privacy policy.

Effective 8 November 2026. Last updated November 6, 2026. Cortisol IQ is operated by All American Atlas LLC, 1500 N Grant St, Ste R, Denver, CO 80203, USA ("we", "us"). Contact: support@cortisoliq.com. If you live in Washington, Nevada, Connecticut or another state with a consumer health data law, also read our Consumer Health Data Privacy Policy.

Health data from Apple Health

With your permission, Cortisol IQ reads these from Apple Health: heart rate variability (HRV), heart rate, resting heart rate, breathing rate, sleep, sleeping wrist temperature, blood oxygen, AFib history and irregular-rhythm notifications, mindful sessions, steps, workouts, one-minute heart-rate recovery, workout effort, exercise minutes, active energy, VO₂ max and walking and running distance.

How it's used. Six of these make up your estimated cortisol score: resting heart rate, heart rate while you sit still, HRV during the day and overnight, how long you slept and your breathing rate overnight. Others tell the app when not to trust a reading (for example, AFib records in Apple Health pause the score), and some fill your sleep, workout and fitness screens. If you turn on the optional readiness number, it uses the same overnight readings and your workouts. See how it works.

Where it stays. All scoring runs on your own iPhone and Apple Watch. Your readings, scores and history stay on your devices (in the app, its widgets and its watch app) and never reach our servers. The only exception is the optional summary you can choose to send with a Kai question (below), which contains no raw readings.

What we write. Cortisol IQ reads your data, and adds only workouts you choose to save, with the effort you log and, for outdoor workouts, the route. Your location is used only while a workout records, to draw the route and measure distance, and goes into your Apple Health workout, not to us.

Never for ads. Health data, and anything worked out from it (your score, its band, alerts, readiness), is never sent to Meta or any other advertising, attribution or analytics company, and never sold.

To stop access, go to iPhone Settings › Privacy & Security › Health › Cortisol IQ.

What you enter in the app

During setup and in Settings you can enter your name, birthday or age, sex, height, weight, sleep and exercise habits, how stress tends to show up for you, your goals, a profile picture, and your alert, reminder and goal settings. If you answer the optional morning "How ready do you feel?" check-in, that's kept too. All of this is stored only on your iPhone (and shared with your own watch and widgets). It's used to set up your plan, to compare you with typical values for people of a similar age and sex until the app has learned your usual, and to personalise the app. It isn't sent to us, to analytics or to advertisers.

The app doesn't ask about medical conditions or medicines.

Kai, the AI coach

Kai chat is optional and stays off until you switch it on from its consent screen. Kai's answers come from OpenAI. Your messages reach OpenAI through AIProxy, a relay service that keeps our API key off your phone.

• Sent with each question: your message plus up to 5 earlier messages in the chat, plus Kai's instructions.
• Sent only if you switch it on ("Also send today's estimate"), and only when your question is about your score or how you're doing: today's estimated score, its band, how it compares with your usual and which signal is adding the most.
• Never sent: your name and your Apple Health readings. The greeting that uses your name is made on your phone.

Anything you type is sent as written, so don't type details you don't want processed this way. We don't save your chats on our servers. OpenAI may keep API requests for up to 30 days to check for abuse and doesn't use them to train its models. Turn Kai off any time in You › Kai chat.

Kai can be wrong and isn't medical advice. It isn't a crisis service: if you're thinking about harming yourself, call or text 988 in the US, or your local emergency number.

Account (optional)

You don't need an account. If you choose to sign in with Apple or Google, sign-in runs on Google Firebase Authentication, which stores an account ID and the name and email address the sign-in service shares with us (Sign in with Apple lets you hide your email). We keep one user record (account ID, name and email) in Google Cloud Firestore. No Health data or scores are stored with your account.

Purchases and subscriptions

Subscriptions are sold and billed by Apple through the App Store. We never see your payment details. The app checks your purchase with Apple's StoreKit, on the device itself, and we use Superwall for subscription infrastructure. Superwall receives a random app user ID, your purchase and subscription status, and basic device and app details such as model, iOS version, app version, language and country. We don't send Superwall any Health data, score or setup answers, and its event tracking is turned off.

Apple sends us notices about your purchases (for example a new subscription, a renewal, a cancellation or a refund), handled by our growth server, described below.

Ad measurement (Meta)

We advertise on Facebook and Instagram, and we use Meta's software development kit (SDK) in the app to measure and improve those ads.

• When: the SDK starts when you first open the app (outside the EEA, the UK and Switzerland).
• Events it sends: that the app was installed, each time it's opened, that you finished setup, and that you bought or renewed a plan, with its price and currency.
• What comes with them: an install ID the SDK creates, a one-way code made from the App Store transaction (so a purchase isn't counted twice), technical details about your device (model, iOS and app version, language, time zone, carrier, screen size), the app's name and identifier, and your IP address, from which Meta can estimate your approximate location.
• If you allow tracking when your iPhone asks, Meta can link these events to your device's advertising identifier (IDFA) and to other information it holds about you.
• If you don't, the events can still be sent, without the advertising identifier.
• Never sent to Meta: your Apple Health data, your cortisol or readiness score or band, alerts, your setup answers, your Kai chats, your name or your email.

We ask Meta to apply its "Limited Data Use" restrictions where Meta offers them. Turning off Tracking in iPhone Settings › Privacy & Security › Tracking removes the advertising identifier; it doesn't stop the events. See your choices.

Apple also tells our growth server, without identifying you, which Apple Ads campaign led to an install, and gives ad networks aggregated, privacy-preserving results (SKAdNetwork / AdAttributionKit). Neither needs tracking permission.

Analytics and crash reports

• PostHog (PostHog Cloud, US region) receives app-funnel events: which setup and paywall screens you reached (as screen IDs), whether a permission prompt was answered, plan choices and purchase steps. Each app session gets a new random ID; we don't link sessions to you or to each other, we don't build a profile, and we set PostHog to discard IP addresses. It also receives app opens, subscription status changes and whether an offer notification was scheduled or opened. PostHog never receives Health data, scores, setup answers or anything you type.
• Firebase Crashlytics (Google) collects crash reports: device model, iOS version, app version, the app's state at the crash and an installation ID. Crash reports don't include Health data or scores.

The app doesn't include Firebase Analytics or Google advertising tools.

Our growth server

We run a small server on Cloudflare so purchase records, refunds and ad attribution stay with us instead of another company. It handles:

• Purchase records from Apple (product, price, currency, dates, renewals, cancellations, refunds and the App Store country), keyed by Apple's transaction ID, to count revenue and pass the same notices on to Superwall.
• Refund requests. When you ask Apple for a refund, Apple may ask us about your use of the app, such as how long you've subscribed and whether the app was used. We answer from our purchase records, never with Health data.
• Apple Ads attribution: which Apple Ads campaign, ad group and keyword led to an install, using a one-time token from your iPhone and a random app user ID.
• Paywall settings: the app fetches which plans and wording to show. That request carries no identifier.

Who receives data

Providers that process data for us (AIProxy, OpenAI, Superwall, PostHog, Google and Cloudflare) are bound by contract to use it only to provide their service to us and to protect it at least as well as this policy describes. Apple and Meta also use the data they receive under their own privacy policies (Apple, Meta).

We also disclose information when the law requires it, to protect someone's safety or our rights, or to a buyer if the business is sold (under this policy). We don't sell personal information for money, but some state laws may treat sending app events to Meta as a "sale" or "sharing"; you can opt out as described below.

Your privacy choices

• Health access: iPhone Settings › Privacy & Security › Health › Cortisol IQ.
• Tracking: tap Ask App Not to Track when your iPhone asks, or later in Settings › Privacy & Security › Tracking. This removes the advertising identifier from Meta events.
• Kai: You › Kai chat turns it off. You can also leave "Also send today's estimate" off.
• Notifications and offers: iPhone Settings › Notifications, and You › Customisation › Offers and discounts.
• Do Not Sell or Share My Personal Information: email support@cortisoliq.com with the subject "Do not sell or share". Sending app events to Meta may count as "sharing" for cross-context behavioural advertising under California law, or as a "sale" or "targeted advertising" under other state laws. We'll record your request and confirm it. Today the app can't switch these events off for one person, so we can't yet stop them for you individually; until it can, deleting the app stops them. We don't sell Health data.

Your rights and how to use them

Depending on where you live, you can ask us to:

• confirm whether we hold personal data about you, and give you a copy (access and portability);
• correct it;
• delete it;
• stop or limit using or sharing it, including for advertising;
• withdraw any consent you gave (this doesn't affect what we did before);
• in the EEA and UK, object to processing or restrict it.

How to do it:

1. On your iPhone. You › More settings › Account and subscription › Delete account and data erases your answers, settings and history from the app and signs you out. It doesn't yet delete a sign-in account on our servers; email us for that (step 2). Apple Health data isn't touched; you manage it in Apple's Health app. Deleting the app also removes its data from your iPhone, except a few flags kept in your iPhone's keychain that stop a one-time offer being shown twice. If your subscription has ended and you can't reach these screens, email us.
2. On our side. Email support@cortisoliq.com with "Access", "Delete" or "Correct" in the subject. If you signed in, write from the email on your account. For purchase records, include the order ID from your Apple receipt email so we can find them. We'll delete your account and user record and our purchase and attribution records, and ask Superwall, Google and Meta to delete what they hold that we can link to you. See Support for the details.

We'll confirm we received your request within 10 business days and reply within 30 days, or sooner where the law requires. Funnel analytics use a fresh random ID each session, so we can't find or return them for one person. You can also send a request through an authorised agent. We'll check requests in a way that fits the data involved, and we won't treat you differently for using your rights. If we say no, you can appeal by replying with "Appeal" in the subject.

How long we keep data

• Health data, scores and your answers: on your devices until you delete them or the app. Never on our servers.
• Kai chats: not saved; they're cleared when you close the chat. OpenAI may keep requests for up to 30 days.
• Account record: until you delete your account.
• Funnel analytics: up to 13 months.
• Crash reports: up to 90 days.
• Purchase and refund records: as long as tax and accounting law requires, then deleted.
• Apple Ads attribution: up to 13 months.

If you're in the EEA, the UK or Switzerland

All American Atlas LLC is the controller of your personal data.

Where Meta's SDK runs with your consent, Meta and we are joint controllers for collecting and sending the events (GDPR Art. 26); Meta is responsible for what it does with them afterwards. The score is worked out automatically, but it doesn't make decisions with legal or similarly significant effects on you. Our providers process data in the US. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses (with the UK addendum). You can complain to your local data protection authority. We haven't appointed a Data Protection Officer. For any request, contact support@cortisoliq.com.

US state privacy rights

California. In the last 12 months the categories we collected were: identifiers (random app IDs, the Meta install ID, IP address, and name and email if you sign in); commercial information (purchases); internet or network activity (app events and screens); approximate location from IP (estimated by Meta); and sensitive personal information (health data, kept on your devices except as described for Kai). Sources: you, your devices and Apple. Purposes and recipients are in the sections above. We may "share" identifiers, app activity and purchase events with Meta for cross-context behavioural advertising. We don't sell or share sensitive personal information, and we use it only to provide the app. To opt out, see your choices.

Washington, Nevada, Connecticut and other states with consumer health data laws: see our Consumer Health Data Privacy Policy.

Other states (such as Virginia, Colorado, Texas and Oregon) give similar rights to access, correct and delete data and to opt out of targeted advertising, sale and profiling. Use the same email. If we decline, reply with "Appeal"; if you're still unhappy, you can contact your state Attorney General.

Age

Cortisol IQ is for people 16 and over and carries a 16+ App Store age rating. We don't knowingly collect data from anyone under 16. If you think someone under 16 is using the app, email us and we'll delete their data.

This website

cortisoliq.com sets no cookies and loads no advertising scripts. It uses PostHog (US) to count page views and App Store button taps: nothing is stored on your device, sessions aren't recorded, and no Health data is involved. Our hosting provider keeps standard server logs, including IP addresses, for security and to keep the site running.

Security

Data in transit is encrypted (HTTPS). Your Health data is protected by iOS on your own devices. Access to our server and vendor accounts is limited to the people who need it. No system is perfectly secure; if a breach affects your data, we'll tell you as the law requires.

Changes

If we change this policy we'll update the date above, and, before a significant change takes effect, tell you inside the app. If a change means using or sharing your consumer health data in a new way, we'll ask first.

Contact

All American Atlas LLC · 1500 N Grant St, Ste R, Denver, CO 80203, USA · support@cortisoliq.com