The short version: Protocol stores everything on your device. There are no accounts, no analytics, no ads, and no tracking. We cannot see your logs or anything else you put into the app. The only things that ever leave your device are (1) purchase information handled by Apple and RevenueCat when you buy Protocol Pro or subscribe to Protocol+, (2) a product barcode number if you use the barcode scanner, and (3) if you subscribe to Protocol+, the names of the supplements in your stack, sent without any identifier to check them for interactions.
The rest of this policy explains that in detail.
Protocol is developed and operated by Javon Taffe, an independent software developer based in the United Kingdom ("we", "us"). For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), we are the controller for the limited processing described below.
You can contact us at [email protected].
Protocol keeps all of your data in local storage on your iPhone:
This data never leaves your device through us. We have no server that receives it, no account system that syncs it, and no way to access it. If you delete the app, this data is deleted with it. You can also erase everything at any time with Settings → Clear all data inside the app.
Because this data stays on your device and is never transmitted to us, we do not "process" it in the sense that requires a lawful basis under UK GDPR — it is entirely under your control.
Protocol Pro is a one-time in-app purchase, and Protocol+ is an auto-renewing monthly or annual subscription, both processed by Apple through your Apple Account. We never see your payment details, card numbers, or Apple ID.
To unlock Pro features and support "Restore purchases", the app uses RevenueCat, a purchase-infrastructure service. RevenueCat receives:
This is used solely to deliver the purchase you made and restore it if you reinstall. It is not used for advertising or tracking. RevenueCat acts as our processor; their privacy practices are described at revenuecat.com/privacy. Legal basis: performance of a contract (delivering the purchase you asked for).
If you scan a supplement barcode (a Pro feature), the app sends only the barcode number to the Dietary Supplement Label Database (DSLD) (api.ods.od.nih.gov), a public, government-run database maintained by the U.S. National Institutes of Health's Office of Dietary Supplements, to look up the product name and brand. No personal data, no account identifier, and no camera images are sent — the camera reads the barcode entirely on your device, and no photo is captured or stored. DSLD's data is public domain; the site policies for NIH's Office of Dietary Supplements are at ods.od.nih.gov/About/Site_Policies.aspx. Legal basis: legitimate interests (returning the product details you requested); the request contains no personal data. DSLD's coverage is strongest for products sold in the United States; supplements sold only in the UK or EU are less likely to be found and may need to be added via catalogue search or manual entry instead.
If you subscribe to Protocol+, the app sends the names of the supplements in your stack to our interaction-check service at api.protocolapp.app, which looks them up with a third-party reference provider (Examine.com) to return additional interaction findings. This runs on a Cloudflare-hosted service we operate and happens only for Protocol+ subscribers who have a stack to check.
That is the complete list. The app makes no other network connections.
If you turn on Write doses to Apple Health (a Pro feature, off by default), Protocol writes your checked-off supplement doses into Apple Health as nutrition records. This is a one-way write on your device: the data goes from Protocol into Apple Health under Apple's HealthKit rules, and you control it in the Health app. Protocol does not read data back from Apple Health, and your Health data is never sent to us or anyone else by Protocol. You can revoke access at any time in the iOS Settings app under Health → Data Access & Devices.
Refill reminders and daily stack reminders are local notifications, scheduled entirely on your device. There is no push-notification server and no push token is created or sent anywhere.
Under UK GDPR you have rights of access, rectification, erasure, restriction, portability, and objection. Because your supplement data exists only on your device, you exercise most of these directly: view and edit anything in the app, and erase everything via Settings → Clear all data or by deleting the app.
For the purchase data held via RevenueCat, contact us at [email protected] and we will handle your request, including deletion of the anonymous purchase record, within one month.
You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have mishandled your data.
Protocol is designed for adults managing their own supplement routines and is rated 13+ on the App Store. It is not intended for children under 13. We do not knowingly collect any personal data from anyone, including children — the app collects no personal data at all beyond the anonymous purchase processing and, for Protocol+ subscribers, the unlinked supplement names described above.
RevenueCat is based in the United States. The limited, anonymous purchase data described in section 3.1 may be processed there, protected by RevenueCat's standard contractual safeguards for international transfers. The live-check service (section 3.3) is hosted on Cloudflare's global network and queries Examine.com, which may process the supplement names outside the UK.
If we change this policy — for example, if a future version of Protocol adds an optional cloud backup — we will update this page and change the effective date above. Material changes will be highlighted in the app's update notes.