Taperist is a behavioural support tool for people who are reducing or stopping GLP-1 medication. To do that job we need to know a small amount about you: roughly how long you were on medication, how much weight you lost, and how the weeks after your last dose are going. This page explains exactly what we collect, why, where it lives, and how to get rid of it.
Taperist is operated by an individual developer ("we", "us"). For the purposes of the EU/UK General Data Protection Regulation we act as the data controller for the personal data described here. You can reach us at support@taperist.com for any privacy question or request.
| Category | What it is | Why |
|---|---|---|
| Account data | Email address, and a password (stored only as a cryptographic hash) or a Sign in with Apple identifier. | To create and secure your account, and to let you restore your progress on a new device. |
| Entry profile | Duration of medication use, amount of weight lost, date of your last dose, whether the stop was planned or abrupt, and whether you are doing any resistance training. | To calculate your regain-risk estimate and to select which weekly protocol you see. |
| Weekly check-ins | Your answers to the single weekly question, plus optional weight entries if you choose to record them. | To show your progress and to adjust the protocol. |
| Purchase data | Subscription status and renewal dates. We never see your card number or billing address — Apple processes the payment. | To unlock the paid content and to know whether your subscription is active. |
| Diagnostic data | Crash reports and a limited set of product events (for example "risk screen viewed"). Device model, OS version, app version, and a random installation identifier. | To find and fix bugs, and to understand which screens lose people. |
Information about medication, body weight, and the timing of a dose reduction is sensitive health data under GDPR Article 9 and comparable laws. We process it only on the basis of your explicit consent, which you give when you complete the entry profile, and only for the purposes described above. You can withdraw that consent at any time by deleting your account or by emailing us; withdrawing consent does not affect the lawfulness of processing that already happened.
We use a small number of infrastructure providers. Each is bound by a data processing agreement and may only process data on our instructions.
| Provider | Purpose | Data location |
|---|---|---|
| Apple | App distribution, in-app purchases, subscription management | Global |
| Supabase | Database and authentication (account, profile, check-ins) | United States |
| RevenueCat | Subscription status and entitlement checks | United States |
| Sentry | Crash reporting and error diagnostics | United States |
| PostHog | Product analytics on aggregated events | United States |
| Resend | Transactional email (account verification, password reset) | United States |
| Cloudflare | Hosting of this website and its DNS | Global edge network |
We do not share personal data with any other third party except where we are legally required to do so (for example in response to a valid court order), or where it is necessary to protect someone's safety.
Depending on where you live, you may have some or all of the following rights. We honour these requests for everyone, regardless of jurisdiction:
To exercise any of these, use Profile → Delete Account in the app, or email support@taperist.com. We respond within 30 days. We may ask you to confirm control of the email address on the account before acting, so that nobody else can delete your data.
Account deletion is available inside the app and removes your profile, check-ins, weight entries and progress history from our production database. It does not cancel an active App Store subscription — that must be cancelled separately in your Apple subscription settings, because Apple controls billing.
Taperist is not directed to children. The app is intended for adults aged 18 and over, and we do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.
Our infrastructure providers store data in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, transfers are covered by Standard Contractual Clauses or an equivalent transfer mechanism. Where required, we rely on your explicit consent for the transfer of health data.
Data is encrypted in transit (TLS) and at rest. Access to production systems is limited to the developer, protected by two-factor authentication. Passwords are stored only as salted hashes. No system is perfectly secure, but we keep the surface small on purpose: the fewer places your data exists, the fewer places it can leak.
If we make a material change — for example, adding a new category of data or a new processor — we will update this page and change the date at the top, and we will notify you in the app before the change takes effect. Continuing to use Taperist after that point means you accept the updated policy.
Privacy questions, data requests, and complaints: support@taperist.com. If you are in the EU or UK and are not satisfied with our response, you have the right to complain to your local data protection authority.