Tare Privacy Policy

Application: Tare

Controller / Operator: PLATON APPLICATIONS LLC (“Platon Applications,” “Platon,” “we,” “us,” or “our”)

Effective Date: 6/18/2026

Last Updated: 10/17/2026

PLEASE READ THIS PRIVACY POLICY CAREFULLY. This Privacy Policy explains how Platon Applications collects, uses, discloses, stores, and protects information in connection with the Tare mobile application and related services (the “Licensed Application” or “Tare”). It is incorporated into and supplements the Tare End User License Agreement (the “EULA”). Capitalized terms not defined here have the meaning given in the EULA.

TARE IS A GENERAL WELLNESS PRODUCT FOR USERS 18 YEARS OF AGE OR OLDER. Tare collects health and fitness information, including — only if you affirmatively opt in — menstrual cycle and reproductive health information. We treat this information as sensitive and apply the heightened protections described in Sections 4, 9, and 13. Tare is supported in part by non-personalized (contextual) advertising. We never use your reproductive health data or HealthKit data for advertising, we do not track you across other companies’ apps or websites, and we do not sell or share your personal information. See Section 6.

1. About This Policy and Who We Are

This Privacy Policy applies to personal information we process when you download, install, access, or use Tare, when you create or manage a Tare account, when you subscribe to Tare Pro, and when you otherwise interact with Platon Applications in connection with the Licensed Application. The data controller responsible for your personal information is Platon Applications LLC, a Delaware limited liability company, located at 8 The Green, STE B, Dover, Kent County, DE 19901, United States.

This Policy does not apply to: (a) Apple Inc. (“Apple”), which processes App Store transactions and certain device data under Apple’s own privacy policies; (b) third-party services you connect to Tare; or (c) any product or website that does not link to this Policy. Your agreement to the EULA does not override this Policy, and where the two address the same subject, this Policy governs questions of data handling.

Age restriction. Tare is intended exclusively for individuals 18 years of age or older. We do not knowingly collect personal information from anyone under 18. See Section 15.

2. Summary of Key Points

This summary is provided for convenience and does not replace the full Policy.

• What we collect: account details; weight, calorie, hydration, workout, and activity data; device and usage data; payment-related data (handled by Apple or Stripe); and, only with your separate opt-in consent, menstrual cycle and reproductive health data.
• Why we collect it: to operate Tare, display your progress, generate trend predictions, personalize your experience, improve our features, and provide support. Tare shows only non-personalized (contextual) ads, never targeted using profiles about you, and we do not sell or share your personal information.
• Who we share it with: service providers acting on our instructions — Supabase (our database and backend host, running on Amazon Web Services), Stripe (direct payments), Apple (App Store payments and HealthKit), PostHog (product analytics), Google LLC (the Gemini API, which powers Tare’s AI features), and Exa Labs, Inc. (nutrition web search, which receives food names only) — Google AdMob to serve non-personalized (contextual) in-app ads, and disclosures required by law. Health, menstrual, and reproductive data are always excluded from advertising. We do not sell or share your personal information, and we do not track you across other companies’ apps or websites.
• Where it lives: in a database hosted by Supabase (running on AWS) in the region we configure, with encryption in transit and at rest. No system is 100% secure (Section 9).
• Your choices: you can access, correct, delete, and export your data; withdraw consent to reproductive health data processing at any time; and limit the use of sensitive personal information (Section 6). We do not sell or share your personal information, so there is no advertising-related “sale” or “sharing” to opt out of. See Sections 12–14.

3. Information We Collect

We collect the categories of personal information described below. The categories are also mapped to the statutory categories used under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”), in the table that follows.

3.1 Information You Provide

• Account and profile information — such as your email address, password (stored only in hashed form), birth month and birth year (used to verify you are 18+), and profile settings.
• Health and fitness inputs — weight measurements, calorie intake logged manually, hydration intake, and goals you set.
• Reproductive health information (opt-in only) — if and only if you affirmatively opt in, menstrual cycle start and end dates, cycle length, symptoms, and related observations. See Section 4.
• Support communications — information you provide when you contact support@platonapplications.com or legal@platonapplications.com.

3.2 Information from Connected Devices and Apple HealthKit

With your permission, Tare reads workout and activity data and, where you choose, weight and reproductive health data from wearable devices and the Apple HealthKit framework. HealthKit access is controlled by your device Privacy settings, is requested separately for each data type, and can be revoked at any time under Settings > Health > Data Access & Devices. Our use of HealthKit data is governed by Section 8.

3.3 Payment-Related Information

If you subscribe through the Apple App Store, Apple processes your payment under your Apple ID; we do not receive your full payment card number. If you subscribe directly through Platon Applications, payments are processed by Stripe, Inc. (“Stripe”), our PCI-DSS-compliant payment processor; Stripe receives and stores your card data, and we receive only limited transaction and subscription-status information (for example, the last four digits, card brand, expiration, and billing status). We do not directly store full payment card numbers.

3.4 Information Collected Automatically

• Device and technical data — device model, operating system version, app version, language, time zone, and similar identifiers.
• Usage and log data — in-app events, feature usage, crash logs, diagnostics, and approximate (non-precise) location inferred from IP address for security and fraud-prevention purposes. In-app usage events (for example, which screens you view, which features you use, and whether an action succeeded) are processed by PostHog, Inc. (“PostHog”), our product-analytics provider, and are associated with your account identifier so we can understand how Tare is used and improve it. These analytics events never contain your name, email address, body weight, calorie or meal details, message content, or reproductive health data, and PostHog does not record your screen or capture the content you type. Tare does not collect precise geolocation for advertising, and does not use location-based advertising or data collection near healthcare facilities (see Section 13).
• Cookies and similar technologies — on any Tare website, as described in Section 16.

3.5 Information Sent to Third-Party AI Providers

When you use Tare’s AI features — AI food logging, menu scan and menu chat, and Tare Coach — the content you submit for that feature is sent from the app to Tare’s own server (operated by Platon Applications and hosted on Railway), which forwards it to Google LLC’s Gemini API for processing. For AI food logging, the food names are also sent as web-search queries to Exa Labs, Inc. to find published nutrition data. We collect this content only when you actively use one of these features (by typing or dictating a description or message, or by taking or choosing a photo), and only after you grant permission in the app. We do not send your name, email address, or account ID to any AI provider. Section 7 lists exactly what is sent, to whom, and why.

3.6 Categories Under the CCPA

The following table identifies the CCPA statutory categories of personal information we have collected within the preceding 12 months, with examples.

We do not collect: biometric identifiers (e.g., fingerprints or face geometry) for identification, precise geolocation for advertising, or information about your race, religion, or sexual orientation. We do not knowingly collect personal information from minors.

4. Sensitive Personal Information and Consumer Health Data

Tare is a health and fitness application, so much of the information we process is “sensitive personal information” under the CCPA and “consumer health data” under state consumer-health-privacy laws. We apply heightened protections to this information.

4.1 Reproductive Health Data — Opt-In Only

Menstrual cycle and reproductive health data are collected only with your separate, affirmative, opt-in consent, obtained through a dedicated in-app consent screen that is presented apart from general onboarding. You may withdraw consent and delete this data at any time in your account settings or by emailing support@platonapplications.com. Withdrawal does not affect the lawfulness of processing before withdrawal.

We use reproductive health data only for the purposes you consented to: cycle awareness, training planning, and analysis of energy availability and the female athlete triad in the context of athletic preparation. We do NOT use reproductive health data for:

• advertising, marketing, or behavioral targeting;
• profiling for any purpose other than the in-app analytics you consented to;
• sale, lease, or licensing to any third party, regardless of consideration;
• disclosure to law enforcement, except pursuant to a valid, enforceable legal process and consistent with applicable state privacy laws; or
• any purpose outside the scope of the consent you provided.

4.2 Right to Limit Use of Sensitive Personal Information

We use sensitive personal information only to provide the features you request, to secure our services, and for the other limited purposes permitted under Cal. Civ. Code § 1798.121. Because we do not use sensitive personal information to infer characteristics about you or for purposes outside those permitted purposes, the CCPA “right to limit” does not require a separate link; nonetheless, you may restrict our processing by withdrawing consent and deleting your data as described above. You may also contact legal@platonapplications.com with any request to limit use.

5. How We Use Information

We use personal information to:

• provide, operate, and maintain Tare and your account;
• display your progress and generate weight-trend predictions and visualizations;
• personalize your experience within the Licensed Application;
• improve the accuracy, reliability, and functionality of our features;
• for users who opt in, support cycle awareness, training planning, and female-athlete-triad analysis;
• process subscriptions, renewals, and free-trial conversions (through Apple or Stripe);
• verify that you are 18 or older and enforce the EULA;
• detect, prevent, and respond to fraud, abuse, security incidents, and unlawful activity;
• provide customer support and respond to your requests; and
• comply with legal obligations and enforce our agreements.

Legal bases (where applicable). Where data-protection law requires a legal basis, we rely on: your consent (including for reproductive health data and HealthKit access); performance of our contract with you (the EULA); our legitimate interests in operating and securing Tare; and compliance with legal obligations. Where we rely on consent, you may withdraw it at any time.

6. How We Disclose Information

We do not sell or share your personal information, and we do not track you across other companies’ apps or websites. Advertising in Tare is non-personalized (contextual) only: we do not use an advertising identifier (such as the IDFA) and do not build advertising profiles about you. We never share Apple HealthKit data, menstrual cycle data, or other reproductive health data with advertising partners.

6.1 Service Providers and Other Disclosures

We disclose personal information as follows:

• Service providers / processors — vendors that perform services on our behalf under written contracts that restrict them to processing data on our documented instructions and prohibit them from using it for their own purposes. These include Supabase (database and backend hosting, which runs on Amazon Web Services as a sub-processor), Stripe (direct payment processing), Apple (App Store payments and HealthKit), PostHog (product analytics, hosted in the United States), Railway (hosting for Tare’s own application server, which relays AI requests), Google LLC (the Gemini API, which processes the content you submit to Tare’s AI features — see Section 7), and Exa Labs, Inc. (web search for published nutrition data, which receives food names only — see Section 7). Each is engaged as a “service provider” under the CCPA or a “processor” under other applicable laws, and its processing is also governed by its own terms and data processing addendum, which apply in addition to this Policy.
• Advertising partners — as described in Section 6.2.
• Legal and safety — to comply with a valid, enforceable legal process; to protect the rights, property, or safety of Platon Applications, our users, or the public; and to enforce the EULA. Reproductive health data is disclosed to law enforcement only pursuant to valid, enforceable legal process and consistent with applicable state privacy laws.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy and applicable law; we will not use this exception to circumvent the protections that apply to reproductive health data.
• With your direction — when you ask us to share information with a third party you select.

6.2 Advertising (Non-Personalized)

Tare is supported in part by non-personalized (contextual) advertising delivered through Google AdMob. Contextual ads are selected from general, non-personal context rather than from profiles about you. To serve these ads and prevent fraud, limited technical data (such as IP address and general device and app information) is processed by Google; we do not collect or share an advertising identifier (such as the IDFA), and this data is not used to track you across other companies’ apps or websites. Google’s handling of the data it receives is governed by its own terms and privacy policies.

No cross-app tracking. Tare does not track your activity across other companies’ apps or websites and does not use the Identifier for Advertisers (IDFA). Because we do not track you, we do not display an App Tracking Transparency (ATT) permission prompt. All advertising in Tare is non-personalized (contextual).

What is processed for contextual advertising: IP address and general device and app information, used by Google LLC (AdMob) to serve non-personalized ads and prevent fraud. No advertising identifier (such as the IDFA) is collected or shared, and no cross-app or cross-site advertising profile is built.

Never used for advertising. The following are never used for advertising or marketing, never shared with advertising partners, and never sold: Apple HealthKit data; menstrual cycle and other reproductive health data (regardless of opt-in status); and any other sensitive personal information, except as you separately and explicitly authorize. We do not use location-based advertising or data collection near healthcare facilities (see Section 13).

No sale or sharing. We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising as those terms are defined under the CCPA and similar laws, because our advertising is non-personalized (contextual) and uses no advertising identifier. There is therefore no advertising-related “sale” or “sharing” to opt out of. We nonetheless honor recognized opt-out preference signals, including the Global Privacy Control (GPC), where applicable.

7. Third-Party AI Models

Tare uses third-party artificial-intelligence and machine-learning systems, including large language models, to estimate calorie and macronutrient intake, read restaurant menus, and power Tare Coach. This Section explains what data is sent, how it is collected, how it is used, and who receives it.

7.1 Who Receives Your Data

• Google LLC (Gemini API) — the large language model provider for all of Tare’s AI features. All AI requests go from the app to Tare’s own server (operated by Platon Applications and hosted on Railway), which then calls the Gemini API. Your device does not connect to Google directly for these features.
• Exa Labs, Inc. (Exa search API) — a web-search provider used only by AI food logging to find published nutrition data. Exa receives only the names of the foods being logged (for example, “grilled chicken breast”) as search queries — no other personal information.

We do not send your name, email address, account ID, or contact details to Google or Exa.

7.2 What Is Sent, by Feature

Not sent to AI providers: menstrual cycle and other reproductive health data are never sent to Google, Exa, or any other AI provider. Apple HealthKit data is never sent directly to AI providers; Tare Coach context includes only the weigh-ins and workouts recorded in your Tare account, as listed above.

7.3 How It Is Collected and Used

Data is sent only when you actively use an AI feature — for example, by typing or dictating a meal or message, or by taking or choosing a photo — and is used only to provide the feature you requested and return the result to you. It is not used for advertising, is not used to build advertising profiles, and is not sold. Tare Coach conversations are stored in Tare’s database (hosted by Supabase) so you can view them later, and you can delete them at any time.

7.4 How the Recipients Protect Your Data

Google processes the content we send on our behalf as a service provider and data processor under Google’s Gemini API terms for paid services and its Data Processing Addendum. Under those terms, Google does not use the prompts or responses from paid services to improve its products or train its models; Google may retain them for a limited time solely to detect abuse, maintain safety and security, and meet legal requirements. Exa receives only food names and processes them on our behalf under its API terms. We engage these providers only under terms that require them to protect your data with confidentiality and security safeguards at least equal to those described in this Policy.

7.5 Your Permission and How to Withdraw It

Before Tare sends any data to an AI provider for the first time, the app asks for your permission and explains what will be shared. You can withdraw that permission at any time in More → Privacy → AI features. After you withdraw it, Tare’s AI features stop sending data to AI providers; manual (non-AI) logging and the rest of Tare continue to work.

7.6 Limitations of AI Output

AI outputs may contain errors, may be incomplete or biased, and are provided for informational purposes only — they are not medical, nutritional, or dietary advice.

8. Apple HealthKit

To the extent Tare reads from or writes to Apple HealthKit, Apple’s HealthKit rules apply in addition to this Policy. Accordingly:

• we will not use HealthKit data for advertising, marketing, or other use-based data-mining purposes, other than for improving health management or for health research with your prior authorization;
• we will not disclose HealthKit data to third parties without your consent, except as required by law or as necessary to provide Tare’s core functionality (for example, secure cloud storage);
• we will not sell HealthKit data or use it to inform decisions outside the health-and-fitness context you authorized; and
• HealthKit access is requested separately for each data type and may be revoked by you at any time in your device settings.

Tare does not use the Apple HomeKit framework.

9. Data Hosting, Security, and the Supabase Environment

9.1 Where Your Data Is Stored

Your account and app data are stored in a PostgreSQL database and backend hosted by Supabase, our database and backend-as-a-service provider, which runs on Amazon Web Services (AWS) infrastructure in the geographic region we configure for the project (a United States region for U.S. users). In this relationship, Platon Applications is the data “controller” (and a “business” under the CCPA); Supabase acts as a “processor” (and a “service provider” under the CCPA), processing data only on our documented instructions under the Supabase Data Processing Addendum; and AWS acts as Supabase’s sub-processor. Supabase is contractually restricted from using your data for its own purposes, and its handling of your data is further governed by the Supabase Terms of Service and Data Processing Addendum, which apply in addition to this Policy.

9.2 Security Measures

We maintain commercially reasonable and industry-standard administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These measures include encryption of data in transit (TLS) and at rest, access controls and least-privilege permissions, database row-level security, network and application security controls available through Supabase and its underlying AWS infrastructure (which maintains industry-recognized certifications such as SOC 2), logging and monitoring, and routine review of our security practices. Responsibility for security in the cloud is shared: Supabase and AWS are responsible for the security of the underlying platform and infrastructure, and Platon Applications is responsible for secure configuration in that environment (for example, access management, row-level security policies, key handling, and data segregation).

No method of electronic storage or transmission is 100% secure. While we take commercially reasonable measures to protect your information, we cannot and do not guarantee absolute security. You are responsible for keeping your account credentials confidential and for promptly notifying us of any unauthorized use of your account.

10. Data Retention and Deletion

We retain personal information only for as long as necessary to provide Tare, to fulfill the purposes described in this Policy, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Retention periods vary by data type and the criteria we use to determine them include: the duration of your account, the nature and sensitivity of the data, legal and tax requirements, and security needs. Reproductive health and other health data are retained only while your account is active or until you withdraw consent or request deletion, whichever is earlier, after which we delete or de-identify the data within a commercially reasonable period, subject to limited backup-retention and legal-hold exceptions.

When you delete your account, we delete or de-identify your personal information except where retention is required by law or for legitimate, narrowly limited purposes such as fraud prevention, dispute resolution, and the enforcement of our agreements.

11. Security-Incident and Breach Notification

We maintain an incident-response process designed to detect, investigate, and respond to security incidents. If we determine that a breach of the security of the system has compromised your personal information, we will notify affected individuals and, where applicable, the relevant regulators and the Attorney General, in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and any measures necessary to determine the scope of the breach and restore the reasonable integrity of the system, as required by applicable breach-notification laws (including Cal. Civ. Code §§ 1798.29 and 1798.82). Where Supabase, AWS, or another processor notifies us of a security incident affecting your data, we will assess and provide any legally required notifications. Our provision of, or response to, a notice is not an acknowledgment of fault or liability.

12. Your California Privacy Rights

If you are a California resident, the CCPA provides you the following rights. We do not discriminate against you for exercising any of them.

• Right to know / access — to request the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of recipients.
• Right to delete — to request deletion of personal information we collected from you, subject to statutory exceptions.
• Right to correct — to request correction of inaccurate personal information.
• Right to opt out of sale/sharing — we do not sell your personal information and do not “share” it for cross-context behavioral advertising under the CCPA, because our advertising is non-personalized (contextual) and uses no advertising identifier. There is no sale or sharing to opt out of; we nonetheless honor opt-out preference signals (including the Global Privacy Control) where required.
• Right to limit use of sensitive personal information — as described in Section 4.2.
• Right to non-discrimination and, where applicable, the right to designate an authorized agent and to appeal a denial of a request.

How to exercise your rights. Submit a request through your in-app account settings or by emailing legal@platonapplications.com. We will verify your identity before responding, typically by confirming control of your account email. You may use an authorized agent with proof of authorization. We respond within the timeframes required by the CCPA (generally 45 days, extendable once).

Shine the Light (Cal. Civ. Code § 1798.83). We do not disclose personal information to third parties for their own direct-marketing purposes.

Notice of financial incentives / California ARL. Subscription auto-renewal, free-trial, cancellation, and renewal-reminder terms are described in the EULA and comply with the California Automatic Renewal Law (Cal. Bus. & Prof. Code §§ 17600–17606). Nothing in this Policy waives, limits, or modifies any non-waivable right you have under California law, including the CCPA, the Confidentiality of Medical Information Act (CMIA) to the extent applicable, and California reproductive-health-data protections.

13. Consumer Health Data — Washington, Nevada, and Connecticut

13.1 Washington — My Health My Data Act (RCW 19.373)

If you are a Washington resident, the My Health My Data Act (“MHMDA”) applies to your “consumer health data,” which includes the menstrual cycle and reproductive health information you opt in to share. Under MHMDA you have the right to:

• confirm whether we collect, share, or sell your consumer health data and access that data;
• withdraw consent to the collection or sharing of your consumer health data;
• request deletion of your consumer health data; and
• request that we cease collecting, sharing, or selling your consumer health data.

We collect consumer health data only with your separate, affirmative consent, and we obtain separate consent before any sharing. We do not sell consumer health data. We do not engage in geofencing around any healthcare facility to identify, track, collect data from, or send notifications to consumers regarding their consumer health data. Requests may be made to legal@platonapplications.com.

13.2 Nevada (SB 370 / NRS 603A) and Connecticut (CTDPA)

If you are a Nevada or Connecticut resident, we provide equivalent protections for your consumer health data: we obtain consent before collecting or sharing it, we do not sell it without your separate authorization, and we honor your rights to access, delete, and withdraw consent. Connecticut residents also have the rights to access, correct, delete, and port personal data and to opt out of targeted advertising, sale, and certain profiling; you may appeal a denied request by replying to our decision.

14. International Users (EU/UK)

Tare is offered from the United States and is intended for U.S. users. If you access Tare from the European Economic Area or the United Kingdom, you acknowledge that your information will be transferred to and processed in the United States. Health and reproductive data constitute “special category” data under Article 9 of the GDPR/UK GDPR, which we process only on the basis of your explicit consent or another lawful basis. Where required, transfers rely on appropriate safeguards such as the Standard Contractual Clauses. Where we serve EEA or UK users, advertising is non-personalized (contextual) and does not use advertising identifiers for tracking; any cookies or similar technologies that require consent are used only after we obtain that consent through a Consent Management Platform (CMP).

15. Children’s Privacy

Tare is for users 18 and older. We do not knowingly collect personal information from anyone under 18, and we implement technical measures intended to prevent under-18 individuals from creating accounts. Because Tare is restricted to adults, we do not direct advertising to children, and our advertising integration is not configured for child-directed treatment or for users below the age of consent. If we learn that we have collected personal information from someone under 18, we will investigate and delete the account and associated data. If you believe a minor has provided us information, contact legal@platonapplications.com.

16. Cookies, Analytics, and Do-Not-Track

Any Tare website may use cookies and similar technologies for essential functionality, security, and analytics. You can control cookies through your browser settings. Within the Tare app, we use PostHog for product analytics as described in Section 3.4; PostHog processes this data only on our instructions, does not use it for advertising, and does not combine it with data from other companies’ apps. Because there is no common industry standard for “Do Not Track” signals, we respond to legally recognized opt-out preference signals (such as the Global Privacy Control) as required by applicable law. Tare uses only non-personalized (contextual) advertising as described in Section 6.2 and does not use cross-site or cross-app tracking technologies; we never use advertising technologies in connection with your health, menstrual, or reproductive data.

17. Third-Party Services and Links

Tare integrates with and may link to third-party services (including Apple, Stripe, Supabase, AWS, Google AdMob, Google’s Gemini API, Exa, Railway, and connected devices). Their handling of your information is governed by their own privacy policies and terms, which we encourage you to review and to which we defer where their terms govern their own processing. We are not responsible for the privacy practices of third parties.

18. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy with a new “Last Updated” date and, for material changes, provide additional notice through the Licensed Application or by other reasonable means. For changes that materially expand our use of sensitive or reproductive health data, we will obtain any consent required by law before the change applies to that data. Your continued use of Tare after the effective date of a change constitutes acceptance of the revised Policy to the extent permitted by law.

19. How to Contact Us

Questions, complaints, or privacy requests may be directed to:

PLATON APPLICATIONS LLC

Address: 8 The Green, STE B, Dover, Kent County, DE 19901, United States

Privacy / Legal: legal@platonapplications.com

Support: support@platonapplications.com

Telephone: +1 (302) 617-0122

© 2026 PLATON APPLICATIONS LLC. All rights reserved.