Skip to content

CogniFlux Privacy Policy

Effective date: September 5, 2026

Policy version: 1.0.0

This policy explains how CogniFlux and cogniflux.app handle information. It applies to the CogniFlux iPhone app, the CogniFlux service, and the public website. CogniFlux is a wellness and education product. Its caffeine and metabolite values are estimates, not measurements or medical advice.

1. Data controller

Baldwinson Corporation ("we," "us") is the controller for the CogniFlux iPhone app (bundle com.baldwinson.cogniflux) and https://cogniflux.app.

13195 Imperial Hwy

Whittier, CA 90605

Contact: CogniFlux Support

2. What the product is

You can log caffeine without an account, and the model runs on your device. An account is optional and supports cloud backup, restore, and subscription linking. If you sign in, cloud sync is on by default; you can pause it or delete the cloud copy. Diagnostics are off unless you turn them on. There is no research contribution program in version 1.0.

With your permission, CogniFlux reads heart rate, resting heart rate, and heart-rate variability from Apple Health. It does not write to Apple Health and does not read Apple Health sleep analysis. Raw Apple Health samples stay in Apple Health and are not uploaded. Daily aggregates derived on your device may be included in your optional cloud backup.

3. App and service information we handle

Caffeine journal and preferences

CogniFlux handles the caffeine amount, drink name or source, and date and time you log. It also handles favorites, recent drinks, the bedtime, cutoff and daily limit you set, optional age and body-weight settings used by the model, and education-article progress. This information supports the journal, modeled curves, reminders, and your chosen settings.

Core journal data and modeling remain on your device while you are signed out. Recent-drink shortcuts remain only on that device. If you create an account and cloud sync is on, the journal, favorites, model settings, and article progress are backed up to CogniFlux services. They remain until you delete an entry, delete the cloud copy, clear the device, uninstall where applicable, or delete the account. Complete export and caffeine-history export are available in the app; recent-drink shortcuts are included only in the complete export.

Account and authentication

If you create an account, we handle your email address, a name supplied by Apple or Google, a CogniFlux user identifier, and security session information. We use this information to create and secure the account, sign you in, reset a password, link a subscription, and operate optional backup and restore. Apple and Google process information when you choose their sign-in methods. Resend delivers account email. CogniFlux session infrastructure stores short-lived session state.

Account information remains until you delete the account, subject to limited security, fraud-prevention, dispute, and legal retention. Signing out removes the local session but does not delete the account or cloud copy. Complete export includes account profile information but never includes session tokens.

Apple Health information

With your permission, CogniFlux reads heart rate, resting heart rate, and heart-rate variability from Apple Health to create an observational overlay. Raw samples remain in Apple Health, are not copied into the CogniFlux journal, and are never uploaded. CogniFlux stores only daily aggregates derived on your device. Those aggregates may be included in cloud backup when both Apple Health access and cloud sync are on.

Disabling Apple Health in CogniFlux stops future queries and deletes local derived aggregates. It does not remove a derived aggregate already included in a cloud copy; use Delete cloud copy or Delete account for that. Complete export includes derived daily aggregates, not raw Apple Health samples. CogniFlux does not write to Apple Health or read Apple Health sleep analysis.

Optional network caffeine estimate

The local drink catalog is the default. If you confirm the just-in-time disclosure, CogniFlux sends the drink description you entered and a rate-limiting identifier to CogniFlux services and OpenAI to estimate a caffeine amount. The description is not added to your journal unless you confirm a resulting drink. Provider retention follows the configured OpenAI account terms. You can avoid this processing by using the local catalog or entering an amount yourself.

Purchases and subscriptions

Apple and RevenueCat handle purchase and subscription information. CogniFlux receives entitlement and subscription status to unlock Pro, restore purchases, and link an entitlement to an account. Apple and RevenueCat retain billing records under their policies. CogniFlux account deletion unlinks the copy we control but does not cancel or erase Apple's billing record. Subscription status is included in complete export; receipts and payment credentials are not.

Diagnostics

If you turn diagnostics on, Sentry receives crash reports and usage metrics used to fix crashes and understand feature operation. If you are signed in, events may be linked to your CogniFlux user identifier, but not to your email, caffeine journal, or raw Apple Health samples. Turning diagnostics off stops new events; it does not automatically erase past Sentry events. Diagnostics are off unless you affirmatively enable them.

Support messages

If you send an in-app support message, we receive its category, message, optional reply email, app and operating-system version, device model, and account context if you are signed in. CogniFlux services and Resend deliver the message to our support mailbox. We retain it only as long as reasonably needed to answer, investigate, secure the service, or meet legal requirements. You may request deletion through support; deleting an account does not retract an email already sent.

Notifications, Siri, and consent choices

Notification preferences and pending local alerts are stored on your device; preference flags may sync with your account, but CogniFlux 1.0 does not use a push-notification token. A drink logged with Siri is kept in a local pending queue until it is safely committed to the journal, after which it follows the journal's sync, export, retention, and deletion rules. CogniFlux records your permission and consent choices so it can enforce what is on or off. Those choices can be cleared from the device and are included in complete export where applicable.

4. Website information

The general website does not use advertising networks or general-purpose analytics. The Support page loads Google reCAPTCHA to reduce spam. Google may receive browser, device, interaction, cookie, and network information under its own privacy terms when that page loads.

If you submit the website support form, we receive your name, email address, category, subject, and message. Google Cloud runs the form endpoint and Google Workspace delivers the message to our support inbox. Vercel hosts the website and may process standard request information, such as IP address, user agent, requested URL, and timestamps, for delivery, security, and operational logs.

We use support-form information only to respond, investigate problems, protect the service, and keep necessary business or legal records. We retain it only as long as reasonably needed for those purposes. You may request deletion through CogniFlux Support; some records may be retained when required for security, fraud prevention, dispute resolution, or law.

5. Information we do not collect or use

We do not sell personal information. We do not use HealthKit data, caffeine logs, or support messages for advertising. CogniFlux does not use the App Tracking Transparency identifier and does not track you across other companies' apps or websites.

6. Cloud sync, retention, and deletion

Pause cloud sync stops upload and download. A copy already on the server remains until you delete the cloud copy or delete your account. "Off" does not mean "this device only" if a server copy already exists.

The app provides separate controls to delete individual caffeine entries, delete the cloud copy, clear this device, sign out, delete the account, and export data. Deleting an account deletes the account and server journal we control. Processor records may remain briefly while deletion retries complete, and records required for security, fraud prevention, disputes, or law may be retained. Deleting an account does not cancel an App Store subscription.

7. Consent and permissions

Apple Health, diagnostics, notifications, and the network caffeine estimator require the applicable permission or affirmative in-app choice. You can withdraw those choices in CogniFlux. Apple Health and notification permissions can also be changed in iOS Settings. Withdrawing a choice stops future processing controlled by that choice; it does not automatically erase an existing cloud copy, past Sentry events, an already-sent support email, or Apple and RevenueCat billing records.

The network caffeine estimator identifies OpenAI before sending the drink description you enter. It runs only after you confirm. The local drink catalog remains available without sending that description to OpenAI.

8. Service providers

Each provider processes information under its agreement with us and its own applicable terms. We require service providers acting for us to protect information consistently with this policy and applicable law.

9. Legal bases and privacy choices

Where data-protection law requires a legal basis, we process core journal and security data to provide the service you request; account, sync, and purchase data to perform our contract with you; permission-gated HealthKit, diagnostics, estimator, notification, and support data with consent; and limited operational data for service security and legal compliance.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information, and to withdraw consent. Submit a request through CogniFlux Support. We may need to verify that the request concerns your information. You may also complain to your local data-protection authority.

10. Security and international processing

We use platform security, access controls, and encrypted network transport appropriate to the information handled. No system can guarantee absolute security. CogniFlux and its providers operate in the United States and may process information in other countries, using legally required transfer safeguards where applicable.

11. Children

CogniFlux is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. If you believe a child has provided information, contact us so we can investigate and take appropriate action.

12. Changes and contact

We may update this policy when the product or law changes. We will update the effective date and provide additional notice when required. Material new optional processing will not be enabled solely by changing this page; the app will request the applicable choice or permission.

Questions, requests, or complaints: CogniFlux Support.