Privacy policy

1. Who we are

revns (revns.com) is operated by AISOLO Technologies Private Limited (“we”, “us”), a company incorporated in India. We decide why and how your personal data is processed, so we are the data controller (the “data fiduciary” under India’s DPDP Act). This policy covers the website, the signed-in app and the MCP server at https://mcp.revns.com.

AISOLO Technologies Private Limited, 1003, Kamdhenu Commerz, Sector 14, Kharghar, Navi Mumbai 410210, Maharashtra, India.

2. What we collect

• Account: email address, name (optional), date of birth (to confirm you are an adult), and a password hash if you set a password. If you sign in with Google, we receive your Google email and name.
• Profile: objective, disciplines, time zone, units, food preferences and the health notes you choose to enter.
• Tracking data: the metrics you create, the values and notes you log, meals, goals, weekly plans and coach notes.
• Imported data: rows from a CSV you upload, and values sent by a source you connect, such as Apple Health through an ingest key.
• Teams: memberships, invitations and challenge results.
• Connected assistants: which AI assistants you authorised, their scopes and when they last connected.
• Technical: IP address and request metadata in short-lived server and rate-limit records, used for security and abuse prevention. The session cookie is described in Cookies and storage.
• Messages to us: what you send to support, and our replies.

Some of this is health-related data. We treat all of it as sensitive. You decide what to enter; the app works with only a few metrics.

3. Why we use it

• To run the service you asked for: scoring your days, building briefs and plans, showing trends, and letting your assistants read and write your data.
• To secure accounts: sign-in, rate limiting, lockout after repeated failures, and abuse prevention.
• To send service emails: sign-in links, email confirmation, password reset. We do not send marketing email without a separate opt-in.
• To meet legal duties and answer valid legal requests.
• To fix problems and improve the product, using aggregate counts, not your entries.

Where the law needs a legal basis (GDPR), it is: performing our contract with you, your consent (for health data and for sharing), our legitimate interest in security, and legal obligation. Under the DPDP Act we rely on your consent and on the legitimate uses the Act lists.

4. What we never do

• We do not sell your data.
• We do not use it for advertising or share it with advertisers or data brokers.
• We do not train AI models on your entries, meals, notes or goals.
• We do not make signed-in pages public, cacheable by shared caches, or indexable by search engines.
• We do not put health data in URLs, logs or error messages.

5. How it is protected

• Health content (values, notes, meals, goals, plans, coach notes, metric names, food preferences) is encrypted with AES-256-GCM using a key unique to your account. That key is derived from a master key that is not stored in the database, so a database copy alone does not reveal it.
• Data is encrypted in transit with TLS.
• Passwords are hashed with bcrypt. Sign-in is rate limited and locks after repeated failures.
• Assistants connect through OAuth 2.1 with PKCE, scoped permissions, short-lived tokens and revocation. Ingest keys are stored only as hashes.
• Every database query is scoped to the signed-in account.

No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires. Report a vulnerability to [email protected].

6. Sharing and who processes your data

Teams. Sharing needs consent from both sides. Team members see derived numbers only: scores, streaks, challenge totals, and pillar scores if you allow it. They never see your entries, meals, notes, goals or email. You can leave a team at any time.

Your AI assistants. When you connect Claude, ChatGPT or another MCP client, that assistant can read and write the data you scoped, through our MCP server. What the assistant provider then does with the conversation is governed by that provider’s terms and privacy policy, not ours. Disconnect an assistant from Settings at any time.

Service providers. We use a small set of processors to run the service, under written terms that limit them to our instructions:

• cloud hosting and managed database and cache providers, to store and serve the data;
• Resend, to deliver sign-in and service emails (it sees your email address and the message);
• Google, only if you choose “Sign in with Google”.

Legal. We disclose data if a valid legal process requires it, and we will tell you first where the law allows. If our business is sold or merged, the data moves under this policy and you will be told before it is covered by a different one.

7. International transfers

We are based in India, and our providers may store data in other countries. Where the law requires, we use safeguards such as standard contractual clauses for transfers out of the EEA or the UK.

8. How long we keep it

• While your account is open: your data stays until you delete it.
• When you delete your account: every row you own is removed at once. Encrypted backups roll off within 35 days.
• Short-lived records: sign-in tokens expire in minutes; rate-limit and security records expire within days.
• Support messages: kept up to 2 years after the last reply, then deleted.
• Records we must keep by law: only what the law requires, and for as long as it requires.

9. Your rights

Depending on where you live, you can access, correct, export and delete your data, withdraw consent, object to or limit processing, and complain to a regulator. Most of it is self-service: download everything as JSON or delete your account from Settings. For the rest, see Your data rights or write to [email protected]. We answer within 30 days, sooner where the law asks.

10. Children

revns is for adults, 18 and older. We ask for a date of birth and block use under the minimum age. We do not knowingly collect data from children. If you think a child has an account, write to [email protected] and we will delete it.

11. Not medical advice

revns is a training tool. It is not a medical device and does not diagnose, treat or prevent any condition. See a clinician for symptoms such as chest pain, fainting or injury.

12. Changes

If we change this policy in a way that matters, we will update the date above and tell signed-in users by email or in the app before it takes effect.

13. Contact and grievances

Privacy questions and requests: [email protected]. Under Indian law, you can also write to our Grievance Officer at the same address with “Privacy grievance” in the subject line; we acknowledge within 72 hours and resolve within 30 days. If you are not satisfied, you may complain to your data protection authority, or to the Data Protection Board of India once it is constituted.

AISOLO Technologies Private Limited, 1003, Kamdhenu Commerz, Sector 14, Kharghar, Navi Mumbai 410210, Maharashtra, India.