Privacy Policy

Last updated: August 27, 2026

This Privacy Policy explains how Kessa collects, uses, and shares information when you use the Kessa website and web app (the "Service"). Kessa is a fictitious business name registered in Placer County, California by Nectar Gummies LLC, a California limited liability company (file number B20250319336), referred to here as "Kessa", "we", "us" or "our". Kessa is a consumer-wellness service and is not a healthcare provider.

1. Information we collect

  • Account information: your email address, used to create and sign in to your account.
  • Quiz answers: information you enter to generate your protein target, such as weight, height, strength-training status, GLP-1 phase, and your primary concern. We use these to estimate lean body mass and calculate a protein target.
  • Results email: if you ask us to email you your protein target from the results screen, we store the email address you enter along with the target and meal split we showed you. We use it to send you that one message. We do not store the quiz answers behind that number against your address, and asking for it does not create an account or add you to a marketing list.
  • Activity in the app: the foods and protein you log, dates, and program interactions. Any medication/"shot" log is recorded as a date only — we do not collect dose amounts.
  • Payment information: subscription payments are processed by Stripe. Kessa does not store your full card number; we may store limited billing details and your subscription status.
  • Technical information: device/browser type, IP address, and usage data collected automatically.
  • Interest-form information: if you submit an interest or lead form hosted on a social advertising platform such as Meta, we receive from that platform the name and email address you submitted, together with any optional free-text answer you chose to give. That platform also keeps its own copy under its own policies, which we do not control.
  • Marketing-page referral tracking: on our public marketing pages we use Rewardful, an affiliate-referral service, to attribute sign-ups to the person who referred you (see "Cookies & analytics").

2. How we use information

To provide and operate the Service (calculate your target, store your logs, authenticate you); process your subscription and refunds; send transactional messages (sign-in links, receipts, renewal and refund notices); provide support; maintain security and prevent abuse; improve the Service; and comply with legal obligations. We do not use your health-related inputs to make decisions about you beyond providing the Service's features.

If you asked us to email you your protein target from the results screen, we use that address to send you that one message and nothing else, unless you later ask to hear from us.

If you gave us your email address through an interest form, or by asking to hear from us, we also use it to send you marketing and promotional email about Kessa — but not an address you gave us only to be sent your protein target, which we use for that message alone. Every one of those messages carries a one-click unsubscribe link, and we stop sending as soon as you use it.

3. How we share information

  • Service providers (subprocessors) that process information on our behalf under contract: Stripe (payments), Supabase (database, authentication, and app hosting), Netlify (website/app hosting), Resend (transactional and marketing email), Anthropic (AI processing of coach conversations and food photos), Rewardful (referral attribution), and Google Workspace (our business email).
  • Legal and safety; business transfers: when required by law or to protect rights and safety, and in connection with a merger, acquisition, or sale of assets, subject to this Policy.

4. We don't sell your personal information

We do not sell your personal information for money. We do share a limited amount of it for cross-context behavioral advertising, in the sense California law gives that phrase: our public marketing pages carry a Meta advertising pixel, described in full in section 5. That sharing is confined to the marketing pages, it carries nothing you have entered into Kessa, and it never carries health information. To opt out, email hello@kessahealth.com with the subject line “Do Not Share”, or switch on Global Privacy Control in your browser, which we honour as an opt-out signal.

5. Cookies & analytics

We use cookies and similar technologies to keep you signed in and operate the Service.

Referral attribution. Rewardful sets a cookie so that a visit from an affiliate link can be credited if you later subscribe. Its script loads on our public marketing pages and, because it is included in the application's page template, it also loads on pages you see while signed in. It records the referral identifier and the fact that a subscription started. It is not an advertising network, and we do not use it to build a profile of you or to target advertising.

Our own measurement. We count how people move through our website and app using a first-party record: a random identifier your browser stores for our sites, sent to our own servers together with the name of a step (for example, that a page was viewed or a quiz was started). It carries no medication name, no health condition, no diagnosis, and no free text. It is not shared with any third party and is not used for advertising.

Advertising technology we use. Our public marketing pages — and only those pages — carry a Meta (Facebook) advertising pixel. It transmits your device’s IP address, your browser user-agent string, an identifier from a cookie, and the address of the marketing page you are looking at. It records two things beyond a page view: that the button to start the free protein quiz was pressed, and that the button to start a trial was pressed. It sends no other information and no parameters of any kind. Automatic Advanced Matching is switched off, so no email address, telephone number or name is collected or transmitted, and the Conversions API is not connected. The pixel is not present in the signed-in application, on the quiz, on your results page, or at checkout — so your weight, your GLP-1 phase, your protein target and every answer you have typed into Kessa are outside its reach entirely. See section 4 for how to opt out.

History. Between 6 August 2026 and 10 August 2026, our public marketing pages carried a Meta (Facebook) advertising pixel, which transmitted browser information and the address of the page being viewed to Meta. Two settings matter: Automatic Advanced Matching was switched off for the entire period, and the Conversions API was never connected — so no email address, telephone number, or name was transmitted. As with any request to a third-party server, your device's IP address, browser user-agent string, and an identifier from a cookie set by our own site were transmitted. The pixel was never present in the signed-in application, and no information you entered into the Service was sent to Meta. It was removed from every page of our website on 10 August 2026, and reinstated on 19 August 2026 in the narrower configuration described above.

6. Sensitive information

Some information you provide (such as weight and GLP-1 phase) may be considered sensitive personal information. We use it only to provide the Service's features and as described in this Policy.

7. Your California privacy rights

If you are a California resident, you have the right to know/access the personal information we hold about you; delete it; correct it; opt out of any sale or sharing; and limit the use of sensitive personal information — and to not be discriminated against for exercising these rights. To exercise a right, email hello@kessahealth.com. We will verify your request as required by law.

8. Data retention

We keep your account information for as long as your account is active. After you close your account, we delete or de-identify your personal information within 90 days, except records we must keep to meet legal, tax, or accounting obligations, which we retain for as long as the law requires. We keep records of auto-renewal consent for as long as the law requires.

If you gave us your email through an interest form but never opened an account, we keep that record for up to 24 months after you last engage with us, and sooner if you ask us to delete it. Any free-text answer you gave on that form is turned into anonymous, non-identifying notes within 30 days and the original text is deleted. If you unsubscribe, we keep your email address on a suppression list, because that is how we make sure we do not contact you again.

9. Security

We use reasonable administrative and technical measures to protect your information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Children

The Service is intended for adults 18 and older and is not directed to children. We do not knowingly collect information from anyone under 18.

11. US-focused service

The Service is intended for users in the United States. We do not target or knowingly offer the Service to individuals in the EU or UK. If you access it from outside the United States, you do so on your own initiative and are responsible for local law.

12. Changes to this Policy

We may update this Policy. If changes are material, we will notify you (for example, by email or in-app). The "Last updated" date shows the current version.

13. Contact

Privacy questions: hello@kessahealth.com · Nectar Gummies LLC, 2305 Spanish Trail, Rocklin, CA 95765.