01. Who is responsible
Dosy is operated by Kickfy Intermediação de Negócios LTDA, Brazil. This policy covers dosy.app, the quiz, checkout, account access and related emails. It describes the current web service, not future features.
02. Information we collect
We process your name, email, phone number and country when you submit them for checkout; order, subscription and payment-status records; account identifiers; and messages you send us. The web app also stores the preferences, meal descriptions, portions, nutrients, water, steps, workouts, sleep, measurements, notes, check-ins, completed actions and weight entries you choose to save. This first version keeps up to 366 daily and weight records per account. When you choose to save and share a Coach conversation, Dosy stores its title and messages in your account so you can reopen it across devices. You can delete conversations from Coach. Each conversation supports up to 100 messages; start a new one to continue without erasing past conversations. When you authorize AI in chat, your plan, up to 14 recent daily records, recent weight records and conversation excerpts are sent to OpenAI to generate a response. When you authorize meal analysis, a resized photo and description are sent to OpenAI. The original photo is not saved in the diary; reviewed nutrients and portions are saved when you confirm. We request that the API not store the response object; the provider may still retain operational logs under its terms. We keep per-account usage counts to enforce limits. The quiz can include age range, sex, weight-related goals, GLP-1 use, symptoms, eating habits and activity. These answers may reveal sensitive health information. Technical records can include IP address, browser information, timestamps and security logs.
Optional profile photos are resized on your device and stored privately with your account. You can replace or remove your photo in Your space. Profile photos are not sent to the Coach. When you submit Give feedback, we store the category, message, app section and language with your account identifier and email. A copy is sent to the Dosy support team through Resend so we can review and reply.
03. Your quiz and device storage
The quiz saves a draft, including answers and contact details, in this browser so a refresh does not erase your progress. Drafts are considered expired after 12 hours and removed when next read. Browser storage may remain on your device until that read or until you clear it. Avoid shared devices for sensitive answers. Clearing site data removes local drafts, not purchase or account records already stored on our servers.
04. When information reaches our servers
When you continue to payment, we store contact and order information to create and track checkout, even if payment is not completed. If you choose to save your quiz with your purchase, we also store the submitted answers and simplified plan so they can be restored. You can turn that option off before continuing. We do not include your health answers in Stripe payment metadata.
05. Why we use it
We use information to personalize the requested plan, process payments, provide access and downloads, handle support, prevent fraud and meet legal obligations. Where applicable, these uses rely on performing our agreement, legal obligations or legitimate interests in security and service operation. Sensitive health-data processing relies on the applicable legal basis, including your explicit consent where required. You may withdraw consent; this can limit personalization without affecting earlier lawful processing.
When you choose voice transcription, your recording is sent to OpenAI to turn speech into text. Dosy does not store the original audio; the text is saved as a conversation only when you send it. Recordings are limited to 60 seconds in the app.
06. Providers and international processing
Supabase supports database and authentication; Vercel hosts the website and server functions; Stripe processes payments and billing; Resend delivers emails; OpenAI processes AI requests you authorize in the app. They receive information needed for their services and may process it outside your country, including in the United States. We use applicable contractual and legal transfer safeguards. Stripe handles card and wallet credentials; Dosy does not store full card numbers or card security codes. We may also disclose information where legally required, to protect rights, or during a business transfer with appropriate protections.
07. Emails, phone and advertising
Account, purchase, access and billing emails support the service. Optional checkout reminders depend on your reminder choice; marketing messages include an unsubscribe option. Giving a phone number does not authorize marketing calls or texts. Email providers can record delivery, bounce, complaint and, when enabled, open or click events. We do not sell quiz answers or send them to advertising networks. The current quiz does not send answers to an external generative-AI service.
08. Cookies and security
We use browser storage and essential cookies for drafts, sign-in, checkout ownership, secure email links and offer eligibility. Payment and authentication providers may use their own essential storage for security and fraud prevention. Controls include encrypted connections, server-side credentials and restricted access. No system can guarantee absolute security.
09. Retention and your rights
We keep server records for as long as needed to deliver the service, resolve disputes, maintain security and comply with accounting or other legal requirements. We assess deletion requests and explain any necessary retention. Depending on your location, you may request access, correction, a copy, portability, deletion, restriction, objection or withdrawal of consent, and complain to your privacy regulator, including Brazil’s ANPD. We may verify identity before releasing or changing records. Canceling a subscription is separate from deleting personal data.
10. Adults, changes and contact
Dosy is intended for adults aged 18 or older. If you believe a child submitted information, contact us so we can investigate. We will update the date on this policy when it changes and provide additional notice for material changes where required. For privacy requests and questions: hello@mail.dosy.app.
Optional product analytics
We use PostHog to measure funnel steps, confirmed purchases and feature usage. We send a random browser identifier and limited events, such as opening a screen or saving an entry, without its content. We do not send names, email addresses, phone numbers, quiz answers, health values, messages, audio or images. We do not record sessions or automatically capture forms. Your choice and identifier stay in your browser for up to 180 days. You can turn it off at any time with ‘Analytics preferences’ on this page; Global Privacy Control or Do Not Track in your browser also turn it off. Withdrawal stops new browser events; previously sent events and confirmation of a purchase initiated with permission may remain. Contact support to request deletion of earlier data. Use of features in a health app can allow inferences, so you can turn analytics off.
Advertising measurement (Meta)
On our website pages only (never inside the app), we use the Meta pixel to measure our ads: page visits, starting and finishing the quiz, leaving your contact, viewing plans and starting checkout. When you buy, our server tells Meta that a purchase happened, with its value and currency, a hashed (SHA-256) email, and browser identifiers set by Meta, so Meta can match it to the ad you saw. We never send Meta your quiz answers, weight, medication, health values, plan contents or anything you record in the app. Meta processes this data under its own policy. Turning off ‘Analytics preferences’ on this page, or Global Privacy Control in your browser, stops the pixel and purchase reporting.