Legal
Privacy Policy
Effective date: October 8, 2026
The short version
- Staq is a social app, and most of what you put in it is visible to other people. Your profile, your staq (what you take, how much and when), your posts, comments, lists and follows can be seen by every signed-in Staq user.
- When you change your staq, Staq posts about it automatically. Adding a product, removing one or changing how you take it creates a post that every signed-in user can see. Details below.
- What you take can say something about your health. Please treat your staq the way you would treat anything else you post publicly.
- We use two AI services, Anthropic and Voyage AI, to build your starter staq, to check posts automatically, and to power search. Exactly what they receive is listed below.
- There is no advertising in Staq. We have no advertising or third-party analytics code in the app or on this site, we do not track you across other companies' apps or websites, and we do not sell your personal information.
- Staq is for people aged 18 and over.
Who we are
Staq is operated by Bill Chan, an individual doing business as "Staq" in New York, New York ("Staq", "we", "us"). This policy covers the Staq iOS app and this website, trystaq.app.
Mail: 225 Cherry St, New York, NY 10002
Email: support@trystaq.app, which we check at least once every 24 hours.
What we collect and why
Everything in these tables comes from you or from your use of the app. We do not buy data about you from anyone. The last column lists the companies that receive each item. Which of it other Staq users can see is set out in the next section.
Your account
| What | Why | Which companies receive it |
|---|---|---|
| Your phone number | To sign you in. We text you a one-time code instead of using a password. | Our sign-in provider and the text-message carrier that delivers the code. |
| A second sign-in method: Apple, Google, or an email address | So you can get back into your account if you lose your number. | Apple or Google, if you pick one of them. They tell our sign-in provider who you are, usually an account identifier and your email address, sometimes your name. The app itself records only which method you chose and when. If you pick email, we store the address and send it a code. |
| Your date of birth, and your confirmation that you are 18 or older | Staq is for adults only. We also use your age, not your birth date, when building a starter staq. | No company receives your date of birth. Anthropic receives your age as a number. See "AI processing" below. |
| The time you accepted our terms, and which version | A record that you agreed. | None. |
Your profile
| What | Why | Which companies receive it |
|---|---|---|
| First and last name, username, bio, profile photo, banner photo | Your public profile. | Voyage AI receives your name, username and bio so that people search works. See "AI processing". |
| Sex, height and weight | The app asks for these during setup and uses them to build your starter staq. | Anthropic, when you ask for a starter staq. |
| Your goals and experience level | To build your starter staq and to make your profile and staq searchable. | Anthropic and Voyage AI. |
| Streak, longest streak, points, level, date of your last check-in, follower and following counts | The app calculates these from what you do. | None. |
What you take
| What | Why | Which companies receive it |
|---|---|---|
| Your staq: the supplements, peptides and other products you say you take, with servings, timing, frequency and cycle days | This is the core of the app. | Anthropic and Voyage AI. See "AI processing". |
| Notes the app writes about your staq: an AI summary, and for an AI-built staq the reasoning behind each item | To explain the staq to you and to others who view it. | Generated by Anthropic. |
| Daily check-ins: which product, which time of day, whether you took it, and when you logged it | Your intake log, calendar and streak. | None. |
What you post
| What | Why | Which companies receive it |
|---|---|---|
| Posts: title, text, photos, tags, and any product, compound or study you attach, including dosing if you choose to include it | The feed. | Anthropic receives the text of each post for automated moderation. Voyage AI receives the title, text and tags, with your name and username, so posts are searchable. |
| Comments, votes, follows, bookmarks, product ratings, the lists you make and the lists you save | The social features. | None. |
| @mentions | To notify the person you mention. They receive a notification with the first 50 characters of your post. | None. |
| Reports you file about a post | So we can review it. | None. |
Your device
| What | Why | Which companies receive it |
|---|---|---|
| Camera | Only to scan a product barcode. Staq does not save or upload pictures from the scanner. | If our own catalog does not know the barcode, your phone asks Open Food Facts, a public product database, directly. Open Food Facts receives the barcode and, like any website you contact, your IP address. |
| Photo library | Only the photos you pick for your profile, a post or a list cover. | None. |
| Storage on your phone | Your sign-in session is kept in the iOS Keychain. Post drafts, a cached copy of part of the product catalog, and a few settings are kept in the app’s local storage. | Nothing. This stays on your phone. |
How you use the app
| What | Why | Which companies receive it |
|---|---|---|
| Activity records tied to your account: app opens and closes and session length; which screens you visit and for how long; which products, compounds, profiles, posts and staqs you view or tap; check-ins, votes and follows; which profile fields you edit; and the text of your searches | To understand how the app is used, to fix what is broken, and to rank the feed. | None. These records stay in our own database. |
| Crash and error reports | To find and fix bugs. | Sentry. A report carries your Staq account ID (never your phone number or email), your device model and iOS version, and the last steps before the error: recent taps, recent network request addresses and app log lines. Text you were typing into people search or an @mention can appear in those addresses. |
| Search text | To find products, studies, people and posts that match what you meant, not only the exact words. | Voyage AI receives the search text by itself, with no name, account ID or IP address attached. We keep a cache of search phrases, not linked to any account. |
| Your search history: your recent searches, and the products, brands, compounds, people and lists you open from search results. We keep the newest 100 entries. | To show your recent searches and the things you opened in the search box, on any phone you sign in on, and to order your own search results: products you opened before, products on your staq and brands you already take are placed higher for you. | None. It stays in our own database, and no other user can see it. |
| IP address and basic device information | Every internet service receives these in order to answer a request. | Our hosting providers log them. Separately, product pictures in the app load straight from wherever they are hosted (for example Amazon’s image servers, brand websites, the U.S. National Institutes of Health label database, Open Food Facts, Unsplash), and those hosts see your IP address when a picture loads. |
What other people can see
Every signed-in Staq user can see: your name, username, bio, profile and banner photos, goals and experience level; your streak, points, level, the date of your last check-in, and your follower and following counts; your staq, including each product, its servings, timing and frequency; your posts, comments and votes; the lists you make and the lists you save; who you follow and who follows you; and the products you bookmark or rate.
Staq does not currently offer private accounts, and there is no setting that hides your staq from other users.
Other users cannot see: your phone number, your email address, your date of birth, your sex, height or weight, your daily check-in history, your notifications, your activity records, or the reports you file.
Photos are stored at unprotected web addresses. A photo you upload (profile, banner, post or list cover) is shown to signed-in users inside the app, but the file itself sits at a web address that is not password-protected. Anyone who has that exact address can open the photo, with or without a Staq account.
Blocking. If you block someone, or they block you, the two of you stop being able to see each other's profile, posts and comments, and any follow between you is removed. That is enforced by our database, not only hidden in the app. It does not reach everything:someone you have blocked can still see your staq, and can still come up in search results. Blocking is in Settings, under Blocked accounts, and the person is not told.
People who are not signed in cannot browse profiles, staqs or posts. The exception is a share link you create on this website, which anyone with the link can open. See This website.
Automatic posts about your staq
When you add a product to your staq, remove one, or change how you take it (servings, timing, frequency or cycle days), Staq automatically publishes a post saying so, for example "Added Magnesium Glycinate". For a dosing change the post includes the old and the new dosing.
Every signed-in user can see these posts, not only the people who follow you.
There is currently no setting that turns these posts off, and you cannot delete one from inside the app. To have one removed, email support@trystaq.app.
AI processing and automated moderation
We send data to two AI companies. This is everything they receive.
Building your starter staq (Anthropic)
When you ask Staq to build a starter staq, we send Anthropic: your goals, the approach you chose, your sex, your age as a number, your height and weight, and the brand, name and main ingredients of the products you told us you already take. We do not send your name, username, phone number, email, date of birth or account ID. The result is written by an AI model. It can be wrong, and it is a starting point for a conversation with a clinician, not advice. See the Medical Disclaimer.
Automated moderation of posts (Anthropic)
The text of every post you write is checked automatically by an AI model run by Anthropic. We send the text only, not your name, account ID, the title or the photos. If the model judges that the post breaks our rules, the post is hidden automatically, without a person reviewing it first, and the app does not currently notify you. Automated checks make mistakes. If you think a post of yours was hidden wrongly, email support@trystaq.app and a person will look at it. Photos, titles and comments are not checked automatically.
Search (Voyage AI and Anthropic)
Staq's search works on meaning, not only on matching words. To do that, text is converted into a list of numbers by Voyage AI:
- What you search for. The text of your search, with nothing attached that identifies you.
- Your profile. Your name, username, bio and goals.
- Your posts. Title, text and tags, with your name and username.
- Your staq. Its name, summary, tags and goals, with your name and username.
Anthropic also receives your staq's name, goals, summary and the names of the compounds in it, to generate search keywords for it.
Anthropic and Voyage AI process this data for us under their own terms for business customers. The links to their privacy information are in the next section.
Who receives your data
Other Staq users, as described inWhat other people can see.
Companies that process data for us:
- Supabase hosts our database, sign-in system, file storage and server code. Everything in this policy that we store, we store there.
- Twilio delivers sign-in codes by text message. It receives your phone number and the code. twilio.com/legal/privacy-notice
- Anthropic runs the AI models described above. anthropic.com/legal/privacy
- Voyage AI converts text into search vectors, as described above. voyageai.com/privacy
- Sentry (Functional Software, Inc.) receives crash and error reports.
- Apple and Google, if you choose to sign in with them. Apple also distributes the app.
- Vercel hosts this website.
Services your device contacts directly: Open Food Facts, for a barcode our catalog does not know, and the hosts of product pictures. They receive your IP address and the barcode or picture being requested, and nothing about your account.
We do not sell your personal information. We do not share it for advertising. There is no advertising SDK, no third-party analytics SDK and no cross-app tracking in the app, and no analytics, cookies or tracking pixels on this site.Phone numbers and text-message consent are never shared with third parties or affiliates for marketing purposes.
We may disclose information if a law, court order or other legal process requires it, or where we believe it is necessary to protect someone's safety or to investigate abuse of the service. If the operation of Staq is transferred, for example to a company formed to operate it, or as part of a merger, a sale of the business or its assets, or a financing, your information may be transferred as part of that, subject to this policy.
This website
trystaq.app sets no cookies and runs no analytics. It collects information in three places.
Reserving a username
The reserve form takes a username and a phone number and stores them so that the username is held for that number, and so that we can text that number when Staq launches. If you use "Fix my staq", the products you graded, your score and your share link are stored with the reservation. We do not verify the phone number and we do not record your IP address. To preselect the country code, the site asks our host which country your connection comes from; the host reads that from your IP address, and the answer is not stored. As you type, the site checks whether the username is free; that check is not stored. The reservation is also saved in your browser's local storage (your phone number, username and country) so the site remembers it. Clearing your browser's site data removes that copy.
Grading a staq
Searches you run in the grader are sent to our database to find matching products. They are answered and not stored. Your score is calculated in your own browser. Product pictures load directly from the sites that host them, which see your IP address but not the page you are on.
Share links
"Share my score" stores the first name you enter together with the products, servings and timing in your staq, and creates a page at a link like trystaq.app/s/abc12345 plus a preview image. Anyone who has the link can open that page; we ask search engines not to index it. We count how many times the page is opened. A share link does not expire. To have one deleted, email us the link.
Our website host and database host log IP addresses and browser information for every request, as all hosting providers do.
How long we keep it
We keep your account, profile, staq, check-ins, posts, comments and activity records for as long as your account exists. We do not yet run automatic deletion schedules on those records. The one exception is the cache of search phrases, which is not linked to any account and is cleared of entries that have gone unused for 45 days.
Your search history holds only your newest 100 entries; older ones are deleted as new ones arrive. You can remove a single entry or clear all of it from the search box, and it is deleted with your account.
Website reservations and share links are kept until you ask us to delete them.
When you delete something in the app it disappears from other users' view straight away. Residual copies can remain in our internal systems, including our search index and backups, until they are cleared. A comment you delete is hidden rather than erased. A photo attached to a post you delete stays in storage until you ask us to remove it or your account is deleted.
Deleting your data and other requests
You can edit your profile, your staq, your posts and your lists in the app at any time.
Deleting your account
In the app, open your profile, then Settings, then Delete account. You confirm in four steps, the last of which asks you to type the word DELETE. There is no waiting period and no way to undo it: your account is deleted straight away and you are signed out.
That deletes your profile, name and photo; your staq and everything you have logged; your posts, comments and votes; your lists, and who you follow; and your streak and history. It also deletes the images you uploaded — profile, banner, post and list-cover photos — from our file storage.Photo deletion is best effort: if a file cannot be removed at that moment it is not retried, so email us if you need confirmation that every image is gone.
Two things do not go with it:
- If you give a reason for leaving on the way out, that reason and any note you write are kept. They are stored on their own, with no link to you — no name, no account number — alongside how many days the account existed. They cannot be traced back to you, and for the same reason we cannot delete a particular one on request.
- A username you reserved on this website is held against a phone number rather than an app account, so deleting the app account does not remove it. Email us to have it deleted.
You can also email support@trystaq.app and ask us to delete the account for you. We will check it is you first.
You can also email us to ask for a copy of the data we hold about you, to correct something, or to delete a website reservation or a share link. We may need to verify your identity first. See also Support.
Security
All traffic between the app, this site and our servers is encrypted in transit (HTTPS). Records that are private to you, such as your check-in history and activity records, are protected by database rules that limit access to your own account. Your sign-in session is stored in the iOS Keychain. Staq does not use passwords: you sign in with a one-time code, or with Apple or Google.
No system is perfectly secure and we cannot guarantee that yours will never be breached. If we learn of a breach that affects you, we will notify you as the law requires.
Adults only
Staq is for people aged 18 and over. We ask for your date of birth and for your confirmation that you are an adult before you can use the app. We do not knowingly collect information from anyone under 18. If we learn that someone under 18 has an account, we will close it and delete their information. If you believe a minor is using Staq, email support@trystaq.app.
Where your data is processed
Staq is operated from the United States and our database is hosted in the United States. The companies listed above may process data in the United States and other countries. If you use Staq from outside the United States, your information is transferred to and processed in the United States, where privacy laws may differ from those where you live.
California
Do Not Track and Global Privacy Control. Staq does not track you across other companies' websites or apps, and does not let anyone else do so through our app or this site. Because there is no such tracking to switch off, a Do Not Track or Global Privacy Control signal does not change how the site behaves.
Selling and sharing. We do not sell personal information, and we do not share it for cross-context behavioral advertising, as California law defines those terms. We have not sold or shared personal information in the 12 months before the effective date of this policy. We do not disclose personal information to third parties for their own direct marketing.
Your rights. Whatever our size, and whether or not California law requires it of us, we offer every user what that law gives its residents: the right to know what we hold about you, to get a copy, to correct it, and to have it deleted, and the right not to be treated differently for asking. The categories we collect, why, and who receives them are set out above. Some of it is sensitive under California law (account sign-in details, and information about what you take); we use it only to run the service described here. To make a request, email support@trystaq.app. You may use an authorized agent; we will ask for proof of their authority.
Consumer Health Data Privacy Policy
This section is for residents of Washington State and Nevada, and for anyone whose information we collect there. It is provided under the Washington My Health My Data Act and Nevada Senate Bill 370. Those laws define "consumer health data" broadly, as personal information that identifies a person's past, present or future physical or mental health status. Some of what Staq holds may qualify.
The consumer health data we collect, and why
- The supplements, peptides and other products you say you take, with servings, timing and frequency, and your daily check-ins.
- Your sex, height, weight and age, and the goals you choose.
- Anything about your health that you choose to write in a post, a comment, your bio or a list.
- The text of your searches, your search history, and the product and compound pages you view.
We collect it to provide the service you ask for: keeping your staq and intake log, building a starter staq, showing your staq and posts to other users, search, and keeping the app working. We do not use it for advertising.
Where it comes from
From you, and from your use of the app and this site. We do not obtain it from anyone else.
Who we share it with, and why
- Other Staq users. Your staq, profile, posts, comments and lists are visible to signed-in users because that is the purpose of the app. Your sex, height, weight, date of birth and check-in history are not shown to other users.
- Processors acting for us: our database and hosting provider (Supabase); AI model providers (Anthropic, Voyage AI), for the purposes listed under AI processing; and our crash-reporting provider (Sentry).
We do not sell consumer health data. We have no affiliates that receive it. No third party collects consumer health data about you over time and across different websites or online services through our app or this site. We do not use geofencing.
Your rights and how to use them
You have the right to confirm whether we collect, share or sell your consumer health data; to access it, including a list of the third parties we have shared it with and how to contact them; to withdraw your consent; and to have it deleted, including by our processors. To use any of these rights, or to ask us to review and change what we hold, email support@trystaq.app. We will verify your identity and respond within the time the law allows, which is 45 days, extendable once where reasonably necessary.
If we decline your request you may appeal by replying to our decision and asking for a review. We will answer the appeal in writing. If the appeal is denied, Washington residents may complain to the Washington State Attorney General at atg.wa.gov/file-complaint, and Nevada residents may contact the Nevada Attorney General.
We will tell you about material changes to this section as described below.
Changes to this policy
If we change this policy we will post the new version here and change the effective date at the top. If a change materially affects how we use information we already hold, we will tell you in the app or by message before it takes effect. When a new feature collects a new kind of data, this policy will be updated before that feature is released.
Contact
Bill Chan, doing business as Staq
225 Cherry St, New York, NY 10002
support@trystaq.app
See also our Terms of Service, Medical Disclaimer and Support page.