Jabful

Privacy Policy

Privacy Policy

Effective October 16, 2026

Jabful is a companion for keeping track of peptide and medication protocols, doses, vials, meals and how you feel, with a cited research library and an AI assistant. A lot of what you record is health information, so this policy is specific: what leaves your phone, who handles it, how long it is kept, and how to delete it.

The short version

  • Jabful needs an account. You sign in with Apple or Google, and the records you keep in the app sync to your account so they are backed up and restored when you sign in again. The contents of those records are encrypted on our servers.
  • Progress photos and meal photos stay on your iPhone. When you scan a meal, that one photo is sent for analysis and is not stored by Jabful.
  • Questions you ask and meals you scan or describe in words are processed by a third-party AI service provider on our behalf, only after you allow it in the app. The provider does not use them to train AI models. Your Ask conversation history is saved only on your iPhone.
  • We never sell your data. Your health information, including anything from Apple Health, is never used for advertising and never sent to advertising or analytics partners.
  • You can delete your account and everything synced to it at any time, inside the app: Settings, then Account, then Delete account.

Who we are

Jabful is operated by MultiMode Labs Inc.. In this policy, "we", "us" and "our" refer to MultiMode Labs Inc., and "you" refers to the person using Jabful. This policy covers the Jabful iOS app, the Jabful service behind it (api.jabful.com) and this website. You can reach us at team@multimodelabs.com.

Your Jabful account

You create an account with Sign in with Apple or Google Sign-In. Jabful never sees your Apple or Google password. When you sign in, we receive and keep:

  • The account identifier Apple or Google assigns to you for Jabful, and which of the two you used.
  • Your email address. With Apple, this can be a private relay address if you chose "Hide My Email". With Google, it is your verified Google email.
  • Your name, if the provider shares it (Apple shares it only the first time you sign in, and only if you allow it).
  • A Jabful account ID we generate, your personal invite code, the code you were invited with (if any), your subscription expiry date and when the account was created.

To keep you signed in, the app holds sign-in tokens in the iOS Keychain on your device. On our side, refresh tokens are stored only as one-way hashes and expire after 90 days. If you use Sign in with Apple, we also keep the token Apple gives us for revoking your Apple sign-in, encrypted, and we use it only when you delete your account.

Records you sync to your account

Jabful keeps your data on your iPhone and syncs it to your account so you can restore it on a new device. Synced records include:

  • Protocols, compounds, dose plans, schedules, reminder times, administration routes, the instructions you save for each compound, and vials (the doses per vial and the dates you enter).
  • Dose logs: the compound or medication, amount and unit, date and time, injection site, pain rating and notes.
  • Body metrics such as weight, body fat, lean mass and waist, including readings imported from Apple Health if you connect it.
  • Check-ins: mood, energy, symptoms, side effects and journal notes.
  • Meals and their food items with calories and macros, water and your daily targets.
  • Profile and setup answers, such as height, starting and goal weight, activity level, goals, units and reminder preferences, plus milestones.

The contents of every synced record are encrypted on our servers with AES-256-GCM, using a key held only by the Jabful service, and each encrypted record is bound to your account so it cannot be read as anyone else's. To make sync work, a few labels are not encrypted: the record type, its ID, when it was last changed and whether it was deleted. Photos are never synced.

What stays on your iPhone

  • Progress photos and meal photos (the images themselves, and their file names).
  • Your Ask conversations.
  • Your sign-in tokens, in the iOS Keychain.
  • Reminders, widgets and Live Activities, which are created on the device from your own schedule.

Jabful 2.0 does not store your records in iCloud. If you used an earlier version of Jabful, records it kept in your private iCloud stay under your Apple ID and your control.

Apple Health (HealthKit)

Connecting Apple Health is optional, and iOS asks for your permission for each type of data. Depending on what you allow:

  • Jabful can read your weight, height, body mass index, body fat percentage, lean body mass and waist circumference.
  • Jabful can write the entries you log: weight, body fat, lean mass and waist, plus dietary energy, protein, carbohydrates, fat, fiber and water from the meals and water you log.

Readings you import from Apple Health become part of your Jabful log, so they sync to your account, encrypted, like the rest of your records. We use Apple Health data only to provide the features you turn on. We never use it for advertising, marketing or data mining, never sell it, never share it with advertising or analytics partners, and never store it in iCloud. You can change or remove Jabful's access at any time in the iOS Settings app, under Health.

AI features

Jabful's AI assistant answers questions about peptides and the research behind them, reads meal photos and turns meals you describe in words into a food log. These features run on a third-party AI service provider, named under "Service providers". Your device never talks to that provider directly: requests go through the Jabful service, which checks your subscription, applies daily limits and then sends the request to the provider. We may change the provider or the AI models we use; if the provider changes, we will update this policy.

The first time you use an AI feature (asking a question, scanning a meal or describing a meal in words), the app asks once, right where you are, for your permission: Jabful uses a third-party AI service to answer questions and read meal photos, only what you send is shared, and it is not used to train AI models. Nothing is sent until you tap Allow. If you choose "Not now", nothing is sent. Once you allow it, the app does not ask again. You can turn AI features off or back on at any time in Settings, under Privacy, then AI features; while they are off, the app sends nothing to the AI service. If what the AI features share changes in a significant way, the app asks again.

Meal scan

The meal photo you choose is sent to our AI service provider to identify the foods and estimate portions. The Jabful service does not save the photo and does not write it to any log. The photo stays on your iPhone with the meal.

Logging a meal in words

What you type about the meal, and the current list of items, is sent to our AI service provider to build or update the list. We match foods against the USDA FoodData Central database to calculate nutrition.

Ask

Your question and the recent turns of that conversation are sent to our AI service provider, together with entries from the Jabful library about the compounds you asked about. The assistant is designed to give educational answers with citations, and it declines to give personal dosing instructions or help with buying compounds. Conversations are saved only on your iPhone, and you can delete them there.

How the AI service provider handles this data

Our requests ask the provider not to store responses for later retrieval. Under the provider's API data policy, data sent through its API is not used to train its models, and the provider may keep requests and responses in abuse monitoring logs for up to 30 days. The provider receives a one-way hashed identifier so it can detect abuse, never your name, email or Jabful account ID. The Jabful service keeps only daily counts and token totals for each AI feature, to enforce limits. It does not keep your photos, questions or AI answers.

Please do not include other people's personal information, or details you would not want processed by an AI provider, in your questions or photos.

Food search

When you search the food library, matching starts on your iPhone and may also send your search words to the Jabful service to search our copy of the USDA database. We do not save searches to your account. Like any web request, a search can appear in our hosting provider's short-lived request logs (see "Security and logs").

Subscriptions and purchases

Apple processes all payments. We never see your payment card or billing details. After a purchase or restore, the app sends Apple's signed transaction to the Jabful service, which verifies it with Apple's certificates and stores the product, transaction identifiers, store environment and expiry date so your subscription unlocks your account, including the AI features.

Our paywall and subscription status are run by Superwall (see "Service providers"). If you subscribed in an earlier version of Jabful, that purchase was handled through RevenueCat, which is not part of Jabful 2.0.

Referrals

Each account gets a personal invite code. If someone signs up with your code, we record that their account was referred by yours, when the code was applied, and whether they later subscribed and to which plan. You see only how many friends joined and subscribed, never who they are. The person who invited you does not learn who you are from Jabful.

Product analytics and session replay

We use PostHog to understand how Jabful is used and to find bugs. PostHog receives:

  • Events such as screens viewed, onboarding steps completed and features used. The app does not automatically record what you type or the values you pick. Events about health features carry counts and yes or no flags only (for example, that a dose was logged with a note), never doses, weights, symptoms, goals, compound names, notes or questions.
  • Your Jabful account ID, email address and first name, so support and analytics refer to the same person.
  • Device and app details (model, iOS version, app version, language) and an approximate location derived from your IP address by PostHog.
  • Session replays: recordings of how screens are used. Text you type and images are masked, and screens that show health values or personal details are masked as well, so those values are not visible in recordings.
  • Technical logs from the app, with any email address scrubbed before sending.

PostHog is not given your synced records, your photos or anything from Apple Health.

Advertising measurement and tracking permission

We advertise Jabful on Meta platforms (Facebook and Instagram) and measure which ads lead to installs and subscriptions. iOS asks whether Jabful may track you, and your answer controls what is shared.

  • Whatever you choose: the Facebook SDK records that the app was installed and opened, and Superwall records paywall and subscription events (such as a paywall being shown or a subscription starting), which its Meta integration reports to Meta for ad measurement together with your tracking choice. These do not include your advertising identifier, name or email.
  • Only if you allow tracking: Superwall checks once, shortly after you install, whether your install came from one of our ad links. That check compares your install with recent ad clicks using your IP address and device details, so it never runs unless you allow tracking. If you decline, or are never asked, it is skipped for good on that install. The Facebook SDK likewise only looks for a link from an ad you tapped when you allow tracking.
  • Also only if you allow tracking: your device's advertising identifier, your Jabful account ID, email address and first name are shared with Meta and Superwall to match your install and subscription to the ad you saw. Meta's SDK hashes contact details before sending them.

Health information is never part of this: no doses, compounds, weights, goals, symptoms, meals or Apple Health data. You can change your choice at any time in the iOS Settings app, under Privacy and Security, then Tracking.

Service providers

These companies process data for us, only for the purposes described in this policy and under their own privacy terms:

Security and logs

All traffic between the app and the Jabful service is encrypted in transit (HTTPS). Synced records and the Apple revocation token are encrypted at rest, as described above. Every request for your data is checked against your sign-in, and we apply rate limits per account and per network address to stop abuse. AI features also have daily limits per account.

Our own service logs record a request ID, the endpoint called, the result, timings, your account ID and an error code. They never contain your sign-in tokens, email, name, photos, questions, AI answers or the contents of your records. Our hosting provider, Cloudflare, also keeps basic request logs (such as the address requested, which can include a food search term, and the response status) for up to 7 days.

How long we keep data

  • Account details and synced records: until you delete them or delete your account.
  • Records you delete in the app: the contents are removed from our servers at the next sync, leaving only a deletion marker so your other devices remove it too.
  • Daily AI usage counts: until you delete your account.
  • Refresh tokens: they expire after 90 days, and are erased when you delete your account.
  • Service and hosting logs: up to 7 days.
  • AI service provider abuse monitoring logs: up to 30 days, under the provider's policy.
  • Our database provider keeps a rolling point-in-time recovery history for up to 30 days, so deleted data fully disappears from it within 30 days.
  • Data held by PostHog, Superwall and Meta: according to their retention settings and policies. Email us to ask for its deletion.

Deleting your data

Open Jabful, tap the gear on Today to open Settings, then Account, then Delete account. Deleting your account immediately and permanently removes:

  • Your account, the Apple or Google sign-in linked to it, and all sign-in tokens.
  • Every record synced to your account.
  • Your invite code and referral records, subscription records and AI usage counts.
  • All Jabful data on that iPhone, including photos and Ask conversations.

If you used Sign in with Apple, we also revoke Jabful's access with Apple. Deleting your account does not cancel your App Store subscription; cancel it in your Apple Account settings. Anything Jabful wrote to Apple Health stays there under your control. Signing out, instead of deleting, keeps your data on the iPhone and on your account.

You can also edit or delete individual entries at any time, export your records from the app, or email us to ask for a copy of your data, a correction, or deletion of data held by our analytics and attribution providers.

What we do not do

We do not sell your personal information. We do not use health information for advertising or share it with advertisers. We do not sell, source or recommend vendors for any compound.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict some processing, and to withdraw consent. Most of this you can do in the app. For anything else, email us and we will respond within the time the law requires. You can also complain to your local data protection authority.

Children

Jabful is for adults 18 and over. We do not knowingly collect data from anyone younger. If you believe a minor has created an account, contact us and we will delete it.

International transfers

MultiMode Labs Inc. is based in India. Our service providers process data in the United States and other countries, so your information may be transferred across borders. We rely on those providers' contractual and security commitments to protect it.

Changes to this policy

If our practices change, we will update this page and its effective date. For significant changes, we will give you notice before they take effect.

Questions or requests about your data? Email us at team@multimodelabs.com.