Privacy policy.
Last updated 26 October 2026. This policy says what Four collects, where it lives, who else handles it, and how you can delete it. The shorter page is the privacy promise.
Controller
FourHer, Inc., a Delaware corporation that makes Four, is the controller of the personal data described here. Its founder, Nikita Lauffer, is based in the Netherlands. For privacy requests, email [email protected].
Your profile choices (name, time zone, goals, equipment, where you like to move, workout length, food and movement styles, units) are stored on our server so you can sign in on a new phone. Your health conditions are not.
What Four collects and where it lives
| What | Where it lives |
|---|---|
| Daily log: check-ins, today plans, cycle marks, notes, Ask Four chat and saved facts, saved recipes and workouts, reminder settings, and the country you choose, if you choose one. | Where it livesEncrypted on your phone. The key stays in this phone's secure storage, never in iCloud Keychain, and a backup carries it only sealed under your passphrase. On iPhone, iCloud and computer backups leave the log out. You can lock Four with Face ID or a PIN, and the PIN is kept only as a salted hash. Reminders stay on the phone and show nothing personal on your lock screen. The log leaves the phone only in a backup you make, or in the parts Ask Four sends for one answer after you allow it. |
| What Four learns about you: what you tend to like, what helps, how your days tend to go, how workouts felt, and your routines. | Where it livesOnly on your phone, encrypted with your daily log. It never syncs to our server. See it and forget any of it in What Four knows. A backup you make keeps it. If you allow Ask Four, a few lines of it go with a question, in words. |
| Account: email, name, sign-in method (email link, Apple, or Google), your Apple or Google account id, your session, and, from Google, your profile picture link. | Where it livesOur server. We keep no Apple or Google sign-in tokens. Your session keeps no IP address and no device details. |
| Profile choices: your name, time zone, goals, equipment, where you like to move, usual workout length, food and movement styles, and units. | Where it livesOur server, so you can sign in on a new phone. The server can read this copy. Your health conditions, life stage, due date, diet, notes, memory and calendar are never stored on our server. With Ask Four on, each question carries some of them, as the list below shows. Four's answer and its cards are kept encrypted for up to 10 minutes so a retry gets the same answer, then deleted. Your birth year, height and weight do not go to our server or to Ask Four. |
| Ask Four, for one answer, after you allow it. | Where it livesSent through our server to our AI providers, OpenRouter and OpenAI. We do not save what you send, and it is not used to train AI. What Ask Four sends
Never your email, account id, birth year, height or weight. |
| Reports you choose to send, when Four has a problem or you send feedback: the app version, your phone system version, the screen name, the error and a short part of its text, and your note. Your email only if you tick the box. Never your daily log. | Where it livesOur server. Sending is always your tap. Four scrubs a crash report on your phone before it is sent, and our server scrubs it again. Feedback is saved with your account and deleted with it. Reports saved in our database are deleted after 90 days. |
| Sign-in email. | Where it livesResend receives your email address and the sign-in link so it can send the message. |
| Apple Health, on iPhone, if you connect it: sleep, workouts, period days, resting heart rate and wrist temperature, only the types you switch on. | Where it livesApple Health data is read on your phone and never stored on our servers. If you turn on AI, a short fact like 'slept under 6 hours' can be sent with a question or the morning note. Four keeps one daily summary of each type, encrypted on your phone, and leaves the summaries out of backups. If you turn them on, Four saves the workouts you finish and the period days you log to Apple Health. |
| Your calendar, if you turn on Use my calendar. | Where it livesFour reads your calendar on this phone to plan around busy days. It never changes your calendar and never saves its events. If you allow Ask Four, it sees how busy today and tomorrow are, never what's in them. |
| What we do not collect. | Where it livesFour does not track your location. The app never asks for location access and never uses GPS. We only ask which country you are in, so Four can show you the right emergency numbers when you need help. You choose it yourself, you can skip it, and it stays on your phone. Our database keeps no IP address. We also collect no advertising ID, no analytics events, no contacts, no Health Connect data, no push token, and no payment data. |
Your profile choices (name, time zone, goals, equipment, where you like to move, workout length, food and movement styles, units) are stored on our server so you can sign in on a new phone. Your health conditions are not.
Processors
These companies process data for Four.
- Fly.io
- Hosts the Four API in the United States (US East).
- Postgres database host
- Stores your account and the copy of your profile choices in Postgres, in the United States, with the API.
- Resend
- Sends the sign-in email. Resend receives your email address and the sign-in link.
- OpenRouter
- Routes each Ask Four request to the model that writes the answer.
- OpenAI
- Writes the Ask Four answer. OpenAI receives the facts needed for that answer, and a plate photo if you attached one. We do not write the turn to our database or disk. It is not used to train AI.
- Apple
- App Store, TestFlight, and Sign in with Apple. Apple receives only what sign-in needs. We do not bill a membership yet. If we add one, Apple would process the payment.
- Sign in with Google. Google receives only what sign-in needs.
Apple and Google receive only what sign-in needs. We use no third-party crash reporter and no analytics. We do not use a separate billing company. Expo builds the app and does not receive your account or your log when you use Four.
Retention
A sign-in link lasts 30 minutes. Expired links are deleted every hour.
A sign-in session lasts seven days, unless you delete the account sooner. Expired sessions are deleted every hour.
We keep the profile copy until you delete your account.
Your daily log stays on your phone until you delete it there, or until you delete your account and the app wipes that phone.
We do not save what you send to Ask Four.
- Four's answer and its cards are kept encrypted for up to 10 minutes so a retry gets the same answer, then deleted.
- The answer is cleared at the next Ask Four request after that.
- How long OpenRouter or OpenAI keep a request is not settled, so this policy does not claim that they delete it.
Reports and feedback saved in our database are deleted after 90 days. Feedback is also deleted when you delete your account.
Deleting your account removes those rows from the live database. How long a backup may still hold them is not settled.
Host logs can include an IP address, and a scrubbed crash report sent when Four could not start. They do not include the text of Ask Four messages. How long the host keeps those logs is not settled.
How deletion works
Back up
Open Profile and choose Back up my data. Four makes one file with everything you logged, except Apple Health summaries, locked with a passphrase only you know. We never see the file or the passphrase. Another phone can open it only with the passphrase.
Delete the data on your phones
On Profile, type delete data, then choose Delete all data. This wipes Four on that phone, removes your profile copy from our server, and wipes your other signed-in phones the next time they sync. It also removes what Four saved to Apple Health, if Four still has access. Your account and email stay until you delete the account.
Delete your account
On Profile, choose Delete my account, type delete my account, and confirm. We delete your account and everything stored with it on our server. Then the app wipes Four on that phone.
What we delete
- your user and your sessions
- your sign-in methods
- your profile copy and the link to it
- any feedback you sent
- any sign-in token that still has your email
Crash reports carry no account and are deleted after 90 days.
With Sign in with Apple, you confirm with Apple once more so we can ask Apple to remove Four.
If you skip that, you can remove Four in your Apple ID settings.
If you are offline, the app asks you to check your connection and try again.
Your rights
If the GDPR applies to you, you can ask us to:
- tell you what personal data we hold
- correct it
- delete it
- restrict how we use it
- give you a copy
- stop a use you object to
- withdraw consent for health details you chose to share
Email [email protected]. You can also complain to a data protection authority. In the Netherlands, that is the Autoriteit Persoonsgegevens. You can complain to the authority where you live.
Transfers to the United States
Your account and profile copy are stored in the United States, where the API is hosted (US East). Resend, OpenRouter, and OpenAI may also process the data they receive in the United States. If you are in the European Economic Area or the United Kingdom, that is a transfer outside your region.
Children
Four is for people aged 16 and over. We do not knowingly collect personal data from anyone under 16. If you believe we have, email [email protected] and we will delete it.
Contact
Privacy: [email protected]. Support: [email protected].
Last updated 26 October 2026.