myself.md Privacy Policy
Updated 2026-10-22
Optional maps in ChatGPT
Map views are optional. When you choose Show map, or ask an agent to enable map tiles, myself.md requests basemap tiles from OpenStreetMap for the viewed geographic areas. OpenStreetMap receives the requested tile areas and the service IP address, not your account identity, precise point records or heart-rate readings. Tile images are cached for seven days. Coordinate plots remain available without external map requests.
Public website logo images
The public homepage loads WHOOP artwork from img.logo.dev. This image service receives the ordinary network request, including your IP address; requests suppress the page referrer and contain no account, phone, health, screen-time or location records. Other homepage product icons are served by myself.md.
What we collect and why
myself.md reads the health, screen time and location data you choose to export or share. Health data comes from HealthKit on iOS and Health Connect on Android, including readings, timestamps, units and the original source details. The app reads your health store without writing to it. You can also connect WHOOP separately to read provider data directly.
Your phone’s permissions and your profile selection control what the app can read and export. HealthKit does not tell apps when read access is denied, so an empty result does not confirm permission. Screen-time data can include app or website identifiers and usage totals, depending on your phone and its permissions.
WHOOP is optional
Connecting WHOOP opens its sign-in and consent page. WHOOP access and rotating refresh tokens stay in secure storage on this phone, scoped to your myself.md account. Our authenticated OAuth broker exchanges authorization codes and refresh tokens using server-held app credentials; it does not persist provider tokens or health data. The phone calls WHOOP’s v2 data API directly.
Select WHOOP types in a profile to export cycles, recovery, sleep, workouts or current body measurements. WHOOP records remain separate from operating-system health records, which can contain overlapping events. On a paired online phone, authenticated agents can read selected WHOOP types when provider access allows it. Profile selections also govern stored-cloud reads after sync. Disconnect in Settings → WHOOP to revoke provider access and remove local credentials. Existing exports remain until deleted. Signing out prevents WHOOP reads but keeps account-scoped credentials for your next sign-in; account deletion erases them from this phone.
Location is optional
Capture current location saves a point on your phone with your permission. Background recording needs both foreground and background permission. It can save precise coordinates, timestamps and other location details while the app is closed.
Open a saved profile → Location and turn off Record location in background, or revoke location permission in your phone’s settings. This keeps existing points. The app cannot recover location history from before you started recording.
Where data goes
Each profile chooses the data types, date range and destination for an export. You can save files on your phone, send them to your own HTTPS endpoint, or use the paired cloud service. Remote exports send the selected records and their details to that destination. Local exports do not need agent access.
A paired online phone approves authenticated agent reads of selected data without a separate agent toggle. Profile selections govern stored cloud reads after the phone syncs. Live query results pass through the paired service before reaching the allowed agent or AI provider. Access to a result expires five minutes after the request was created. The service discards its result when access is revoked, the request is forgotten, expired requests are cleaned up or the service process ends. Request history keeps metadata separately; recipients may keep their own copies.
Signing in also uses your account identity, sessions and connected-phone details. Purchases use store verification and purchase-access records. For cloud storage subscriptions, we keep the store, product, renewal and expiry status and the store transaction or purchase-token identifiers. The app sends Apple or Google an opaque identifier derived from your account with the purchase, so one subscription stays with one account. Apple and Google process payment details; we do not receive card numbers.
App updates and launch recovery
The phone app checks Expo’s update service for compatible app updates. These automatic checks send a random installation identifier and app, platform and runtime version information. After a failed launch, a later update check can also send a short error message so the update service can help recover from the failure. These checks do not depend on signing in and there is no in-app switch to turn them off.
Expo processes this information to deliver updates and recover from launch failures. Error text may contain details about the failure. This is separate from the optional debug reports and agent log access described below.
Cloud storage and retention
We use Cloudflare to host the service. A private R2 bucket stores encrypted exports. Account storage holds identity, sharing permissions, phones, billing, subscription and activity details.
Export files and their manifests are encrypted in storage. The service decrypts them for approved reads, so this is not end-to-end encryption.
Completed cloud exports stay until you delete or replace them, or delete your account, with two exceptions. If a paid cloud storage subscription ends while you keep Lifetime access and use more than the included 100 MB, we keep your files for 30 days, then delete the oldest exports until usage is 100 MB or less unless you resubscribe or delete files first. If Apple or Google refunds or revokes your Lifetime purchase, we delete all your cloud exports immediately. Moving to a smaller plan does not delete files. Unfinished uploads expire after one hour. We remove unfinished uploads during cloud operations and background cleanup, and retry failed deletions. Activity older than 90 days is cleaned up when you view history. Account, sharing, subscription and billing records stay until you delete your account.
We send cloud storage notices, such as reminders before deletion and confirmations after it, as push notifications through Expo’s notification service to phones signed in to your account, and by email to your account’s sign-in email address. Emails come from support@myself.md and are delivered through Cloudflare Email Service, which processes your address and the message. These notices are part of the service and are not marketing.
Files and recorded points on your phone do not expire automatically. Your own server or export destination may have different storage and backup rules.
After sharing with an AI provider
Connecting an agent can send your approved records to an AI service such as ChatGPT, Claude or Grok. That service may keep results in conversations, logs or other storage. Its terms, privacy policy and your account settings control how it uses them.
We cannot guarantee that another service will avoid training on your data, keep it for a set time, or delete an existing copy. Check its settings before sharing health or location data. Revoking access stops future reads but does not remove copies already sent. Delete those conversations or ask the provider to remove its copies.
We use your records for the exports and sharing you request. We do not use them for advertising or sell health data.
Revocation and deletion
To stop future collection or sharing, revoke permissions in your phone’s settings, remove profile data selections or disconnect the phone, and stop automatic exports. Disconnecting a phone stops its connection but keeps cloud exports and copies sent elsewhere.
You can delete cloud exports in the dashboard. Stop their export schedules too, or the app may upload them again.
To delete your account, use Settings → Your account → Delete account or the website’s Delete account page. After you confirm, we remove cloud exports, sharing permissions, phones, activity history, identity and account access. Failed storage or identity cleanup stays pending or failed until it succeeds.
Starting deletion on the phone pauses recording and exports. The phone clears its account-owned app data, files and credentials after the server confirms deletion has started. If a response is lost, the phone preserves its data and asks you to retry; an expired session or lost status receipt can leave the outcome unconfirmed. Deleting from the website or through an agent cannot erase another phone’s local files, your own stored copies, or data another service has received. Health and screen-time data stay in their system apps.
Limited records after account deletion
Deletion status remains available for seven days. Its account-routing record is removed by the following daily cleanup, normally within one further day. We keep a small pseudonymous record that rejects old credentials. We also keep purchase identifiers to prevent duplicate claims, without the account link or receipt proof.
Analytics events and account links are erased. A pseudonymous disabled analytics preference has no automatic expiry, and linked anonymous retry-blocking identifiers remain for 180 days, so delayed deliveries cannot restore erased activity. These markers contain no analytics events.
Deleting your account does not cancel store subscriptions or issue refunds. Cancel cloud storage subscriptions in your Apple account subscriptions or Google Play subscriptions before or after deleting your account, and request refunds from the store. Delete copies in other services, AI providers or your own backups separately.
ChatGPT plugin connection
The dedicated /mcp/chatgpt connection exposes approved data discovery and reads through a separate OAuth resource. It does not expose diagnostic reports, raw phone error messages, support-message delivery, deletion or purchase/upgrade flows. Phone catalogs on this connection omit diagnostic reports and HTTP export destinations. The broader app and other MCP endpoint retain their separately consented capabilities. Health and recorded-location results still require your existing profiles and data grants. Do not submit protected health information, government identifiers or authentication secrets through this connection.
Debug logs
The app keeps up to 300 recent app events on your phone for seven days. These include times, actions, results, request durations and HTTP status codes. We always record raw error messages, which may contain sensitive information. Logs do not capture structured record excerpts, request credentials or URLs; retained attachment fields from older versions are removed. Raw error text is not redacted and may itself contain these details. These logs do not capture native crashes.
A paired phone includes diagnostics in authenticated agent access without a separate opt-in. The app sends a metadata-and-error report to the paired service while open. Reports expire after five minutes; expired reports are removed at the next service cleanup or when the service process ends. An agent can read them only if the phone has sent a heartbeat within the last 15 seconds and the paired phone has a profile. Agents can also read their separately authorized export and access history.
Disconnect the phone to stop future app-log reads. Copies already shared follow the recipient’s retention policy.
Contact and previous support conversations
Contact us by email or public GitHub issue. The app, dashboard and connected agents no longer provide support chat. Check a message or bug report before sending it, and keep health records, precise location, credentials and receipts out of support requests.
Previously stored support conversations remain subject to account deletion. Deleting your account requests removal from the former support service and cleanup of retained legacy Discord threads. We retry failed cleanup before marking deletion complete. Discord backups and copies staff made elsewhere may remain under their own retention rules.
Usage analytics and website measurement
Optional product analytics measures visits, sign-in, onboarding, profile saves, exports and return activity across the website, dashboard, iOS and Android. It is off until you allow it. Events include an event name, time, surface and a limited screen or step category. They do not include health records, location points, profile names, file contents, credentials, full URLs or screen recordings. We store these events in a separate Cloudflare D1 database for up to 180 days. Private aggregate reports are available only to designated service operators and their authorized agents.
The website stores your choice in local storage and a random identifier and pending events in session storage. The phone stores its choice, random identifier and up to 200 pending events locally. Events retry for up to seven days. Sign-in can connect that anonymous activity to a pseudonymous account identifier across devices; app-store installs are not automatically linked to website visits.
Change Share usage analytics in app Settings or Analytics preferences on the website and dashboard. Your explicit local opt-in carries into a signed-in account only if that account has no earlier choice. Turning account analytics off stops authenticated collection and erases its linked events. Linked anonymous identifiers are blocked for 180 days so delayed deliveries cannot restore erased activity; a pseudonymous disabled preference prevents authenticated retries. Account deletion also erases linked analytics events. Signed-out choices apply to that browser or installation, and unlinked anonymous events expire within 180 days. The website also respects Do Not Track and Global Privacy Control.
The hosted website separately uses Cloudflare Web Analytics to measure page views and performance without analytics cookies or local-storage identifiers. Cloudflare processes website visit and performance information; this is separate from your health, screen-time and location exports. Analytics injection is disabled for visitors in the European Union. Internal browsers can use Exclude this browser on the operator page. This stores a one-year exclusion preference cookie with no visitor identifier and suppresses future website measurements in that browser; other browsers and private windows need their own choice.
We use Google Search Console to understand how the public website appears in Google Search. Search Console domain verification uses a DNS record, not a Google Analytics tracking script.
Support and policy changes
Use the support links below for app help, privacy questions or deletion questions. Check a bug report’s text and screenshots before sending it; GitHub issues may be public.
The date above shows when this policy was updated. Review it before enabling new data sharing.