PRIVACY
Privacy Policy
Last updated 6 November 2026
Soven turns health and activity data you choose to connect into a daily recommendation. This policy explains what we process, why, where it lives, and the controls you have. In short: scoring runs on your device, we never sell or share health data for advertising, and you can export or delete everything at any time.
Who we are
Soven is operated by Eden Makers s.r.o., Prague, Czech Republic (the "controller"). Contact us about privacy at privacy@getsoven.com.
What we process
| Data | Source | Purpose |
|---|---|---|
| Account: email, first name, optional avatar | You, or Sign in with Google | Signing in, syncing between your devices |
| Daily health summaries: sleep, resting heart rate, HRV, steps, active minutes, and optional VO2 max, weight, body composition, oxygen saturation, respiration, temperature | Apple Health or Google Health, only after you grant access | Computing your readiness, sleep and activity scores and showing your history |
| Check-ins, mood, energy, context tags and experiments | You | Finding patterns in your own data |
| Settings and consent choices | You | Making the app behave the way you chose |
| Subscription status | Apple App Store or Stripe | Unlocking paid features |
| Push notification token | Your device, only if you enable reminders | Sending reminders and your weekly review |
We store daily summaries, not minute-by-minute raw data. Free-text journal notes stay on your device and are not uploaded. Data from Apple HealthKit is never used for advertising, marketing or data mining, and is never sold or shared with third parties except as needed to provide the features you use.
Optional AI coach
The default coach runs locally on rules. If you turn on the AI coach, a compact daily summary you have consented to, plus your question, is sent to Google Gemini through our server to generate an answer. In private mode the coach receives scores only, never raw measurements or your personal context. You can turn this off at any time.
Connecting other AI assistants (MCP)
You can connect Soven to an AI assistant such as Claude through our MCP connector. It is read-only, works only after you sign in and approve it, respects the same private mode, and every access is logged in your account. You can revoke a connection at any time in Settings.
Legal bases
- Health data: your explicit consent (GDPR Art. 9(2)(a)), given when you connect a source. Withdraw it by disconnecting the source or deleting your account.
- Account and service data: performance of our contract with you (Art. 6(1)(b)).
- Security, abuse prevention and service reliability: our legitimate interest (Art. 6(1)(f)).
Where data is stored and who processes it
- Supabase (database, authentication, account emails, server functions)
- Cloudflare (website hosting and the MCP connector)
- Google (Gemini, only if you enable the AI coach; Google Health, only if you connect it)
- Apple (App Store purchases, push notifications) and Stripe (web purchases)
Where a processor transfers data outside the EEA, it does so under the European Commission's Standard Contractual Clauses or an adequacy decision.
How long we keep it
We keep your data while your account exists. When you delete your account, your profile, health summaries, check-ins and settings are deleted from our database immediately and from backups within 30 days.
Your rights and controls
- Export everything as JSON or CSV from Settings.
- Delete your account and all data from Settings, in the app or on the web.
- Disconnect any data source or AI connection at any time.
- Access, correct, restrict or object to processing, and data portability, by emailing us.
- Complain to a supervisory authority; in the Czech Republic that is the Office for Personal Data Protection (uoou.cz).
Children
Soven is not intended for anyone under 16 and we do not knowingly collect their data.
Changes
If we change this policy in a way that matters, we will tell you in the app before the change applies.