Privacy Policy · Number Two

Who we are

Number Two — the iPhone app listed on the App Store as numbertwo.io, and this website — is operated by Harrison, trading as a sole proprietor in the United States. For anything in this policy, write to hello@numbertwo.io.

Number Two is a wellness log, not a healthcare provider, and it is not covered by HIPAA. It does collect consumer health data, so this policy is written to meet the Washington My Health My Data Act, Nevada's consumer health data law, and, for people in the EU and UK, the rules for special-category data.

What we collect

Your account

You sign in with Apple, Google, or a phone number. We store the name you give us, the email address or phone number your sign-in provides, which method you used, when you joined, your profile picture if you set one, and your daily-reminder time. Sign-in itself is handled by Firebase Authentication (Google).

Your photographs

When you log, the photograph is uploaded to our servers and stored under your account so that it can be measured and shown back to you in your journal. Before it leaves your phone the image is re-encoded, which removes the camera's metadata — including any location — and our server strips anything that survives, so a photo never carries the coordinates of your bathroom. The pin on your map, if you turn the map on, does not come from the photo (see Your location below). The app also checks each photo for blur and darkness before it is logged; a photo that fails that check is sent for the check but is not stored.

What the photo becomes

Your phone outlines the stool on-device and sends the outline with the photo. Our system then measures the photo: Bristol type, colour, whether blood or mucus appears present, texture, how many pieces, how much of the bowl, and similar descriptive attributes. These measurements, any correction you make to them, and the pattern your log is matched to are stored with the log.

Your check-ins

Symptoms you log, how rough they were, and the date. These are the outcomes your reports are counted from.

How you use the app

Screens visited, taps, scrolls, whether requests succeeded, and error codes — tied to your account's internal id, never to your name, email or number. No health attribute, symptom, photo, or measurement ever enters this stream; the list of forbidden fields is enforced in the code. We also send four events to Firebase Analytics (Google) — a screen was viewed, you signed in, you finished onboarding, you completed a log — with no advertising identifier and no advertising features enabled. You can turn usage analytics off in Profile → Privacy.

Support

Messages you send us from inside the app or by email, and the app version attached to them.

Your location (optional, off by default)

The app has a map of your logs. It is off until you turn it on. While it is on, and only then, each photo you take with the camera in the app is stored with where your phone was at that moment, as reported by iOS. A photo you choose from your library never gets a location, and we never read location data out of a photo file. Where a log was taken is stored with that log, in your account, and is shown to you on your map. It is shown to your friends only if you also turn on the separate "Friends on your map" switch, and then they see the exact spot. It never enters usage analytics and is never used to improve the app's reading of photos. Turning the map off stops new locations being recorded and hides the map, but keeps the locations already stored, so that turning it back on brings your map back; deleting your account removes them.

What we do not collect

Your location, unless you turn the map on (above). Your contacts. Apple Health data. Anything from your photo library other than the photo you choose to log. We do not use an advertising identifier and the app never asks to track you.

How we use it

To run the app: store your logs, measure your photos, keep your journal, and build your reports.
To build the counts your reports are made from. Every report is arithmetic over other people's logs and what they went on to report; yours are part of that arithmetic for other people in the same way. These are counts across many people, never anything that identifies you.
To answer you when you write to us.
To see how the app is used and where it breaks, from the usage data described above.
To keep the service secure, including a rate limit on share links.

We do not sell your data. We do not share it with advertisers, data brokers, or anyone for marketing. We do not use it to make decisions about you with legal or similar effects.

AI processing

Each photograph you log is read by an AI model — currently Claude, made by Anthropic — which returns the descriptive measurements above. Today that call goes to Anthropic's API under their commercial terms, which do not permit them to train on it; we are moving it to run inside our own cloud account (Amazon Bedrock) as soon as that is enabled, at which point the photo will not leave our infrastructure. Either way, no name, email, phone number or account identifier accompanies the photo. Nothing in the app reasons about your health: the model describes what is in the picture, and the rest is counting.

Your consents

Everything above is what it takes to run the app. The things below are optional. Each is a separate switch in Profile → Privacy, off until you turn it on, and each can be turned off again with one tap. Nothing in the app is unlocked by saying yes, and nothing is withheld for saying no. The exact words the app shows you when you decide are reproduced here. The version of these terms shown in the app is dated 2026-09-09.

Help make Number Two better

Asked after your second log.

What we keep: the photo from each log, the attributes measured from it, and any correction you make.
What comes off first: your name, email, phone and account ID. What is kept is tied to a random identifier, not to you.
What it is for: improving how accurately the app reads a photo, and the pattern counts your own reports are built from.
Who sees it: our team, and reviewers under contract who label images. Never sold, never used for advertising.
How long: kept while your account exists, and — because what is kept is not tied to you — the de-identified copy stays in our training set after you delete your account.
Turning this off stops new logs going in. Ask us any time and we'll delete what's already there, but once your account is gone there is no longer a link back to find it.

Help the wider picture

Asked at the same time.

What is shared: counts and averages across many people — how often a pattern is followed by a given symptom, and how that compares with everyone else.
What is never shared: your photos, your individual logs, or anything that names or contacts you.
Who with: academic and clinical research partners, and figures published in aggregate.
How long: shared figures already published cannot be recalled, but turning this off removes you from every future one.
This is separate from the switch above on purpose. You can say yes to one and no to the other.

Hosted share links

Asked the first time you want a link, in context.

What a link is: a web page at numbertwo.io showing the card you chose, and nothing else.
Who can see it: anyone you send it to, and anyone they send it to. The address is unguessable, but it is not private.
What is never on it: your photos, your name, your account, or any log you did not put on the card.
How long: about 30 days, then the page and the picture are deleted. There is no way to take one back sooner.
Saving a picture to your own phone is different, and never needs this.
Turning this off stops new links. Links you already made still expire on their own.

Friends

Asked when you first open Friends.

Who sees it: only people you have added as friends, or who opened an invite link you sent. Nobody can add you without your say.
What they see: each log — the type, the colour, the pieces, and the group it matches — with the day it was logged, and your name, username and picture.
What they never see: your photos, your insights, your symptoms, or anything about your account.
How long: for as long as you are friends. Remove a friend, or block them, and they see nothing from then on.
Turning this off removes all of your friends at once. You can add them again later.

Map

Asked when you first open the map.

What is collected: where your phone is at the moment you take a photo with the camera in the app. Never from a saved picture, and never from the photo file itself.
What it is for: a map of your logs that only you can see.
Where it goes: it is stored with the log, in your account. Not into analytics, and not into anything used to improve the app.
Who sees it: you. Your friends only if you also turn on the switch below.
How long: until you delete your account. Turning this off stops new pins and hides the map, but keeps what is already there, so turning it back on brings your map back.

Friends on your map

Asked in the same place, as its own switch, off until you move it.

Who sees it: only the friends you have added, on their own map.
What they see: the exact spot each of your logs was taken, with the log — the same log they can already see on Recent.
When: only while both this and the map are on. Turn either off and every pin disappears from their maps at once.
What they never see: your photos, your insights, or your symptoms.

Share links and saved cards

Saving a card to your phone, or handing it to another app such as Instagram, happens entirely on your phone. Nothing is sent to us and no consent is involved. The page for a hosted link is built from a fixed template on our servers; its preview title and description are generic and carry nothing about your health, and the page tells search engines not to index it.

Who can see your data

Who	What	Why
Our team	Your account and logs, including photos, when needed to support you or investigate a problem. An operator can view an account read-only; every such view is recorded in an audit log, and nothing can be changed that way.	Running the service
Reviewers under contract	De-identified photos and measurements — only if you turned on "Help make Number Two better".	Labelling images to improve the reading
Anthropic	The photograph, with no identifiers, for the duration of a request. Not used to train their models.	Reading the photo (see AI processing)
Amazon Web Services	Everything, as our hosting provider, in the United States.	Storage and computing
Google (Firebase)	Your sign-in identity, and the four analytics events above.	Sign-in; basic analytics
Research partners	Aggregate counts only — only if you turned on "Help the wider picture".	Research
Anyone with a share link	The card you chose to publish, for about 30 days.	You shared it
Your friends	Your logs (type, colour, pieces, match, day) and your name, username and picture — only if you turned on "Friends". Where each log was taken — only if you also turned on "Map" and "Friends on your map".	You added them

We would disclose data if the law required it, and would tell you unless we were prohibited from doing so. If the business were ever transferred, this policy would go with the data and you would be told.

How long we keep it

Photos, measurements, check-ins, reports: as long as your account exists, or until you delete the individual log.
Where a log was taken (only if you turned the map on): as long as the log exists, even if you later turn the map off.
Account details: as long as your account exists.
Usage data: raw events are automatically deleted after a limited period; daily totals with no personal detail are kept.
Share links: about 30 days, then the page and picture are deleted automatically.
Support messages: as long as your account exists.
De-identified training copies (only if you turned on "Help make Number Two better"): kept after your account is deleted, because they are no longer tied to you and cannot be found by account.

Deleting your account (Profile → Privacy → Delete my account and data) is immediate and cannot be undone. It removes your profile, every log and photo, every measurement and correction, every check-in, your consents, your support messages, your profile picture, every share page and picture, your usage data, and your sign-in identity. Totals that no longer identify anyone — how many logs there were in a month, say — stay as totals.

Your rights

Wherever you live, you can:

See and get a copy of your data. Profile → Privacy → Get a copy of my data. We assemble it and send it to the email or phone number on your account, normally within 24 hours.
Correct a measurement, from the report itself, or your profile, from the profile screen.
Delete one log, or everything, from inside the app.
Withdraw any consent with one tap, with the effects described above.
Ask us for anything you cannot do in the app at hello@numbertwo.io. We will answer within 30 days, and we will not treat you differently for asking.

Washington and Nevada residents: the collection and sharing of your consumer health data described here happens only as set out in this policy; the optional sharing described under Your consents requires your separate, affirmative consent, which you give and withdraw in the app. You may withdraw consent and request deletion as above. If we deny a request, you may appeal by replying to our answer; if you are not satisfied with the appeal, you may contact the Washington Attorney General.

EU and UK: our legal basis for running the app is performance of our contract with you; for your health data and photos it is your explicit consent, given when you log and withdrawable by deleting; for usage data it is our legitimate interest in running the service, which you can object to by turning analytics off. Your data is stored in the United States. You have the right to lodge a complaint with your supervisory authority.

California: we do not sell or share personal information for cross-context behavioural advertising, and we have not done so in the past twelve months. The rights to know, delete, correct and not be discriminated against are honoured as described above.

Age

Number Two is for adults. You must be 18 or older to use it. We do not knowingly collect information from anyone under 18; if you believe we have, write to us and we will delete it.

Security

Everything travels over encrypted connections. Photos are stored in a private bucket that only the application can reach, under a key your phone never chooses, and are served back only through short-lived signed addresses. Camera metadata is stripped twice. Where a log was taken, when the map is on, is stored with the log under the same protections and never enters analytics. Health measurements never enter analytics. Administrative access is limited to named accounts, is read-only, and is logged. If a breach ever affected your data we would tell you, and where the law requires it, the relevant authorities, without undue delay.

Changes

If this policy changes in a way that matters, the app will tell you before the change takes effect and, where a change would need it, ask again. The effective date at the top is the date of the current version.

Contact

hello@numbertwo.io. Harrison, trading as Number Two, United States.