Legal

Privacy Policy

Last updated November 4, 2026

Siloh (“Siloh”, “we”, “us”) respects your privacy. This policy explains what information we collect, why, and the choices you have. It includes:

Part A describes what happens today on the waitlist at getsiloh.com. It is binding now.
Health Connect (Android) describes the integration and applies whenever you use it, including during testing. It is separate from the anticipated practices in Part B.
Part B describes what we anticipate collecting and doing when the Siloh product launches. Part B is not yet in effect and is provided for transparency. When the product launches, a superseding version of this policy will be published and you will be notified of the change.

Part A — Waitlist (in effect now)

What we collect

When you submit the waitlist form, we store the following in our database (hosted by Supabase, a third-party processor):

Email address — to contact you about your waitlist slot.
Source — a short label identifying which page you joined from (e.g. landing).
User agent — your browser's self-reported identifier string, used for spam and abuse diagnostics.
Referral code — a randomly generated code tied to your row, so we can credit people you refer.
Referrer — if you arrived via another person's referral link, we store their code so we can credit them.
Campaign tags — the utm_ tags on the link you arrived from, if any, so we know which post or campaign brought you.
Timestamp — when you joined.

If you buy a Founding 500 membership, Stripe collects your payment details on its own checkout page. We receive your email, the amount paid and the payment status, never your full card number.

We do not collect your name, phone number, precise location, or any health or fitness data on this website.

Cookies, analytics and advertising

The website uses cookies, browser storage and the services below to understand how people find and use it, and to measure our ads and creator posts. They record things like the pages you view, the buttons you tap, the site that sent you, your browser and device type, and your approximate region. Your IP address is sent to each service as part of loading it.

PostHog (product analytics) — sets a random visitor ID in a cookie and in browser storage. If you join the waitlist, your email is attached to that ID so we can see which pages lead to signups.
Google Analytics 4 (traffic analytics) — sets Google Analytics cookies. IP anonymization is turned on.
Microsoft Clarity (heatmaps and session replay) — records how pages are scrolled and clicked so we can find confusing layouts. Clarity masks text you type into form fields.
Reddit Pixel (ad measurement) — tells Reddit when someone who saw a Siloh ad visits the site or joins the waitlist.
Cloudflare (hosting) — may collect aggregate, cookie-free traffic statistics.

The website also stores a few items in your browser for its own use: your campaign tags for the visit, and a token that lets you look up your waitlist referral link again on the same device.

You can block or delete cookies in your browser settings, use your browser's tracking protection, or install Google's Analytics opt-out add-on. The site still works with them blocked. We do not sell your personal information, and our analytics vendors may only use it to provide their service to us.

How we use it

To notify you when your waitlist wave opens.
To count positions and compute referral counts.
To diagnose abuse of the signup form (e.g. automated spam).
To send occasional product updates if you opt in. You can unsubscribe at any time.

Who we share it with

We do not sell your email or any other data. We share limited information only with the infrastructure providers needed to run the site:

Supabase — database host; stores the waitlist row.
Cloudflare — content delivery and hosting.
Resend — sends our emails to you.
Stripe — processes Founding 500 payments.
PostHog, Google Analytics, Microsoft Clarity and Reddit — analytics and ad measurement, described under Cookies, analytics and advertising.

The full list, with what each one receives and where it is based, is on our subprocessors page.

How long we keep it

We keep waitlist entries until you ask us to remove them or until the waitlist program ends. After the product launches, unclaimed rows may be archived or deleted at our discretion.

Your rights (waitlist)

You can ask us to:

See what we have stored about you.
Correct inaccurate information.
Delete your record.
Export your record.

The fastest path is the self-service form at getsiloh.com/delete-data, which opens a pre-filled deletion request to our legal alias. If you'd rather email us directly, write to legal@getsiloh.com from the address you signed up with. We'll respond within a reasonable time and at most within 30 days.

Health Connect (Android)

Connecting Health Connect is optional. Siloh asks for your permission before accessing each data type, and reads or writes only the types you allow. This section applies whenever you use the integration, including before the general product launch.

Data we read — weight, exercise sessions, distance, heart rate, resting heart rate, heart rate variability, and active calories burned. These records keep your training history, recovery information, and nutrition and calorie targets current.
Data we write — weigh-ins, nutrition logs, completed workouts, and tracked activities you record in Siloh. Activity records can include distance, active calories, and a route when available. Each write requires the corresponding Health Connect permission.
Background access — if your device supports it and you grant the additional permission, Siloh can read authorized records while the app is not open to keep your history and fitness information in sync.
Past history — if you grant the additional permission (for example by choosing to bring in workouts older than 30 days), Siloh reads authorized records from before you connected to fill in your training history.

Information synced from Health Connect is stored with your Siloh account and processed to provide the health and fitness features you use. This can include the optional Coach features or information you choose to share with a linked trainer. If you turn on auto-posting for Health Connect (off by default), each new run or activity imported from Health Connect is posted publicly to Discover about 10 minutes after it syncs, with its title, distance, time and pace (and the run details your privacy settings allow others to see); you can cancel a pending post or turn the setting off at any time. Infrastructure providers may process it as needed to operate these features. We do not sell Health Connect data, use it for advertising, or transfer it for unrelated purposes.

Siloh's use of information received from Health Connect adheres to the Health Connect Permissions policy, including its Limited Use requirements. Access, use, and sharing are limited to the permitted purposes described here and the health and fitness features visible in the app.

You can revoke any or all permissions in Health Connect settings at any time. Revoking access stops future access to those data types; it does not automatically delete records already synced to your Siloh account or records Siloh previously wrote to Health Connect. You can manage Health Connect records in its settings. For requests about data held by Siloh, use our deletion request page or contact legal@getsiloh.com.

Part B — Product practices (takes effect at launch)

Not yet in effect. The Siloh product is in pre-launch development. The section below describes the categories of data we expect to handle and the controls we plan to offer when the product goes live. It is published so you can see where we are headed. It does not describe what we do today and does not create obligations before launch. A superseding privacy policy will be posted at launch; the then-current version at getsiloh.com/privacy will be the binding one.

Categories we expect to collect

Account data — email, password hash, optional phone, device and session identifiers.
Profile data — name, date of birth, sex, height, weight, body measurements, nutrition and training goals, dietary restrictions, and allergies.
Health and fitness data — meal logs, macro and calorie totals, workout programs, completed sets and reps, recovery metrics, sleep if provided, and related notes you choose to record.
Wearable and integration data — data pulled from services you connect (for example Apple Health, Google Fit, Whoop, Garmin, Oura), limited to the scopes you authorize.
Payment data — a customer token from our payment processor. We do not store full card numbers.
Usage and device data — pages viewed, features used, app version, operating system, approximate region (not precise location), crash traces.
Support communications — messages you send us and our replies.

Consumer health data

Some of the categories above may qualify as “consumer health data” under laws such as the Washington My Health My Data Act, Nevada SB 370, and the Connecticut Data Privacy Act. When the product launches we will:

Ask for separate, specific consent to collect, use, and share consumer health data.
Honor revocation of that consent without penalty.
Not geofence health-related locations for advertising.
Publish an attestation of compliance alongside this policy.

AI and automated decision-making

Meal plans, workout programs, and adjustments are generated with machine learning models, some of which are provided by third parties (for example OpenAI, Anthropic). When the product launches we will:

Name the model providers we use.
State whether your inputs are used by those providers to train their models, and give you the option to opt out where available.
Explain how to request human review of a plan or decision.

How we expect to use product data

To deliver the core features you signed up for.
To generate, adjust, and improve meal plans, workout programs, and related content.
To process payments and manage subscriptions.
To provide customer support and troubleshoot issues.
To measure how the product is used in aggregate and improve it.
To detect and prevent fraud, abuse, and security incidents.
To meet legal and regulatory obligations.

We will not use your health or fitness data to serve you cross-context behavioral advertising, and we will not sell it.

Subprocessors at launch

The subprocessors the website uses today are listed at getsiloh.com/privacy/subprocessors. We will add the product's subprocessors there at launch. Expected categories include:

Cloud infrastructure and hosting.
Database and authentication.
Payments and billing.
Transactional and marketing email.
Customer support tooling.
Error and performance monitoring.
Product analytics (privacy-respecting, no cross-site tracking).
AI model providers.

Cookies and similar technologies

The website's cookies and analytics are described in Part A. If the product introduces others, we will list them and, where required (for example in the UK, EU, and parts of California), offer consent controls before any non-essential cookie is set.

International transfers

Our infrastructure is primarily based in the United States. If we process personal data of people in the UK, EU, or other regions with cross-border transfer rules, at launch we will rely on an appropriate transfer mechanism (such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum) and identify it in the superseding policy.

Your rights (product)

Depending on where you live, you may have the right to access, correct, delete, port, restrict, or object to the processing of your personal data, to opt out of certain sharing, and to appeal a denial of a request. At launch we will provide in-product tools for access, correction, export, and deletion, and an email channel for all other requests. We will not discriminate against you for exercising a right.

California specific

When the product launches, California residents will have the rights described under the California Privacy Rights Act (CPRA). Although we do not sell or share personal information for cross-context behavioral advertising, at launch we will publish a “Do Not Sell or Share My Personal Information” notice and honor Global Privacy Control signals.

Children

The Siloh product is intended for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has submitted their information, contact us and we will delete the record.

Security and breach notification

We will implement administrative, technical, and physical safeguards appropriate to the sensitivity of the data we handle, including encryption in transit, encryption at rest for health-category data, least-privilege access, vendor diligence, and logging. No system is perfectly secure. If a breach affects your personal information, we will notify affected users and regulators within the timeframes required by applicable law.

Retention at launch

We will retain personal data for as long as you maintain an account and for a limited period after closure to satisfy legal, tax, fraud, and dispute-resolution obligations. Category-level retention schedules will be published in the launch version of this policy.

Common provisions

Do Not Track

Our site does not respond differently to Do Not Track browser signals. At launch we will honor Global Privacy Control (GPC) for applicable California opt-out rights.

Changes to this policy

We may update this policy as the product evolves. Material changes will be reflected in the “Last updated” date at the top and, for substantive changes, we will notify you via email or an in-product notice before the change takes effect. Earlier versions will be archived and linked from this page.

Contact

Questions, complaints, or requests? Email legal@getsiloh.com. If you are in the UK or EU and believe we have not handled your data properly, you also have the right to lodge a complaint with your local supervisory authority.