate and say “New message from your coach”.
Scheduled reminders have daily limits. Homework due-soon and overdue reminders are each limited to one per day in your coaching workspace. Task and tracker reminders use one reminder per kind and chosen time each day. Overdue reminders stop after the number of days set for that homework, three by default. System timed reminders only fire between 08:00 and 21:00 in your own time zone. Reminder times that you chose are honoured as set, subject to your notification preferences and delivery delays. You can turn notifications off in Settings.
7. How long I keep things
The rule is simple: your data lives as long as your account does, and deleting your account removes it from the app’s database in one step. The database has no timed purge running in the background, and this table does not pretend there is. The one exception is the backup copies described below the table, which are deleted on a timer.
| What | How long |
|---|---|
| A pending invitation | Until it expires, 7 days by default. An expired invitation cannot be used |
| A revoked or expired invitation | Kept as a record that it was sent, with the address it went to, until the account it was addressed to is deleted or you ask for it to be removed |
| Your messages, homework, tasks, trackers and their entries | For the life of your account. Deleting your account removes them at once |
| A journal entry you delete | Hidden from the app the moment you delete it, and removed with your account |
| An archived student record | Kept while archived, because a coaching relationship can resume. Reviewed yearly. Deleted on request at any time |
| Audit records | Kept. When you delete your account, the records of actions you took no longer point to your account. Records of actions about you stay, with their record numbers, statuses and dates and, where I archived a student, the note I wrote explaining why. The record of the deletion keeps your old account number, like the tombstone below. None of them holds anything you wrote. The entry for the invitation sent to you still holds the address it went to |
| Push tokens | Deleted when you sign out, switched off when the push service reports the token dead, and deleted with your account |
| Deleted account tombstone | A hashed email address, the old account id, your role, the dates and a count of what was removed, so a deleted account cannot be silently recreated or abused. No name and no content |
Backups. I take a copy of the app’s database before I change how it is built or repair data in it, and when I test that copies restore, so that a mistake can be undone. A copy holds everything in the app’s database: what sections 3.1 to 3.4 describe, plus the notification, invitation and deletion records in sections 6 and 7. It does not hold your password or sign in session (those stay with the authentication provider), the contents of any file attached to homework, or what your browser keeps on your own device. Copies are encrypted and kept on my own computer in New York State. Each one is deleted automatically once it is 6 days old. That deletion runs only while my tools are running on that computer, so a copy that falls due while they are not running is deleted the next time they run. So after you delete your account, your data can remain in a copy for up to 7 days, and longer only if those tools did not run for more than a day. If a copy is ever used to repair the app, every account deleted since the copy was taken stays deleted, I delete again anything else you removed since then, and anything you made private since then stays private. I say all of this rather than claiming an instant that is not true.
If a timed purge is ever added, for example removing old invitations or audit records on a schedule, it will be described here before it runs.
8. What you can do
- See it. Everything about you is visible in the app.
- Correct it. Your profile, journal, tasks and trackers are yours to edit.
- Export it. Settings has “Export my data”. It produces a JSON file containing your profile, homework, messages, journal, tasks, trackers and entries, and hands it to you through your phone’s share sheet, or as a file download in the web version. No request, no waiting, no email to anybody.
- Delete it. Settings has “Delete your account”. It removes your account and your data. A backup copy can still hold them, normally for up to 7 days; see section 7. There is no dark pattern here and no retention pitch.
- Turn notifications off, entirely or by kind.
- Ask. Email me at reese@dietdiscipline.com. If you are in a place with a legal right to access, correction, portability or erasure, exercising it is the same two buttons above, and anything they do not cover you can ask me for directly.
One honest limit on deletion. If a coach has active students, the app refuses to delete that coach’s account and says how many people’s records would be destroyed alongside it. The coach has to move or archive them first. That applies to me too, and the refusal is deliberate: one person’s exit must not silently take other people’s records with it.
9. Security
- Deny by default. Every table starts closed and then opens only for your own rows.
- Column level write permissions. Fields the server owns, such as review verdicts, version numbers and invitation tokens, cannot be written by an app at all.
- Invitation tokens are never stored. Only a SHA-256 hash of the token is kept, so the link in your email cannot be recovered from the database.
- Encryption in transit and at rest, provided by the hosting platform.
- Backup copies (section 7) are encrypted too (AES-256). The key is kept on the same computer as the copies.
- Passwords are handled entirely by the authentication provider and are never visible to the app or to me.
- A security test suite proves student isolation, and it runs on every change to the code.
No system is perfect. If something goes wrong that affects you, I will tell you what happened, plainly, and what to do about it.
10. This is coaching, and it is not health care
Diet Discipline is a health education and accountability service. It is not a medical practice, not a covered entity, and not a business associate under HIPAA. HIPAA does not apply to this app, which means the protection your data gets here comes from this policy and from how the app is built, not from that law. I say that plainly rather than implying a medical grade shield that is not there.
I am not a physician, a Registered Dietitian, or a Certified Nutritionist. I do not diagnose, do not treat, and do not advise on medication. See the Terms of Use.
11. Age
The app is for adults, 18 and over. It is invitation only: without an invitation, a login cannot see anyone else’s data, and the app offers it nothing but redeeming an invitation, signing out and deleting itself, so a minor cannot use it without being invited. If I learn that an account belongs to someone under 18, I delete it.
12. Where the app is offered
United States only, at present.
13. Changes to this policy
If the app starts collecting something new, this policy is updated before that feature ships, not after. One concrete example: a future strict video player would record how much of an assigned video you actually watched. Nothing of that kind is collected today, and if it is added, it will be described here first.
I announce material changes in the app.
14. Contact
reese@dietdiscipline.com
Diet Discipline, New York, United States. I reply within 2 business days.