Privacy Policy

Last updated 6 October 2026

Jab is a personal tracker for GLP‑1 medication, whether that is a weekly injection or a daily tablet. This policy explains what it collects, how that data is stored, and how to get rid of it.

What we collect and store

A device identifier. When you first open the app it generates a random ID and stores it on your device. That ID is what links your records to you. No name and no email address is required to use Jab.

What you enter. Your titration plan, the doses you log — a weekly injection or a daily tablet — side effects and how strongly you felt them, weight and body measurements, the protein and water you record, journal entries, injection sites, your pen, vial or pack supply, and what any of it cost if you record that. This is sent to our servers so it survives losing your phone.

Earlier versions of your plan. When you change your plan or stop it, the earlier versions are not erased: they stay with your account as its history, and are removed when the account is deleted.

Progress photos stay on your device. The photos themselves are saved in the app’s own storage on your phone and are never uploaded to us. Our servers hold only the entry that goes with each one — its date, which angle it is, any note you add, and where the file is on your phone (a location inside the app’s storage; the image itself stays on the phone). Because the pictures live only on the device, they do not follow you to a new phone and are lost if the app is removed.

Sign in with Apple or Google (optional). If you sign in, we store the identifier the provider gives us, an email address, and your name if the provider or the sign-in screen passes one on, so your data follows you to a new device. If you use Apple’s Hide My Email, what we store is the relay address Apple generates, not your real one.

Apple Health (optional). If you connect it, Jab reads your weight, and the protein and water you have already logged in another app; it writes back the weight and body-fat entries you enter here. Reading protein and water is how Jab can show those totals without asking you to type a meal twice — it never writes them, because it has no idea what you ate. That is the entire scope: Jab does not ask for sleep, workouts, glucose or heart data, because it has no feature that uses them. You can revoke access at any time in the Health app.

Your IP address, in passing. Like any internet service, our servers see the address a request comes from. We use it to limit abuse — how quickly one address can create accounts or run scans. It is not saved with your records.

What we do not collect

No phone number, no location, no contacts, no advertising identifiers. The Jab app runs no advertising and no analytics SDK.

The meal photo scan (optional, Jab Pro)

Jab has one feature that uses an AI service. If you are a Pro subscriber and choose to scan a meal or a nutrition label, the photo you pick is sent through our server to Anthropic, a third-party AI provider, for analysis. What comes back is an estimate of the calories, protein, carbohydrate and fat in the picture, a short name for the meal and a list of the items it identified. The app asks for your agreement before the first photo is sent, and nothing is sent if you decline.

The photo is sent to Anthropic for that one analysis and is not stored by Jab: our server passes it on and keeps no copy. It is sent without your name, email address, account details or dose history, and the request says nothing about you. The scan looks at the food only. If you never use the scan, nothing is ever sent to Anthropic.

Who we share it with

We do not sell your data, and there is no arrangement under which we would. Nothing you log is shared for advertising or for analytics. Apart from the meal photo scan described above, which happens only when you choose to use it, Jab sends what you log to no third party.

A small number of companies handle data on our behalf and are not free to use it for anything else: our hosting provider Vercel, the database host below, and our subscription processor RevenueCat.

RevenueCat receives your device identifier whether or not you subscribe. The app sets RevenueCat up with that identifier every time the app starts, because that is how it finds out whether you have a subscription, and our server may ask RevenueCat the same question using the same identifier. If you do subscribe, RevenueCat also holds the record of that purchase — that a subscription started, renewed or lapsed. RevenueCat never receives anything you log. Your card details go to Apple or Google and never reach us at all.

Where it is stored

In a PostgreSQL database hosted by Neon in the United States, encrypted in transit with TLS and encrypted at rest.

Deleting it

You can delete your account from inside the app: on the Home screen tap the person icon at the top right to open Profile, scroll to the bottom, tap Delete my account, and confirm. That removes the account and the records attached to it from Jab’s database when you confirm — it is not a request queue. You can also email us and we will do it within 30 days.

Four things are outside what that deletion reaches, and you should know about them:

• RevenueCat keeps its own record of any purchase, under the device identifier described above. Deleting your Jab account does not erase it.
• Backups. Copies of the database kept by our database provider as backups are not erased at the moment you delete; they age out on the provider’s schedule.
• Photo files on your phone. Deleting your account clears what the app has saved about you on the phone, but progress photo files already in the app’s storage can remain there until you delete the app itself.
• Records made before you signed in to an existing account. If you used Jab without signing in and then signed in to an account you already had, what you recorded before signing in stays under the earlier device identifier. It is not linked to your name or email, and deleting your account in the app does not remove it. Email us if this applies to you.

Deleting your account does not cancel a Jab Pro subscription, because subscriptions are billed by Apple or Google rather than by us. Cancel it in your device’s subscription settings — see the Support page.

This website

This site is separate from the app. It uses the Meta Pixel on its home page only — not on this page, the Terms or the Support page. When the home page loads, the pixel sends Meta the address of the page, including any campaign tag in the link that brought you there, your IP address, details of your browser, and Meta’s cookie. It sends the same again, with the name of the event and nothing more, when a visitor taps the App Store button or signs up to be told about the Android launch. Nothing you record in the app is ever sent to Meta.

If you leave an email address on the site we store it, with the campaign tag of the link that brought you here if there was one, and use it only to send the notice you asked for. Email us to have it removed.

Children

Jab is not directed at children and is intended for adults. We do not knowingly collect data from anyone under 18. If you believe a child has provided us data, email us and we will remove it.

Changes

If this policy changes materially, the date at the top changes with it. Continued use after a change means you accept it.