TestoPilot

TestoPilot Privacy Policy

Last updated: November 2, 2026

TestoPilot is a personal diary for adults on testosterone replacement therapy (TRT) and other treatments prescribed by their doctor. Your protocol. Your diary. Your progress. This policy explains, in plain language, what data the app stores, what it is used for, who it is shared with, and how you stay in control.

It applies to the TestoPilot app (bundle ID com.jumaappsllc.testopilot) on the App Store and Google Play and to the website https://testopilot.jumaapps.com. It is available in English.

Who is responsible for your data

The data controller is Juma Apps LLC, a limited liability company organized in Wyoming, United States, at 30 North Gould Street, STE N, Sheridan, WY 82801, United States.

What TestoPilot is — and what it is not

TestoPilot records what you write down or choose to import: your compounds and protocols, applications, vials, lab results, weight and body composition, workouts and daily check-ins. It is not a medical device and provides no medical advice. The app never recommends, suggests or adjusts doses, and never converts doses between units; it only stores what you enter. The estimated testosterone curve is a mathematical estimate drawn from your own entries — it is not a lab result and must not be used to adjust a dose.

TestoPilot is intended for adults aged 18 or over who follow a treatment prescribed by their own doctor or obtained legally where they live. Decisions about your treatment are always yours and your doctor's.

Data we collect

Data you enter in the app

All of it is optional and only exists if you type it in:

  • Display name (from your sign-in provider or typed by you)
  • Email address (only if you sign in with Google, Apple or email)
  • Sex, year of birth and height
  • Compounds and protocols (name, category, unit, route, dose you were prescribed, schedule, start and end dates, notes)
  • Application log (date, time, dose, injection site and side, vial used, notes)
  • Vials (label, volume, concentration written on the label, opening and expiry dates, remaining volume you note)
  • Lab results (marker, value, unit, collection date, laboratory, reference range from your report, notes)
  • Weigh-ins and body composition (weight, body fat %, lean mass) and goals
  • Workouts (date, duration, muscle groups, type, notes) and weekly training goal
  • Daily check-ins (mood, energy, libido, sleep quality, side effects such as acne or water retention, optional blood pressure, notes)
  • Daily habits (water, protein, steps, sleep) and habit goals
  • Body measurements (waist, hips, arm, etc.)
  • Reminder settings
  • Progress photos

Most of this is health data. See "Health data and your consent".

Data you choose to import (Apple Health, Health Connect and Strava)

Integrations are off by default and only start when you turn them on (More → Integrations, or during onboarding). TestoPilot only reads; it never writes to Apple Health, Health Connect or Strava.

  • Apple Health (iPhone) and Health Connect (Android): with your permission, the app reads weight, body fat, lean body mass, workouts (exercise sessions, with their distance and calories burned), hydration, steps and sleep from the last 30 days, only while the app is open. On Android, the exact Health Connect permissions are: Weight, Body fat, Lean body mass, Exercise, Distance, Total calories burned, Hydration, Steps and Sleep (read only). Nothing is read in the background, and no other data type is requested.
  • Strava: if you connect your account (OAuth, scope activity:read_all), the app reads your activities (type, start time, duration, distance, calories) and your first and last name as shown on Strava. The connection's access tokens are stored on your device; the code exchange that issues them goes through our server so the app does not hold Strava's secret.

Imported entries appear in your diary with their source and can be edited or deleted like any other entry. A deleted import is not imported again.

You can turn an integration off at any time. Turning off Apple Health or Health Connect stops all reading (on Android, the app also revokes its permissions); you can also revoke access in the Health app or in Health Connect settings. Disconnecting Strava revokes the app's access on Strava and removes the workouts that came from Strava from your diary.

Limited Use. TestoPilot's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements. Data from Apple Health, Health Connect and Strava is used only to fill in your own diary and show it to you. It is never used for advertising, never sold, never used to build profiles, never sent to analytics or crash reporting, and never used to train or feed any artificial-intelligence feature. Data from Strava is shown only to you.

Account data

You can use TestoPilot in four ways. There is no password: we never ask for or store one.

  • Google: we receive your name, email address and a Google account identifier.
  • Apple: we receive your name and email address (or Apple's relay address, if you choose to hide your email) and an Apple account identifier.
  • Email: we receive the email address you type. To sign in we send a one-time 6-digit code to it (valid for 10 minutes); only a cryptographic hash of the code is kept until it is used or expires.
  • Without an account ("Continue without an account"): we ask for no name or email. The app creates an anonymous account with a random identifier, which you can link to a Google, Apple or email account later (More → Link account).

Authentication and the cloud database run on our own servers, hosted by Hetzner Online GmbH.

Data collected automatically

TestoPilot contains no advertising SDK and does not use your device's advertising identifier. What it does collect automatically:

  • App usage events: which screens you open and which actions you take (for example, "logged an application" or "opened the paywall"), measured with Google Firebase Analytics and Mixpanel to understand how the app is used and improve it. Events never carry your health data — no compound, dose, lab value, weight, body composition, workout content, check-in, symptom, measurement or name; only that an action happened. They are linked to the random identifier of your TestoPilot account and, before you sign in, to a random app-instance identifier.
  • Crash reports: if the app crashes or hits an internal error, Google Firebase Crashlytics receives the technical report (device model, operating system, app version and the error), linked to the same random account identifier. It never includes your diary entries.
  • IP address: the app's main typeface is bundled with the app, but two typefaces are downloaded from Google Fonts servers when needed: the one on the "Sign in with Google" button, and, for PDF reports in Japanese, Korean and Chinese, the matching Noto Sans font. In those requests, Google receives your device's IP address.
  • Subscription and paywall data: the app user ID that RevenueCat and Superwall receive is the random identifier of your TestoPilot account — it contains no name or email. When the subscription screen (paywall) is shown, Superwall receives that ID, basic device information (such as platform, operating system, app version and language) and paywall events (which screen was shown, whether you closed it, started a trial or bought). If you subscribe, the store (App Store or Google Play) processes the payment, and RevenueCat receives the same ID, the purchase receipt or transaction details, and the device platform. None of them receives health data.

How we use your data

  • To show your diary, agenda, charts, estimated curve, streaks and reminders
  • To back up your diary to the cloud and bring it back when you sign in on a new device
  • To import the data you allowed from Apple Health, Health Connect or Strava into your diary
  • To manage your account and subscription
  • To respond when you contact support
  • To keep the service secure and prevent fraud
  • To comply with legal obligations

What we do not do: we do not sell your data, we do not use it for advertising, we do not build commercial profiles, and we do not track you across other companies' apps or websites. That is why Apple's App Tracking Transparency prompt never appears in TestoPilot.

Compounds, protocols, applications, lab results, weight, body composition, workouts, check-ins, symptoms, habits, measurements and progress photos reveal information about your health. Under the Brazilian LGPD (Art. 5, II and Art. 11) they are sensitive personal data; under the GDPR and UK GDPR (Art. 9) they are special category data.

We process this data only with your specific and explicit consent: you give it when you enter each item, and, for imports, when you turn on an integration and grant the system permission. TestoPilot never collects health data on its own or from sensors.

You can withdraw consent at any time: by deleting entries inside the app, by turning off an integration, by deleting your account, or simply by no longer using TestoPilot. Withdrawing consent does not affect processing that already happened, but without this data the diary cannot work.

We do not share health data with advertisers, insurers, employers or data brokers.

Who we share it with

Only with the parties needed to make the app work, and each receives only what it needs:

  • Hetzner Online GmbH — hosts the servers that run our authentication and cloud database. Stores the synchronized data listed under "Where data is stored" and, if you sign in with Google, Apple or email, your name (when the provider shares it) and email address.
  • Google — Google Sign-In; Google Fonts (IP address); Google Play (subscription billing on Android); Firebase Analytics and Firebase Crashlytics (usage events and crash reports, as described above). Health Connect runs on your device: data read from it goes into your diary, not to Google.
  • Apple — Sign in with Apple; App Store (subscription billing on iOS). Apple Health runs on your device: data read from it goes into your diary, not to Apple.
  • Strava, Inc. — only if you connect it: receives the authorization request from your device and, from our server, the one-time code exchange. We send Strava no diary data.
  • Mixpanel, Inc. — product analytics (usage events, as described above). Never receives health data, name or email.
  • Resend (Plus Five Five, Inc.) — sends the one-time sign-in code to your email address. Receives only that address and the code.
  • RevenueCat, Inc. — processes and validates App Store and Google Play subscriptions on our behalf and tells the app whether Premium is active. Receives the random app user ID, the receipt or transaction details, and the platform. Never receives health data.
  • Superwall, Inc. — displays the subscription screen (paywall) on our behalf and measures how it performs. Receives the random app user ID, basic device information and paywall events, and purchase status from the store. Never receives health data.

Hetzner, Google (Firebase), Mixpanel, Resend, RevenueCat and Superwall act as our processors (service providers) and may only use the data to provide their service to us.

We may also disclose data when the law requires it, to protect rights, safety or property, or in a merger or sale of the company. In that last case you will be notified beforehand.

We do not sell your data and do not share it for behavioral advertising. In the terms of the CCPA/CPRA (California), we do not "sell" or "share" personal information.

Where data is stored

TestoPilot is offline-first. Everything is saved to a local database on your device before anything else.

Every account (including anonymous ones) sends the following to our cloud database: profile, compounds and protocols, applications, vials, lab results, weigh-ins and body composition, workouts (including imported ones), daily check-ins, reminders, daily habits and habit goals, symptoms and body measurements. When you sign in to the same account on a new device, this data is downloaded back to it. Data from an anonymous account can only be recovered on another device if you linked it to Google, Apple or email first.

Some preferences stay only on your device: skipped occurrences, per-compound reminder switches, the weekly training goal, integration settings and Strava tokens.

This cloud copy is private to your account: row-level security means no other user can read it. The people at Juma Apps who operate the service can technically access the database, and do so only to provide support you ask for, to keep the service secure, or when the law requires it.

Progress photos stay on your device only and are never uploaded. If we ever offer cloud backup for photos, it will be opt-in and this policy will be updated first.

Exports (CSV, PDF report and the shareable "story" image) are generated on the device and only leave it when you choose to share them. The story image never includes compounds, doses or protocols.

Our servers are located in Helsinki, Finland (European Union), which may be outside your country.

International transfers

When your data leaves your country, we rely on the safeguards the law provides: in Brazil, the mechanisms of Article 33 of the LGPD (ANPD-approved standard contractual clauses or an adequacy decision); in the European Union and the United Kingdom, Standard Contractual Clauses (SCCs) or the UK IDTA, or an adequacy decision; and equivalent contracts elsewhere.

How long we keep it

  • While your account exists, your data is kept.
  • After a deletion request, we delete the account and synchronized data within 30 days.
  • Backups are purged within 30 days.
  • Purchase and transaction records may be retained as required by tax and accounting law.
  • Data on your device, including photos, is removed when you uninstall the app.

Device permissions

  • Notifications: for application reminders per compound, weigh-in, water and vial reminders. They are scheduled locally on the device; we use no push-notification service.
  • Camera and photo library: only when you add a progress photo or save a story image.
  • Apple Health / Health Connect: read-only, only if you turn the integration on (see above).
  • Run at boot (Android, RECEIVE_BOOT_COMPLETED): to re-schedule reminders after the phone restarts.

We do not request location, contacts or microphone.

Subscription and payments

The core diary is free: profile, compounds and protocols, agenda and application log, lab results, weigh-ins and body composition, workouts, daily check-ins, habits, reminders, integrations, progress charts and up to 3 progress photos. In the free plan, history lists and charts show the last 30 days; older records are kept, not deleted, and appear again with Premium.

TestoPilot Premium adds vial tracking, the estimated testosterone curve, PDF reports and CSV export, the shareable story image, body measurements, side-by-side photo comparison, full history and unlimited progress photos. In Brazil it costs R$ 19.90 per month or R$ 129.90 per year. If an offer includes a free trial, its length is shown in the store before you buy. Prices vary by country and are shown in the store before you buy. Billing is handled by the App Store or Google Play, and the subscription auto-renews until you cancel it in the store. RevenueCat processes the store receipts for us and Superwall displays the subscription screen. Neither we nor they ever have access to your card number.

Security

Data in transit uses TLS. In the cloud, it is encrypted at rest and protected by row-level security, which prevents one account from reaching another account's data. On the device, the local database lives inside the sandbox the operating system reserves for the app. No method is 100% secure; if an incident affects your data, we will notify you and the competent authority as the law requires.

  • Performance of a contract: providing the diary, sync, integrations and subscription.
  • Explicit consent: health data, including imported data (LGPD Art. 11, I; GDPR Art. 9(2)(a)).
  • Legitimate interests: security, fraud prevention and service improvement. We never rely on this basis for health data.
  • Legal obligation: tax records and responses to authorities.

Your rights

At any time you can:

  • Access your data and learn how it is processed
  • Correct incomplete or outdated data (directly in the app)
  • Delete entries or your whole account
  • Take your data with you (portability): export CSV or PDF inside the app
  • Restrict or object to a processing activity
  • Withdraw consent, including by turning off an integration
  • Complain to an authority: the ANPD in Brazil, the ICO in the United Kingdom, or your national data protection authority in the European Union

If you live in California: you have the right to know, delete and correct your information, and not to be discriminated against for exercising those rights. Because we do not sell or share personal information, there is no opt-out to exercise.

To exercise any right, write to [email protected] from the email address you sign in with (Google, Apple or email). If you use TestoPilot without an account, there is no email to match: delete entries or the account inside the app, or write to us and we will explain how to identify the account. We respond within 15 days (LGPD, simplified format) or 30 days (GDPR, UK GDPR and CPRA). We may ask you to confirm your identity first.

Delete your account

You can delete your account inside the app (More → Account → Delete account); the account and synchronized data are deleted right away. If you can no longer open the app, email [email protected] or see https://testopilot.jumaapps.com/delete-account — we then fulfil the request within 30 days, deleting the account and all synchronized data. Data on your device is removed when you uninstall the app. Full details are on the deletion page.

Children

TestoPilot is not directed to anyone under 18, and we do not knowingly collect their data. If we learn that we have, we will delete it. If you are a parent or guardian and believe a minor has created an account, write to [email protected].

Changes to this policy

When we change something material, we will notify you inside the app and on the website, and update the date at the top. Changes that require new consent, such as cloud backup for photos or reading lab reports from a photo, take effect only after you accept them.

Contact