Gallen is an independent app. It is not affiliated with, endorsed by, or connected to any device maker. This policy says what data Gallen handles, where it goes, and what you can do about it.
Who is responsible: [Placeholder: legal entity name, registered address, contact email, country]
Sections marked TODO could not be verified yet or need a decision.
1. The short version
- Your raw sensor data (heart rate, beat-to-beat intervals, motion) stays on your phone. Gallen never sends it to a server.
- AI insights are off by default. If you turn them on, a small numbers-only summary is sent to Gallen's AI service and on to an AI provider.
- If you create an account, your derived data (daily scores, chart series, journal, workouts, profile) is copied to Gallen's server. Raw samples, Bluetooth identifiers and keys are not.
- You can export everything, and you can delete your account.
2. Stored only on your phone
Gallen keeps your raw samples, derived scores, journal, workouts and settings in its private storage on your phone. None of this leaves the phone unless you use one of the features below. Removing the app removes this data.
TODO (owner): confirm Android auto-backup behaviour for the final build.
Your own exports. More, Export my data creates a copy of the database, including raw samples, and opens your phone's share sheet. Where it goes after that is your choice and outside Gallen's control.
3. AI insights
When you turn on AI insights (More, AI insights), Gallen sends requests to Gallen's AI proxy. The proxy is a Cloudflare Worker that adds fixed instructions and forwards the request to OpenAI's API, then returns the answer. Gallen checks every number in the answer against your stored data before showing it.
- Morning briefing: one day's summary. Coach chat: up to 30 daily summaries plus the conversation so far (up to 12 messages, each up to 1,000 characters).
- Each daily summary holds: the date; whether Gallen is still calibrating; the journal tag names you picked (from a fixed list, such as "alcohol" or "late_meal"); a few words saying whether recovery drivers are better or worse than usual; and a list of numeric facts written as short text, each with an id and a short label.
- What you type in the Coach is sent as you typed it. Do not include your name, location or other personal details in it.
- Technical data every internet request carries: your IP address, a shared app key, and your random install id.
What is never sent: raw heart rate, R-R intervals, motion or temperature readings; your name, email, location, journal notes, device name or Bluetooth id; anything at all while AI is off.
The proxy code does not store request bodies or answers. It keeps rate-limit counters per install id (20 requests a minute) and globally (120 a minute). Gallen asks OpenAI not to store the request (store: false).
- TODO: Cloudflare Worker logging is switched on at full sampling. Confirm what Cloudflare logs for these requests (metadata such as URL, status and IP) and for how long.
- TODO: OpenAI's own retention for API requests and whether data is used for training are set by OpenAI's terms and account settings. Verify and state them here.
- TODO: confirm a data processing agreement with OpenAI and Cloudflare is in place.
You can turn AI off at any time; the app then uses offline, rule-based insights and sends nothing.
4. Account and sync
The app works without an account; you need one only to download the beta from the dashboard and to use the dashboard or sync. If you sign in, Gallen copies derived data only to Gallen's server so a web dashboard or a second screen can show it: daily scores, downsampled chart series, journal entries, logged workouts and profile fields, the list of devices signed in to the account, and your email address, used for sign-in with a 6-digit code. Gallen has no password.
Signing in uploads nothing: sync is a separate switch, off by default, and turning it on records a consent on the server. TODO (owner): GDPR legal basis (explicit consent, Article 9), hosting region, and backup retention for deleted accounts.
Never copied: raw heart-rate samples, R-R intervals, motion data, Bluetooth identifiers, a ring's key, or your install id. The AI Coach chat text is not copied either. TODO: decide and state whether the cached morning briefing is.
The server records technical data needed to run the service: sign-in sessions, a sync log (when a device synced and how many rows, never health values), which device writes the account's scores, how far each device has synced, your consent decisions, and for sign-in codes the requesting IP address. Journal notes are stored readable by the server in this version. TODO: list web server log contents and retention.
5. Health Connect
If you turn on Share with Health Connect, Gallen writes heart rate, sleep (asleep and awake only, no stages), steps, resting heart rate, heart rate variability and exercise sessions to Android Health Connect. Gallen requests no read permission and does not read other apps' health data. You can turn the export off in Gallen and revoke access in Health Connect at any time.
6. Permissions
- Bluetooth (scan and connect, declared as not used for location) to talk to your strap or ring.
- Notifications and a foreground service, so Gallen can stay connected and sync about every 30 minutes with the app closed; plus the permissions the smart alarm, bedtime nudge, Sunday recap and workout notices need. These run on the phone and send nothing anywhere.
- App updates: Gallen checks Expo's update service (EAS Update) for new app code. That request carries your IP address and technical details such as app version and platform. No health data.
- No advertising, third-party analytics or crash-reporting library is included. TODO: re-check before each release, and confirm the final Android manifest lists no other permission.
7. Your rights
- Access and export: More, Export my data gives you everything stored on the phone. Account, Export my account data gives you everything on the server as one file.
- Delete: deleting the app removes the data on the phone. Deleting your account removes every row of yours on the server at once, including the sign-in codes sent to your address. TODO: backup retention, so deletion from backups is complete.
- Withdraw consent: turn off AI insights, Health Connect export or sync at any time. Turning a feature off does not recall data already sent; for the server, delete the account.
- How long we keep data: on the phone until you delete it; on the server until you delete the account. TODO (owner): decide fixed retention periods, including for inactive accounts and backups.
- TODO: add the lawful basis (health data is special-category data; consent is the likely basis) and how to exercise further rights in the EU/UK.
8. Security
- Sign-in codes are stored only as keyed hashes, expire after 10 minutes and allow 5 attempts, with a limit of 3 codes an hour per address.
- Access tokens last 15 minutes. Refresh tokens last 60 days, rotate on use, and a replayed token revokes that sign-in.
- Every server table is protected by per-user Row Level Security in the database, in addition to the API checking the signed-in user.
- Traffic to the server and to the AI proxy uses HTTPS.
- TODO: encryption at rest depends on the hosting setup; confirm. No security audit has been done. TODO: breach notification process.
9. Children
Gallen is not intended for people under 16 (TODO: confirm age threshold by region). We do not knowingly collect data from children.
10. Not medical advice
Not medical advice
Gallen's scores and insights are estimates for personal interest. Gallen is not a medical device and does not diagnose, treat or prevent any condition.
11. Changes
We will update the date above when this policy changes, and ask for your consent again if a change affects the data a feature sends. TODO: how users are notified (in-app notice, email).
12. Contact
TODO: legal entity, postal address, email for privacy requests, and (if serving the EU/UK) the EU/UK representative and data protection officer if one is required. Region where data is hosted: TODO.