checkın

Privacy Policy

Beta version · Last updated October 24, 2026

Check In is a companion for people with questions about GLP-1 medications, available through the Check.in iPhone app and a text-message beta. System1 runs the texting beta; S1 Check.in, LLC distributes the iPhone app. This policy says what we collect, what we do with it, who else handles it, and how to delete it. We wrote it to match how the service works today; when that changes, this page changes first.

The short version

  • We keep what you text or type to Check In, and the facts you share (like your medication, dose, shot day and goals), so it can remember you.
  • Your conversations and logs stay until you delete your account; they don't expire on their own. Some other data expires sooner (see Keeping and deleting your data).
  • Your conversations are never shared with your manager, HR, or anyone else at System1 outside the small team that runs Check In.
  • We don't sell your information. Your messages, answers and health information are never used for advertising. On the web sign-up page only, Meta's pixel counts visits and sign-ups so we can measure our ads (details below).
  • Delete your account in the app, or text DELETE if you use texting, and we erase your profile and conversation history. A few records are kept; they are listed below.
  • On-phone reminder logs stay on your iPhone. If you choose to connect, chat, tracking and the data you explicitly share are stored with your Check In account.
  • Apple Health sharing is optional. On-phone Health stays on your iPhone; connected Health sends the totals you allow to Check In. Health data is never sold or used for advertising.

The Check.in iPhone app

You can use on-phone reminders and logs without an account, create a connected account with Apple or Google, or connect your existing Check In texting account. Connecting is optional. Before connected setup or sign-in, the app explains what is shared and asks for your permission.

  • On-phone reminders and logs. Your name, medicine, dose, reminder settings, weights, doses and feelings stay in the app on your iPhone unless you share them in a connected conversation. Local notifications are scheduled by your phone. Their text can appear on the lock screen; you can hide previews in iPhone notification settings.
  • Connected chat and tracking. Messages, profile facts and the logs you send or edit are stored with your Check In account on Google Cloud in the United States. They are shared with the AI providers described below to answer you and show your own patterns. Your texting and app conversations use the same profile. If you sign in with Apple or Google and have no phone number, there is no text thread: Check In's replies, check-ins and answers appear in the app's chat. Food, weight, medication and symptom information may be health information.
  • Optional notifications. In app versions that offer connected notifications, if you turn them on, we keep your phone's notification token with your account so we can tell you when Check In has a new message. Each notification says only that you have a new message, never what it is. You can turn them off in Account or in iPhone Settings. Signing out or deleting your account erases the token.
  • Connected setup. After you allow sharing, the answers you give during setup are sent to Check In to choose the next question and prepare your profile. Partial choices are saved under an anonymous visit ID for up to 90 days. A completed setup code lasts up to seven days until you use it to create or connect your account.
  • Apple and Google sign-in. Firebase Authentication, a Google service, verifies the sign-in. It receives the provider's user ID and, for Google, your email, name and profile photo; for Apple, the app asks for neither your name nor your email. Check In's own server does not read any names, emails or photos. It keeps a keyed hash of the Firebase user ID and an encrypted copy, used to ask Google to delete the Firebase login when you delete your account. Deleting your account does not remove Check.in from the Sign in with Apple list in your Apple Account settings; you can remove it there. This sign-in does not connect your email inbox.
  • Text sign-in and your phone number. The app can send the number you enter to request a code in your existing Check In thread, or ask you to send a code from your own app. The server uses a keyed hash to find that account; it does not keep the typed number. Linq handles your number to deliver texts. Only send a sign-in code from your own app. A session lasts up to 90 days, unless you sign out, delete the account or access is revoked.
  • Meal photos. A photo you choose is resized and its metadata removed before it is sent for processing. OpenRouter and Anthropic read it; TypeSafe also reads it when photo understanding is enabled. Check In does not save the image on its servers. The app keeps its copy and any food cutout on your phone, excluded from backups, until you sign out or the local photo cache removes it. Food estimates and the conversation are saved with your account.
  • Talking instead of typing. Dictation uses Apple Speech, on your phone when supported; otherwise Apple may process the audio under the speech-recognition permission you grant. Check In does not save audio. The transcript stays in the message box until you send it.
  • What stays on the phone. The sign-in token is in this device's Keychain. The cached connected profile, meal photos and place records use iOS file protection and are excluded from backups. On-phone reminder logs may be included in your normal iPhone backups. Signing out clears the connected token, cached profile, photos and places from this phone and stops connected Health and place sharing.
  • Invites and feedback. If invites are available, Check In records which of your five invitations were used and whether you viewed, copied or shared an offer. It does not read who you shared with. A friend who joins is linked to the inviter's pseudonymous account. When a friend opens an invite page, we count the visit without knowing who they are: a random ID, that the page opened, and whether it was an iPhone. Feedback you send is kept so the small team can respond and fix problems.
  • Feature usage. The app sends a fixed list of events, such as opening the app or using a tab, with a random install ID, app and iOS versions, and your profile ID once signed in. These events never include your messages, photos, answers or health values. They help us understand and improve which features work. Event records expire after about 400 days. Account has a switch to stop sharing which features you use; switching it off clears unsent events. The switch covers what the app sends. It does not stop our server from noting the days you were active (stored with your account and erased with it) or from adding to its overall totals, such as how many messages or photos the service handled, which are not tied to you. Deleting a connected account removes its linked install and event records; events sent before you signed in carry only a random install ID and stay until they expire.
  • Your choices. Account links to this policy, Terms and Help. Delete account erases your Check In cloud profile, conversations, logs, Health and place records and sessions, and disconnects connected email; we ask Google to delete your Firebase sign-in record. Some records are kept (see Keeping and deleting your data). If you also use texting, you can text DELETE to do the same. On-phone reminder logs and Apple Health records are separate; erase local logs in Reminders, and manage Health records in Apple Health.
  • No advertising or cross-company tracking. The app has no advertising SDK or advertising identifier. Your health information is not sold or used for advertising. First-party feature counts, limited invitation interactions and operational records help run and improve the service.

Apple Health in the app

On-phone Health. If you allow it, the reminders app reads weight from Apple Health and saves weights and symptoms you log there. That on-phone feature does not send Health data to Check In.

Connected Health is a separate choice. In the connected app, an explanation appears before Apple's permission sheet. If you choose to connect, the app sends daily totals for steps, active energy, exercise, walking distance, sleep and resting heart rate; recent hourly step totals; workout type, start and end times, energy and distance; and a daily weigh-in. The first sync can include up to 120 days. These records let Check In show your own charts and answer your questions. It does not send workout routes or individual heart-rate readings. Day totals and workouts have a retention period of about 400 days; deleting your account removes your stored Health records and workouts too.

You can turn connected sharing off in Account and change Apple's permissions in Settings, then Health, then Data Access & Devices, then Check.in. Turning sharing off stops new sends; what was already sent stays with the account until deletion. Health records written by the on-phone app stay in Apple Health until you remove them there. Health data is not used for advertising, sold or placed in iCloud by Check In. Declining Health access does not prevent chat or manual logging.

Places and movement

These are optional connected features. With your permission, the phone records visits and movement so the app can show time at places and activity. Coordinates, addresses and routes stay on the phone. Check In receives a made-up place identifier, a general label such as home, work or gym, visit times, and movement stretches such as walking, running, cycling or driving with their times, steps, distance and pace where available. Visit and movement records expire after about 90 days; the list of places (made-up identifiers and labels) stays with your account until you delete it. Turn the feature off in Account or revoke location and motion permissions in iPhone Settings. Signing out stops it and clears place records from this phone. Delete the connected account to erase the server records.

What we collect

  • Your messages. The messages you send Check In, by text or in the app's chat, and its replies. We keep every one until you delete your account. Only the most recent 30 are sent to the AI with each new message, so replies have context.
  • Facts you share. As you talk, Check In notes things like where you are with GLP-1s, which medication and dose, your usual shot day, your goal, and who you're asking for. You don't have to share any of it.
  • A chat identifier. If you text with Check In, our messaging provider gives us an identifier for your conversation so replies reach you. We keep it in a separate place from your profile, which is stored under a random ID.
  • Sign-up details. When you ask for an invite, we check that your email is a System1 address (or that your passcode is right) and then discard it. That invite-gate check does not store your email. We record that an invite code was used, not who used it.
  • Web waitlist and free guides. If you join the web waitlist or ask for a free guide, we store the email you provide, your consent, the guide or ad that brought you, and your onboarding answers, including the first name you gave and anything you typed or said in your own words. We use them to send the guide and the launch emails you requested. Your email is stored apart from your answers; a random ID is the only link between them. A small team can read each sign-up's answers, including your own words, on an internal dashboard; the dashboard never reads email addresses or phone numbers. We keep a web sign-up until you ask us to remove it: contact hello@check.in. Texting DELETE or deleting your app account does not remove it. (An older version of the page also asked for a US mobile number; those are kept the same way.)
  • Web onboarding visits. When you open check.in/onboard, partial onboarding choices (choices and numbers only, no name or typed words) are saved under an anonymous visit ID for up to 90 days. We also record the steps of your visit (screens seen, questions answered or skipped, whether you used the microphone, how long you stayed) with that visit ID, the ad and campaign details in the link you followed, and a rough browser type. We don't record your IP address, your answers or the words you spoke in these step records. They are kept for about 13 months.
  • Your private page. If you use texting, Check In can text you a link to your page (check.in/p/…), which shows your goal, weight trend, shots, meals, how you've felt and the questions you asked, and lets you log from it. The link is a long random address with no sign-in: anyone who has it can open and use the page until it expires, 30 days after it was made. Each time you get your page you get a new link; older links keep working until they expire. STOP stops them working until you text START, and DELETE ends them for good. Don't forward the link. The app doesn't use these links.
  • Questions no answer page covered. When Check In has no ready-made answer page for a question, we keep the first part of the question, with a scrambled code for who asked (not your profile ID), to decide which pages to write next. TypeSafe and the AI model read those questions to group them and draft pages from published sources. Your questions are erased when you delete your account. If one of them was among the examples behind a new page, its wording may stay in that draft with nothing linking it to you.
  • Email, only if you connect it. If you text CONNECT EMAIL and agree on the connect page, Check In gets read-only access to your Gmail or Outlook. For Gmail, it only opens emails from the pharmacies, telehealth services, drug makers and labs on our list (see Google user data). For Outlook, Hotmail and Live, it also opens emails from senders on our lifestyle list (gyms, fitness apps and wearables; food delivery, grocery, meal-kit and coffee services) and emails with "happy birthday" in the subject. It picks out a few facts (like your medication, a refill date, your gym, how often you order delivery, the city deliveries go to, or your birthday month), and then throws the email away. We store the fact and which sender it came from, never the email itself, what you ordered, prices or street addresses. For habits we keep only which service and when, for up to 6 months. Check In texts you to check each fact, and only uses the ones you confirm.
  • Feedback. Anything you send after the word FEEDBACK.
  • Operational logs. Timings and the kind of reply sent (for example "answered" or "emergency message"), keyed to a shortened random ID. Logs don't include your message text.

How we use it

  • To reply to you and remember what you've told it.
  • To keep you safe: messages are screened for urgent symptoms, and replies are checked for advice to change a dose. These checks are simple and don't catch everything. Check In is not for emergencies.
  • To run, fix and improve the beta. When the team looks at data to fix a problem, it's limited to what's needed.

We don't use your conversations to train AI models. Our requests to OpenRouter ask that only providers that don't keep or train on the data handle them. TypeSafe is covered below.

Who else handles it

Check In relies on a few providers to work. Each one only gets what it needs:

  • Linq delivers the texts (iMessage and SMS). It handles your phone number and message content to deliver messages.
  • OpenRouter and Anthropic run the AI model that writes replies. With each message they receive up to your last 30 messages and the facts in your profile: your first name, medicine, dose, shot day, goal, age range, sex, how you pay, side effects, other medicines, weights, and facts you confirmed from email. They also receive the photos you send. The same model reads your meal descriptions and photos, writes check-ins, and reads what you say in your own words during web setup. We tell OpenRouter to route only to providers that don't keep or train on the data.
  • TypeSafe (its service is called Jev) makes quick judgments that Check In acts on: which answer or chart fits your question, whether a message logs a weight, a shot or a meal, whether to add a reaction or reminder, and how to order setup questions. To do that it receives the text of nearly every message you send and, for some judgments, Check In's reply or its last message to you, along with some profile facts (like medicine, dose, side effects and age range), your meal items, your setup answers and anything you say in your own words during setup, and a summary of how active you have been. If you connect email, it reads matching emails to pick out facts. If photo understanding is enabled, it also processes photos you send in the app's chat. For place labels it gets visit patterns in words (how often, which hours, overnight or not), not where a place is. It does not receive your phone number or precise coordinates from Check In. We don't send TypeSafe a no-retention request; how long it keeps what it receives is under its own terms.
  • USDA FoodData Central and Open Food Facts, two public food databases, receive the food names and package barcodes Check In looks up when you log a meal. They see Check In's server address, not your name or profile. For a packaged or branded food it can't pin down, Check In can also search the web for the product's label: the product and brand name go to OpenRouter's web search (for Anthropic models, Anthropic's own search) as the query, with nothing else about you.
  • Google Cloud hosts the service and stores your profile and conversation (in the United States). Firebase Authentication handles Apple and Google sign-in as described above.
  • Composio (only if you connect Outlook, Hotmail or Live) holds the read-only connection to your mailbox and fetches the emails from our list for us. Composio keeps connection records and may keep copies of fetched emails for a limited time under its own policy. Gmail connects directly to Check In; see Google user data.
  • Vercel hosts this website and passes some requests, such as your private page link and the web sign-up's questions, on to our servers on Google Cloud.
  • OpenAI, through OpenRouter, turns your voice into text if you use the microphone on the web sign-up page. The recording is sent once and the text comes back; we don't keep the recording. (The app's own dictation uses Apple Speech, as described above.)
  • Meta (Facebook) measures our ads. Meta's pixel loads when check.in/onboard opens (not on other pages, and not for our own test runs). Meta receives the page address, which for our ads can include the ad's code and, on some links, the ad's topic (for example a=sideeffects or a=reta); we don't remove it. It also receives the event (page viewed, email saved, or setup finished) with an event ID that contains your random visit ID, your IP address, your browser type and Meta's own cookies. When you save an email, our server also sends Meta that event, with the time, the event ID, a fixed page address with no ad details, your IP address, browser type and Meta's cookie IDs. Meta never gets your answers, your email address or your phone number. You can block the pixel with your browser's tracking settings or an ad blocker; the page still works.
  • Google Analytics is built in for the web sign-up page and only runs if we switch it on. When on, our server (not your browser) sends the step of your visit, the ad and campaign details and your random visit ID. Google doesn't get your cookies, device ID or IP address this way, and never your answers, words, email or number.
  • Resend sends the emails we send you, such as the launch email you asked for. It receives your email address and the message.
  • Google Fonts supplies the fonts on your private page, answer pages, free guides and the How to use page, so Google sees your IP address and browser type when those load. Your page link is not passed on to Google. The rest of this website serves its own fonts.

We may share information if the law requires it, or to protect someone's safety.

Google user data (Gmail)

What we access. If you choose to connect Gmail, Check In asks Google for read-only access to your Gmail (the gmail.readonly permission). It can't send, change or delete anything. Check In only searches for, and opens, messages from the pharmacies, telehealth services, drug makers and labs on our sender list. Nothing else in your Gmail is opened.

How we use it. Only to provide the Gmail feature you turned on: Check In finds your prescription, pharmacy, refills, shipments, appointments and lab visits, texts you what it found, and uses only the facts you confirm to make your reminders and check-ins match your real dates. Nothing from Gmail goes into your profile until you say yes by text.

What we keep. We don't keep copies of your emails. A matching message is read in memory, the facts are taken out, and the message is discarded. We keep the facts, which sender they came from, and a keyed hash of the message ID so the same email is never read twice. Your Google access token is encrypted with Google Cloud Key Management Service, and only our email service can decrypt it.

Who processes it. Google Cloud hosts and stores it in the United States. TypeSafe, our AI provider for reading email, reads each matching message to pick out the facts and doesn't keep it or train on it. No person at Check In reads your Gmail messages. We don't transfer Google user data to anyone else, except as the law requires.

What we never do with it. We never sell it, use it for advertising, use it for credit or lending decisions, give it to data brokers, or use it for anything other than your own Check In reminders and check-ins. We do not use Google Workspace API data, raw or derived, to develop, improve or train generalized or non-personalized AI or machine-learning models.

Disconnecting and deleting. Text EMAIL OFF: we revoke our Google access right away and delete everything we learned from your email. Texting DELETE (or deleting your account in the app) erases your account and everything Check In learned from your email; see Keeping and deleting your data for the few records that stay. You can also remove Check In at myaccount.google.com/connections.

Limited Use. Check In's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Health information

Check In isn't a healthcare provider, and what you share isn't part of a medical record. Please don't send things you wouldn't want stored, like full names of other people or account numbers. Text messages can be seen on your lock screen, so Check In tries to avoid putting medication names or weight in the first line of a reply.

Keeping and deleting your data

How long we keep things:

  • Your conversations, profile, logs (weights, meals, shots, how you feel), feedback and the questions no answer page covered: until you delete your account. They don't expire on their own, and we don't automatically delete inactive accounts.
  • Apple Health day totals and workouts: about 400 days. Place visits and movement: about 90 days. The list of places stays until you delete your account.
  • App feature events: about 400 days.
  • Web onboarding: choices in progress, 90 days after your last answer; the anonymous steps of a visit, about 13 months; a finished setup waiting for your first text or sign-in, about a week (up to two weeks for a code in a launch email). Web sign-ups (email, consent and answers): until you ask us to remove them.
  • Sign-in sessions, up to 90 days; private page links, 30 days; email connect links, 24 hours; reminders, about 30 days after they are sent or canceled.
  • Short-lived markers that stop us handling the same message twice or counting a sign-up twice: 30 days. Product facts found by a web lookup, which never record who asked: 30 days.
  • Our messaging provider and other services keep their own records under their own policies. Our requests to OpenRouter ask that the AI provider doesn't keep what it receives; see TypeSafe above.

What deleting your account erases:

  • In the app, choose Delete in Account and confirm. If you use texting, text DELETE. Either way it takes effect right away.
  • We erase your profile and every record under it: all messages and replies (texts and app chat), logs, Health, places and movement records, check-in answers, and facts from email. We also erase your notification tokens, chat link, sign-in links and sessions, reminders and feedback, your invites and any note of who invited you, the questions no answer page covered, and the app install and event records linked to your account.
  • We disconnect your email and delete everything Check In learned from it (EMAIL OFF does this on its own, too). For Apple or Google sign-in, we ask Google to delete your Firebase sign-in record.

What deleting your account does not erase:

  • Counts and totals that aren't tied to you, such as daily activity counts and rollups.
  • A record that an invite code was used, with no one attached to it. Friends you invited keep their accounts; the note that you invited them is cleared.
  • A few short-lived markers whose names contain your random profile ID, for up to 30 days. The ID no longer points to anyone.
  • App feature events sent before you signed in. They carry only a random install ID and expire after about 400 days.
  • Web onboarding records from before you signed up (choices in progress, anonymous steps). They aren't linked to your account and expire on their own, as listed above.
  • Web waitlist sign-ups, kept apart from your account. Contact hello@check.in and we remove it, by hand.
  • Wording from a question that was one of the examples behind a new answer page, with nothing linking it to you.
  • Copies held by our providers (such as Linq's delivery records, TypeSafe, and Composio), and your Firebase record if Google doesn't process our request. Deleting your account also doesn't remove Check.in from your Apple Account's Sign in with Apple list.

Other choices:

  • You can also remove access from your Google or Microsoft account settings at any time.
  • Text STOP to stop getting messages. STOP doesn't erase your data; deleting your account does.

Security

Data is encrypted in transit and at rest. Webhooks from our messaging provider are signature-checked, and access to stored data is limited to the people who run the service. No system is perfectly secure; if something goes wrong that affects you, we'll tell you.

Age

Check In is for adults 18 and over. If you're asking for someone younger, keep it general; Check In will point you to their doctor.

Questions

Email hello@check.in. If you use texting, you can also text FEEDBACK followed by your question to Check In, or HELP for your options.