Draft pending legal review. This policy describes how the current release of Elk works. It is written in plain language and must be reviewed by counsel before launch. It is worded for the owner to review against the app and the store privacy answers.
The short version
Your check-ins, measurements, lab values and health readings are stored encrypted on your phone and are never sent to our servers. Elk reads from Apple Health (or Health Connect on Android) and never writes to it. Nothing is sold, used for advertising, or sent to an AI service. Elk needs no account.
A few small things do leave the phone, and they are listed below under “What does leave your phone”. None of them is a health reading.
Who this is for
Elk is for adults 18 and over. You confirm your date of birth when you start, and the app will not run for anyone under 18. If you connect Apple Health, Elk also checks the birth date stored there.
What Elk collects, and where it lives
Elk is local-first. The data it works with is kept in an encrypted database on your device. The encryption key is held in the device keychain, stays on that device, and the database is excluded from iCloud and Android backups:
- Your check-ins: how you feel each morning (energy, mood, sex drive, recovery, morning erections) and how many drinks you had the day before.
- A short questionnaire (ADAM) about once a month.
- Body measurements you enter: waist and weight.
- Life events you add, such as illness or travel, so Elk can account for unusual days.
- Nightfall logs, only if you turn that optional item on. It is off by default.
- Lab results you type in or import from a report (see below).
- Apple Health / Health Connect data, read-only: sleep (duration and timing), heart-rate variability, resting heart rate, body measurements and exercise. Elk never writes anything back.
- Optional voice and selfie checks: see “Biometric data” below.
- A baseline and trend that Elk computes from the above, on the device.
- Your settings and consent choices, including which version of each consent you accepted and when.
Apple Health & Health Connect
Elk only requests the specific health types it needs, and only if you turn that signal on. Health data is read on the device to compute your own trend. It is not used for advertising, not sold, and not shared. Health information is never stored in iCloud.
Lab reports
You can type lab results in, or import a PDF or photo of a lab report. The report is read on your phone and the file is deleted after reading; only the values you confirm are kept. On Android, reading text from a report uses Google's ML Kit, which runs on the device. Your report and its values never leave your phone, but ML Kit sends Google basic usage and performance information (such as device model, app version, timing and error codes). On iPhone, Apple's on-device text recognition is used.
Biometric data (optional)
These signals are off unless you choose to enable them, and you can turn them off at any time.
- What is kept: a small set of numeric measures only — voice-quality and pitch measures from a voice clip, and facial-appearance measures from a selfie. No identity template is ever created.
- What is not kept: the raw recording or photo. These are deleted on your phone within seconds of capture, are never saved to your photo library, and are never uploaded.
- Purpose: your own wellness trend only. Elk never does face recognition and never compares you with other people.
- Retention: until you delete the signal or your data, or after a period of inactivity set before release, whichever comes first.
- Sharing: we do not sell, lease, trade or disclose these features to anyone.
Files you share
Some features create a file on your phone for you to share: the doctor report (PDF), a data export (JSON or CSV), and an encrypted backup. Each is created on the device and goes only where you send it through your phone's share sheet. Elk deletes its own copy once the share sheet closes, and any leftover is removed the next time the app starts.
Encrypted backup (optional)
You can make a backup to move your data to a new phone. The backup is encrypted on your device with a passphrase only you know, using strong, standard encryption; the key is derived from your passphrase and never leaves your phone. You choose where to save the file, for example Files, iCloud Drive or Google Drive. We never receive it. If you lose the passphrase, the backup cannot be opened by you or by us.
What does leave your phone
This is the complete list for the current release.
- Reminder registration (only if you turn reminders on and allow notifications). Elk sends our server your phone's push token (an address Apple or Google gives the phone), your platform (iPhone or Android), your app language, your time zone, and whether reminders should use generic wording. This lets us send you a notification. Turn reminders off and Elk asks the server to forget the token. Stale tokens that Apple or Google reject are also removed.
- Subscription (only if you open the paywall or buy). Elk uses RevenueCat to confirm what you bought. RevenueCat receives an anonymous app identifier and the purchase details from the store. Apple or Google processes the payment. None of this includes health data.
- Proof that the app is genuine. When Elk fetches content from our server, it sends a one-time check from Apple or Google that the request comes from the real app, and for Pro content your RevenueCat identifier. It carries nothing about your health.
- Ordinary server records. Like any server, ours sees the IP address and time of a request when your phone contacts it, and keeps that in routine technical logs. Those logs are rotated automatically and old entries are dropped as new ones come in.
Elk does not send usage analytics. There is no analytics code in the app.
The current release has no account and no cloud backup. If that changes, we will update this page first.
Notifications and discretion
Your daily reminders are scheduled on your phone; their content does not pass through our servers. If you allow notifications, our server may also send you a message directly through Apple or Google, for example an announcement. With discreet notifications on (the default), these use generic wording. The app is hidden behind a cover or blur in the app switcher (and screenshots are blocked on Android while this is on), and you can switch to a plain app icon.
Subscriptions
A record of a purchase stays with Apple, Google and RevenueCat as part of their own records, and Delete everything in Elk does not remove it. Today, a purchase is held under an anonymous identifier that is not linked to your name or email. Elk's deletion screen tells you this when it finishes.
What we never do
- We do not sell or rent your data.
- We do not use your data for advertising.
- We do not send your data to third-party AI services.
- We do not track you across other companies' apps or websites.
- We do not show a hormone value or a diagnosis. Elk shows trends, not numbers.
Your choices and rights
- Delete everything: Settings → Delete account (button: Delete everything) erases the encrypted database and its key, scheduled reminders, and any report, export or capture files left on the phone, and asks the server to forget this phone's reminder token. It then shows a receipt of what was and was not removed. If the app ever holds an account on our server, that is deleted first, and if it cannot be reached nothing is wiped so you can try again.
- Export: you can export all of your data as JSON or CSV from Settings.
- Withdraw a signal: each signal can be turned off independently in Settings → Data sources, and you choose whether to delete what it collected.
- Consent changes: if we change what a signal does, Elk asks you again before continuing to use it.
Children
Elk is not intended for anyone under 18 and is not directed at children.
Changes
If this policy changes in a way that affects how your data is handled, we will update this page and the “last updated” date, and surface material changes in the app.
Contact
Questions about privacy? Email [email protected]. Elk is provided by the Elk team.