Last updated 8 August 2026
Wrought holds what you eat, what you lift, what you weigh, and whatever your watch reports. That is about as personal as data gets, so this page is written to be read rather than to be legally survivable. If anything here is unclear, ask and it gets rewritten.
Your data is never sold, never rented, never used to train anyone's model, and never shared for advertising. It is stored in one database that only you can read. You can export every row or delete the whole account at any time, without asking us.
| What | Where it comes from |
|---|---|
| Your log | Meals, workouts, sets, weight, measurements, notes, moods — whatever you tell your AI assistant. |
| Device data | Steps, sleep, heart rate, HRV, glucose, blood pressure and similar, if you connect a phone or wearable. Only what you choose to send. |
| Bloodwork | Only if you enter it yourself. |
| Profile | Timezone, units, height, birth year, and optionally sex — used to calculate resting energy. All optional except timezone. |
| Account | Your email address, for signing in. |
| Connections | Which assistants and devices you have linked, and when each last synced. |
There is no analytics script, no advertising pixel, no third-party tracker and no session recording on any page of this site.
Four companies process data on Wrought's behalf. There are no others, and none of them are advertising companies.
| Processor | What they handle |
|---|---|
| Supabase | The database and sign-in. Every row lives here, protected by row-level security so your rows are reachable only by your account. |
| OpenAI | Reads your food and workout descriptions to turn them into structured entries, and writes your nightly verdict. See below. |
| Netlify | Serves the site and runs the server functions. |
| Resend | Sends the nightly brief email, if you want it. |
When you say "chicken burrito bowl, no rice", that sentence is sent to OpenAI so it can be turned into calories, macros and categories. Your nightly verdict is written the same way, from numbers already calculated here.
OpenAI's API terms state that data submitted through the API is not used to train their models. Even so — this is a real third party seeing real sentences about your life, and you should know that before you type anything you would not want processed by a company that is not us.
GET /api/export returns every row Wrought holds about you as JSON, or
?format=csv for spreadsheets. There is a button on the
connect page. No request, no waiting period, no export fee.
A hub you cannot leave is a trap.
Deleting your account removes every row — log, sets, metrics, routines, briefs, memory, connections — by database cascade, not by a flag that hides it. Email laszlobrianczako@gmail.com and it is done within 7 days. Backups roll off within 30.
Disconnect an assistant and its token stops working immediately. Revoke a device key on the connect page and the phone using it stops being able to write. Neither affects your data.
Data is stored in Supabase's cloud infrastructure. Wrought is operated from Canada, so PIPEDA applies; if you are in the EU or UK, GDPR and UK GDPR give you rights of access, rectification, erasure, restriction, objection and portability — all of which are satisfied by the export and delete above, and none of which require a form.
Your log is kept until you delete it, because that is the entire product — a record that forgets after ninety days is not a record. Server logs are kept 30 days. Nothing is archived after account deletion.
Health information is sensitive-category data under GDPR Article 9 and is treated as such. The legal basis is your explicit consent, given by connecting an assistant or a device, and withdrawable at any time by disconnecting or deleting.
Wrought is not a medical device. It does not diagnose, treat, or advise on any condition, and it is not a substitute for a doctor or dietitian. It will not interpret your heart rate, HRV or bloodwork as a clinical sign, and it is built to say so and point you at a professional when a question crosses that line.
No system is perfect. If something is breached that affects you, you will be told directly and promptly — not buried in a status page.
Wrought is not for anyone under 16 and is not directed at children. If an account is found to belong to someone younger, it is deleted.
If this policy changes in a way that affects how your data is handled, you will be emailed before it takes effect — not after, and not only on this page.
Laszlo Czako ·
laszlobrianczako@gmail.com
Data requests, deletions and complaints all go to the same place and are answered by a
person.