Last updated 5 September 2026
Stop List is provided by Wellness Protocol Inc. These two documents govern your use of the app. Together they form a single agreement between you and us.
This Privacy Policy explains how Wellness Protocol Inc., as the controller of your personal data, collects, uses, discloses, and protects information in connection with the Stop List application. It applies to the App alone, and not to any third-party service you may reach through it.
Content you provide: the entries you write, the explanations generated for them, the transcripts and summaries of your spoken sessions, and the times at which they were created or changed. Account identifiers: an anonymous account identifier created on first launch, and, if you use Sign in with Apple, the identifier Apple assigns to you, together with the name and email address you choose to share. Subscription status: whether an active subscription exists, as reported by Apple. Technical data strictly necessary to operate and secure the service, including the device attestation used to verify that a request comes from a genuine installation of the App.
We do not collect payment card or bank details, contacts, photographs, precise location, or health records. The App contains no advertising software and no third-party analytics or tracking technology, and we do not track you across other applications or websites.
We use the information described above in order to provide and maintain the App; to generate and update your explanations; to synchronise your list across your devices; to deliver the daily spoken session; to detect, prevent, and address abuse, fraud, and technical faults; and to comply with our legal obligations.
Where the EU or UK General Data Protection Regulation applies, we process personal data on the basis of the performance of our contract with you, our legitimate interest in keeping the App secure and functional, your consent where it is requested (for example for microphone access and notifications), and compliance with legal obligations.
To generate an explanation, the text of the relevant entry is transmitted to Google's Gemini models through Firebase AI Logic, and the response is stored in your account. During a spoken session, microphone audio is streamed to the same service in real time so that it can be transcribed and answered. Audio is processed transiently and is not retained by us as a recording; only the resulting text transcript is stored in your account. This content is not used to train models. Please do not enter information that you would not wish to have processed by a cloud AI service.
The microphone is used only while a spoken session is running, and only with your permission, which you may withdraw at any time in iOS Settings. Reminders are scheduled locally on your device; their wording is fixed and never contains the content of your entries, so nothing you have written appears on your lock screen.
Your data is held in Google Cloud Firestore, in a private per-user area protected by server-side access rules, and is transmitted over encrypted connections. Our service providers, Apple and Google, operate internationally, and your data may therefore be processed in the United States and in other countries in which they maintain facilities. Where such transfers require it, they are made under appropriate safeguards, including the European Commission's standard contractual clauses.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the California Consumer Privacy Act. We disclose information only to the service providers that process it on our behalf, as described above; where required by law or valid legal process; and where necessary to protect the rights, property, or safety of our users or of ourselves.
Your content remains in your account until you delete it. Removing an entry moves it to History, from where it can be restored. Deleting your account removes your entries, your spoken-session records, and the account itself; the data is purged from our systems within 30 days, except where retention is legally required, and the action cannot be undone. Backups are overwritten in the ordinary course of operation.
Depending on where you live, you may have the right to access, correct, export, restrict, or delete your personal data, to object to certain processing, to withdraw consent, and to lodge a complaint with your supervisory authority. Deletion is available directly in the App, under Me → Delete account. For any other request, write to hz489@cornell.edu; we will respond within the period required by applicable law, and we will not discriminate against you for exercising these rights.
The App is not directed to children under the age of 13 (or under 16 in the EEA and the UK), and we do not knowingly collect personal data from them. If we discover that we have collected data from someone in this age range, we will delete it promptly. If you believe a child has used the App, please contact us.
We apply industry-standard safeguards: authentication through Sign in with Apple, so there is no password to leak; encryption in transit (HTTPS/TLS) and at rest; per-user access rules enforced on the server; and app attestation, so requests must come from a genuine installation. No system is perfectly secure. If we discover a breach affecting your information, we will notify you and the appropriate regulators in accordance with applicable law.
We may update this Policy from time to time. The date shown above is that of the most recent revision, and where a change is material we will notify you in the App before it takes effect.
Wellness Protocol Inc. hz489@cornell.edu — subject line "Privacy" for fastest routing. We aim to respond within 5 business days.