Privacy Policy
Last updated 8 October 2026
The short version. Roicel stores your plan in your browser. If you create an account, it also stores it in your account so you can use it on another device. We don't run ads, analytics or trackers, we never sell data, and you can delete everything yourself from the Profile tab in one step.
Who we are
Roicel is a planning and tracking tool at roicel.com. Questions about this policy go to [email protected].
What we store
| Data | Where it lives | Why |
|---|---|---|
| Your plan: compounds, doses, schedule, which doses you ticked off, cycle name and notes | Your browser (localStorage). Your account, if you have one. | It is the product. |
| Body log: weight, body fat, blood pressure, resting heart rate | Same | Trend charts and safety checks. |
| Bloodwork results you enter | Same | Safety checks against reference ranges. |
| Profile: name (optional), sex, age, height, goal weight, unit preference | Same | Calorie and body-composition estimates. |
| Email address and password | Your account only. The password is stored as a hash by our account provider, never in readable form. | To sign you in and send verification codes. |
| Sign-in times | Your account only | Security and to see whether the service is being used. |
Without an account, nothing leaves your device except the page itself being downloaded.
What we don't do
- No advertising, no tracking pixels, no third-party cookies. The only measurement is Cloudflare Web Analytics, described below.
- No selling, renting or sharing of your data with anyone.
- No reading of your plan by a person. The site owner can see how many accounts exist, when they were created and signed in, and which compounds appear across all plans in aggregate, in order to run the service. The owner cannot see which plan belongs to which person's email, and never sees your notes, body log or bloodwork.
Who processes it
| Provider | Role |
|---|---|
| Supabase | Accounts database and sign-in emails. Data is encrypted at rest and in transit, and database rules allow each row to be read only by the account that owns it. |
| Cloudflare | Hosts the website and protects it. Like any web host it sees your IP address in connection logs. Cloudflare Web Analytics also counts page views and load times for us; it uses no cookies, no fingerprinting and stores no IP addresses or identifiers, so it can't tell us who you are or tie a visit to an account. |
| Google Fonts | Serves the typefaces. Your browser requests them directly from Google. |
How long we keep it
Until you delete it. Browser data goes when you clear the site's storage or use Start over. Account data goes when you delete your account. There are no backups that outlive deletion beyond the provider's short-term disaster-recovery copies, which expire within 30 days.
Deleting your data
Profile → Account → Delete account. This removes your account and your synced plan immediately. You can also download a copy first with Download backup. If you can't sign in, email [email protected] from the address on the account.
Your rights
Depending on where you live (for example under the GDPR or the CCPA) you have the right to access, correct, export, restrict and delete your data. Export and delete are built into the Profile tab; for anything else, email us. We won't treat you differently for using these rights.
Security
The site is served only over HTTPS. Passwords are hashed. Database access is restricted by row-level rules. Health data is sensitive, so we store as little as the product needs and nothing about you that you didn't type in.
Age
Roicel is for adults aged 18 and over. We don't knowingly hold data about anyone younger; if you believe we do, email us and we will delete it.
Changes
If this policy changes in a way that matters, the date above moves and the welcome screen says so the next time you open the app.