What we know about you, and what we don't.

What does n1lab record?

What you enter, what a practitioner you share with sends you, and the account and technical records it takes to run the service.

The list below is meant to be complete: it was checked against the app's database, table by table, on 10 oct 2026. If you find something n1lab keeps that isn't on it, tell us and we'll add it.

"Kept until" says when each thing is deleted. Nothing is deleted because you haven't used n1lab for a while: your account, your record and your files stay until you delete them, however long you're away, whether you're a client or a practitioner. The one exception is age: n1lab is for adults, so if we learn an account belongs to someone under 18, we tell them, give them 14 days to download their record, then close the account and delete it.

Why we keep it. Your record, to show it back to you and to anyone you choose to share it with. Your email and password, to sign you in and send the service's own email. Sign-in records and request logs, to keep accounts secure, limit abuse and find faults. Your reminder devices, to deliver the reminders you turn on, and the record of each one sent, so none goes twice. The access log, to show you who read your record. Your participation answer, as a record of what you agreed to. Backups, to recover from a disaster. n1lab uses none of it for anything else.

Changed 9 oct 2026: added the energy estimates row. A practitioner you share with can now estimate the energy your body needs from a few facts about you, and record their own reading of a food entry; both are kept on their side and shown only to them.

Changed 9 oct 2026: n1lab is for adults. An account found to belong to someone under 18 is closed and deleted after 14 days' notice, the one exception to keeping your record until you delete it.

Changed 10 oct 2026: added the food energy row, and the food log row now names what you pick from the full food list and the readings you set. You can choose to see the energy in what you log, set your own reading of an entry, and keep a daily target. A practitioner you share with can read your readings and see your target and how you set it, but not the sex, age and activity level behind it. Their own energy estimates are now deleted when you stop sharing with them, as this page already said; before this change, stopping sharing left those estimates readable by the practitioner.

Changed 18 oct 2026: the food energy row now covers a target set from a goal weight. n1lab keeps the goal weight, the pace you chose and the figure the target was worked out from, with the target, and clearing the target clears them. "A day that fits", which builds the rest of a day from meals in your record, is worked out when you open it and is not kept. A practitioner you share with doesn't see a target set from a goal weight, or the goal.

What you have to give. An account needs an email address and a password; everything else is up to you, and what you don't enter isn't there to show or share. No law requires you to give n1lab any of it. The health information you record is collected with your consent, which you give by entering it. That is one reason n1lab is for adults: an account holder must be 18 or older (terms, section 03).

Where is my data stored?

In a managed database in Sydney, Australia, tied to your account.

The database is Postgres, run by Supabase in their Sydney region, and files you attach to your plan sit in its private file storage there. The app's server runs on Vercel, also in Sydney; each request first passes through Vercel's nearest edge location, which checks you're signed in. Each reading you record is written under your account id. The database itself, not just the app, keeps each account's rows sealed from every other account ("row-level security"), apart from what you choose to share with a practitioner (question 3). Traffic is encrypted in transit and the provider encrypts disks at rest.

Supabase takes a daily backup of the database and keeps each one for 7 days. Backups are for disaster recovery only; a deleted account is not restored from them. They don't include attached files. Some of the companies that run parts of n1lab are based overseas: question 9 names them and says what each one handles.

On your device. The app sets only sign-in cookies: your session, and, for three days after you sign up, a random code that protects setting your password. It keeps an unfinished evening check-in, and a few markers for the open tab, in that browser tab until you close it. This site sets no cookies; its page-view counter doesn't use them.

If a data breach is likely to cause you serious harm, we will tell you, and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Changed 12 aug 2026: earlier drafts of this page described a device-local design with end-to-end-encrypted sync. That design was retired when n1lab became a hosted web app; a hosted database is what lets your notebook follow you across devices. We would rather say that plainly than keep the better-sounding sentence.

Who can see my readings?

You. A practitioner only if you choose to share with them, and only until you stop (below names one gap). No one else who uses n1lab, and never advertisers.

How sharing starts. You invite a practitioner from Settings → Share your record, choosing the name they'll see you as (it starts as your email address), and your record is shared once they accept. Or a practitioner invites you by email: tapping "Start", "Confirm … and start" or "Start without a plan" accepts it, and shares your record with them, including any earlier days. To refuse, ignore the email. An invitation sent from n1lab's screens stays open for 14 days.

What an invitation holds. An invitation to an address with no n1lab account creates an account there straight away, holding that address and the fact that an invitation made it (and, when a practitioner sends it, who they are), so the invitation can be accepted. If a practitioner invited you, we got your address from them, and their invitation can also hold the name they gave you and a plan they drafted for you. Until you accept, that stays with their account, even if they withdraw the invitation or it lapses, until they delete their account. Nothing removes an unused account or invitation automatically yet: write to privacy@n1lab.app and we'll delete it.

What they see. The Share screen lists it: check-ins (including typed detail), food log, plan record, daily signals and trials. It covers your whole history, including the days before you shared:

• your check-ins, food log (with any readings you set), plan and study, and your scores day by day;
• a food energy target, if you set one: the figure and whether you typed it or worked it out, never the sex, age and activity level behind it. A target you set from a goal weight isn't shown to them, and neither is the goal or its pace;
• what you took or did: what it was, when, and how much;
• what you wrote about an off-plan day;
• your food trials and their outcomes, and what moved and the signals you tapped in a trial's windows, but the windows only if you switch on "Food trial windows" for that practitioner;
• your supplement and medication trials, with each day's entry (better, same or worse, and the side effects you tag). There is no switch for these: every practitioner you share with sees them.

What n1lab's screens never show them:

• your Notes, the note at the end of a check-in, and pain notes;
• the note you add to something you log (a walk, a coffee, a medicine or a supplement);
• a trial's outcome notes, the notes in a food trial's windows, and the private note on a trial's daily entry;
• notes on how something you took felt, on a longer change, or on your plan's ticks and results;
• the files you attach to your plan, your reminders, and your account, apart from the name you give them.

The Share screen says "Notes — never shared". Since 8 oct 2026 that holds for every note above, on n1lab's screens and outside them (below). Before then, a practitioner's trial pages showed a note you typed when starting a trial before 23 sep 2026, and reads outside the screens reached most of these notes.

The access log. Each read through n1lab's screens is written to the access log on your Share screen: who, which day, and how many times. Opening any of their pages about you, or saving a PDF of your record, shows as "[their name] read your record". The summary in their client list shows as "[their name] saw your 14-day summary in their client list". The screen shows your ten most recent log lines; your export holds the whole log. A practitioner with access can also read your record outside n1lab’s screens, and those reads can’t be logged.

Outside n1lab's screens. Read that way, your record holds the same kinds of things as the list under "What they see", and none of the notes above. Of your study's settings, it holds only the timezone, which symptom is marked Lead, any food groups a custom protocol leaves out, and a food energy target's figure and whether you typed it or worked it out (not one set from a goal weight). Both check-ins' notes are kept on your Notes screen, not with the check-in. Before 8 oct 2026, a read outside the screens also reached a trial's outcome notes (and earlier ones you replaced), the note you add to something you log, pain notes, notes on how something felt, on a longer change or on your plan's ticks and results, and your study's settings, such as your reminder times; before 4 oct 2026, the note at the end of a check-in too.

On n1lab's screens, they can't change anything you've recorded. There a practitioner's access is read-only. A change they propose to your plan is stored with your record, and nothing a proposal holds reaches your plan until you confirm it. What you confirm is each change as n1lab will make it, with every amount and time. If the description sent with a change says something different, n1lab shows it beside the change, and a change n1lab can't make can only be left off.

Who they are. n1lab doesn't check who a practitioner is, or where they are. The name and practice on an invitation and on your Share screen are what they typed. A practitioner may be outside Australia, where their country's law, not Australia's, governs what they do with what they read; n1lab's terms tell practitioners to use it only to support you (from 14 oct 2026 for those who joined earlier). Accept an invitation only from someone you know, and if in doubt, ask them first.

Stopping. On Settings → Share your record, tap Revoke access. They lose access to your record through n1lab at once. Nothing in your record is deleted: it stays yours, and the access log stays with it. They can still see the name you gave them and when they read your record, but not your record. Their own energy estimates for you are deleted (question 1). What they already read, noted or saved stays with them: a PDF of your record, for example, or a food's name they copied into one of their groups in n1lab.

The person who runs n1lab. One person, Sean Odisho, holds administrative access to the database, the way any hosted service's operator does. It is used to fix a fault you've reported, to keep the service running, or to act on a request you make, not to browse readings. n1lab is built and run with Claude, an AI assistant made by Anthropic, which works with the same access. Our rule since 30 sep 2026: it works from the code, the database's structure and counts, and, to find a fault, the service's logs, which hold network addresses, account ids and the pages asked for, and it reads no one's records without their written OK. Before that rule, sessions read parts of other people's records while fixing faults: two people's sleep entries in August 2026, and, in September, counts and dates of other accounts' check-ins, with the operator's go-ahead but not theirs. "We don't look at your data" is a working rule here, not a cryptographic guarantee, and we'd rather you know which one you're getting.

Anyone else. We don't sell, rent or trade your information, and n1lab has no partnerships team, no enterprise plan and no research arm. We would disclose your information without your say-so only where the law requires or allows it: under a court order, for example, or to lessen a serious threat to someone's life or health. The companies in question 9 are also subject to the laws of the countries they're in. An export is different: it is a file you control, to share with whoever you choose (question 5).

Does n1lab use my data to train models?

No. Not now and not later. Your readings are not training data.

Today the app's summaries are plain arithmetic on your own rows. A future version may use an AI model to draft an insight from your readings — that is on the roadmap — and if it ships, your data would be processed by that model only to serve you, under terms that forbid the provider from training on it, and the feature will say so where it appears.

Serving you with a model and training a model on you are different acts. The first may happen, clearly labelled. The second we won't do: the product would be a different product if we did.

n1lab makes no decisions about you on its own. Its summaries are arithmetic on your entries, and where it suggests a label, such as a trial's outcome, you choose it.

Can I export everything?

Almost everything. Settings → Data gives you a spreadsheet workbook, or JSON with your data exactly as stored; for the few things it leaves out, ask.

The export holds your check-ins, food log with the readings you set, what you took or did, longer changes, trials with their daily entries, your plan with its ticks and results, your notes, your study, anything added to your own lists, and your sharing records: who you shared with, the whole access log, and the plan changes practitioners proposed, with what you decided. The workbook has a sheet for most of it; the JSON has all of it, including your account details, your beta access and your reminder records. The JSON keeps every time exactly as stored; the workbook shows times in your study's timezone and carries an About sheet explaining its own columns. The formats are flat and boring on purpose: a file exported today will load against a script written next year.

Not in it: the files you attached to your plan, and their titles (you have the originals, and files on your current plan open from it); credentials, meaning the address and keys your browser uses for reminders and an invitation's security code; the sign-in service's own records (your sessions, when you signed up, confirmed your address and last signed in, and who invited you); and emails or a beta application you sent us. Write to privacy@n1lab.app for a copy of any of these (question 12).

Can I delete everything?

Yes, from the app. Settings → Account → Delete account erases your account and everything tied to it, with the exceptions below.

Deletion is immediate in the live database, with no recovery window, which is why the app asks you to export first. It removes your account and everything in question 1 tied to it: your record, the files you attached to your plan, your sharing records, your reminders and your sign-in. Exports you have already downloaded are files you control; deleting the account does not reach into your downloads folder.

What deletion doesn't reach:

• a deletion that fails part-way, after a lost connection for example. Your account and record are then kept: try again, or write to privacy@n1lab.app and we'll delete them;
• the daily backups, kept 7 days for disaster recovery (a deleted account is not restored from them), and the service's logs, kept up to 7 days;
• Resend's copies of the automatic emails sent to you (sign-in links and invitations), kept 30 days, and emails or a beta application you sent us, which aren't tied to your account: ask and we'll delete them;
• what a practitioner already read, noted or saved from your record.

A practitioner who deletes their account does it from Practice → Account. The name they gave and the reads they made stay in each client's access log, because that log is part of the client's record.

What about crash reports and analytics?

This site counts page views. The app is built to report errors and to count how its screens are used, but neither is switched on, and neither collects anything today.

The marketing site (the page you are reading) uses Vercel's aggregate page-view counter, which sets no cookies. The app is built to send an error report when a screen fails: the failing route and a technical trace. That reporting is not switched on today; before it is, this page will say what a report can hold. Error reports exist so a crash you hit once gets fixed.

No ad trackers, no session replays, no health-data analytics. The app asks everyone in the beta to accept pseudonymous usage analytics when they sign up or first open it: which screens and controls are used and whether a task finishes, never what you enter. Accepting it is a condition of the beta. It isn't switched on, and collects nothing today. Before it is, this page will say what it keeps, where (PostHog, in the EU), for how long, and how it's deleted.

Is n1lab a medical device?

No. It records observations. It does not diagnose, treat, or recommend.

What it shows is suggestive at best. It is meant to be brought into a conversation with a clinician, not to replace one. If a symptom is concerning, the right next step is care, not another reading.

Which companies handle my information, and where are they?

A handful of service companies run parts of n1lab. Your record is stored in Sydney; most of these companies are based in the United States.

We use these companies under their standard terms, and we stay responsible for how they handle your information. Two more are built into the app but not switched on: error reporting (Sentry) and usage analytics (PostHog, in the EU). Neither receives anything today, and each will be named here, with what it keeps, before it does. A practitioner you share with may also be outside Australia (question 3).

What happens to a question or an email I send you?

A question sent from the app's question form, once it exists, will stay in the Sydney database, and the email telling us it arrived will carry a notice and a link, never the question.

The app is getting an "Ask a question" form. When it arrives:

• it will keep your question, the screen or Help page you asked from, whether you're a client or a practitioner, the app's version, and when you sent it, with your account in the Sydney database;
• Sean will get an email through Resend saying a question arrived, with your address to reply to, the screen, whether you're a client or a practitioner and a link, but not the question. He will read it inside the app and answer you by email, so the answer, and anything it quotes, is an email (below);
• your question will be used to answer you and, with names and health details removed, to make Help clearer. To answer, Sean may look at the part of your record you ask about. Health details are optional. The AI assistant that helps build n1lab is never given questions: it sees only how many came from each screen, and any one-line summary Sean chooses to write;
• the question's text will be deleted 12 months after you send it; the rest (which screen, and when) stays with your account. Deleting your account will remove all of it, and your export will include it.

So your readings stay what the short version says: not product-feedback data. A question is something you choose to send, and it will be used only as above.

Email is different. If you write to privacy@n1lab.app or another n1lab address, or reply to one of our emails, your message and our reply are kept in n1lab's Google mailbox (question 9) until we delete them. Our replies come from that mailbox; Resend keeps a copy of the automatic emails n1lab sends (sign-in links, invitations and notices) for 30 days. Ask and we'll delete yours.

Beta applications. The form at n1lab.app/beta keeps your email address, and which site sent you there when the link says so (Instagram, Facebook or Reddit), in the Sydney database, and sends a copy through Resend, which keeps it for 30 days, to n1lab's Google mailbox. They are used only to choose the beta group, to reply to you and, if you're in the group, to send you an invitation to the app, which creates an account at your address (question 3, "What an invitation holds"). Your network address is used briefly to limit repeated submissions, and isn't stored with your application. The page also keeps the address you typed in your browser tab, only to show it back to you after you send it, until you close the tab. The database copy is deleted automatically 12 months after you send it. The mailbox copy stays until you ask us to delete it, and you can ask for either sooner.

I'm a practitioner. What does n1lab keep about me?

Your email, the name and practice you type, your links to clients, and what you create in the practice screens. Each read you make through n1lab's screens is written to that client's access log.

• Your name and practice are what you type; n1lab doesn't check them. Clients see them on their Share screen and in their access log.
• An invitation you send keeps the client's email address, the name you gave them and any plan you drafted, including after you withdraw it, until you delete your account. Inviting an address that has no n1lab account creates an account there (question 3).
• Your groups, and the focus symptoms you pick for each client, are visible only to you. Groups you remove are deleted 30 days after you remove them. A plan change you propose, with your note, is stored with the client's record once sent, attributed to you.
• Your energy estimates for a client (the sex, age, activity level and weight you enter, and your readings of their food entries) are visible only to you. They are deleted when that client stops sharing with you, or when either of you deletes your account.
• Your beta participation answer and your sign-in records are kept as they are for anyone (question 1).
• You delete your account from Practice → Account. That removes your account, your groups and focus symptoms, and invitations nobody has accepted, with any plans drafted on them. Each client keeps, in their own record, your name, practice and email as you gave them, the reads you made, and the plan changes you proposed, and an account your invitation created for a client stays. Your access to every client ends.
• What you may do with a client's record is set out in the terms.

For a copy of what n1lab keeps about you as a practitioner, write to privacy@n1lab.app; the export in Settings covers a client's own record.

How do I get a copy, correct something, or complain?

Write to privacy@n1lab.app. You'll have a full answer within 30 calendar days, and if you're not satisfied you can take it to the Office of the Australian Information Commissioner.

• A copy. The export in Settings → Data gives you your record at any time (question 5). For anything not in it, write to us. It's free.
• Correcting something. You can edit most entries in the app yourself. For anything you can't, write to us and we'll correct it, or add a note that you disagree.
• Before we send or change anything, we'll check the request comes from your account's email address. If we refuse a copy or a correction, we'll tell you why in writing, and how to complain.
• Complaints. Write to privacy@n1lab.app and say what went wrong. You'll hear within 7 days that it arrived, and get a full answer within 30 calendar days.
• If you're not satisfied with the answer, or haven't had one within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC). Complaints to the OAIC must be in writing: oaic.gov.au, or ask them how on 1300 363 992.