Privacy policy

• Your account: your email address, and a password if you choose to set one (stored only as a secure hash by our sign-in provider).
• What you enter: vials, protocols and schedules, doses you log, notes, daily check-ins, journal entries, bloodwork results, feedback and your settings. If you upload a lab report, we keep only the results you check and save, never the file itself.
• Your devices: if you turn on reminders, the push address your browser gives us for that device, and the device and browser type so you can tell your devices apart. If you make a calendar link, we keep only a fingerprint of it, not the link.
• On your device: a copy of today's doses and any logs waiting to be sent, so the app works offline. Signing out deletes them.
• The email list: your email, which emails you asked for (launch news, research updates), the page you joined from, when you unsubscribed, and a scrambled (hashed) version of your IP address used only to stop spam.
• Visit counts (public pages only): the page you opened, the site or campaign that sent you (on your first page), your country and whether you're on a phone, tablet or computer. No cookies, and never your IP address: it's mixed with a random code that changes every day and is then thrown away, so we can count each visitor once a day without knowing who they are or following them from day to day.
• Server logs: our hosting provider keeps standard request logs (such as IP address and browser type) for security and troubleshooting.

• To run the app for you: your schedule, reminders, low-stock alerts and calendar link.
• To send sign-in codes to your email.
• To email you launch news or research updates, only if you asked for them. Every email has a one-click unsubscribe.
• To send the push messages you turned on in Notifications: research updates, offers or a weekly app tip. All three are off unless you turn them on.
• To answer you when you write to us, and to improve Dosaly from feedback you send.
• To keep the service secure and working.

Information about doses and how you feel is health-related. We use it only to run Dosaly for you.

• Sell your data, or share it for anyone's marketing.
• Show ads, or put ad networks or tracking pixels in the app.
• Recommend doses or compounds, or pass your data to anyone who sells them.

The buying guide can show one lab. Following that link tells the lab only that you came from Dosaly, nothing about you or what you track.

The app has no analytics. The public website counts visits itself, as described above: nothing goes to an outside analytics company and no analytics cookies are used.

These providers process data on our behalf, only to provide their service:

• Supabase: database and sign-in. Your data is stored in the United States (Oregon).
• Anthropic: when you upload a lab report, its AI (Claude) reads the file once to copy out the results for you to check. Dosaly doesn't keep the file, and Anthropic doesn't use it to train its models.
• Netlify: hosting, and the scheduled jobs that send reminders.
• Resend: delivers sign-in emails and the list emails you asked for.
• Your device's push service (Apple, Google or Mozilla): delivers reminders. A reminder shows as much as you choose in Notifications: the protocol and amount, just “Dose reminder”, or a neutral line.

Everything travels over encrypted connections and is encrypted at rest by our database provider. Each account can only reach its own data, enforced by the database itself. Your journal is private to your account but isn't end-to-end encrypted: like the rest of your data, it's stored on our servers.

• Download everything, or your dose log as a spreadsheet, from Settings.
• Delete your account and all of its data from Settings. It's removed from our live database at once; copies in encrypted backups expire within 30 days.
• Change what reminders show, or turn them off, in Notifications.
• Ask us anything about your data, or to correct it, at hello@dosaly.com. Depending on where you live, you may have further rights (for example under the GDPR or California law); write to us and we'll help.

We use cookies only to keep you signed in, and your browser's storage for your theme and the offline copy described above. No advertising or tracking cookies.

Dosaly is for adults 18 and over. We don't knowingly collect data from anyone younger.

If we change this policy, we'll update the date above, and tell you in the app if the change matters. Questions: hello@dosaly.com.