Privacy Policy

Last updated: October 30, 2026

Epoch ("we", "us", or "our") operates the Epoch mobile application. This Privacy Policy explains how we collect, use, and protect your information when you use our app.

1. Information We Collect

We collect information you provide directly:

We also collect limited data automatically:

Optional web analytics

If you allow analytics on app.epochai.app, we send anonymous page steps and loading times to PostHog in the EU, together with a broad screen-size category and our campaign label. We use a random identifier for the current browser tab, do not create a named person profile, and disable IP storage.

We do not send your quiz answers, weight, height, meals, period information, Coach messages, name, email, authentication details, or full page URLs to PostHog. We do not record screens. Declining analytics does not restrict any features. You can change or withdraw your choice in Analytics options.

2. How We Use Your Information

3. Third-Party Services

We use the following third-party services, each governed by their own privacy policies:

Web purchases. When you buy Pro on the web, Dodo Payments processes the payment as Merchant of Record. Your card and billing details go to Dodo Payments and are never stored by Epoch; Dodo Payments handles them under its own privacy policy. We receive only what we need to unlock Pro and support you: your email address, the plan, the purchase and renewal status, and a customer reference. You can cancel from Settings in the app or from the link in your Dodo Payments receipt. Questions: [email protected].

4. Direct Messages & End-to-End Encryption

Direct messages (DMs) between users are end-to-end encrypted using ECDH P-256 key exchange and AES-GCM 256-bit encryption. This means only you and the person you are messaging can read your messages: we cannot decrypt them. Your private encryption key is stored only on your device and is never transmitted to our servers. Group chat messages use the same encryption protocol with a shared group key wrapped per member.

Messages are stored encrypted on our servers solely to enable delivery to other devices. You can delete individual messages or clear a conversation at any time.

5. In-App Support Chat

The app includes a support chat feature that lets you send messages directly to the Epoch support team. Messages sent through support chat are not end-to-end encrypted and may be read by Epoch staff for the purpose of resolving your support request. We do not share these messages with third parties. You can also reach us by email at [email protected].

6. Voice Input in Coach

Voice input is optional and starts only when you tap the microphone in Coach. The app asks for microphone permission the first time. A recording stops when you tap Done or Cancel, when you close Coach or leave the app, and after one minute.

The recording is sent through our server to OpenAI to turn it into text. We do not keep recordings: the temporary audio file on your device is deleted once it has been turned into text, canceled or failed, and our server does not save or log the audio or the text. The text is shown only in your message box; if you send it, it is handled like your other Coach messages. OpenAI processes the recording to return the text under its API data controls.

7. Data Storage & Security

Your data is stored on Supabase infrastructure. All data is encrypted in transit (HTTPS/TLS). Sensitive data such as session tokens are stored in encrypted storage on your device. We implement row-level security so users can only access their own data. Encryption keys for E2E messages never leave your device.

8. User Content & Community

Posts, workout shares, and meal shares you publish to the Community feed are visible to other Epoch users. You can delete your own posts at any time. Profile privacy settings allow you to control what information is visible to others. You may block other users, which prevents them from viewing your profile or contacting you. You may report content or users that violate our Terms of Service; reports are reviewed by our team.

9. Data Retention & Deletion

You can delete your account at any time from the Settings screen in the app. Account deletion permanently removes your profile, fitness data, and user content from our systems within 30 days.

To delete your account: open the Epoch app → Settings → scroll to the bottom → tap "Delete Account" → confirm. All personal data including your profile, workout logs, nutrition logs, progress photos, and community posts will be permanently erased within 30 days. Some anonymised, aggregated data may be retained for service improvement.

10. Children's Privacy

Epoch is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us at [email protected].

11. Your Rights

Depending on your location, you may have rights to access, correct, or delete your personal data, or to object to certain processing. To exercise these rights, contact us at [email protected].

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or by email. Continued use of Epoch after changes constitutes acceptance of the updated policy.

13. Contact

For privacy-related questions, contact us at [email protected].

© 2026 Epoch · Pricing · Refund policy · Terms of Service · Privacy Policy · Contact