1. Information We Collect
Account Information
When you create an account, we collect your email address and password (stored in hashed form). You may also choose to provide your name, birthday, weight, height, and fitness goals.
Health & Nutrition Data
The App collects information you voluntarily enter, including dietary logs, nutritional intake, weight entries, calorie and macronutrient goals, and fitness-related preferences.
Usage Data
We automatically collect certain technical information such as device type, operating system version, app version, and general usage patterns to improve the App experience.
Advertising Identifiers & Attribution Data
We collect information used to understand how marketing campaigns lead to App installs, account registrations, and subscriptions. Depending on your device, permissions, and privacy settings, this may include your device's advertising identifier (such as IDFA on iOS or Google Advertising ID on Android), an AppsFlyer-generated installation identifier, IP address, device and App information, campaign and referral information, App install and open activity, your Mosaic account identifier, registration method, and subscription or purchase events. On iOS, we access IDFA only if you grant permission through Apple's App Tracking Transparency prompt. If you deny permission, we do not access IDFA, although non-IDFA information may still be processed for attribution and analytics.
2. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain the App's core functionality
- Personalize your nutrition and fitness recommendations
- Process your data through AI-powered features to deliver meal analysis, nutrition estimates, workout feedback, and other insights
- Improve, update, and expand the App
- Attribute installs, registrations, and subscriptions to marketing campaigns and measure advertising performance
- Communicate with you regarding your account or updates to the App
- Detect and prevent fraud or technical issues
3. Third-Party Services
Mosaic uses the following third-party services that may receive your data:
AI Service Providers (OpenAI & Anthropic)
Certain features of the App use third-party AI providers — currently OpenAI and Anthropic — to generate AI-powered nutrition insights, meal analysis, workout feedback, recommendations, and chat responses. When you use these features, relevant data (such as your dietary entries, food photos, workout entries, journal notes, profile context, questions, or summarized wearable and Health Connect metrics requested by Coach) may be sent to these providers for processing. Their use of this data is governed by their respective privacy policies. We use API configurations that opt out of training on your data, and these providers do not use commercial API data to train their models. Some features (such as on-device semantic search of your notes) run locally and do not send your data to any third party. AI-generated outputs can be incorrect or incomplete, so review important information before relying on it.
Backend Server
Your account and app data are transmitted to and stored on our secure backend servers. We use industry-standard security measures, including encryption in transit (TLS) and at rest, to protect your information.
Attribution & Subscription Services (AppsFlyer & RevenueCat)
We use AppsFlyer to attribute App installs and registration events to marketing campaigns and measure campaign performance. We use RevenueCat to manage subscriptions, purchases, and entitlements. We connect the AppsFlyer installation identifier to RevenueCat so subscription and revenue events can be attributed without Mosaic sending duplicate purchase events. These providers may receive the advertising identifiers, attribution data, account identifier, and subscription or purchase information described above and process that information under their respective privacy policies and our agreements with them.
We do not send health, wearable, biometric, nutrition, food-photo, attachment, journal, or Coach conversation content to AppsFlyer, and we do not use that information for advertising.
4. Wearable, Health Connect & Biometric Data
If you choose to connect WHOOP, Apple Health, or Health Connect, the App collects data from that source only after you explicitly opt in and complete the provider or system permission flow. You can deny individual Health Connect permissions and use the rest of the App, although features that need denied data will be unavailable.
Health Connect Data We Read and Why
On Android, Mosaic requests read-only access to the following Health Connect record types:
- Sleep Sessions (SleepSession): session start and end times and sleep-stage durations are used to show sleep duration, time in bed, light, deep, REM, and awake stages, sleep trends, and Mosaic sleep and recovery context.
- Heart Rate (HeartRate): heart-rate samples are reduced on the device to heart-rate-zone durations and exercise-session average and maximum heart rate. These derived values support visible workout details and the Mosaic Strain score; Mosaic does not upload the raw heart-rate sample stream.
- Heart Rate Variability (HeartRateVariabilityRmssd): daily average HRV is used in the Heart view, HRV trends, and the personalized Recovery score.
- Resting Heart Rate (RestingHeartRate): daily average resting heart rate is used in the Heart view, resting-heart-rate trends, and the personalized Recovery score.
- Steps (Steps): daily step totals are used for the Activity view, step trends, fitness progress, and activity context.
- Total Calories Burned (TotalCaloriesBurned): daily total energy burned is used for the visible calories-burned and activity views.
- Exercise Sessions (ExerciseSession): exercise type, start and end time, duration, and derived heart-rate details are used for visible activity counts, workout history, activity context, and strain.
- VO2 Max (Vo2Max): the available daily VO2 max value is shown in the Performance and oxygen view.
- Oxygen Saturation (OxygenSaturation): daily average SpO2 is shown in the Performance and oxygen view and, after a personal baseline is available, contributes to recovery context.
- Respiratory Rate (RespiratoryRate): daily average respiratory rate is shown in the Performance and oxygen view and, after a personal baseline is available, contributes to recovery context.
- Weight (Weight): the latest available weight measurement in the sync window is shown in the Body and metabolic view and in body-measurement details.
Health Connect Sync, Upload, and Storage
Health Connect records are read on your device when you connect Health Connect, request a manual sync, or return to and use the App. The first foreground sync reads a bounded window of up to the previous 30 days; later foreground syncs re-read a shorter recent window so corrections and new records can be reflected. Mosaic does not request Health Connect's background-reading or extended-history permissions.
On the device, Mosaic converts permitted records into daily summaries, sleep sessions, exercise sessions, derived heart-rate zones, and selected body measurements. These values are encrypted in transit and uploaded to Mosaic's backend. Mosaic stores the uploaded values, normalized wearable records, and derived daily scores with your Mosaic account so it can show synchronized history, dashboard metrics, trends, and personalized sleep, recovery, strain, and health scores across sessions. Mosaic never receives or stores your Health Connect account credentials.
Other Direct Device Connections
WHOOP connections use WHOOP OAuth, while Apple Health is read on your device after its native permission prompt. Mosaic never receives or stores your Apple Health credentials.
Purpose limitation and sharing. Wearable and biometric data is used to provide the user-facing features described above and to operate, secure, and improve those features. If you ask Coach a question that calls for wearable context, relevant summarized metrics may be processed by the AI service providers described in Section 3 to answer that request. We do not sell wearable or Health Connect data, provide it to data brokers, use it for advertising, or share it with third parties for their own independent purposes.
Retention & deletion. Disconnecting Health Connect or revoking its permissions stops future Health Connect collection, but it does not erase Health Connect data already uploaded to Mosaic because that history remains available in your account. Deleting your Mosaic account deletes the associated Health Connect connection record, uploaded payloads, normalized sleep, exercise, body, and daily records, and derived wearable summaries. The general retention terms in Section 6 apply.
5. Data Sharing & Disclosure
We do not rent or trade your personal information. We may disclose your information in the following circumstances:
- With service providers who assist in operating the App (as described above), under contractual obligations to protect your data
- With AppsFlyer, RevenueCat, and participating advertising or attribution partners to attribute installs, registrations, and subscriptions and measure marketing performance
- If required by law, regulation, or legal process
- To protect the rights, property, or safety of Mosaic, our users, or the public
- In connection with a merger, acquisition, or sale of assets (you will be notified of any such change)
Some privacy laws may define disclosures of advertising identifiers for advertising measurement as a "sale," "sharing," or use for "targeted advertising," even when no money is exchanged. Where applicable, you may exercise the opt-out rights described in Section 7. We do not sell or share health, wearable, biometric, nutrition, food-photo, attachment, journal, or Coach conversation content for targeted advertising.
6. Data Retention
We retain your personal information, including uploaded Health Connect data and derived wearable records, while your account is active or as needed to provide the App's services. Disconnecting a wearable preserves existing history but stops new collection from that source. If you delete your account, we will delete or anonymize personal data associated with the account within 30 days, except where retention is required by law.
Attribution and subscription providers may retain identifiers and event data for the periods described in their privacy policies and our agreements with them, including as needed for attribution, fraud prevention, reporting, legal compliance, and aggregated or de-identified analytics.
7. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access, correct, or delete your personal data
- Withdraw consent for data processing
- Request a portable copy of your data
- Opt out of certain data uses, including the sale or sharing of personal information or targeted advertising where applicable
Marketing measurement is optional. You can grant, decline, or withdraw your consent at any time under Mosaic Settings > Privacy > Marketing measurement. If you turn it off, Mosaic stops AppsFlyer attribution collection and no longer sends new device identifiers or App events to AppsFlyer for marketing measurement. You can also limit access to advertising identifiers through your device settings. On iOS, you can change Mosaic's tracking permission under Settings > Privacy & Security > Tracking. On Android, you can reset or delete your advertising ID in your device's privacy settings. These choices do not affect the App's core functionality.
To exercise your rights or request that we stop using your information for targeted advertising, contact us using the information below.
8. Children's Privacy
The App is not directed to individuals under the age of 13 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have collected data from a child without parental consent, we will take steps to delete that information promptly.
9. Security
We implement reasonable administrative, technical, and physical safeguards to protect your information. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" at the top of this page and, where appropriate, notify you within the App. Your continued use of the App after changes are posted constitutes your acceptance of the updated policy.
11. Contact Us
If you have questions or concerns about this Privacy Policy or your data, please contact us at:
[email protected]