Privacy Policy

Effective November 4, 2026

1. Who we are

UnitedMarkers (“we”, “us”) operates the website and web application at www.unitedmarkers.com (the “Service”). The Service's complete source code (licensed under the GNU AGPL-3.0) is shared with anyone on request, so you can verify that everything we say in this policy is true: just email hello@unitedmarkers.com. Questions about this policy: privacy@unitedmarkers.com.

2. How the encryption works

When you create a vault, your browser derives encryption keys from your password (PBKDF2-SHA256, 600,000 iterations). A random data key encrypts your vault with AES-256-GCM. Only ciphertext is ever written to browser storage or sent to our server. Because we never receive your password or keys, we cannot read, analyse, recover or hand over your health data.

Recovery key. Each vault has a recovery key that only you hold. With it you can set a new password and keep your data. The key never leaves your device. Our server stores only a hash of a token derived from it, which lets you authorise a password reset of your online account. If you lose both your password and your recovery key, you can reset your account by email (keeping your plan and credits), but the encrypted data cannot be recovered by anyone.

3. Information we process

3.1 Stored only in your browser (encrypted)

Everything you enter or import: lab results, imported documents' text, marker notes, supplements and medications, exercise, sleep and wearable data, saved chart views, AI chat history, your profile (name, sex, birth year), settings and API keys. It stays on your device unless you enable sync.

3.2 Stored on our server if you create an account (for sync and/or UnitedMarkers AI)

• Your email address, used as your account identifier.
• An encrypted copy of your vault, only if you turn on sync. We cannot decrypt it. An account created only for UnitedMarkers AI does not upload your vault.
• Plan and AI credit counters: your plan, remaining credits, and credits and requests used per month. Never the content of your questions or answers.
• Key-derivation salt and a one-way login token. Your browser derives the token from your password, and we hash it again (scrypt). It cannot be used to decrypt your data.
• Session tokens (stored hashed), the date your account was created, and when your vault was last updated.
• Email verification status and, briefly, one-time codes (stored hashed, expiring after 30 minutes) that we email you to confirm your address or reset your account. These emails are sent through our email provider (Hostinger). Accounts never confirmed are deleted after 7 days.

3.2.1 Share links (only if you create one)

• When you create a private link for a doctor or coach, your browser encrypts the results you selected (AES-256-GCM) with a new random key. Our server stores only that ciphertext, its creation and expiry dates (7, 30 or 90 days), a hash of the code that lets you revoke it, and how many times it was opened.
• The key is part of the link itself, after the “#”. Browsers never send that part to servers, so we cannot read shared results. Anyone who has the complete link can view them until it expires or you revoke it, so send it only to the intended person.
• Expired and revoked links are deleted from our server. The printable report is created on your device and is not sent anywhere.

3.2.2 UnitedMarkers Pro waitlist (only if you join)

If you ask to hear when UnitedMarkers Pro launches, we store the email address you give, the features you ticked, an optional suggestion and the date. We use it only to tell you about Pro and the Founding member offer, never for anything else, and never share it. Reply to any of our emails, or write to privacy@unitedmarkers.com, to be removed. Suggestions sent without an email are kept without any identifier.

3.3 Technical information

• Abuse prevention without tracking. To stop mass account creation we use a short proof-of-work computation in your browser (instead of third-party captchas), block disposable email domains, and limit sign-ups per network address.
• IP addresses are held briefly in memory to rate-limit sign-ups, logins and abuse. We do not keep web access logs. IP addresses may appear in short-lived error and security logs on our server.
• No cookies and no local tracking identifiers. The app uses your browser's storage only to keep your encrypted vault, an anonymous vault identifier, and your choice if you turn off usage statistics.
• No advertising, social media, third-party analytics or other third-party scripts. All code and fonts are served from our own server.

3.4 Anonymous usage statistics

To understand whether UnitedMarkers is useful and which features people use, the app sends small anonymous messages to our own server (never to a third party):

• Visits: which section of the app or website is viewed (for example “Import”, “a marker page” or “a guide”, never which test in your vault), how long the page was open and visible, the website you came from (its name only), the browser family, operating system and screen size category (mobile, tablet or desktop), and whether this browser already holds a vault.
• Feature use: counts such as “a vault was created”, “an import was made with AI”, “an AI question was asked”, “a supplement was added”. When a vault is opened or an import is made, rough ranges computed from it: number of imports (e.g. “3–4”), number of results (e.g. “10–49”), days since the first import (e.g. “30–89 days”) and whether sync is on. When the free report viewer is used: a rough count of the results it showed (the files themselves are read only in your browser and never uploaded). Never your results, values, test names, documents, supplements, questions or anything else inside your vault.
• Server counters: the number of sign-ups, sign-ins, sync uploads and UnitedMarkers AI requests per day.

How it stays anonymous. We use no cookies and store nothing on your device for statistics. Each page load gets a random identifier that exists only in memory and is discarded when you leave. To count unique visitors (and active accounts) per day, our server computes a one-way hash of your network address and browser with a random value that is deleted every night; only the daily totals are kept, so visitors cannot be recognised from one day to the next, and IP addresses are never stored. Statistics are not linked to your account or email. Aggregated statistics are kept for up to 13 months.

Your choice. If your browser sends a “Do Not Track” or “Global Privacy Control” signal, no statistics are sent. You can also turn them off in Settings → Storage & security (this choice is remembered in your browser).

4. Features that send data to third parties (only if you use them)

• UnitedMarkers AI (our included AI, optional). Your question, earlier messages in that conversation, and the results summary your browser prepares (which can include supplements, exercise and sleep data), or the document you ask it to read, pass through our server to Venice.ai, which processes them with our API key. Venice states that it does not store prompts or responses. Our server forwards this content without storing or logging it, and keeps only the number of credits used. To keep the service on topic, a short automated check of your latest message, also run on Venice, decides whether it is about health; declined questions use no credits.
  End-to-end encrypted extraction. When the import screen shows “🔒 Private model using TEE and E2EE”, text documents are read by a Venice model running inside a hardware Trusted Execution Environment (TEE). Your browser first checks the enclave's cryptographic attestation, then encrypts the document so that only that enclave can decrypt it. Our server and Venice's API relay only encrypted data, and the results come back encrypted for your browser. Scanned images and photos, and AI chat, currently use Venice's private models (no data retention) without this end-to-end encryption.
• Your own AI provider (optional). If you choose your own provider instead, the same information is sent to the AI provider you select (e.g. Anthropic, OpenAI, xAI, Venice.ai) using your API key, or to a local model you run yourself. Some providers block direct browser requests. In that case the request passes through our server's relay, which forwards it without storing or logging its content. The provider's own privacy terms apply to what it receives. Choose a local model for full privacy.
• Lab portal import (only when you run UnitedMarkers on your own computer). You sign in to your lab's website yourself. We never see or store your portal password.
• Oura sync. If you connect Oura, an access token is stored inside your encrypted vault. Your sleep data is fetched from Oura into your browser, directly or through our relay without being stored.
• Future paid plans. If we offer paid plans, payments will be processed by a payment provider such as Stripe, which receives your billing details under its own privacy policy; we will only receive your subscription status. This policy will be updated before payments launch.

5. How we use information

Only to provide the Service: authenticate your sync account, store and return your encrypted vault, keep the Service secure and prevent abuse, and answer your requests. We do not use your information for advertising, profiling or training AI models, and we do not sell or share personal information as defined by U.S. state privacy laws.

6. Consumer health data

Information you store in UnitedMarkers may be “consumer health data” under laws such as Washington's My Health My Data Act and similar state laws, and “special category” data under the GDPR. You consent to the Service processing it on your device, in encrypted form, by creating a vault and choosing to import or enter it. You may withdraw consent at any time by deleting your data (section 8). We do not collect consumer health data in a form we can read, and we never share or sell it.

7. Storage, security and retention

• Our server is hosted by Hostinger in the United States. Connections use HTTPS (TLS).
• Encrypted vaults and account records are kept until you delete your account. Deleted data is removed from our active systems immediately and from any backups within 30 days.
• If we learn of a breach of security affecting your information, we will notify you and the relevant authorities as required by law (including the U.S. FTC Health Breach Notification Rule). Because vaults are end-to-end encrypted, a breach of our server would not expose readable health data.

8. Your choices and rights

• Export: Settings → Export encrypted backup, or Export CSV (unencrypted).
• Delete synced data: Settings → Stop syncing → also delete the account and encrypted copy from the server.
• Delete everything on a device: Settings → Danger zone, or clear your browser's site data.
• Depending on where you live (for example under the GDPR, UK GDPR or U.S. state laws), you may have rights to access, correct, delete, port or restrict processing of your personal information, and to complain to a data protection authority. Most of these you can exercise directly in the app. For anything else, email privacy@unitedmarkers.com. For data on our server we can only act on your email and account records, as we cannot read your encrypted vault.

Legal bases (EU/UK users): performance of our contract with you (providing the Service), your explicit consent for health data, and our legitimate interest in securing the Service.

9. Children

The Service is not intended for anyone under 18, and we do not knowingly collect information from children.

10. Changes

We will post any changes on this page with a new effective date, and notify users in the app before material changes take effect.

Terms of Use · Back to UnitedMarkers