Check a claim
Privacy

Privacy Policy

Last updated: June 2026

This policy explains how Caveat collects and uses your personal data, and the rights you have under the EU General Data Protection Regulation (GDPR) and equivalent UK law. We are privacy-first by design and take no industry money.

1. Who we are

Caveat is an independent, non-commercial passion project, not a business. For data protection purposes the controller responsible for your personal data is Niko Hems, as an individual. Contact Niko about anything in this policy, or to exercise your rights, at niko@nikohems.de. Given the size of the project there is no Data Protection Officer; privacy questions go to the same address.

2. What we collect, why, and our legal basis

We collect only what the service needs. For each purpose the GDPR requires a legal basis; ours are set out below.

  • Account email address. To create your account and send one-time, passwordless sign-in links. Legal basis: performance of a contract with you (Article 6(1)(b)); sign-in is not possible without it.
  • Your experiment content (the interventions, outcomes, schedules and daily logs you enter). To provide the n-of-1 tool and sync your data across your devices. Because these entries can reveal information about your health, we treat them as special category data. Legal basis: performance of a contract (Article 6(1)(b)) and your explicit consent for health-related data (Article 9(2)(a)), given when you create an account and use the tool.
  • Newsletter email address. To send you new checks and occasional updates, if you ask. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time.
  • Technical data (such as IP address, browser type and request times), collected by our hosting provider. To keep the service secure, reliable and free from abuse. Legal basis: our legitimate interests in security and reliability (Article 6(1)(f)).

3. Health-related data

Some of what you log in the experiments tool may relate to your health, which is a special category of data under Article 9. We rely on your explicit consent (Article 9(2)(a)) to process it. You can withdraw that consent at any time by deleting the data or your account. Withdrawal does not affect processing carried out before you withdrew.

4. Cookies and local storage

We use your browser’s local storage to run the experiments tool and to keep you signed in. These are strictly necessary for the service you request, so they do not require consent. We do not use third-party analytics or session-recording tools, we do not set advertising cookies, we do not use cross-site tracking, and we do not share data with advertising networks.

5. Who we share your data with

We do not sell your personal data. We share it only with the service providers (processors) that run the service for us, each bound by a data processing agreement and acting only on our instructions:

  • Supabase: authentication and database hosting (EU region).
  • Netlify: website hosting and content delivery.
  • Our email and newsletter provider: to deliver sign-in links and, if you subscribed, the newsletter.

We may also disclose data where we are legally required to do so.

6. International transfers

Your account and experiment data are stored in the European Union (Supabase EU region). Some providers, such as our hosting and email partners, may process limited data (for example technical logs or email delivery) outside the European Economic Area, including in the United States. Where that happens, the transfer is protected by appropriate safeguards under the GDPR, such as the European Commission’s Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. You can ask us for more detail at niko@nikohems.de.

7. How long we keep your data

We keep your account and experiment data until you delete it or close your account; you can export or erase everything from inside the tool at any time. Newsletter data is kept until you unsubscribe. Technical logs are kept only for a short period for security purposes. When you delete your account, your data is removed from our active systems and from backups within a reasonable period.

8. Your rights

Under the GDPR you have the right to access the personal data we hold about you, to have inaccurate data corrected, to have your data erased, to restrict or object to processing, to receive your data in a portable machine-readable format, and to withdraw any consent you have given at any time without affecting earlier processing. The export and delete tools inside the experiments app cover access, portability and erasure instantly; for anything else, email niko@nikohems.de. We aim to respond within one month.

9. Automated decision-making

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

10. Complaints

If you believe we have mishandled your data, please contact us first so we can put it right. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU or EEA country where you live or work, or where you think the issue occurred.

11. Is providing data mandatory?

You can read Caveat freely without an account. To use the experiments tool, providing an email address is necessary to create and secure your account; without it we cannot offer the tool. The newsletter is entirely optional.

12. How we protect your data

We use encryption in transit and at rest, row-level security that makes each user’s records private at the database level, least-privilege access, and passwordless sign-in so there is no password to leak. No system is perfectly secure, but we take these measures seriously.

13. Children

Caveat is not directed at children. Do not use the experiments tool if you are under 18.

14. Changes to this policy

If we make material changes we will update this page and the date above, and, where appropriate, tell you by email.

Caveat is journalism and a self-tracking tool, not medical advice. Talk to a qualified clinician about your health.