Privacy Policy

Last updated: October 27, 2026

This Privacy Policy explains how Kessa collects, uses, and shares information when you use the Kessa website and web app (the "Service"). Kessa is a fictitious business name registered in Placer County, California by Nectar Gummies LLC, a California limited liability company (file number B20250319336), referred to here as "Kessa", "we", "us" or "our". Kessa is a consumer-wellness service and is not a healthcare provider.

This Policy also covers the Kessa mobile apps for iPhone and Android, which are part of the Service.

1. Information we collect

  • Account information: your email address, used to create and sign in to your account.
  • Quiz answers: information you enter to generate your protein target, such as weight, height, strength-training status, GLP-1 phase, and your primary concern. We use these to estimate lean body mass and calculate a protein target.
  • Results email: if you ask us to email you your protein target from the results screen, we store the email address you enter along with the target and meal split we showed you. We use it to send you that one message. We do not store the quiz answers behind that number against your address, and asking for it does not create an account or add you to a marketing list.
  • Activity in the app: the foods and protein you log (including any food you add yourself from its label), dates, and program interactions. If you turn on Shots, you can keep a log of your shots: the date and, if you add them, the time, the medication by its generic name (such as semaglutide or tirzepatide), the dose exactly as you enter it, the injection site, and your shot schedule. If you choose to keep the dates only, we store the date alone. Kessa never suggests, changes or checks a dose. If you use them: your weekly goal and the milestones you reach, your buy-again answers (which only you can see), whether you have a check-in buddy, and your device's time zone, which we use to date your week and your reminders.
  • Payment information: subscription payments are processed by Stripe. Kessa does not store your full card number; we may store limited billing details and your subscription status.
  • App store purchases (Apple or Google Play): if you subscribe in the iPhone app, Apple processes the payment under its own terms, and Kessa never sees your card details. If you join in the Android app, Google Play processes the payment under its own terms, and Kessa never sees your card details. We use RevenueCat to keep the record Apple or Google sends us (which plan, its dates, and whether it is active or set to renew), tied to a random account identifier rather than your name or email address.
  • Technical information: device/browser type, IP address, and usage data collected automatically.
  • App install attribution (iPhone app): whether your download followed a tap on one of our Apple Ads search ads and, if so, which of our campaigns and keywords it came from (see "Cookies & analytics").
  • Ad measurement events (iPhone and Android apps): that the app was installed and opened, that you created or signed in to an account, and that a free trial or paid membership started, with its price and currency. These are sent to Meta through Meta’s app software, together with device information and identifiers it uses to recognise the device (see “Cookies & analytics”).
  • Interest-form information: if you submit an interest or lead form hosted on a social advertising platform such as Meta, we receive from that platform the name and email address you submitted, together with any optional free-text answer you chose to give. That platform also keeps its own copy under its own policies, which we do not control.

2. How we use information

To provide and operate the Service (calculate your target, store your logs, authenticate you); process your subscription and refunds; send transactional messages (sign-in links, receipts, renewal and refund notices); provide support; maintain security and prevent abuse; improve the Service; and comply with legal obligations. We do not use your health-related inputs to make decisions about you beyond providing the Service's features.

If you asked us to email you your protein target from the results screen, we use that address to send you that one message and nothing else, unless you later ask to hear from us.

If you gave us your email address through an interest form, or by asking to hear from us, we also use it to send you marketing and promotional email about Kessa — but not an address you gave us only to be sent your protein target, which we use for that message alone. Every one of those messages carries a one-click unsubscribe link, and we stop sending as soon as you use it.

3. How we share information

  • Service providers (subprocessors) that process information on our behalf under contract: Stripe (payments), RevenueCat (app membership records and install attribution), Supabase (database, authentication, and app hosting), Netlify (website/app hosting), Resend (transactional and marketing email), Anthropic (AI processing of coach conversations and food photos), and Google Workspace (our business email). Apple processes App Store purchases and Apple Ads attribution under its own privacy policy. Google processes Google Play purchases under its own privacy policy. Meta Platforms receives the ad measurement events from our iPhone and Android apps described in section 5. Meta is not our service provider for this; it handles them under its own terms and privacy policy.
  • Legal and safety; business transfers: when required by law or to protect rights and safety, and in connection with a merger, acquisition, or sale of assets, subject to this Policy.

Sharing with a buddy you choose. Only if you turn it on. Kessa shows the one person you pair with whether you checked in today and how many days in a row you've both checked in — never your name, email, food, numbers, target, weight, medication or answers. You turn it on by sending or accepting an invite and confirming on a screen that lists exactly this. Your invite goes through your phone's share sheet to whoever you choose; Kessa never sees your contacts. You can stop at any time with Remove buddy in the app, and sharing ends at once.

4. We don't sell your personal information

We do not sell your personal information for money. We do share a limited amount of it for cross-context behavioral advertising, in the sense California law gives that phrase, in two places, both described in full in section 5: our public marketing pages carry a Meta advertising pixel, and our iPhone and Android apps send Meta a small set of ad measurement events (that the app was installed and opened, that an account was created or signed in to, and that a free trial or paid membership started, with its price and currency). Neither carries anything you have entered into Kessa: no weight, GLP-1 phase, protein target, shots, meals or answers. To opt out on the web, email hello@kessahealth.com with the subject line “Do Not Share”, or switch on Global Privacy Control in your browser, which we honour as an opt-out signal. The apps do not yet have a switch that turns their Meta events off for one person; until they do, Kessa on the web at app.kessahealth.com does not send them.

5. Cookies & analytics

We use cookies and similar technologies to keep you signed in and operate the Service.

Our own measurement. We count how people move through our website and app using a first-party record: a random identifier your browser stores for our sites, sent to our own servers together with the name of a step (for example, that a page was viewed or a quiz was started). It carries no medication name, no health condition, no diagnosis, and no free text. It is not shared with any third party and is not used for advertising.

In our mobile apps, the same kind of record uses a random identifier stored by the app. Once you are signed in, these records are tied to your account.

Install attribution in the iPhone app. When the iPhone app first opens, it asks Apple for an attribution token through Apple’s AdServices framework and passes it to RevenueCat, which checks it with Apple. Apple’s answer says only whether the download followed a tap on one of our Apple Ads search ads and, if so, which of our campaigns and keywords it came from. This does not use your device’s advertising identifier, the app never asks for permission to track you, and nothing you enter into Kessa is sent to Apple Ads.

Advertising technology we use. Our public marketing pages — and only those pages — carry a Meta (Facebook) advertising pixel. It transmits your device’s IP address, your browser user-agent string, an identifier from a cookie, and the address of the marketing page you are looking at. It records two things beyond a page view: that the button to start the free protein quiz was pressed, and that the button to start a trial was pressed. It sends no other information and no parameters of any kind. Automatic Advanced Matching is switched off, so no email address, telephone number or name is collected or transmitted, and the Conversions API is not connected. The pixel is not present in the signed-in application, on the quiz, on your results page, or at checkout — so your weight, your GLP-1 phase, your protein target and every answer you have typed into Kessa are outside its reach entirely. See section 4 for how to opt out.

Ad measurement in our mobile apps. Our iPhone and Android apps include Meta’s app software (the Meta SDK). It tells Meta that the app was installed, when it is opened and for how long, that you created or signed in to an account, and that a free trial or paid membership started, with its price and currency. With those events go device information (such as model, operating-system version, language and time zone), your IP address, and identifiers the Meta SDK uses to recognise the device, such as a random identifier it creates for the app. It does not collect your device’s advertising identifier, the iPhone app never asks for permission to track you, and automatic advanced matching is switched off, so no email address, telephone number or name is sent. None of your weight, GLP-1 phase, protein target, shots, meals, coach conversations or answers is sent. Meta uses these events to tell us which of our ads led to installs, sign-ups and trials, and handles them under its own terms and privacy policy. See section 4 for how to opt out.

History. Between 6 August 2026 and 10 August 2026, our public marketing pages carried a Meta (Facebook) advertising pixel, which transmitted browser information and the address of the page being viewed to Meta. Two settings matter: Automatic Advanced Matching was switched off for the entire period, and the Conversions API was never connected — so no email address, telephone number, or name was transmitted. As with any request to a third-party server, your device's IP address, browser user-agent string, and an identifier from a cookie set by our own site were transmitted. The pixel was never present in the signed-in application, and no information you entered into the Service was sent to Meta. It was removed from every page of our website on 10 August 2026, and reinstated on 19 August 2026 in the narrower configuration described above.

6. Sensitive information

Some information you provide (such as weight and GLP-1 phase) may be considered sensitive personal information. We use it only to provide the Service's features and as described in this Policy.

7. Your California privacy rights

If you are a California resident, you have the right to know/access the personal information we hold about you; delete it; correct it; opt out of any sale or sharing; and limit the use of sensitive personal information — and to not be discriminated against for exercising these rights. To exercise a right, email hello@kessahealth.com. We will verify your request as required by law.

8. Data retention

We keep your account information for as long as your account is active. After you close your account, we delete or de-identify your personal information within 90 days, except records we must keep to meet legal, tax, or accounting obligations, which we retain for as long as the law requires. We keep records of auto-renewal consent for as long as the law requires.

If you gave us your email through an interest form but never opened an account, we keep that record for up to 24 months after you last engage with us, and sooner if you ask us to delete it. Any free-text answer you gave on that form is turned into anonymous, non-identifying notes within 30 days and the original text is deleted. If you unsubscribe, we keep your email address on a suppression list, because that is how we make sure we do not contact you again.

9. Security

We use reasonable administrative and technical measures to protect your information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Children

The Service is intended for adults 18 and older and is not directed to children. We do not knowingly collect information from anyone under 18.

11. US-focused service

The Service is intended for users in the United States. We do not target or knowingly offer the Service to individuals in the EU or UK. If you access it from outside the United States, you do so on your own initiative and are responsible for local law.

12. Changes to this Policy

We may update this Policy. If changes are material, we will notify you (for example, by email or in-app). The "Last updated" date shows the current version.

13. Contact

Privacy questions: hello@kessahealth.com · Nectar Gummies LLC, 2305 Spanish Trail, Rocklin, CA 95765.