Regent

Privacy Policy

Effective date: August 21, 2026 · Last updated: October 20, 2026

This Privacy Policy describes how KoyoteByte, LLC. (“KoyoteByte, LLC.,” “we,” “us,” or “our”), an Arizona company, collects, uses, discloses, and otherwise processes personal information when you use the Regent Fitness mobile application (also branded as “Regent”), our websites (including koyotebyte.com), and related services (together, the “Services”). Regent is a product of KoyoteByte, LLC. This Policy is part of our Terms of Service.

The Services are for people who are 18 or older. Do not use them if you are under 18. They are not directed to children.

Regent is offered only in the United States and Canada, and this Policy is written for people who live there. “Personal information” in this Policy includes “personal data” under U.S. state privacy laws and “personal information” under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25).

Regent is a logging app with an account, optional cloud backup, and a subscription that starts with a free trial. It does not run a third-party ad network or offer a public social feed. We will not start selling personal information or using Apple Health, Health Connect, or diary data for advertising without updating this Policy and, where required, asking again.

HIPAA does not apply. KoyoteByte, LLC. is not a covered entity or business associate under the Health Insurance Portability and Accountability Act. This Policy is not a HIPAA Notice of Privacy Practices. Consumer nutrition and body data you store in Regent may still be “consumer health data” or a personal health record under other U.S. laws. See our standalone Consumer Health Data Privacy Policy (required for Washington and similar state health-data laws) and Breach notification.

1. Who we are

KoyoteByte, LLC. is responsible for your personal information (the “controller,” or the organization accountable for it). We operate the Services from the United States. Contact: regent@koyotebyte.com, or by mail at 4539 N. 22nd St., Ste. B, Phoenix, AZ 85016, United States.

Privacy Officer. Our Privacy Officer is responsible for how we protect personal information and is the person in charge of the protection of personal information under Quebec law. Reach the Privacy Officer at regent@koyotebyte.com with the subject “Privacy Officer.”

2. Notice at collection

California and some other states require a notice at or before we collect personal information. This Policy is that notice. In short: we collect the categories in Section 3 to provide, secure, back up, and improve Regent (see Section 4). We disclose them to the service providers in Section 6. We do not sell personal information or share it for cross-context behavioral advertising. We keep it for the periods in Section 15. Sensitive information (account login and health-related diary, body, and stack data) is used only to provide the Services you request, not to infer characteristics for ads. You can delete your account in Settings or email us as in Your choices and rights.

If you are in Canada, this Policy is also our explanation of what we collect, why, and who receives it, so that your consent is informed. Optional features ask again when you use them (see Section 5).

3. Information we collect

We collect information from you, from providers you connect, automatically from devices and our sites, and (if you opt in) from partners.

What is required and what is optional

An email address or sign-in-provider account identifier is required to create and secure a Regent account. Information needed to calculate a plan — such as age, sex, height, weight, activity level, goal, and pace — is required only when you ask Regent to create that plan. Diary entries, supplements, notes, photos, voice, connected Health data, and community product contributions are optional. If you decline an optional permission or do not provide optional information, the related feature may be unavailable or less personalized, but unrelated features continue to work.

Account and profile

• Email address (from you, or from Apple or Google)
• Password, if you use email sign-up (stored as a hash by our authentication provider; we do not see the plaintext password)
• Optional display name
• Sign-in method and the account identifiers those providers issue

We do not require a last name or phone number. If we later add phone sign-in or two-factor authentication, we would collect the number you provide for that purpose only.

Diary, body, and stack (may be health-related)

To run the product you asked for, you may provide:

• Sex, age (with the date it was set or last moved up a year), height, weight, activity level, whether you strength train, start weight, goals, and setup answers (such as what gets in the way of tracking and what would make your first week a win)
• Foods, meals, recipes, leftovers, water, and day notes
• Supplements (name, brand, barcode, dose, schedule) and doses marked taken
• Weigh-ins and calorie/macro targets
• Photos, text, or voice used to estimate a meal or read a label, including a meal description typed on the welcome screen before an account exists
• Questions you ask in Ask my Regent, your saved conversations, and short notes Ask my Regent keeps while its memory is on
• Settings (units, theme, reminders, product-contribution preference, and similar)
• If you connect Apple Health or Health Connect and grant the relevant permissions: weight, body-fat percentage, lean mass, steps, workouts, sleep, resting heart rate, and active energy, and on Apple Health your date of birth, used only to keep your age current

Under some laws this is sensitive or health-related personal information because it can describe diet, body measurements, or supplements. We use it to provide, back up, and improve the Services — not to advertise to you, and not to infer a medical diagnosis.

Cloud backup is optional. New accounts start with it off, and this information stays on your device. When you turn it on in Settings → Account & backup, a copy is saved with your account so you can restore it on another phone. Turning it off stops new copies and lets you delete the saved copy right away or keep it.

Information from Apple or Google

If you sign in with Apple or Google, we receive an account identifier and, when the provider shares it, email and name. Apple may issue a private relay address. We do not receive your Apple or Google password, your full contacts list, or your phone number from those flows.

Device, usage, and website data

Our hosts and the stores may process:

• IP address, timestamps, app version, device type, and operating system
• A random install id generated on the phone and sent with a welcome-screen estimate, so the daily limit can be enforced before an account exists
• A separate random install id and which look the app is set to (Moments or Classic; Gallery on earlier app versions), sent while you are signed in when you pick a look in the welcome tour or change it in Settings, and at most once a day otherwise, so we can see which design people prefer. It is not linked to your account
• Setup step counts: the first time this install reaches a step of setup (the welcome screen, a first welcome log, each setup question, your plan, the account screen, a new account, and the subscription screen or starting a subscription), the app sends only that step’s name and whether it is a test build. We add one to that day’s total for the step; no account, install id, or answers are kept with it
• App update checks: when Regent checks for an over-the-air update, Expo (our app-delivery provider) receives the app and runtime version, the platform, and a random identifier generated for this installation — not your account or diary
• Crash reports and aggregated usage from Apple, only if you choose to share analytics with app developers in your iPhone settings. Regent does not include a third-party analytics, advertising, or crash-reporting SDK
• Ad attribution: if you install Regent after tapping one of our ads on the App Store (Apple Ads), Apple gives the app a short-lived token. RevenueCat, our subscription provider, uses it to ask Apple which campaign, ad group, and search keyword led to the install and keeps that with your subscription record, so we can see which ads lead to subscriptions. It uses no advertising identifier, needs no tracking permission, is kept apart from your diary, and is not used to target ads. Installs that did not come from an ad are marked organic
• AI usage records: your account id and the time of each cloud estimate or Ask my Regent request (and whether a request that failed on our side was given back), so fair-use limits can be applied. Daily totals of AI use (how many people used each feature, how much, and how many reached a limit) and daily counts of limit pauses are kept without any account or install id
• Approximate location inferred from IP (country or region), not GPS, unless you later grant location permission for a feature we describe at the time
• On our websites: pages viewed, referrer, and cookie identifiers as described in Cookies

Reminders are scheduled on your device. We do not currently operate a remote push-notification server for Regent. If we add push, we would store a device token to deliver those messages.

Camera, photos, and microphone are used only if you grant permission: the camera for barcodes, nutrition labels, meal photos, and receipts; your photo library if you pick an existing image; the microphone only when you speak a meal, label details, or a question for Ask my Regent. You start each of those actions. In the meal camera, Live sends a small, low-resolution frame about every 1.5 seconds while you aim, so Regent can name the food and estimate its calories and macros before you take the photo. Live starts only after you allow AI estimates, and then stays on by default; the Live button turns it off, and Regent remembers your choice on that device. Frames go to OpenAI, our AI service provider, only for that read and are not stored by Regent or added to your diary or cloud backup. Live stops after about 25 seconds, when you switch modes, or when you leave the camera. Voice you record for a meal or a question is sent to OpenAI for that request, after you allow it, and is not added to your diary or cloud backup. Do not submit a photo or recording of another person, a child, an identity document, or a payment card. If someone else’s voice would be on the recording, you are responsible for having their permission.

If you choose Finish later for a meal photo, Regent keeps a temporary copy and any details you entered in the app’s local cache. When estimates are briefly paused while Regent reads a nutrition label or receipt, that photo is kept the same way so it is not lost. It is not included in your Regent cloud backup or counted in your diary until you return, review, and log it. The app removes the copy after you finish or discard it, on account-data reset, or after approximately 48 hours when Regent next runs; your operating system may clear the cache sooner.

When you log a plate photo that Regent read, the app keeps a small copy of it (512 pixels on its longest side) on your device, so that meal can show it in your diary. The copy is not sent anywhere again and is not included in your Regent cloud backup. It is deleted when you delete the foods it was logged with, on account-data reset, or when you delete your account.

Home Screen widgets and Apple Watch (where offered) display information already on the device or the paired iPhone — for example calories left and what’s still open today. We do not send widget or Watch contents to advertisers, and Watch does not create a separate health upload.

We do not collect biometric identifier templates (Face ID, fingerprints, or voiceprints used to identify you). If you unlock the phone with Face ID or a similar feature, that stays with the operating system.

Payments

If you subscribe to Regent, Apple or Google collects payment method and billing data. RevenueCat processes purchase confirmation, subscription status, product, store, trial or billing-period status, and a Regent account identifier so we can provide access across your devices. RevenueCat also tells our server when a trial or subscription starts, renews, ends, or is refunded, and we keep that current status with your account. We do not receive your full card number.

Support, surveys, and research

If you email us, we keep the content of that correspondence. If you join a survey, beta, or research study, we collect what you choose to submit, which we will describe in that invite.

User-generated and social content (when offered)

If we add friends, messaging, public profiles, comments, or forums, we will collect the content you post, identifiers of people you connect, and reports you file. Do not post other people’s health information. Public posts are visible to others and may be indexed.

4. How we use information

We use personal information to:

• Create, secure, and restore accounts (including email confirmation and password reset)
• Calculate and display nutrition targets, diary totals, and on-device analysis
• Back up and restore your dataset across devices
• Run optional AI estimates, label reading, and Ask my Regent responses that you request, and apply their fair-use limits
• Improve barcode lookups when you contribute product facts
• Provide customer support
• Monitor security, prevent fraud and abuse, and comply with law
• Measure and improve the Services (including aggregated statistics)
• Send service messages (security, account, material policy changes)
• If you opt in: send product news or offers; see Marketing
• Provide your subscription: confirm trials and renewals, manage access across your devices, and prevent payment fraud
• See which of our App Store ads lead to installs and subscriptions, using the ad attribution in Section 3
• If we offer ads: deliver and measure advertising as described in Cookies, never using Apple Health, Health Connect, or sensitive diary fields for ads
• If you join research: the purposes described in that study’s notice

5. How we get your consent

We collect, use, and disclose personal information with your consent, or as the law otherwise allows (for example to secure the Services, prevent fraud, or meet a legal obligation). When you create an account, you agree to this Policy for the information needed to run the account and the diary you choose to keep. Information about your diet, body, and supplements is sensitive, so we rely on your express choices: you decide what to enter, and optional features that use it or send it anywhere ask at the moment you use them.

• Apple Health or Health Connect — the operating system’s permission sheet, which you can change at any time
• Camera, photos, and microphone — the operating system’s permission prompt, and each photo or recording you choose to send
• AI features — before the first estimate is sent, Regent shows what it will send and that it goes to OpenAI, and asks you to allow it; Ask my Regent asks separately before your first question. If you choose Not now, nothing is sent. Turn either off in Settings → Scans & labels → AI estimates or Settings → Ask my Regent. Section 9 lists what each request includes
• Cloud backup — off until you turn it on
• Improve scans — on by default for product facts only, never your diary; turn it off in Settings
• Reminders — the notification permission prompt and the switches in Settings

You can withdraw consent by turning a feature off, disconnecting Health, changing a permission in your phone’s settings, turning off cloud backup, or deleting your account. The feature that needs that information then stops working; the rest of Regent keeps working. Withdrawing consent does not undo processing already done.

6. How we share information

We share information with:

• Infrastructure. Supabase (authentication, backup, optional product reports). Other users cannot read your backup.
• Email delivery. Resend sends account messages, such as confirmation and password reset, to the address on the account. Those messages do not include your diary.
• Sign-in providers. Apple or Google, only if you choose that method.
• AI service provider. OpenAI, for the estimates and Ask my Regent questions described in Section 9, and only after you allow it in the app.
• Public databases. USDA FoodData Central, Open Food Facts, NIH DSLD, and similar catalogs receive a search or barcode, not your diary.
• Subscriptions. Apple or Google processes the purchase; RevenueCat processes the Regent account identifier, device and app information, and subscription status needed to manage your access, and sends our server subscription events (such as a trial start, renewal, cancellation, or refund) for your account. If you installed Regent from one of our App Store ads, RevenueCat also keeps the ad attribution described in Section 3.
• App delivery. Expo delivers over-the-air app updates. Update checks include the app version, platform, and a random installation identifier, not your account or diary.
• Analytics and crash tools. Regent does not include third-party analytics or crash-reporting tools. If you share analytics with app developers in your iPhone settings, Apple gives us crash reports and aggregated usage. If we add a tool, we will list it here first.
• Advertising partners. Only if we introduce advertising; see Cookies.
• Professional advisers. Lawyers, accountants, and insurers under confidentiality.
• Successors. In a merger, acquisition, or asset sale, with notice or this Policy still applying.
• Law enforcement or others when we believe in good faith we must, to protect rights and safety, or to meet a legal process.

Service providers are allowed to process personal information only on our instructions and as needed to perform their work. We do not sell personal information or give it to data brokers.

7. Google and Apple sign-in

We use Google sign-in only to authenticate you and to receive email and name so we can create your account. We do not use Google user data for ads. We do not allow other apps to access Google data obtained through sign-in. Use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Apple sign-in is used the same way. You may hide your email with Apple’s private relay. We do not post to your Apple or Google accounts.

8. Apple Health, Health Connect, and other connected health data

If you connect Apple Health (iOS) or Health Connect (Android), Regent may read weight, body-fat percentage, lean mass, steps, workouts, sleep, resting heart rate, and active energy, and on Apple Health your date of birth, with the permissions you choose. Regent uses this information to import weigh-ins, show movement and recovery context in Trends, optionally include today’s active energy in today’s calorie budget, size your protein target from your latest body composition, hold a weekly calorie change on a lose-fat-keep-muscle plan when your body-fat readings are trending down, and keep the age behind your targets current. From your date of birth Regent saves only your age and your most recent birthday with your profile. Regent does not create a medical interpretation or turn these signals into a proprietary readiness score.

On iPhone, if you allow it in Apple’s permission sheet, Regent also writes to Apple Health: each food you mark eaten, with its name, calories, and the nutrients Apple Health records; the nutrients in supplement doses you check off; and each day’s water. Planned meals are not written. When you edit or delete an entry from the last 30 days, Regent updates Apple Health to match. You choose which types Regent may write, can turn saving off in Settings → Devices & health, and can change permissions in the Health app. What Regent wrote stays in Apple Health under Apple’s terms when you turn saving off or delete your Regent data; you can delete it in the Health app. Regent does not write to Health Connect.

That information is not used for marketing, advertising, or similar services, and is not sold. Recent connected movement, recovery, body-composition, and active-energy snapshots are kept on-device for no more than 35 days. They are not copied into your Regent cloud backup. Android system backup is turned off. An iPhone backup you turn on can still include that on-device store. Imported weigh-ins become ordinary Regent weigh-ins and may be included in your backup. Health authorization and connection status are device-local, so a new device must connect again. Your preference for whether active energy is added to today’s budget may follow your account.

Connected-health snapshots otherwise stay on the device. An Ask my Regent answer can use a summary from your log, which may include today’s calorie target when active energy is part of it and your number of workouts and workout minutes over the last seven days, but raw Health samples are not sent. Ask my Regent does not write to Apple Health or Health Connect itself; a diary change you confirm reaches Apple Health like any other entry when saving is on.

If we later add Samsung Health or another repository, we will request permission in-app and will apply the same rule: no advertising use of unique data from that repository. Those platforms’ own terms also apply.

9. AI features

Regent uses artificial intelligence and machine-learning technology, including third-party large language models, to provide features you ask for: estimating a meal from a photo, description, voice memo, or recipe, fixing an estimate, naming the food in view while Live is on in the meal camera, reading a nutrition label or receipt, and answering Ask my Regent questions. These requests are sent to our AI service provider, OpenAI. Barcode lookups, food search, and nutrition labels read on the device are not sent to OpenAI. What each request includes:

• Meal photo, label, or receipt: the photo, any details you typed, and text the phone found in it. A label is sent only when it can’t be read on the phone.
• Voice: the recording, which OpenAI turns into text to estimate the meal.
• Typed meal or recipe: your words or the recipe lines.
• Fixing an estimate: your note or recording and the foods already on the estimate.
• Live: while you aim the meal camera with Live on, a still frame about every 1.5 seconds, up to 12 frames, with the names of foods already seen.
• Ask my Regent: your question or recording, the recent conversation, your memory notes, and a summary from your log: foods, targets, and nutrients from recent days; your goal, goal weight, activity level, and whether you strength train; recent weigh-ins; recent workout totals; your stack; day notes; and saved foods, plans, and recipes.

Requests pass through our server, which checks your account and fair-use limits; OpenAI does not receive your name, email, or account. We use what you send only to return the estimate or answer, apply those limits, and keep the Services secure.

Your permission. Before the first of these requests, Regent shows what will be sent and that it goes to OpenAI, and asks you to allow it. Ask my Regent asks separately before your first question. If you choose Not now, nothing is sent, and barcodes, food search, and on-device label reading keep working. You can withdraw permission at any time in Settings → Scans & labels → AI estimates or Settings → Ask my Regent. Your choice is kept on this device, and Regent asks again after you sign out or on a new device.

How OpenAI protects it. OpenAI processes these requests only on our behalf, under a data processing agreement that requires it to protect personal information with safeguards equal to those described in this Policy, use it only to provide the service to us, and keep it confidential. OpenAI does not use them to train its models and may keep them for a limited time to monitor for abuse.

Ask my Regent memory is on by default. When you mention something lasting about how you eat or train, it can keep a short note, shows it under that answer, and sends your notes with later questions. Notes are never meant to hold body measurements, health conditions, medicines, or allergies, and a note with a weight or body-fat figure is dropped. Review, delete, or turn off notes in Settings → Ask my Regent → Memory; while memory is off, nothing new is kept and no notes are sent.

The welcome screen can estimate one meal you type before you create an account. To apply a daily limit, we keep a random install id and the request time, not the meal text.

AI output can be wrong and is not medical advice. Ask my Regent saves a change only after you confirm it. We do not use your content to train AI models.

10. Community product reports and social features

If Settings → Improve scans is on (default on), a scan or label correction may submit product facts only (barcode, name, serving, nutrition) so later scans resolve faster. The public report is labeled with a token derived from your account id, the product table, and the barcode. It is not labeled with your name, email, or diary. A private rate-limit record keeps your account id for about 24 hours and is removed when you delete the account. Other users cannot read either identifier. You can turn this off at any time; lookups still work. Turning it off stops future reports. A report already sent remains a product fact, and deleting your account does not remove it.

If we add friends, follows, messaging, leaderboards, or forums, content you share with other users is as public as the feature you used. We may review reports of abuse. We may remove content that violates the Terms. Other users’ copying or screenshots are outside our control.

11. Partners, grocery, and research

A grocery list is built on this phone from meals you planned. Sharing it is optional, and which items you have checked stays on this phone. We do not currently connect a grocery retailer, restaurant account, or wearable partner. If we add one, we will collect only what that connection needs and describe it in the feature.

We may invite you to research or surveys. Participation is voluntary. We prefer aggregated or de-identified results. A study-specific notice will say if data is shared with a university or other researcher.

12. Cookies, analytics, ads, and Do Not Track

Cookies are small files or similar technologies (pixels, local storage, SDKs) stored on a browser or device.

What we use today

• Strictly necessary. Our sites and sign-in flows (including Google’s or Apple’s pages) set cookies required to keep a session, prevent fraud, and complete OAuth.
• The Regent app stores your diary locally and session tokens as needed to stay signed in. That is functional storage, not a third-party ad cookie.
• Fonts. Our legal pages load the Geist typeface from Google Fonts, which receives your IP address and browser details when a page loads. It does not set an advertising cookie.

Analytics

We may use first-party or third-party analytics (including store-provided analytics) to understand feature use and reliability. Those tools may collect device identifiers and in-app events. Where required, we will request consent or offer an opt-out.

Advertising

We do not currently run personalized advertising in the app. If we introduce ads or sponsorships, we or our partners may use cookies or advertising IDs to show, measure, and limit ads. That may be “sharing” or “targeted advertising” under some U.S. state laws. We will then provide a “Do Not Sell or Share” / opt-out of targeted ads control and will not use Apple Health, Health Connect, or sensitive diary contents (meals, weight, stack) to target ads.

You can also limit tracking in iOS/Android settings and in your browser. Blocking all cookies may break sign-in on the web.

Do Not Track

California’s Online Privacy Protection Act requires us to say how we respond to browser “Do Not Track” (DNT) signals. We do not currently respond to DNT signals because our sites do not use third-party advertising trackers. If we introduce those trackers, we will update this statement and, where required, honor DNT, Global Privacy Control, or a comparable opt-out signal.

13. Payments and subscriptions

The Regent subscription is sold through the App Store (and Google Play, if we offer Regent there). The store bills you, collects any tax, keeps your payment details, and handles refunds under its rules. RevenueCat helps us confirm your trial or subscription and manage access. We never receive your full card number, and we use subscription status only to provide your access and to support you.

14. Marketing and communications

We send service email, such as sign-in confirmation, password resets, security notices, and notice of material changes to our Terms or this Policy. We do not send marketing email today. If we start, we will send it only to people who opt in (including the express consent Canada’s anti-spam law requires), and every message will include a way to unsubscribe. We do not text you. Reminders in the app are local notifications that you control in Settings and in your phone’s notification settings.

15. Retention and deletion

Data	Typical period
Account and cloud backup	Until you delete the account (or, for the backup, delete it when turning cloud backup off), then removed from production systems except limited legal holds. Archived copies of deleted health-related data may take up to six months to expire
Unused catalog foods on device	Dropped after a few days if never logged
Support email	As long as needed to resolve the request, then routinely deleted
Security logs	Generally up to 12 months unless investigating an incident
Community product reports	May remain; they are not your account record
Purchase records	As required for tax and accounting (often several years)
Subscription status	Your current trial or subscription status, kept while the account exists and deleted with it. Apple, Google, and RevenueCat keep their own purchase records under their policies
AI usage records	Account id and request times, kept up to about a month for cloud estimates, 7 days for Ask my Regent, and about 24 hours for Live reads, then deleted automatically; also deleted with the account. Daily usage totals and pause counts carry no account or install id
Ask my Regent conversations	The five most recent stay with the account and are included in the cloud backup until you delete them or the account
Ask my Regent memory notes	Up to 12 short notes stay with the account and are included in the cloud backup until you delete them or the account; turning memory off keeps them but stops their use
Welcome estimate limit	Random install id and request time, kept about 24 hours to enforce the cap. The meal text is not stored in that record
App look	Random install id, the current look, and when it last reported, kept while we compare the two designs. Not linked to your account
Setup step counts	Daily totals per setup step, with no account, install id, or answers, kept while we use them to improve setup
AI requests	Not kept by Regent beyond what you save. Our AI service provider may keep a request for a limited time to monitor for abuse
Unfinished meal, label, and receipt photos	Local cache only; removed after completion, discard, account-data reset, or approximately 48 hours when the app next runs, and may be cleared sooner by the operating system
Logged plate photos	On your device only, beside the meal they were logged with; deleted with those foods, on account-data reset, or on account deletion. Never in the cloud backup

In the app, Settings → Delete account and all data removes the auth user, cloud backup, and local data on that device. Settings → Account can also export a CSV of your diary or stack to a file you choose. Turning off Cloud backup there can delete the cloud copy without deleting the account. Sign-out alone does not delete the cloud copy. We may keep de-identified statistics that cannot reasonably identify you.

If we de-identify information, we will maintain and use it in de-identified form and will not attempt to re-identify it except as required or permitted by law.

16. Security

We use measures appropriate to a consumer health-adjacent app: encryption in transit (HTTPS), encryption at rest by our database host, hashed passwords, access rules so users only read their own backup, and least-privilege operator access. No system is perfectly secure. Protect your device and sign-in. Tell us at regent@koyotebyte.com if you suspect unauthorized access.

17. Breach notification

If we discover a breach of unsecured personal health record information, we will notify affected people without unreasonable delay and no later than 60 days after discovery, notify the U.S. Federal Trade Commission as its Health Breach Notification Rule requires for vendors of personal health records that are not HIPAA covered entities, and notify prominent media when that rule requires it because 500 or more residents of a state or similar jurisdiction are affected. We will also follow applicable state breach-notification laws. Tell us at regent@koyotebyte.com if you suspect unauthorized access.

If you are in Canada, we will report a breach of security safeguards that creates a real risk of significant harm to the Office of the Privacy Commissioner of Canada (and, where Alberta’s law applies, to Alberta’s Information and Privacy Commissioner) and notify affected people as soon as feasible. We keep a record of every breach for at least 24 months. For Quebec residents, we will notify the Commission d’accès à l’information and affected people of a confidentiality incident that presents a risk of serious injury, and we keep a register of incidents.

18. Where we store and process information

Our account and backup database is hosted in the United States (Ohio). Our service providers process information in the United States and in other countries where they operate. If you live in Canada, your personal information is transferred to, stored, and processed outside Canada, mainly in the United States, and while it is there it may be accessible to courts, law enforcement, and national security authorities under the laws of those countries.

We use contracts and other measures to require our service providers to protect personal information, use it only to provide their services to us, and keep it confidential. Before we communicate personal information about Quebec residents outside Quebec, we assess whether it will receive adequate protection, as Quebec law requires.

Regent is not offered outside the United States and Canada. If you visit our website from elsewhere, the website information described in Section 3 is processed in the United States.

19. Your choices and rights

• Edit profile, diary, and settings in the app
• Disconnect Health in iOS Settings and in Regent
• Turn off product contribution
• Turn off reminders
• Unsubscribe from promotional email
• Delete your account in the app
• Export a diary or stack CSV from Settings
• Email regent@koyotebyte.com to access, correct, delete, or export personal information if you cannot do it in-app

We will not discriminate against you for exercising privacy rights. We may need to verify you (for example by emailing the address on the account). Authorized agents may write to the same address and must show their authority.

Where a U.S. state law sets a deadline, we will respond within 45 days (one extension of 45 days if reasonably necessary, with notice). Where Canadian law applies, we will respond within 30 days, or tell you within that time if we need an extension the law allows. To appeal a refusal, reply to our decision; we will answer the appeal in writing within 45 days and, if we deny it, point you to your state attorney general.

We do not currently honor a global privacy-control signal for ads because we do not run ads. If we start, we will describe how GPC or similar signals apply.

20. California and other U.S. state rights

If you live in California or another U.S. state with a comprehensive consumer privacy law — including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia — you may have the right to know, access, correct, delete, and obtain a portable copy of personal information, and to opt out of sale, sharing for targeted advertising, or certain profiling. Where a state requires consent before processing sensitive data, the choices in Section 5 are how we get it.

Categories we collect (CPRA-style): identifiers (email, account id); customer records; protected-class information you enter (sex); commercial information if you purchase; internet or electronic activity (app/site usage); geolocation at coarse IP level; audio/visual if you submit meal photos or voice; inferences we generate from your log (for example targets or insights); and sensitive personal information (account login, and health-related diary/body/stack data). We collect these from you, from Apple/Google if you use them, and from our processors as needed.

We use these categories for the purposes in How we use information. We disclose them to the service providers in How we share information. In the prior 12 months we have disclosed identifiers and customer-record data to our authentication and backup processor, identifiers and commercial information to our subscription processor, device information to our app-delivery provider, and (only if you used those features) audio/visual content and diary context to our AI service provider. Connected-health snapshots otherwise remain on-device as described above. We do not sell personal information for money. We do not share it for cross-context behavioral advertising today.

Sensitive personal information (CPRA). We use account login and health-related diary, body, and stack data only to provide the Services you request. We do not use it to infer characteristics for advertising. A request to “limit the use of my sensitive personal information” is already how we operate; email us if you want that confirmed in writing.

California “Shine the Light” (Civil Code § 1798.83): we do not disclose personal information to third parties for their own direct marketing. Nevada residents may email us to record an opt-out of sale; we do not sell anyway. We do not offer a discount, prize, or other financial incentive in exchange for personal information.

To exercise state rights, email regent@koyotebyte.com with the subject “Privacy request” and your state. You may appeal a refusal by replying to our decision. You may also contact your state attorney general.

21. Consumer health data (Washington and similar states)

Diet, body measurements, supplements, optional Apple Health or Health Connect samples, and similar fields can be “consumer health data” under Washington’s My Health My Data Act and similar U.S. state laws. The required standalone notice is the Consumer Health Data Privacy Policy. That page is also linked from Settings in the app and from the koyotebyte.com homepage (to this product path, not the agency’s own legal pages).

22. Canada, including Quebec

If you live in Canada, PIPEDA and, depending on your province, Quebec’s Act respecting the protection of personal information in the private sector, Alberta’s Personal Information Protection Act (PIPA), or British Columbia’s Personal Information Protection Act (PIPA) apply to how we handle your personal information. You do not have to give us personal information, but some features cannot work without it (see What is required and what is optional).

You may:

• Ask what personal information we hold about you, how we use it, and to whom we have disclosed it, and get access to it
• Ask us to correct personal information that is inaccurate or incomplete
• Withdraw consent, subject to legal or contractual limits, and learn what withdrawing would mean for the Services
• If you live in Quebec: receive computerized personal information you gave us in a structured, commonly used technological format, or have it sent to another organization; ask us to stop disseminating your personal information or to de-index a link to it where the law allows; and be told about a decision made exclusively by automated processing (see Section 25)

Much of this is available in the app: edit your profile and log, export a CSV, disconnect Health, turn features off, or delete your account. For anything else, email the Privacy Officer at regent@koyotebyte.com with the subject “Privacy request” and your province. We will answer within 30 days, or tell you within that time if we need an extension the law allows. Access and correction are free.

If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, or the Information and Privacy Commissioner of Alberta or of British Columbia, as applies to you.

This Policy does not cover an employer, clinic, or other company whose site or app you open from a link. Their terms and privacy policy apply there.

23. Children

The Services are 18+. We do not knowingly collect personal information from anyone under 18, and we do not knowingly collect personal information from children under 13 (COPPA). If we learn we have, we will delete the account and associated backup. Parents or guardians who believe a minor used Regent should email us.

24. Do we sell or share your information?

No, not as of this date: we do not sell personal information and we do not share it for targeted advertising. If analytics or ads we add later are treated as a “sale” or “share” under state law, we will update this Policy and offer opt-out. We will not sell Apple Health or Health Connect data.

25. Automated decisions

Regent calculates your starting calorie and nutrient targets automatically from the details you enter (age, sex, height, weight, activity, goal, and pace) and the published references described in the app. If you connect Apple Health or Health Connect, your latest body composition can lower the weight your protein target is sized from. If you turn on Regent adjusts, Regent also updates your calorie target once a week from your logged intake and weigh-ins without asking first, then shows the new number, why it changed, and an Undo. On a lose-fat-keep-muscle plan, your strength-training answer and body-fat trend can hold that change instead, and Regent says why. By default, Regent asks before changing it, and you can always type your own calorie or protein target. Changes Regent makes by itself from Apple Health or Health Connect (an imported weigh-in, your profile weight, or the age behind your targets) are listed in the app beside the target changes, each with why it happened, Keep or Go back, and a switch to have Regent ask first. A figure Regent worked out, such as your calorie target, opens its working, line by line from your own answers.

These calculations do not produce legal or similarly significant effects, and we do not use automated processing to decide on credit, housing, employment, insurance, or health care. If you live in Quebec, you may ask which personal information and main factors produced a target, ask us to correct the information used, and have a person at KoyoteByte, LLC. review it, by emailing regent@koyotebyte.com.

26. Changes

We may update this Policy. We will change the “Last updated” date and, if the change is material (for example introducing ads or selling data), we will provide additional notice in the app or by email and any consent the law requires. Continued use after the effective date means you accept the updated Policy. If you do not, delete your account.

27. Contact us

KoyoteByte, LLC.
4539 N. 22nd St., Ste. B
Phoenix, AZ 85016, United States
regent@koyotebyte.com

Privacy Officer: regent@koyotebyte.com, subject “Privacy Officer.” Privacy, consumer health data, Apple Health, Health Connect, U.S. state, and Canadian requests all go to that address.