DYLD — Get Dialed Last updated: August 18, 2026
This policy explains what DYLD collects, where it goes, and what you can do about it. It is written to be read, not to be survived.
Two companion documents sit alongside this one: our Consumer Health Data Privacy Policy, which the law requires to stand on its own and which covers your training, food, and mental-health data in detail, and our AI Coach Disclosure and Safety Protocol, which says plainly that the coach is a machine and publishes exactly what happens if you write something that suggests you are in crisis.
The short version: almost everything you log stays on your phone. Your workouts, your food, your journal, your check-ins and your record are stored only on the device. Two things you choose to do send some of it out: posting in Crew, and asking the AI coach a question. Nothing is stored on our servers either way.
DYLD is operated by RJ Galasieski, an individual developer based in California, United States.
Contact: support@dyld.app
You must be at least 13 to create a DYLD account. We do not knowingly collect information from anyone under 13. If we learn we have, the account and its data are deleted.
Crew — the in-app community — is 13+, the same floor as the account itself. If you are under 13 the Crew tab does not appear and its screens are not reachable. This is enforced in the app.
Because members aged 13 to 17 can post, Crew is moderated. Every message passes a content filter before it sends, any member can report or block any other, reports reach a human queue that is acted on, and the code of conduct must be accepted before a first post. Contact for anything urgent is published inside the app and here: support@dyld.app. There are no private messages in Crew and no way for one member to contact another off-platform through the app.
If you believe a child under 13 has given us information, email support@dyld.app and we will remove it.
This is most of the app. The following is stored only in a database on your device. We cannot see it, we have no copy of it, and it is not backed up to us:
Your date of birth and age are stored on your device only. They are never transmitted to our servers.
Apple also tells us an age category, and we do not keep it. Texas and Louisiana law require an app to honor the age range declared on your Apple Account rather than trusting a box you ticked inside the app, so on launch DYLD asks iOS for it. Apple returns a range — under 13, 13–15, 16–17, or 18+ — never your birthday. We hold it in memory for that run of the app to decide two things: whether Crew appears (it needs 13) and whether the under-18 food guardrails apply (they need 18). Those are separate thresholds and the range answers both. It is never written to disk, never sent to our servers, and gone when you close the app. It can only ever restrict what is available to you; it can never unlock anything you did not already qualify for.
One exception, and you trigger it: the AI coach. When you ask the coach a question, the app sends a snapshot of the above — your recent training, your food numbers, your check-ins, and your journal entries from the last 7 days, as you wrote them — along with your question, so the answer is about your actual life instead of generic advice. It is used to answer that one question and is never stored, by us or by the AI provider. If you never open the coach, none of this ever leaves your phone. Section 5 covers exactly where it goes.
If you delete the app, this data is gone. We have no way to restore it.
An account is required only for Crew. If you never use Crew, you can use DYLD without giving us anything.
When you create one we receive:
Your starting display name is a neutral generated name, not your email.
Why: to let you sign in, to attribute your messages to you, and to prove you accepted the community rules.
Crew is a public community inside the app. Anything you post there is visible to other members.
We store your messages, reactions, replies, the channel and the timestamp, plus any blocks you set.
Why: because a chat room does not work otherwise.
If you report a message, or if you are moderated, we store:
Why: Apple requires that we act on reports, and a moderation system that destroys its own evidence cannot be fair to either side. Report snapshots are retained as a safety record.
If you use the AI coach or the meal-photo scan, we store a count of how many times you used them today. Not what you asked. Not what you sent. A number.
Why: to enforce a daily limit and keep costs bounded.
When you ask the coach a question, your question is sent to our AI provider, OpenRouter, which passes it to a US-hosted model to generate a reply. Sent with it, so the answer is about you and not about people in general:
Nothing is stored on our servers, and the AI provider is contractually barred from retaining it or training on it. The exchange exists for the length of one request. If you never ask the coach anything, none of this is ever sent.
When you photograph a meal, or speak what you ate, the photo or the transcript is sent to the same provider to estimate what is in it. Neither is ever stored on our servers — each exists for the lifetime of one request and is then gone.
On where these go, specifically. We route only to US-hosted providers that are contractually barred from retaining or training on what we send. The AI model itself is an open-weight model developed in China (Qwen), but it runs on servers in the United States — your photos and questions are not sent to China.
Barcodes are looked up against Open Food Facts, a free public food database. Only the barcode number is sent.
| Service | What it receives | Why |
|---|---|---|
| Supabase | Your account, Crew messages, moderation records | Hosts the community |
| OpenRouter (and the US compute providers it routes to: DeepInfra, Parasail) | Coach questions with your numbers; meal photos; spoken food logs | Generates coaching and food estimates |
| Open Food Facts | Barcode numbers | Food lookup |
| PostHog | A short list of named app events, tied to your account ID after you sign in | Product analytics |
| Sentry | Crash reports and error diagnostics | Fixing crashes |
| RevenueCat | Your subscription status and purchase events | Managing subscriptions |
| Apple | Sign in with Apple, subscription purchases, and the age category on your Apple Account | Sign-in, payment, and the age check Texas and Louisiana require |
About analytics specifically: we use a short, deliberate list of named events — such as opening the app, viewing the paywall, winning a day, starting or completing a purchase. There is no automatic event capture, no session replay, and no screen recording. We do not log what you write, what you eat, or what you lift.
We never receive your payment details. Apple handles all payment. We see only whether a subscription is active.
You can revoke either in iOS Settings at any time. The app keeps working without them.
You can delete your account from inside the app, under the YOU tab. No email, no form, no waiting.
Deleting does two things in one action:
If the server deletion fails, nothing is wiped and nothing is claimed. You will be told it did not work.
Moderation records are the exception and are kept as described in section 9.
This cannot be undone. There is no backup and no recovery.
Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to not be discriminated against for exercising those rights.
California residents (CCPA/CPRA): you have the right to know what we collect, to delete it, to correct it, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined, so there is nothing to opt out of.
Washington, Nevada and Connecticut residents: your rights over health data — confirming it, accessing it, withdrawing consent, and having it deleted, plus an appeal if we say no — are described in full in the Consumer Health Data Privacy Policy.
Every other state with a comprehensive privacy law gives you some version of access, correction, deletion and portability. We honor those requests from anyone who asks, wherever you live, rather than checking your state first.
The fastest way to exercise any of these is the in-app delete described above. For anything else, email support@dyld.app. We respond within 30 days for general requests and within 45 days for health data requests, and we will tell you inside that window if we need longer. We never charge for this, and never treat you differently for asking.
Your account and Crew data sit behind row-level security policies in Supabase, so one user's data is not reachable by another. Traffic is encrypted in transit. Server-side keys are never shipped inside the app.
No system is perfectly secure, and we will not claim otherwise.
If a breach affects your information, we will tell you. We will notify affected users without unreasonable delay once we understand what happened, and we will notify state authorities wherever the law requires it. We will tell you what was taken, when, and what to do about it — even when that is an unflattering answer.
DYLD is available in the App Store regions listed on its store page. Availability changes over time.
Your account and Crew data are stored in the United States (Oregon). If you use DYLD from outside the US, your information is transferred to and processed in the US. Where that transfer is regulated — for example from the European Economic Area or the United Kingdom — we rely on the appropriate legal mechanisms, including the EU–US Data Privacy Framework and Standard Contractual Clauses with our service providers.
Remember that this applies only to the small amount of data described in section 4. Everything covered in section 3 never leaves your device at all, and so is never transferred anywhere.
If we expand to new regions, this policy is updated before we do.
This policy is part of the Terms of Use, and the Terms of Use govern any dispute about it. They are one agreement. Everything below is stated in full in the Terms of Use — it is repeated here so that nobody has to go looking for it.
We describe our data practices as accurately as we can. DYLD and everything in it is provided "AS IS" and "AS AVAILABLE," without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, and non-infringement.
We do not warrant that any system is free from unauthorized access, that a third-party service we use will behave as documented, or that data stored on your device will survive a device failure, an OS update, or a deleted app. Section 12 says it plainly: no system is perfectly secure. Section 3 says the other half: we keep no backup of your on-device data and cannot recover it.
TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE ARE NOT LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST DATA, LOST PROFITS, OR PERSONAL INJURY ARISING FROM OR RELATING TO THIS POLICY OR OUR HANDLING OF YOUR INFORMATION.
OUR TOTAL LIABILITY FOR ALL CLAIMS COMBINED IS LIMITED TO THE AMOUNT YOU PAID US IN THE 12 MONTHS BEFORE THE CLAIM, or $100, whichever is greater. This applies to every theory of liability — contract, warranty, negligence, strict liability, statute, or anything else.
Nothing here excludes liability the law does not allow us to exclude, including for fraud, willful misconduct, gross negligence, or violation of law. Some jurisdictions do not allow some of these limits, so parts of this section may not apply to you.
You agree to hold us harmless from claims arising out of your content, your use of DYLD, or your violation of the Terms of Use, this policy, or the law. Full text in Terms of Use section 12.
Any dispute about this policy or about our handling of your information is covered by Terms of Use section 13, which requires you and us to try to resolve it by email first, then to bring it in binding individual arbitration rather than in court.
None of the above waives a right the law says you cannot waive. Your rights under section 11, including access and deletion rights under the CCPA/CPRA and comparable state laws, and any statutory claim that cannot be sent to arbitration or waived, are unaffected by this section — and exercising any of them will never be held against you.
Either of us can end this relationship. You can delete your account from the YOU tab at any time, which wipes your server-side account and your on-device data. We may suspend or terminate an account under Terms of Use section 9. Section 9 of this policy covers what is retained afterward and for how long, and Terms of Use section 13 survives termination either way.
If we change this policy materially, we will update the date at the top and notify you in the app before the change takes effect. Continuing to use DYLD after that means you accept the change.
support@dyld.app
This section is a working reference for the App Store Connect privacy questionnaire, kept here so the answers and this policy cannot drift apart.
| Apple category | Collected? | Linked to you? | Tracking? | Where |
|---|---|---|---|---|
| Contact Info — Email | Yes | Yes | No | Account creation (Crew only) |
| User Content — Messages | Yes | Yes | No | Crew posts, reactions |
| User Content — Photos | Yes, not retained | No | No | Meal scan — sent for processing, never stored |
| User Content — Audio Data | No | — | — | The spoken food log is recognised on the device. The recording never leaves the phone and we never receive it; only the resulting text is sent, and that text is User Content — Other below |
| User Content — Other | Yes | Yes | No | Report snapshots · coach context (journal entries + check-in lines) — sent for processing, never stored |
| Identifiers — User ID | Yes | Yes | No | Account ID, analytics identity, RevenueCat |
| Purchases | Yes | Yes | No | Subscription status via RevenueCat |
| Usage Data — Product Interaction | Yes | Yes | No | Named PostHog events |
| Diagnostics — Crash Data | Yes | Yes | No | Sentry |
| Health & Fitness | Yes, not retained | No | No | Stored on-device only; workout and food numbers are sent with a coach question for one request, never stored |
| Sensitive Info | No | — | — | Age is on-device only and never transmitted. The age RANGE received from Apple is held in memory for one app run, never written to disk or sent to us. Journal text is User Content — Other above |
| Location | No | — | — | Not collected |
| Contacts | No | — | — | Not collected |
| Browsing History | No | — | — | Not collected |
| Search History | No | — | — | Not collected |
Tracking: DYLD does not track users across apps or websites owned by other companies. App Tracking Transparency does not apply.
Not legal advice. This document was drafted against the app's actual code and live database on 2026-08-06 and re-verified against it on 2026-08-17, when the health data policy, the AI safety disclosure and the app-store age signal were added. It should be reviewed by an attorney before or shortly after launch. See [[decisions/log]] for the rulings it reflects.