Privacy policy.

Atta (“Atta,” “we,” “us”) helps you build healthier habits, and that only works if you trust us with personal information about your health. This policy explains, in plain language, what we collect, why, who touches it, and the control you keep. The short version: we use your information to run your coaching — we do not sell it, and we do not share it with advertisers or data brokers.

What we collect

Information you give us

• Account details — your email address and password (your password is stored only by our authentication provider in encrypted form; we never see it).
• Health profile — answers from onboarding and settings: name, goals, weight, dietary preferences and allergies, activity level, and medications you choose to tell us about, including GLP-1 medications and dose-day timing.
• Logs and check-ins — protein, water, activity, weight entries, and weekly check-in answers.
• Coach conversations — messages you exchange with the Atta coach.

Information collected automatically

• Basic technical data — such as browser type and pages visited, used to keep the service working and secure. We use cookies only for essential purposes like keeping you signed in — no advertising or cross-site tracking cookies.
• Push subscription — if you turn on notifications, the technical token your browser issues so we can deliver them. You can turn this off anytime.

How we use it

• To personalize your coaching — daily plans, targets, meal ideas, and the coach’s replies are generated from your profile, logs, and conversations.
• To send you the service itself — your morning plan email, push notifications, and account emails. You can unsubscribe from non-essential email anytime.
• To operate, secure, and improve Atta, and to respond when you contact support.

We do not sell your personal information, share it with advertisers or data brokers, or use it for third-party advertising. We do not use your identifiable health information to train AI models.

Who processes your data

Atta runs on a small set of service providers who process data only to provide their service to us:

• Supabase — our database and authentication (your account and health data live here, encrypted at rest).
• OpenAI — powers the coach. Relevant parts of your profile and conversations are sent to generate responses and plans; under our API terms, OpenAI does not use this data to train its models.
• Vercel — hosts the website.
• Resend — delivers our emails.
• Stripe — handles payments if you buy a paid plan. Your card details go directly to Stripe; we never see or store them.

Beyond these providers, we disclose personal information only if required by law, to protect the safety of a person, or as part of a business transfer (in which case this policy would continue to apply to your data).

A note on health data

Atta is a consumer wellness product, not a healthcare provider, so the information you give us is generally not covered by HIPAA (the U.S. health-privacy law that applies to doctors, hospitals, and insurers). We treat it carefully anyway: encryption in transit and at rest, access limited to what is needed to run the service, and no advertising use — ever.

Your choices and rights

• See and update — you can view and edit your profile and targets in the app under You → Update my profile.
• Export — email us and we will send you a copy of your data.
• Delete — email us and we will permanently delete your account and associated data, subject to any records we must keep by law.
• Quiet the inbox — every non-essential email has a manage link, and push notifications have an in-app toggle.

For any of these, write to support@tryatta.com from your account email. Depending on where you live (for example California or the European Union), you may have additional legal rights to access, correct, delete, or port your data — we honor these requests regardless of where you live.

Retention and security

We keep your data while your account is active so your coaching stays continuous. If you delete your account, we delete your personal data promptly. We use industry-standard safeguards, but no system is perfectly secure — if a breach affects your data, we will notify you as required by law.

Children

Atta is for adults. It is not directed to anyone under 18, and we do not knowingly collect information from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

Changes

If we make material changes to this policy, we will notify you by email or in the app before they take effect. The date at the top always reflects the current version.

Questions about privacy? support@tryatta.com.