Consumer Health Data Privacy Policy
Effective date: November 11, 2026
Some of what you record in Tiny Engine can say something about your physical or mental health. Laws such as the Washington My Health My Data Act (RCW 19.373), and similar laws in Nevada and Connecticut, call this "consumer health data" and give you extra rights over it. This page explains exactly what we do with it. It adds to our Privacy policy, which covers everything else.
The short version
- If you use Tiny Engine without an account, your health-related entries stay on your device and we never receive them.
- With an account, we store them only to sync them between your devices and to show them back to you.
- We never sell consumer health data, never use it for advertising, and never share it except with the service providers that run the app.
- We collect it only with your consent, and you can withdraw consent and delete it at any time.
- We do not collect your location, so no location-based ("geofence") use is possible.
What consumer health data we may collect
- Moods and feelings you pick in check-ins and journal pages (for example a mood score or "anxious", "calm").
- What you write in your journal, check-ins, notes and seeds, which may mention your health, body, sleep, stress, symptoms, mental health, medication or treatment.
- "What shaped today?" choices and habits you track, such as sleep, exercise, rest, food or substance use, and whether you did them (system runs).
- Goals and systems you create that relate to health (for example "sleep by 11" or "walk daily").
- Patterns the app finds in that data (Insights), worked out on your device; if you turn on weekly reminders, one sentence of that finding is stored so the reminder can show it.
- Voice memos and photos you choose to add, if they relate to your health.
We do not collect biometric data: the optional Face ID or fingerprint lock is checked by your own device, and we never receive it. We do not collect precise location.
Where it comes from
Only from you, when you enter it in the app, and from the app's own calculations on that data. We do not buy or receive health data from anyone else.
Why we collect and use it
- To store your entries and sync them between your signed-in devices.
- To show them back to you: your journal, history, mood views, Insights and Your week.
- To send reminders you turned on (for example "How's today?" and the weekly finding).
- To place related notes together in the optional Brain view (text turned into number patterns inside our own servers; no outside AI company).
- To keep the service secure and working, and to meet legal obligations.
We do not use it for advertising, to make decisions about you, or to train AI models.
Who we share it with
Only with service providers ("processors") that run the app for us under contracts that limit them to that job:
- Supabase: stores your synced data and runs our server functions.
- Your browser's push service (Apple, Google, Microsoft or Mozilla): carries the text of a reminder you turned on, which may include a step name or your weekly finding.
Cloudflare, Resend and Stripe do not receive your consumer health data. We may disclose data if the law requires it (for example a valid court order), and will tell you unless we are legally prohibited from doing so.
We do not sell consumer health data. We will never sell it without a separate, signed authorization from you, as the law requires, and we have no plans to ask.
Your consent
We collect consumer health data only for the purposes above and only with your consent. Using the app without an account means we never receive it. When you create an account, you are asked, with a separate checkbox, to agree that your entries, including health-related ones, are stored on our servers to sync them. We keep the date of that agreement with your account. You can say no and keep using the app on your device only. You can withdraw consent at any time (see below); withdrawing does not affect what we did with your consent before.
Your rights
You have the right to:
- Confirm and access: know whether we collect, share or sell your consumer health data, see it, and get a list of every third party and affiliate it was shared with (with an email address or other contact for each). Settings › Backup downloads all of it.
- Withdraw consent: stop syncing by signing out, turn off reminders or the Brain, or delete entries.
- Delete: delete entries in the app, or your whole account in Settings › Sync across devices › Delete account. This deletes your data from our database straight away; our providers' backups expire on their schedule. We also tell our processors to delete it.
- Appeal: if we refuse a request, reply to our answer with "Appeal". If you are still unhappy you can contact the Washington State Attorney General at atg.wa.gov/file-complaint (or your own state's attorney general).
To use any of these rights, email [email protected] from the address on your account. We confirm it is you by replying to that address, and answer within 45 days (we may extend once by 45 days where needed, and will tell you why). Requests are free, up to twice a year.
Security
Consumer health data is protected like everything else in your account: encrypted connections, encryption at rest, row-level security so only your account can read it, and limited administrator access. See "How we protect it" in our Privacy policy.
Not a health service
Tiny Engine is not a medical device and does not diagnose or treat anything. If you are in crisis, call your local emergency number. In the US, call or text 988, or call 911.
Contact
Cam Mitchels, doing business as Tiny Engine. Email: [email protected]
Related: Privacy policy · Terms