Privacy Policy
Joul helps you compare the calories you eat with the calories WHOOP estimates you burn. Your food and body data are sensitive, so this policy explains plainly what we collect, why, who else touches it, and how you stay in control.
1. Who we are
Joul is operated by Julian Stastny, an individual, Av. Amsterdam 255, Hipódromo, Cuauhtémoc, 06100 Ciudad de México, CDMX, Mexico (“Joul”, “we”). Contact: hq@joul.health.
2. What we collect
| Data | Where it comes from | Where it's kept |
|---|---|---|
| Profile and goals: goal type, weight, height, date of birth, optional target weight, calorie and protein targets, unit preference | You | On your device |
| Food diary: foods, portions, calories, protein, carbohydrates, fat, meal times, saved meals, days you mark complete | You | On your device |
| Photos of meals, only if you choose photo logging | You | Saved with the meal on your device if you keep them. Sent for analysis when you ask (see section 5). Our server does not keep them. |
| WHOOP data: cycle start and end, time zone offset, energy expenditure (kilojoules), strain. Recovery, sleep, heart rate and HRV data will be covered here only if those features are added. | WHOOP, with your permission | Cached on your device. Our server passes it through and our server passes it through and does not store it |
| WHOOP connection: an access and refresh token that let us read your data until you disconnect | WHOOP, when you connect | Our server, encrypted. Never on your device. |
| Session token that identifies your device to our server | Us | Your device's Keychain, plus a hash on our server |
| Subscription status | Apple (StoreKit) | Handled by Apple. We don't receive your payment details. |
| Technical logs: IP address, request time, error codes | Your device | Our server logs. Our server logs, kept for 30 days. |
We do not collect your WHOOP password. You sign in on WHOOP's own page.
Website visitors. This website does not use cookies or analytics. It loads a font from Google Fonts, which means your IP address is sent to Google when the page loads.
3. What we don't do
- We don't sell your data or share it for advertising.
- We don't use health or nutrition data to build advertising profiles.
- We don't include third-party advertising or tracking SDKs. If we later add analytics, we will update this policy first and choose a privacy-respecting option.
4. How we use your data
- To show your calorie balance, calendar, charts and insights.
- To keep your WHOOP connection working (refreshing access) and to fetch your WHOOP data when you open the app.
- To analyse a meal photo when you ask us to.
- To run subscriptions, prevent abuse (for example rate limits), fix bugs and keep the service secure.
- To comply with the law.
If you use Joul from the EU or UK, we rely on your consent to process health data, on contract to provide the service you asked for, and on legitimate interests for security and abuse prevention.
5. AI photo analysis
Photo logging is a Premium feature (with a few free trial analyses). When you use it, the photo is sent from the app to our server and on to our AI provider, Anthropic, PBC, which returns a list of foods and estimated portions. We send only the photo and the instructions needed to analyse it, not your name, profile or WHOOP data. Our server does not keep your photo or the result after the analysis is returned. If you choose to keep a photo with a meal, it is stored only on your device, as part of your diary. How our AI provider handles API data is governed by its own terms and privacy policy, which we review before relying on it.
AI results are estimates and can be wrong. You review and edit every result before anything is saved.
6. Who else handles your data
- WHOOP, the source of your expenditure data. WHOOP's own terms and privacy policy apply to data in your WHOOP account.
- Apple, for the App Store, in-app purchases and notifications.
- Hosting provider a cloud hosting provider in the United States or the European Union, which runs our server and database.
- AI provider Anthropic, PBC, only for photo analysis, as described above.
We may also disclose data if the law requires it. If Joul is ever sold or merged, we'll tell you and your choices will stay in place.
7. Your WHOOP connection
You can disconnect WHOOP in the app at any time. Doing so asks WHOOP to revoke our access and deletes your connection and tokens from our server. You can also remove Joul's access from your WHOOP account.
8. Keeping and deleting data
- Your food diary, any meal photos you keep, and your profile live on your device. Deleting an entry removes its photo, and deleting all data in the app, or deleting the app, removes everything from the device.
- Deleting all data in the app also asks our server to revoke WHOOP access and delete your account records (tokens and sessions).
- Server logs are kept for 30 days.
- If we add cloud sync later, we will update this section first.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, port or restrict the use of your data, to withdraw consent, and to complain to a regulator. Email hq@joul.health and we'll respond within 20 business days (or sooner where the law requires). This policy also includes a Mexico privacy notice (Aviso de Privacidad) in section 16.
10. Security
WHOOP tokens are encrypted at rest on our server. Connections use HTTPS. Your session token is stored in the iOS Keychain. No system is perfectly secure, so please keep your device protected.
11. International transfers
Our server and providers may be located outside your country. Where data is processed outside your country, we rely on the safeguards available under applicable law, such as contractual protections with our providers.
12. Children
Joul isn't for children under 16. We don't knowingly collect their data. Joul isn't designed for anyone with an eating disorder, and we don't give personalised dietary advice.
13. Not medical advice
Calories, nutrition values and balances shown by Joul are estimates and are not medical advice. See our Terms.
14. Changes
If we change this policy in a meaningful way, we'll update the date above and tell you in the app before the change applies to you.
15. Contact
hq@joul.health · Av. Amsterdam 255, Hipódromo, Cuauhtémoc, 06100 Ciudad de México, CDMX, Mexico
16. Aviso de Privacidad (Mexico privacy notice)
This section is the privacy notice required by Mexico's federal law on the protection of personal data held by private parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares). It applies to everyone, and it adds the details Mexican law asks for.
Responsable (data controller)
Julian Stastny, an individual, with address at Av. Amsterdam 255, Hipódromo, Cuauhtémoc, 06100 Ciudad de México, CDMX, Mexico. Contact: hq@joul.health.
Datos personales (personal data we process)
The data listed in section 2: profile and goals, food diary, optional meal photos, WHOOP data, your connection and session records, and technical logs. We do not ask for your name, phone number, financial data or government identifiers to use the app.
Datos personales sensibles (sensitive personal data)
Weight, height, date of birth, nutrition records and WHOOP energy and activity data are health-related and are treated as sensitive personal data. We process them only with your express consent. You give it when you enter them in Joul and when you connect WHOOP, and you can withdraw it at any time by disconnecting WHOOP, deleting your data in the app, or writing to us.
Finalidades (purposes)
- Necessary purposes: to provide the service you request (calorie balance, calendar, charts), to connect to WHOOP, to analyse meal photos when you ask, to manage subscriptions through Apple, and for security, abuse prevention and legal compliance.
- Secondary purposes: none at present. If we ever add any, we will tell you first and give you a way to refuse that does not affect the necessary purposes.
Transferencias y encargados (transfers and processors)
We do not sell your data. We rely on service providers that process data on our behalf, described in section 6 (hosting, AI photo analysis, and Apple). We may also disclose data to authorities where the law requires it.
Derechos ARCO (your rights)
You have the right to access, rectify, cancel or oppose the processing of your personal data (ARCO rights), to withdraw your consent, and to limit the use or disclosure of your data. To exercise them, email hq@joul.health with:
- a way for us to contact you and enough information to identify you (we may ask for reasonable proof that you are the data subject);
- a clear description of the data and the right you want to exercise;
- anything that helps us locate the data.
We will tell you our decision within 20 business days and carry it out within 15 business days after that, as the law provides. Because most of your data lives on your own device, you can also delete or edit it directly in the app.
Limitar el uso (limiting use and disclosure)
You can limit how we use your data by disconnecting WHOOP, turning off optional features in the app, or writing to us.
Cambios al aviso (changes)
If we change this notice, we will update the date at the top and tell you in the app before the change applies to you.
Autoridad
If you believe your rights have been violated, you may bring a complaint to the Mexican data-protection authority.