The short version: Protocol stores everything on your device. There are no accounts, no analytics, no ads, and no tracking. We cannot see your supplement stack, your logs, or anything else you put into the app. The only things that ever leave your device are (1) purchase information handled by Apple and RevenueCat when you buy Protocol Pro, and (2) a product barcode number if you use the barcode scanner.
The rest of this policy explains that in detail.
Protocol is developed and operated by Javon Taffe, an independent software developer based in the United Kingdom ("we", "us"). For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), we are the controller for the limited processing described below.
You can contact us at [email protected].
Protocol keeps all of your data in local storage on your iPhone:
This data never leaves your device through us. We have no server that receives it, no account system that syncs it, and no way to access it. If you delete the app, this data is deleted with it. You can also erase everything at any time with Settings → Clear all data inside the app.
Because this data stays on your device and is never transmitted to us, we do not "process" it in the sense that requires a lawful basis under UK GDPR — it is entirely under your control.
Protocol Pro is a one-time in-app purchase processed by Apple through your Apple Account. We never see your payment details, card numbers, or Apple ID.
To unlock Pro features and support "Restore purchases", the app uses RevenueCat, a purchase-infrastructure service. RevenueCat receives:
This is used solely to deliver the purchase you made and restore it if you reinstall. It is not used for advertising or tracking. RevenueCat acts as our processor; their privacy practices are described at revenuecat.com/privacy. Legal basis: performance of a contract (delivering the purchase you asked for).
If you scan a supplement barcode (a Pro feature), the app sends only the barcode number to Open Food Facts (world.openfoodfacts.org), a non-profit open food-products database, to look up the product name and brand. No personal data, no account identifier, and no camera images are sent — the camera reads the barcode entirely on your device, and no photo is captured or stored. Open Food Facts' privacy policy is at world.openfoodfacts.org/privacy. Legal basis: legitimate interests (returning the product details you requested); the request contains no personal data.
That is the complete list. The app makes no other network connections.
If you turn on Sync doses to Health (a Pro feature, off by default), Protocol writes your checked-off supplement doses into Apple Health as nutrition records. This is a one-way write on your device: the data goes from Protocol into Apple Health under Apple's HealthKit rules, and you control it in the Health app. Protocol does not read data back from Apple Health, and your Health data is never sent to us or anyone else by Protocol. You can revoke access at any time in the iOS Settings app under Health → Data Access & Devices.
Refill reminders and daily stack reminders are local notifications, scheduled entirely on your device. There is no push-notification server and no push token is created or sent anywhere.
Under UK GDPR you have rights of access, rectification, erasure, restriction, portability, and objection. Because your supplement data exists only on your device, you exercise most of these directly: view and edit anything in the app, and erase everything via Settings → Clear all data or by deleting the app.
For the purchase data held via RevenueCat, contact us at [email protected] and we will handle your request, including deletion of the anonymous purchase record, within one month.
You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have mishandled your data.
Protocol is rated for general audiences but is designed for adults managing their own supplement routines. We do not knowingly collect any personal data from anyone, including children — the app collects no personal data at all beyond the anonymous purchase processing described above.
RevenueCat is based in the United States. The limited, anonymous purchase data described in section 3.1 may be processed there, protected by RevenueCat's standard contractual safeguards for international transfers.
If we change this policy — for example, if a future version of Protocol adds an optional cloud backup — we will update this page and change the effective date above. Material changes will be highlighted in the app's update notes.