Back to Staxyz Terms of Service Consumer Health Data Privacy Policy Community Guidelines

Privacy Policy

This Privacy Policy is provided by Staxyz, Inc. Effective date: November 11, 2026. Last updated: November 10, 2026.

1. Who we are

Staxyz, Inc. ("Staxyz", "we") runs the Staxyz website and apps. Staxyz is a tool for logging supplements and wellness metrics. It is not a health care provider and does not give medical advice. Staxyz is not a HIPAA covered entity, so HIPAA does not apply to the information you give us.

This policy covers staxyz.com and the Staxyz apps. Staxyz is for people 18 and older who live in the United States. For consumer health data, also see our Consumer Health Data Privacy Policy.

2. Information we collect

(a) Invite requests

When you request an invite: your email address and, if you choose, a social media handle and its platform (Instagram, LinkedIn or X). Our team uses them to decide who to invite, which can include looking at that handle's public profile, and to email your invite. We don't sell or share them. We keep them until you ask us to delete them or we finish picking and sending invites. When you enter an invite code, we collect the code. If you've copied an invite code, the app can fill it in for you after you allow it to paste. Only the code is sent to us to check it, and the rest of your clipboard stays on your device. To tell you how long to wait after too many tries, the app also sends a random number made on your phone for that purpose only; we keep a scrambled form of it for 24 hours.

(b) Your account

Your Apple or Google sign-in or email address, display name, any profile photo you add (profile photos are public), and any birthday, height and sex you choose to add. Your plan and when it renews.

(c) Health and wellness records

Health and wellness records you add: what you take and when (doses, schedules, supplies, lot and certificate files), symptoms, check-ins, measurements, lab results and files you import, and food and meals. If you scan a barcode, the barcode number is sent to a public food database to look up the product.

When you speak a log entry, your phone turns your speech into text on the device. We don't receive or keep the audio, and we don't create voiceprints.

Apple Health. Only if you turn on Apple Health sync, we copy daily summaries of weight, resting heart rate, heart rate variability, sleep, steps, dietary energy, active energy, protein, carbs, fat, fiber and water to your account. Your Apple Health data is never sold or used for ads. It's shared only with our AI service provider, if you turn on Natt, to answer you, and with an AI assistant you connect through Connect Staxyz to my AI, if you allow it to read your health data.

(d) Natt, our AI assistant

Natt is powered by an outside AI service provider. Once you allow Natt, each time you ask it something we send that provider the text of what you type or say. We also send the parts of your Stack and log Natt needs to answer: your display name, protocols, doses, supply, adherence, injection sites, lot and certificate results, symptoms, measurements and lab results, plus, if you've turned on Apple Health, the Health figures you've allowed. Check-ins are not sent. The provider uses this only to answer you, under a contract that limits its use, and it may not train its models on it. Our moderation provider also screens every message you send to Natt.

When you talk to Natt in the app, your phone turns your voice into text, and your audio never leaves your phone. Natt's spoken replies are generated on your phone. If you use Siri to log a dose, Siri turns your voice into text under Apple's privacy terms, and that text is handled by the phone's own dose-log reader on your device. It isn't sent to Natt's AI.

Our AI service provider keeps what we send for up to 30 days and then deletes it automatically. It may keep it longer only if its safety systems flag it as breaking the provider's usage policy (up to 2 years) or the law requires it. We don't store your Natt conversations. We keep only counts, such as how many messages you send. You can turn Natt off in Settings at any time.

(e) Community posts and moderation

What you post in the Staxyz community, including your display name, posts and replies, can be seen by other members. Don't post anything you want to keep private. Deleting a post also deletes the replies under it. If you attach log details to a post, other members can see them. Members who can see your posts and replies, including in members-only groups, can also read them through their own connected AI using Connect Staxyz to my AI, without your name or handle. Photos you post are stored privately and shown only to signed-in members. A link to a posted photo works for up to an hour. Profile photos are public. We record which posts are shown to you and keep that for 7 days. If you turn on "Improve the Feed", we also record how long you view them and what you do (likes, taps and similar actions), and keep that for 180 days, to rank posts. Turning it off deletes that record.

To keep the community safe and enforce our Community Guidelines, our automated moderation system, provided by an outside moderation provider, screens the text of posts and replies, including titles, poll options and quoted text, before they appear, and screens every message you send to Natt. Profiles, reports and images aren't sent. Based on that screening, our system decides whether a post is published. If it isn't, we tell you why, and you can edit and resubmit it. Our team reviews reports and may remove posts or limit accounts that break our Community Guidelines. Posts that claim cures or extreme results may be shown to fewer members.

When you post or reply, we keep the screening result and a scrambled (hashed) version of your network (IP) address, to stop spam and abuse. We don't keep the address itself, and we delete the scrambled version after 90 days, or sooner if you delete the post, the reply or your account. When you delete a post or reply, its screening result is deleted too, unless we had already removed that content after a report or a block. In that case we keep our decision, without the scrambled (hashed) network address linked to it, to enforce our rules. We use this information only to run and moderate the community, respond to reports, and meet legal obligations. We don't sell it or use it for ads. We don't tell other members who made a report. The moderation provider uses what we send only to provide these services to us, under a contract that limits its use. Our moderation provider keeps what we send only as long as needed to provide its services to us, and it may not train its models on it.

If a post suggests someone may be at risk of self-harm, our system marks it so we can show the person who posted it support resources. This mark is used only for that safety purpose. It isn't shown to other members, isn't used for ads or profiling, and is deleted after 90 days, and from backups within 7 days after that.

(f) Usage, diagnostics and subscriptions

Usage and diagnostics. When you use the Staxyz app, we collect which screens and features you use. We tie this to a random analytics ID that isn't connected to your account, name, or health information, and we use it only to fix problems and improve Staxyz. On our website, a random ID stored in your browser is used the same way, and we don't set it if your browser sends a Global Privacy Control or Do Not Track signal. We don't sell this data, share it for advertising, or use it to track you across other companies' apps or websites. We also keep daily totals with no IDs attached, such as the number of deletion requests, opt-outs, survey scores and calls to our service providers.

This data never includes the compounds, doses, lab results or Health values you log. You can turn off usage stats in Settings. We keep usage and diagnostics data for up to 2 years, then delete it.

Subscriptions. When you start, renew, change or cancel a subscription, we record the event, the plan and its list price, to provide the subscription and understand how Staxyz is doing. These records are kept as daily counts and aren't tied to your account. Your current plan, renewal date and Apple's ID for your subscription are kept with your account so we can give you access. Apple keeps the price you pay; we don't store it. Payments are handled by Apple, and we don't receive your card details.

(g) Importing your history (Staxyz+)

When you import a file, Staxyz reads it on your device, in the iPhone app or in your web browser, and the file itself is never sent to us. We keep the file's name and size, a fingerprint of the file, and the entries that were matched. If some entries can't be matched, only the text of those entries is sent to our moderation provider, an outside AI service, to help match them. We ask your permission first. If you say no, everything your device matched still comes in. Our moderation provider keeps what we send only as long as needed to provide its services to us, and it may not train its models on it.

Screenshots and photos. If you allow it on its own permission screen, we send the images you pick to our moderation provider's AI, which reads the text in them. Crop out anything you don't want to share. Our moderation provider keeps your images only as long as needed to provide its services to us, and it may not train its models on them.

(h) Comparing lab-testing services

Staxyz can list blood-testing services from other companies so you can compare their panels and prices. Staxyz doesn't order, run or review tests, and these services don't pay Staxyz to be listed or matched.

If you tap "Match tests to my Stack," the app uses the compounds in your Stack to show which tests cover the markers listed for those compounds. The published sources for each compound are shown in the app. This matching happens on your device each time you tap. Your Stack is not sent to Staxyz's servers for this purpose, and nothing is sent to any testing service. We record that you used the feature and the version of the text you saw, but not the result. If you don't tap the button, services are shown in standard order and your Stack isn't used.

If you follow a link to a testing service, that company's own terms and privacy policy apply to anything you share with it.

(i) Credential badge (Staxyz+)

If you apply for a credential badge, we collect the name on your credential, the credential type (such as MD, PharmD or PhD), your license number and issuing state or the school and year of your degree, and the result and date of each check. We check this with the body that issued it, such as a state licensing board or the school. We don't ask for a photo of your ID, a selfie or a face scan. We use this information only to check your credential, show your badge and recheck it, and the badge shows only the credential type to other members.

(j) Community Stacks

Natt may summarize de-identified, combined themes from public community posts to answer other members' questions. It never quotes posts or names who wrote them, and it only uses topics posted by at least 25 members.

Help improve Staxyz is optional and off unless you turn it on. If you do, what you log is used only in de-identified, combined stats, to improve Staxyz and to build the Community Stacks totals other members see. You can turn it off anytime in Settings > Health and data.

Community Stacks shows the most-logged whole stacks across Staxyz, each made of two or more supplements, without amounts. It shows what members stack, not anything Staxyz suggests or recommends. The stacks come from de-identified, combined totals, built only from members who turned on both Help improve Staxyz and Health sync, and a stack is shown only when at least 25 members log that same stack. No member's name, handle or profile is attached to a stack.

(k) Connect Staxyz to my AI (Staxyz+)

If you use Connect Staxyz to my AI, we send the parts of your Staxyz data you choose only after you pick what to share and agree. If you turn on Let my AI add entries, your connected AI can also log doses, skips and symptoms (a logged dose counts down the linked supply) and suggest new or changed protocols and Stack items, which are added only if you confirm them in the app. We store what it adds like anything else you log, and you can edit or delete it. You can disconnect at any time, and it can no longer read or add anything. The company that runs your AI assistant handles what it receives under its own terms and privacy policy, not ours. We keep a record of which assistant you connected, what you allowed and each request it made (which tool and how many entries, not their contents).

(l) Share My (Staxyz+)

Share My lets you share parts of your log with another Staxyz member you pick by their @handle. You choose from three items: your schedule (what you take, how often and when it's next due), which days you logged, and, only if you turn it on, the amounts. Nothing else is shared, so the other member never sees your lots, sources, certificates, lab results, Apple Health data, symptoms, notes or photos. Before anything is shared, we show you who will see it and exactly what they'll see, and you agree. The other member then accepts or declines. Sharing is one way: they see your items, and you don't see theirs unless they choose to share with you. They see your items live in the app, can't download or export them, and we don't make a separate copy for them. Sharing stops right away when you tap Stop sharing, block them or delete your account, and you can change which items you share at any time. If your Staxyz+ plan ends, sharing pauses and they see "Paused". It starts again if you renew, and nothing is deleted. Shared items aren't used for analytics, research or Natt, and Connect Staxyz to my AI can't reach another member's shared view.

3. How we use information

4. When we share information

We share personal information only with:

Staxyz has no affiliates.

5. Sale and advertising

We do not sell your personal information or consumer health data. We do not share it for cross-context behavioral advertising, use it for targeted advertising, or let advertising companies collect it on our website or apps.

6. AI training

We do not use your personal information to train large language models, and we do not sell it for that purpose. Our AI service provider and our moderation provider may not train their models on it.

7. Your choices and rights

You can view and edit your records in the app, export them from Settings, turn Apple Health sync, Natt and usage stats on or off, and delete your account in the app.

To ask what we hold, get a copy, correct it, delete it, withdraw consent or appeal a decision, use Settings or email support@staxyz.com. You don't need an account to make a request. If you have one, we'll ask you to sign in. If not, we'll confirm by a reply or a one-time link sent to the same email. Someone you authorize may ask for you with your signed permission, and we'll confirm with you directly.

We answer within 45 days of receipt. We may extend once by 45 days and will tell you why. We complete deletion within 30 days of confirming it's you, and from backups within 7 days after that. Requests are free up to twice a year, and we won't treat you differently for asking. We use sensitive personal information, such as health information and sign-in details, only to provide Staxyz, so there is nothing to limit. For consumer health data, we also give, on request, a list of the third parties and affiliates we shared it with and how to contact them.

Deletion covers all parts of our systems, including backups (except the spreadsheet edit history described for invite requests in section 11), and we tell our service providers and anyone we shared with to delete too. Public community posts and replies are deleted with your account. Copies other people made outside Staxyz can't be recalled.

If we say no, you can appeal by replying or emailing support@staxyz.com with "Appeal". We'll answer in writing within 45 days. If we still say no, we'll tell you how to complain to your state Attorney General (Washington: atg.wa.gov/file-complaint; we'll give Nevada and Connecticut contacts in our response).

8. Do Not Track and Global Privacy Control

We do not track you over time or across third-party websites, and we do not allow other companies to do so through our website or apps. If your browser sends a Do Not Track or Global Privacy Control signal, our website doesn't set its random analytics ID.

9. Children

Staxyz is only for adults 18 and older. We don't knowingly collect information from anyone under 18. If we learn we have, we delete it. Contact support@staxyz.com.

10. Security

We protect information with access limits and encryption in transit and at rest, and we limit staff and service-provider access to what is needed.

11. How long we keep information

12. Changes

We'll post the new version here with a new date. If a change is material, we'll tell you by email or in the app before it takes effect. If we change how we use data we already have, we'll ask you first.

13. Contact

support@staxyz.com · Staxyz, Inc.