Privacy Policy

1. Data Controller

The party responsible for data processing on this website/app is:

Vitalli, Inhaber Mirco Stege
Höllenberg 12
21441 Garstedt
Deutschland
E-Mail: hello@vitalli.app

2. Data We Collect

When using Stackwell, the following personal data is processed:

2.1 Account Data

• Email address: For identification and login
• Password: Stored encrypted (bcrypt hash), never in plain text
• Display name: Optional, for personalization

2.2 Usage Data

• Supplements: Your tracked supplements and dosages
• Intake logs: When you take your supplements
• Health context: Your personal health information (diet, conditions, goals)
• Nutrient tracking: Aggregated nutrient data from your supplements
• AI conversations: Your interactions with the AI assistant
• Usage events: Pseudonymous, server-side events (e.g. page viewed, feature used, error type) to improve the app – without health content (see section 5, Uptik)

3. Legal Basis for Processing

We process your personal data on the following legal grounds:

• Art. 6(1)(a) GDPR in conjunction with Art. 9(2)(a) GDPR: Your explicit consent to the processing of your health data (supplements and doses, intake log, health context, nutrient tracking and health details in AI conversations). You give it before first use and can withdraw it at any time in your profile settings with effect for the future (Art. 7(3) GDPR).
• Art. 6(1)(b) GDPR: Performance of contract (providing app features you signed up for)
• Art. 6(1)(f) GDPR: Legitimate interest (improving app functionality and security)

4. Cookies and Session Data

Stackwell sets cookies only where they are necessary to run the service or hold a setting you chose yourself. No advertising or analytics cookies; our usage analytics (Uptik, see section 5) runs server-side and sets no cookie at all. Complete list, measured against the actual responses — including those of the routes the app loads in the browser itself, not just the page (and not inferred from the source):

• Sign-in (“__Secure-authjs.session-token”): holds your session so you stay logged in. Expires with the session.
• Security of signing in (“__Host-authjs.csrf-token”, “__Secure-authjs.callback-url”): short-lived cookies that secure signing in against abuse and bring you back afterwards. They are set on every page view — including this page, and including when you are not signed in — because Stackwell asks in the browser whether a session exists. As security cookies they are technically necessary (Section 25(2) no. 2 TDDDG); they do not require consent. Detour via Vitalli (“__Secure-authjs.state”, “__Secure-authjs.pkce.code_verifier”): these secure the sign-in path at the respective provider. These two only appear on the sign-in paths and expire within minutes. Consent marker (“sw-consent”): records that you consented to the processing of your health data, so we do not ask again on every request. One year. Language setting (“sw-locale”): only if you change the language with the switch — not when we derive it from your browser. One year. Admin view (“sw-impersonate”): only on accounts with administration rights, while a support view is active.

In your browser's local storage we additionally keep interface state that is never transmitted: your language choice, the view and sorting of your lists, whether the chat column is open, and whether you dismissed a notice. We do not use: Tracking cookies, advertising cookies, Google Analytics, Facebook Pixel, or analytics scripts that record your usage in the browser. The feedback button doesn't store anything on your device either (see section 5).

5. Third-Party Services

We use the following third-party services to operate Stackwell:

Hosting: Railway (EU)

Our application and database are hosted on Railway servers. Your data is stored within the European Union.

AI Processing: Anthropic Claude

When you use the AI assistant, your conversation is sent to Anthropic's API — including the health details you mention there and the health context the assistant draws on for its answer: your Stackwell profile (age instead of date of birth, goals, medications, allergies, conditions you entered, symptoms, supplements) and, if you use those apps, fasting data from Still and lab values, diagnoses, medications, allergies and family history from Vora. Your name and email address are not passed to the model; which data the assistant can fetch from Still and Vora is bound to your sign-in on the server. Our contracting partner and processor is Anthropic Ireland, Limited (Dublin, Ireland). Processing also takes place outside the EU, in particular in the United States: by its affiliate Anthropic, PBC and by cloud providers that Anthropic uses as sub-processors. This transfer is based on the EU Standard Contractual Clauses in Anthropic's data processing addendum (Art. 46(2)(c) GDPR). Anthropic does not use content submitted through the API to train its models and deletes inputs and outputs within 30 days. They are kept longer only if Anthropic's review systems detect a violation of Anthropic's usage policy (then for up to 2 years) or if the law requires it.

Authentication: NextAuth.js

We use NextAuth.js for secure authentication. Your credentials are processed locally and never shared with third parties.

Semantic Search: Voyage AI

For semantic search in our knowledge base and in your health context we use Voyage AI (Voyage AI Innovations Inc., USA, a MongoDB, Inc. company). Text from your health context is sent to Voyage AI's API to compute vectors from it. That text is not anonymised — it describes you; without your name, but with your details. Voyage AI is our processor (Art. 28 GDPR); the data processing agreement is part of Voyage AI's terms of service. Since 6 November 2026, Voyage AI deletes the submitted content immediately after the vectors have been computed and does not use it to train models. The transfer to the United States is based on the EU Standard Contractual Clauses incorporated in that agreement (Art. 46(2)(c) GDPR).

Usage analytics: Uptik

To understand how Stackwell is used and to find errors, we send usage events server-side to Uptik (operated by Vitalli, owner Mirco Stege; hosted on Railway in the EU, Amsterdam). Without your consent we only transmit what is technically necessary: sign-in, sign-up, account deletion, errors, and page views of pages without a health reference (home, sign-in, legal texts, nutrient encyclopaedia). The basis is our legitimate interest in operating and debugging the service (Art. 6(1)(f) GDPR). Anything beyond that — in particular events with a health reference such as “intake logged”, “supplement added”, “health context updated”, “plan created”, and page views inside the signed-in area — is only transmitted if you have explicitly consented in your Vitalli account (Art. 6(1)(a), Art. 9(2)(a) GDPR). You can withdraw that consent at any time in your Vitalli account settings, without giving a reason and without disadvantage: without it you use Stackwell just the same. The withdrawal takes effect going forward. If your consent cannot be determined, we send nothing. We transmit a pseudonymous identifier (your Vitalli account ID), the event name, the normalized path, browser, operating system, device type and language, and for errors the error type plus a technical error code (such as “ETIMEDOUT” for a database timeout). On sign-up and sign-in we additionally send your email address so we can match feedback from beta testers. We do not transmit your IP address, your country of origin, your full browser identifier or any health content (no supplement names, dosages, conditions or free text) — only that and when something happened. No cookies are set and nothing is stored on your device.

Feedback: IdeaQ

Feedback and bug reports you send with the feedback button are filed by Stackwell as a ticket in IdeaQ, our tool for bugs and ideas (operated by Vitalli, owner Mirco Stege; hosted on Railway in the EU). Nothing is stored in your browser for this. If you're signed in, the ticket carries a pseudonymous reporter ID that is calculated from your Vitalli account ID – no name and no email address. With this ID you can see under “My reports” how far along your reports are, and you get a notice once when an item has been fixed; we note on the ticket that you have seen it. Without signing in, the report arrives without an ID. A screenshot of the page is not taken automatically. The feedback window offers it as a separate option, “Attach screenshot”; it is off by default. A screenshot can show health data — for example your plan, your intake log or your health profile — and the feedback window points this out right there. A screenshot is taken only if you select “Attach screenshot” yourself: Stackwell then captures the visible part of the screen when you submit, without the feedback window; only at that moment does your browser load a helper script from ideaq.io for this. Whether screenshots are currently accepted is shown in the feedback window: the option only appears then. Only when you submit are your text, any screenshot, technical details (browser, screen size, the page you're on without search parameters) and the page's latest error messages since it loaded transmitted. So that we know how many reports arrive, our server counts a submitted report as an event — without any content. That event only reaches Uptik with your analytics consent (see above). Legal bases, separated by what is transmitted: for your feedback text, the technical details and the reporter ID it is our legitimate interest in fixing errors and in showing you the status of your reports (Art. 6(1)(f) GDPR). For the screenshot it is your consent — your selection of “Attach screenshot” in the feedback window (Art. 6(1)(a) GDPR) and, because an image of your screen can show health data, additionally Art. 9(2)(a) GDPR. The transfer to the United States is based on Standard Contractual Clauses. What happens to your feedback: For triage, IdeaQ transmits the feedback text and — if you selected “Attach screenshot” in the feedback window — that image as well to Anthropic (contracting partner Anthropic Ireland, Limited; processing also takes place in the United States). The option is off by default. A screenshot can show whatever is on your screen at that moment, including health data. The images are stored with Cloudflare R2; that storage is not confined to the EU. Feedback tickets and screenshots are not deleted automatically — they remain until we delete them as the project owner.

Payments: Stripe

You do not book paid plans (Vitalli Plus) in Stackwell but in your Vitalli account at auth.vitalli.app; payment is processed there by Stripe Payments Europe, Ltd. (Ireland), partly involving Stripe, Inc. (USA) — details are in the privacy policy of the Vitalli account. Stackwell itself sends nothing to Stripe and only learns which plan your Vitalli account has (Free, Plus or Max) to unlock the matching features. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). No health data goes anywhere in this process.

Notifications: Apple

If you allow push notifications on an Apple device, delivery runs through Apple's push service (APNs, Apple Inc., USA). The notification text and a device token are transmitted. We phrase reminders without health content; the name of a supplement can appear in one if you set up an intake reminder. You can turn notifications off at any time. Since 22 October 2026 we no longer offer signing in with “Sign in with Apple”.

Sign-in: Google (until 22 October 2026)

Until 22 October 2026 you could sign in with your Google account. Since then you sign in only with your Vitalli account, and nothing is sent to Google when you sign in. If you signed in with Google before, the identifier Google issued for it stays linked to your account until you delete your account.

Network and delivery: Cloudflare

The domains run through Cloudflare (Cloudflare, Inc., USA, with an EU establishment). Cloudflare terminates the TLS encryption and thereby sees the IP address, the requested address and the browser identifier — technically necessary to deliver the site and fend off attacks (Art. 6(1)(f) GDPR).

6. Data exchange with the other Vitalli apps

Stackwell is part of the Vitalli family and exchanges health data with other apps in it — in both directions. This happens via your Vitalli account identifier, not your name. We read from Vora: recorded conditions, lab values and biomarkers, the glucose-ketone index, notes on your digestion over the last few days, allergies and medication. They appear in your plan as a note next to the relevant supplement. We write to Vora: conditions you record in Stackwell, and symptoms you enter, resolve or let expire here. Vora is the shared store for these entries across the family. We only do this with your consent “Stackwell stores your symptoms and conditions in Vora”. It is collected centrally in your Vitalli account, separately from other purposes, and recorded with its version and time. There you can withdraw it on its own at any time under “Consents”. The consent you gave in Stackwell earlier does not cover this storage. Until you agree, Stackwell writes nothing to Vora and reads no symptoms from there. We then show you a note with the way to the consent. The same applies after a withdrawal. What is already in Vora is not deleted automatically but locked for Stackwell. In Vora it stays visible to you, and you can delete it there at any time. We read your fasting state from Still, and — when you act on it — we control Still: you can end a fast or pick a different fasting template from here as well. What other apps in the group can retrieve from us: your supplements with their ingredients and dosage, your daily nutrient totals, and your intake log — including what you took, skipped or never logged. Joiva combines this with the food side into a nutrient balance. Each of these requests uses a separate secret per app and is logged on our side; without your Vitalli account identifier there is no answer. Height and weight live in the Vitalli account; we read them there and write changes back. The legal basis is performance of the contract you entered into with the Vitalli account (Art. 6(1)(b) GDPR) and, for the health details, your consent (Art. 9(2)(a) GDPR).

7. Connected AI assistant (MCP)

Stackwell offers an interface that lets you connect your own AI assistant to your account (Model Context Protocol). If you connect one, it can read and write on your behalf: your supplements, intake, plans, nutrient figures and shopping list — it can create and archive supplements, create and activate plans, and add or delete intake entries. The connection only exists if you establish it yourself, and it requires an access key. Where the data goes from there is determined by the assistant you connect, not by us. If a third party operates it, your health context leaves our area of responsibility — we have no contract with them and cannot restrict them; whether they store your health context or use it to train their own models is governed solely by their own terms. Read those before you connect. We log that a call happened, not which tool it used. You can revoke the access key at any time.

8. International Data Transfers

Your data is primarily stored and processed within the EU. Data reaches third countries — essentially the United States — with: Anthropic (your conversations with the AI assistant, including the health details you mention there; plus feedback texts and any screenshot you allow), Voyage AI (health-context text for semantic search), Stripe (payment and contact data), Apple (push notifications) and Cloudflare (connection data). These transfers are based on Standard Contractual Clauses (Art. 46(2)(c) GDPR), and additionally on the EU-US Data Privacy Framework where a provider is certified under it (Art. 45 GDPR).

9. Data Retention

We retain your data according to the following policy:

• Account data: Retained as long as your account exists. Deleted within 30 days of account deletion.
• Usage data: Retained as long as your account exists. You can delete individual entries at any time.
• Backups: Database backups are retained for up to 7 days and then automatically deleted.
• Analytics events: We store analytics events for two years. If you delete your Vitalli account, the events are anonymised: the link to you is deleted in every field and cannot be restored. What remains is a count without any reference to a person.

10. Data Storage and Location

Your data is stored on encrypted servers within the European Union (Railway, EU region Amsterdam). Your account, your supplements, your intake log and your health context live there. Data is processed outside the EU only with the providers named in section 5 and only for their purpose — see section 6.

11. Your Rights under GDPR

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): Request a copy of all data we store about you
• Right to rectification (Art. 16 GDPR): Correct inaccurate personal data
• Right to erasure (Art. 17 GDPR): Delete your data ("right to be forgotten")
• Right to restriction (Art. 18 GDPR): Restrict how we process your data
• Right to data portability (Art. 20 GDPR): Receive your data in a machine-readable format
• Right to object (Art. 21 GDPR): Object to processing based on legitimate interest
• Right to withdraw consent (Art. 7(3) GDPR): Withdraw your consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at the email address listed above. We will respond within 30 days.

12. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority — either the one competent for us or the one where you live. The authority competent for us is: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

13. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• All data transmitted via encrypted connection (HTTPS/TLS)
• Passwords stored only as cryptographic hash (bcrypt)
• Regular security updates and dependency audits
• Access controls: Only authorized personnel can access production data

14. Minimum age

Stackwell is for adults only. Use requires you to be at least 18 years old; this is confirmed when the Vitalli account is created. We do not collect a date of birth for it. If you believe a minor has provided us with data, please contact us so we can delete it.

15. Changes to This Policy

We may update this privacy policy from time to time. We will notify registered users of material changes via email. The current version is always available on this page.