How KnowsYou handles your information.

1. Who is responsible, scope and intended users

KnowsYou is operated by Terra Cycle S.R.L., a company registered in Romania (trade register no. J2017000856137, fiscal code RO37298322), with its registered office at Aleea Ghiocelului 7, Eforie Nord, Eforie, Constanța, România. Terra Cycle S.R.L. is the controller of the personal data described in this notice; the contact for anything in it is privacy@knowsyou.ai.

KnowsYou is a conversational general-wellness application. This notice covers the authenticated application, its web and mobile clients and the public website. It does not replace the privacy notices of connected services such as WHOOP or Google.

The current service is intended for adults aged 18 or older. We do not knowingly design the service for children.

2. Information the service processes

Depending on how you use KnowsYou, this can include:

• Account and profile data: name, email address, timezone, preferred conversation language and profile details you choose to provide.
• Conversation and wellness data: messages, meals, activities, habits, goals, treatment routines, body measurements, check-ins, notes and remembered preferences.
• Files and media: images, PDFs and voice recordings or transcriptions you submit.
• Connected data: information you authorize from WHOOP, which can include profile and body measurements, cycles, recovery, sleep, strain and workouts.
• Payment data, if you subscribe: your plan, currency, subscription status, trial and renewal dates, and the reference of your customer record at Stripe. Your card details, billing name and address and any VAT number you enter go to Stripe on its payment page, and Stripe issues and emails your invoices. KnowsYou never sees your full card number.
• Technical and operational data: sessions, device and notification tokens, usage records, errors, security events and audit records of agent actions. This includes a first-party record of when you open the app — a timestamp and which client, nothing about what you did — kept so we can tell whether the service is genuinely used. No third-party analytics SDK is involved.

You decide what to submit, but wellness information and health documents can be sensitive. Do not upload information you do not want the service and its necessary providers to process.

3. Why information is used

Information is processed to:

• create and maintain your account and profile;
• respond in conversation and create the records you request;
• preserve conversation context and selected active memories;
• calculate and display progress and approximate wellness estimates;
• sync connected services you authorize;
• send reminders or notifications you enable;
• sell and manage subscriptions, issue invoices and keep the accounting records that tax law requires;
• troubleshoot, prevent abuse and audit whether agent actions matched the request; and
• improve reliability and safety.

Where EU data-protection law applies, the legal bases are: performance of the service you signed up for, for account and product records; your explicit consent, given when you create the account, for the health information you choose to submit and for the provider transfers described in section 4; our legitimate interest in keeping the service secure, preventing abuse and fixing failures, for technical and audit data; performance of the subscription contract, for payment data; and our legal obligations under tax and accounting law, for invoices and the records behind them. You can withdraw consent at any time by deleting your account (section 7); the service cannot run without it.

KnowsYou does not currently sell personal information or use wellness data for targeted advertising.

4. AI and other service providers

KnowsYou relies on providers to operate particular parts of the service. Relevant data is sent only when needed for that function. Current providers can include:

DeepSeek, OpenRouter, OpenAI, Microsoft, Anthropic, Google, Alibaba's Qwen models and Groq are the current AI providers, used for generating replies, transcribing voice, and reading images and documents you attach. Alongside them:

• DigitalOcean for private object storage and service infrastructure;
• Google also provides sign-in, if you choose it, and the basemap on Android activity-route screens. The Maps SDK processes technical request and device metadata, crash metrics, IP address and a Maps-specific pseudonymous identifier to provide and improve maps;
• Expo and platform push services for enabled mobile notifications;
• Sentry for crash and error reports — scrubbed before sending, so they carry technical detail and an opaque account identifier, never your content;
• Discord hosts our internal operations channel. It receives your name and email when you register, and — when you ask the assistant for something it cannot yet do — what you asked for, so the missing feature reaches the people who build it. That request is sent without your name, account or conversation attached;
• WHOOP when you choose to connect your WHOOP account; and
• Stripe (Stripe Payments Europe, Ltd., Ireland) when you buy a subscription. Stripe processes the payment and the billing data for it: card details, billing name and address, VAT number if you give one, the subscription and its invoices. Stripe also uses payment data to prevent fraud and meet its own legal obligations, and for those purposes it acts as a separate controller under its own privacy policy.

Which provider handles which task changes as models change, and several are configured as alternates that take over when another is unavailable or is not the right tool for a task. So what this page keeps current is the set of providers your information can reach — not a mapping of task to vendor, or the individual model names, both of which move too often to be useful here.

Where the conversation goes, stated plainly: replies are generated by DeepSeek, a provider based in China. To answer you it receives your message together with the health context that message needs — which can include your stored notes about yourself, recent conversation, active treatments and conditions, out-of-range lab markers, goals and habits. China has no European adequacy decision, so the protection given to that data there may be weaker than under EU law. The legal mechanism for this transfer is your explicit consent, given on the register form when you create the account — the form says this in the same words before you agree. You can withdraw it at any time by deleting your account. If you are not comfortable with the transfer, do not use KnowsYou during this beta — the assistant is the product, and there is currently no version of it that runs elsewhere.

These providers operate under their own terms and privacy obligations, and not all of them keep data in the same country as you. See Data & security for the current technical data flow.

4a. Android Health Connect

Where Health Connect is available in KnowsYou, connecting it is optional and requires a separate agreement in Settings before Android asks for access. We request read access only to steps, sleep sessions and stages, exercise sessions, distance, active and total calorie estimates, heart rate, resting heart rate and weight. You can allow individual types. We do not request routes, reproductive data, medical records, background health access or extended history access in this integration.

KnowsYou reads the records that other applications share with Health Connect on your Android phone. It sends the permitted measurements, timestamps, source application identifiers and record identifiers to your authenticated KnowsYou account over HTTPS. Individual heart-rate samples are reduced to averages and maxima before upload. We use imported data for your journal, activity and weight records, goals, energy estimates, conversation and reports. Relevant summaries can reach the AI providers and international destinations in section 4, including DeepSeek in China. The connection screen explains this before you agree. This integration does not train a general-purpose AI model, sell health data, or use it for advertising, credit, employment or insurance decisions.

Sync runs while KnowsYou is open, automatically on opening and on request. A new connection normally reads up to 30 days of prior data; availability depends on the source application. KnowsYou does not write to Health Connect. Changing Android permissions controls future reads; disconnecting in KnowsYou stops future uploads. WHOOP authorization is separate.

Imported records remain in your account until you remove them or delete the account. Settings offers separate Disconnect and Remove imported data controls on Android and web. Removing data also disconnects the integration and deletes its imported measurements and activities from the live product database; it preserves manual entries, direct WHOOP imports and data in the original source applications. Facts already copied into conversations, reports, saved memories or audit records remain until those records or your account are deleted. Backups can retain deleted information until the backup expires, currently up to 30 days. You can request access or deletion at the privacy contact above.

If you create an account API key, services you authorize with that key can also read imported Health Connect summaries and journal records through the account API.

5. Storage and security

Core account, conversation and structured wellness records are stored in the product database. Uploaded files are currently stored in a private DigitalOcean Spaces bucket in Frankfurt, Germany. The application uses authenticated, short-lived links when a client needs to retrieve a private file.

Deployed web connections use HTTPS. WHOOP access and refresh tokens are encrypted before they are stored, are not returned to the client and are not added to agent context. Security controls reduce risk, but no online service can guarantee absolute security.

6. Retention, memory and deletion

KnowsYou retains account and product records while they are needed to provide the service, preserve its audit trail, investigate problems and meet applicable obligations. A final, category-by-category retention schedule has not yet been adopted.

Invoices and the payment records behind them are kept for as long as tax and accounting law requires, also after an account is deleted. Invoices issued to customers in Romania are also reported to the Romanian tax authority's e-invoicing system (e-Factura), as Romanian law requires. Deleting your account cancels a running subscription and asks Stripe to delete your customer record there; the invoices already issued remain.

Raw conversation history and curated memories are separate. Asking the agent to forget a saved memory removes it from future active context by soft-deleting it; the audit record is still retained. It is not an immediate hard erasure of the underlying record or the messages from which it came.

Disconnecting WHOOP stops future imports and removes the local connection credentials. Previously imported records remain until they are deleted through a supported control or an account-data request.

7. Your choices and privacy requests

You can correct records by talking to the agent, manage notifications in the application, disconnect WHOOP from Settings — and delete your account and everything in it yourself, under Settings → Profile → Delete account, on the web and in the app (how deletion works). Depending on where you live, you may also have rights to access, correct, export, restrict, object to processing of, or delete personal information, and to withdraw consent where consent applies.

Send a request to privacy@knowsyou.ai. We may need to verify your identity before disclosing or changing account data. Applicable legal rights are not limited by the wording of this notice.

8. Public website data

The marketing site loads no advertising or analytics code from a third party and sets no tracking cookie. Normal hosting and network systems can still process technical request data, such as an IP address, timestamp, requested page and browser information, to deliver and protect the site.

Our ads link to the site with the campaign and the ad's keyword in the address (utm parameters). If you create an account during that visit, the site passes those parameters to the registration page and we store them with your new account, so we can tell which campaigns bring people who keep using KnowsYou. Nothing is written to your device for this, and nothing about you or your account is sent to Google or any other advertiser.

Sign-in and authenticated application sessions use the technical storage needed to keep you signed in and protect the account.

9. Changes and contact

This notice can change as the product, providers and launch markets change. Material revisions will be accompanied by a new effective date.

For privacy questions or requests, email privacy@knowsyou.ai. For a plain-language view of current processing and controls, read Data & security.