Privacy

What is recorded

Everything below is something you entered, something you chose, or something the Catalyst store already holds about your orders. Nothing is inferred about you, and nothing is bought from anyone.

• Doses: the amount in milligrams, the site you injected, the date, and any note you added.
• Weights, body measurements, symptoms and how strong you said they were, and notes you wrote.
• Progress photos: the image, a smaller copy of it, the view you framed, the day you took it, and your note.
• The protocol you chose and every change to it — a new plan, a pause and the reason you gave, a move to maintenance, a dose you marked skipped.
• Medication history and age: whether you have taken a GLP-1 medication before and, if so, which one (semaglutide, tirzepatide or another), and your age as a whole number. Setup asks each once and moves on when you have answered.
• The units you read in and the goal weight you set.
• Which articles and videos you have opened, finished, or saved.
• Your Catalyst orders: the order number, the date, what was in it, and what the store recorded about shipping.
• What is on your counter: how many vials of each strength you said you still have, which one you are using, how many doses have come out of it and how big each of those was, whether you had already taken that day's dose, and the day you counted them.
• Once sign-in is switched on: the email address Google verified, the identifier Google issues for you, and one row for each signed-in device so that a session can be ended.

Where it is kept

One Postgres database, on the server. Every row carries the account that wrote it, and every read is narrowed to that account before the query runs.

None of it is kept in your browser's own storage. This app has no local database, and the build refuses code that would add one.

A photo is kept as bytes in a column of your own account's row, not as a file at a public address. There is no link to it that anyone could guess or pass on: the bytes come back only to a request already signed in to the account that owns them, and that response is marked private and never cached.

Who can see it

You, on your account. No screen shows one account's record to another, and every read is narrowed by account before it returns anything.

Catalyst can reach the database, because somebody has to run it. The one internal tool that exists — the console that sends Catalyst's announcements — sees how many people can be reached and in which language, and nothing else: it is built so that it cannot read a dose, a weight, a symptom, a photo or an order, and a test walks its code on every build to keep it that way.

What leaves this app

Nothing about your record is sold, handed to an advertiser, or sent to an analytics service. There is no analytics and no tracking code in this app. Four things do go out, and these are all of them.

• The Catalyst store is asked which orders belong to the email address on your account. It is Catalyst's own store, not another company.
• Google is asked to confirm who you are when you sign in. Google is told nothing about your record.
• A reminder is handed to the push service your browser maker runs. It carries no health data by design: which kind of reminder it is, your language, a version number, and a random identifier for that one message. Nothing else fits in it. Every word you read on your lock screen is written on your own device from those four fields.
• The news digest and the video thumbnails are fetched by the server rather than by your browser, so the publishers behind them are never told who is reading.

How long it is kept

Your record is kept until it is deleted. Nothing expires on its own, and nothing is thinned out over time.

Deleting an entry or a photo deletes it. The row is removed from the database, and for a photo the image bytes go with it. It leaves every screen, every chart and every export at once, and it cannot be undone — which is why you are asked first.

Taking your record with you

Two exports, each covering your whole record: a printable summary to take to an appointment, and the same entries as a spreadsheet.

Both are on the Progress screen. Each is an ordinary link that works with no JavaScript, is narrowed to your own account, and is never cached anywhere.

Deleting it

A dose, a weight, a measurement, a symptom, a note and a photo can each be deleted in the app, from the entry itself.

Three things cannot: a protocol change, a pause or a move to maintenance, and a dose you marked skipped. Each one is part of the schedule you are on rather than a note about it, so the app shows them and offers no control that removes one.

The answers you gave about earlier medication and your age are not entries in the Record, and there is no control that removes either one on its own.

There is no control that erases a whole account yet, and this page will not pretend otherwise. Where to write to ask for one is a decision Catalyst has still to make, and it belongs here before this page is published.