Waypoint Privacy Policy
Last updated 21 October 2026
This policy explains what information the Waypoint iOS app (“Waypoint”, “the app”) handles, where it is kept, who it is shared with, and the choices and rights you have. “We”, “us” and “our” mean the developer that publishes Waypoint, based in Nigeria and named on its App Store page.
Summary of key points
Do we have your data? Yes, as a backup. What you log is stored on your device and backed up to Waypoint’s own server so you can restore it after reinstalling the app or on a new iPhone. There’s no sign-in: the backup is tied to an anonymous account key kept in your iPhone’s Keychain, not to your name, email or Apple ID.
Do we handle sensitive information? Yes. Your medication, doses, weight, food and mood are health information. The app processes them only to give you its features. They are never sold, never used for advertising and never used to train AI.
Does anything leave your device? Your logs and meal photos go to our backup server. When you ask the AI to estimate a meal, a nutrition label, an ingredient or an activity, the text or photo you gave is also sent to an AI provider to get the estimate, and nothing else about you goes with it.
Do we track you? Only if you allow it. There are no ads in the app. After onboarding, Apple asks whether Waypoint may track you; if you allow it, Meta receives your device’s advertising identifier. To measure whether our ads on Instagram and Facebook lead to installs, the app uses Meta’s SDK, which tells Meta when the app is installed and opened and when a subscription is bought. Nothing you log is ever shared with Meta. See section 15.
How can you control it? Edit or delete any entry, delete everything (including the backup on our server) with Settings → Delete All Data, turn Apple Health and notifications on or off, or skip AI and enter values yourself. You can also email us at any time.
Medical disclaimer
Waypoint is a self-tracking companion. It is not a medical device and does not give medical advice, diagnose conditions, or recommend, prescribe or change doses. Calorie, macro and activity estimates, daily targets and the medication level chart are approximations and may be inaccurate. Always follow the guidance of your prescriber or healthcare professional.
1. Who we are
Waypoint is an independent app for people taking GLP-1 medications. It is published by a developer based in Nigeria and named on its App Store page, who is the data controller for the personal data we handle ourselves: the backup of what you log, the emails you send us, AI requests while they pass through our server to our providers, and the anonymous device check described in section 4.
Waypoint is built to keep data with you. The app follows a few principles: collect only what a feature needs, keep the backup tied to an anonymous key rather than to who you are, process data only for the purpose you used it for, and let you delete it, everywhere, at any time.
2. Information Waypoint handles
| Category | Examples | Where it’s kept | Does it leave your device? |
|---|---|---|---|
| Profile | Sex and year of birth (if given), height, starting, current and goal weight, activity level, main goal, units | Your device and our backup server | Backed up to our server |
| Medication | Medication name, dose, schedule, first or last dose date, dose log and notes | Your device and our backup server | Backed up to our server |
| Food and nutrition | Meals, ingredients, calories and macros, saved foods, water and protein top-ups | Your device and our backup server | Backed up to our server; the description or photo you ask the AI to estimate also goes to the AI provider |
| Food photos | Photos of meals or nutrition labels you take or pick | A small compressed copy with the food you log, on your device and on our backup server | Backed up to our server, and sent to the AI provider for that estimate |
| Weight, activity and mood | Weigh-ins, workouts and calories burned, mood and food-noise check-ins | Your device and our backup server | Backed up to our server; an activity description you ask the AI to estimate also goes to the AI provider |
| Apple Health | Step count and active energy (read only) | Read on your device when shown | No. It isn’t backed up or sent anywhere |
| AI device check | An anonymous key made by your iPhone for Waypoint (Apple App Attest), a signature counter, and how many AI requests it made today | Our AI server (Cloudflare) | Yes, when you first use AI. It isn’t linked to your name, Apple ID or anything you log |
| Settings | Reminder times and switches, units, targets | Your device and our backup server | Backed up to our server |
| Backup account key | A random account number and secret your iPhone makes for Waypoint, kept in your Keychain (synced by iCloud Keychain so a new iPhone can restore) | Your Keychain; our server keeps the account number and a one-way hash of the secret | Used to reach your backup. It isn’t linked to your name, email or Apple ID |
| Subscription status | Whether Waypoint Premium is active, trial eligibility | Apple, checked by the app on your device | Handled by Apple. We don’t receive your payment details |
| Support messages | Your email address and what you write to us | Our support inbox | Yes, when you choose to email us |
What we don’t collect: your name, phone number, contacts, precise or approximate location, advertising identifier (IDFA, unless you allow tracking), or browsing activity. Apart from the app events described in section 15, there are no usage analytics. There is no account to sign up for or sign in to.
If you choose to share crash reports and diagnostics with app developers in iOS Settings, Apple may give us anonymous crash reports under Apple’s terms. These help us fix bugs and don’t identify you.
Please don’t enter other people’s information, government ID numbers or payment details in free-text fields such as notes or meal descriptions.
3. How it is used, and legal bases
| Purpose | Information used | Legal basis (EEA, UK, Switzerland) |
|---|---|---|
| Tracking features: logs, dose schedule, countdowns, charts, daily targets, medication level estimate | Profile, medication, food, weight, activity, mood, Apple Health | Providing the app you asked for (contract), and your explicit consent for health information, which you give by entering it and can withdraw by deleting it |
| AI estimates of food, labels, ingredients and activities | The description or photo you submit | Contract, and your explicit consent each time you choose to use AI |
| Backup and restore (after reinstalling or on a new iPhone) | Everything you log, meal photos, the backup account key | Contract, and your explicit consent for health information, which you can withdraw with Delete All Data |
| Reminders | Schedule and reminder settings | Contract and your notification permission |
| Subscriptions and the free plan’s meal limit | Subscription status from Apple, number of meals logged today | Contract |
| Answering support requests | Your email and message | Legitimate interests in helping you, or contract |
| Complying with the law | Only what we actually hold | Legal obligation |
Apart from measuring our own ads (section 15), we don’t use your information for advertising or marketing, don’t build profiles about you, don’t make automated decisions with legal or similarly significant effects, and don’t use your content, photos or health information to train AI models.
4. AI food and activity estimates
When you describe a meal, scan a meal or nutrition label, add or rename an ingredient, or describe a workout, Waypoint sends that text or photo to an AI service so it can estimate calories, macros or effort.
Requests go to our own small server, hosted on Cloudflare, which forwards them through the Vercel AI Gateway to a language model from OpenAI, Anthropic or Google. Only the description or photo and the instructions for the estimate are sent. Your name, health profile, medication, weight and other logs are not. Our server doesn’t store what you send or the answer.
To keep the AI service for real Waypoint users and stop misuse, the first time you use AI your iPhone creates an anonymous key with Apple’s App Attest, and Apple confirms it belongs to a genuine copy of Waypoint. Each AI request is signed with that key. Our server keeps the key’s public part, a counter and how many requests it made that day, so it can apply a daily limit. This isn’t linked to your name, Apple ID, location or anything you log, and it isn’t used for tracking.
These providers process the request to return an answer and handle it under their own privacy terms. Some may keep requests for a limited time, for example to prevent abuse. We don’t keep a copy.
AI is optional. You can enter calories and macros yourself on the Enter macros tab, and edit any estimate before saving it.
5. Apple Health
If you connect Apple Health, Waypoint reads your step count and active energy to show the calories you burn. It only reads and never writes to Apple Health.
Information from Apple Health stays on your device. It is never sent to the AI service, never shared with anyone, never used for advertising or marketing, and never sold.
You can stop access at any time in the Health app → Sharing → Apps → Waypoint.
6. Camera, photos and notifications
Camera and photos. These are optional and used only when you scan food or a nutrition label. Photos you take or pick are used for that estimate and, if you log the food, kept with it on your device, with a compressed copy in your backup. Waypoint doesn’t browse or upload your photo library.
Notifications. Dose, protein, weight and calorie reminders are scheduled on your device. No reminder content is sent anywhere. You can change them in Settings → Reminders or turn them off in iOS Settings.
7. Where data is stored and for how long
- On your device: until you delete the entry, use Delete All Data, or delete the app.
- On our backup server (Cloudflare): what you log, and compressed meal photos, are kept in a database for your anonymous account so you can restore them. Each account’s data is stored separately and reached only with its secret key. It stays until you delete the entry or use Delete All Data, which removes the backup and its photos from our server. Deleting the app alone doesn’t remove the backup, so you can restore it later. We may delete backups of accounts that haven’t been used for two years.
- Device backups: if your iPhone backs up to iCloud or a computer, Waypoint’s data is included under Apple’s terms, as with any app.
- AI requests: not stored by us. Providers keep them only as their own terms allow.
- AI device check: the anonymous device key and today’s request count are kept on our server for as long as the app uses AI on that device. The count resets daily. Cloudflare keeps basic request logs, such as time and status, for a few days.
- Support emails: kept for as long as needed to help you and handle any follow-up, then deleted. You can ask us to delete them sooner.
8. Who we share data with
| Recipient | What | Why |
|---|---|---|
| Apple | The backup account key (iCloud Keychain), subscription purchases (App Store), Apple Health access (HealthKit), and the App Attest device check | Carrying the key to your new iPhone, payments, reading steps and active energy, confirming a genuine copy of Waypoint |
| Cloudflare | Your backup (logs and meal photos), AI requests passing through, and the anonymous device check | Hosting our server: it stores the backup for us and doesn’t use it for its own purposes |
| Vercel | AI request text or photo | Routing the request to the AI model |
| OpenAI, Anthropic or Google | AI request text or photo | Generating the estimate |
| Meta (Facebook SDK) | That the app was installed and opened, subscription purchases, basic device details (model, iOS version, app version), and the advertising identifier if you allow tracking | Measuring whether our Instagram and Facebook ads lead to installs and subscriptions. Never your logs or health information |
| Google (Gmail) | Emails you send us | Our support inbox |
| Authorities | Only what we actually hold, if legally required | Complying with the law, or protecting rights and safety |
We don’t sell personal information. The only data shared for advertising is the limited app activity Meta uses to measure our ads (above); nothing you log is shared. If Waypoint is ever transferred to a new owner, this policy would continue to apply to anything we hold, and we would tell you in advance.
9. International transfers
Cloudflare, Apple and our AI providers may process data in the United States and other countries outside where you live. Where data protection law requires it, these transfers rely on safeguards the providers offer, such as adequacy decisions (including the EU–US Data Privacy Framework where a provider is certified) and Standard Contractual Clauses.
10. Security
Waypoint keeps your data in the app’s private storage on iOS, protected by your device passcode and iOS data protection. Everything sent to our server goes over encrypted HTTPS connections, and Cloudflare encrypts stored data at rest. Each backup account is kept in its own separate database and can only be read with its secret key, which stays in your Keychain; our server keeps only a one-way hash of it. New accounts can only be created by a genuine copy of Waypoint (Apple App Attest). Our server doesn’t keep what you send to the AI.
No method of storage or transmission is completely secure. Keeping your device passcode and Apple ID secure helps protect your data.
11. Your choices and rights
Most of your data is in your hands, so you can act on it directly:
- See and correct: everything you log is visible in the app and can be edited.
- Delete: delete any single entry (it’s removed from the backup too), or use Settings → Delete All Data to permanently remove everything Waypoint stored, on this device and on our server, including meal photos and the backup account. This also cancels its reminders. If you’re offline, the server copy is deleted the next time the app connects. It doesn’t cancel a subscription; do that in your App Store settings.
- Deleted the app without deleting your data? Reinstall Waypoint (your backup comes back) and use Delete All Data, or email us.
- Withdraw permissions: turn off Apple Health, camera or notification access in iOS Settings at any time.
- Avoid AI: enter values yourself instead of using the AI estimate.
For anything else, including questions about support emails we hold, email support.waypoint.app@gmail.com. Requests are free. We may ask for information to confirm the request is yours, and we reply within one month. Because backups aren’t linked to names or emails, the quickest way to delete one is Delete All Data in the app; if you can’t, email us and we’ll help.
12. People in Nigeria, the EEA, the UK and Switzerland
Under the Nigeria Data Protection Act 2023, the GDPR, the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection, you have the right to:
- access your personal data and receive a copy
- have it corrected or erased
- restrict or object to its processing
- data portability
- withdraw consent at any time, without affecting earlier processing
- not be subject to decisions based solely on automated processing that significantly affect you. Waypoint makes no such decisions.
The legal bases we rely on are set out in section 3. You can contact us to exercise your rights. We respond within one month, which may be extended by two months for complex requests, and we’ll tell you if it is.
You can also complain to your local data protection authority: in Nigeria, the Nigeria Data Protection Commission (NDPC); in the EU, the authority in your country; in the UK, the Information Commissioner’s Office (ICO); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC). We’d appreciate the chance to help first.
13. California residents
Under the California Consumer Privacy Act, as amended by the CPRA, you have the right to:
- know what personal information we collect, use and disclose
- delete it
- correct it
- opt out of its sale or sharing
- limit the use of sensitive personal information
- not be discriminated against for using these rights
In the last 12 months, the personal information we may have received is: the backup of what you log, including health information and meal photos, under an anonymous account key; the content of AI requests (passed to the providers in section 8 to generate an estimate); the anonymous AI device check; and support emails (identifiers and the content of your message).
We do not sell personal information, and we use sensitive personal information only to provide the app’s features. We share limited app activity (installs, app opens and subscription purchases) with Meta to measure our ads, which California law may treat as “sharing”; you can opt out by emailing us. To make a request, email us. An authorised agent may act for you with written permission.
14. Children
Waypoint is meant for adults taking GLP-1 medications and is not directed to anyone under 18. We don’t knowingly collect information from children. If you believe a child has sent us information, email us and we’ll delete it.
15. Cookies, tracking and advertising
The app shows no ads and doesn’t use cookies. It includes Meta’s SDK (the Facebook SDK) only so we can tell whether our Instagram and Facebook ads lead to installs and subscriptions. The SDK sends Meta app events (the app was installed or opened, a subscription was bought) with basic device details. If you allow tracking in Apple’s prompt, it also sends your device’s advertising identifier (IDFA), which lets Meta link the install to the ad you saw; you can change this at any time in iPhone Settings → Privacy & Security → Tracking. Nothing you log (doses, food, weight, mood, Apple Health) is ever sent to it. Meta handles this data under its own privacy policy and Apple’s privacy rules, and when you haven’t allowed tracking, Meta only receives aggregated, privacy-preserving measurement. This page doesn’t set cookies.
Links to other websites, such as Apple’s terms or a health resource, are governed by those sites’ own policies.
16. Changes to this policy
If what the app does with your data changes, we’ll update this policy and the date at the top before the change ships. For significant changes, we’ll also let you know in the app.
17. Contact
Questions, requests or concerns about privacy? Email us at support.waypoint.app@gmail.com.