Privacy
Sosta never sells your data, never uses it for advertising, and health information never leaves your device for any purpose other than generating your personalised schedule.
Last updated · 13 May 2026
Used to create and secure your account via Apple Sign In or email/password (Supabase Auth). Your email is never shared with advertisers or third parties. Your display name is stored only to personalise the app experience.
Read from Apple HealthKit with your explicit permission. Used locally on your device to determine your daily readiness and inform how Sosta structures your schedule. This data is never uploaded to our servers or shared with any third party.
Read from EventKit with your explicit permission. Used to detect existing commitments so Sosta can schedule around them. Calendar data never leaves your device.
The blocks you create, the subjects and goals you set, and the feedback you log after sessions are stored in our database (Supabase) and used exclusively to improve your future schedule recommendations. This data is linked to your account and never shared or sold.
Sosta uses the following infrastructure providers. Each is bound by their own privacy policies and appropriate data processing agreements.
Provides authentication and database hosting. Stores your account details and schedule data on servers in the EU (Frankfurt). Data is encrypted at rest and in transit. supabase.com/privacy
Hosts the scheduling backend that produces your personalised schedule. Receives anonymised task metadata (subject, duration estimates, block type) to produce schedule recommendations. No health data is sent to Railway. railway.com/legal/privacy
Sends transactional emails (waitlist confirmations, launch notifications). Receives only your email address and the message body. resend.com/legal/privacy-policy
Sosta's use of HealthKit data is limited to on-device scheduling logic. We comply fully with Apple's HealthKit guidelines:
Your account data (schedule blocks, feedback, learned stats) is retained while your account is active. You can request deletion at any time by contacting us below. We will permanently delete your data within 30 days of a verified request.
HealthKit and Calendar data is accessed transiently on-device and never persisted outside of your iOS device's own secure storage.
Sosta is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided personal information, please contact us and we will delete it promptly.
Depending on where you live, you may have the right to:
To exercise any of these rights, email us at the address below.
We may update this policy as the app evolves. When we make material changes, we will update the date at the top of this page. Continued use of Sosta after an update constitutes acceptance of the revised policy.
Questions about this policy or requests to exercise your data rights can be sent to:
Sosta
contact@sosta.au