Privacy Policy

Data Numon Processes

Numon processes the food entries, messages, photos, profile details, and settings a user provides in the Telegram bot or Telegram Mini App. Numon also stores operational metadata needed to run the service, such as Telegram chat identifiers, timestamps, preferences, and connection state.

WHOOP Data

Connecting WHOOP is optional. If a user connects WHOOP, Numon requests access to selected user-data scopes: profile, body measurements, cycles, recovery, sleep, and workouts, plus offline access so Numon can refresh tokens without asking the user to reconnect every time.

Numon uses WHOOP data to provide nutrition and fitness context in the user's own experience, including chat answers and planned weekly nutrition-boundary review. Numon does not expose a generic WHOOP endpoint caller to the agent; the agent has only typed WHOOP read tools and an explicit disconnect tool for user-requested disconnection.

Hevy Data

Connecting Hevy is optional. If a user connects Hevy, Numon stores a user-provided Hevy API key and uses it only to read Hevy workouts, routines, exercise templates, and body measurements.

Numon does not expose a generic Hevy endpoint caller to the agent; the agent has only typed Hevy read tools and an explicit disconnect tool for user-requested disconnection. Numon does not create, update, or delete data in Hevy.

Google Health Data

Connecting Google Health is optional. If a user connects Google Health, Numon requests read-only access to three restricted Google Health categories: activity and fitness, sleep, and health metrics and measurements, plus offline access so Numon can refresh tokens without asking the user to reconnect every time. Numon does not request write access and does not create, update, or delete data in Google Health.

Numon's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Health data is used only to provide nutrition and fitness context in the user's own experience, such as chat answers to the user's questions. It is not used for advertising, not sold, and not transferred to third parties except as needed to provide the user-facing feature or as required by law. Numon does not expose a generic Google Health endpoint caller to the agent; any agent access to Google Health data is limited to typed read tools and an explicit disconnect tool for user-requested disconnection.

Integration Tokens

WHOOP and Google Health access and refresh tokens, and Hevy API keys, are stored only as encrypted server-side payloads. Tokens and API keys are not returned to the Mini App, chat interface, public API, or model prompts.

How Data Is Used

Numon uses data to operate the diary, analyze entries, generate reports, answer user questions, improve nutrition recommendations, maintain security, debug incidents, and understand product reliability. Analytics events are intended to avoid raw health payload values.

Sharing

Numon does not sell personal data. Data may be processed by infrastructure and service providers that help run Numon, including hosting, database, analytics, Telegram, and AI-model providers. Data may also be disclosed if required by law or to protect the service from abuse.

Retention And Deletion

Numon keeps data while it is needed to provide the service or meet operational and legal needs. A user may request deletion of their Numon data or disconnection of their connected integrations by contacting Numon through the Telegram bot. A user may also disconnect WHOOP, Hevy, or Google Health in the Mini App, and WHOOP or Hevy by asking the agent; Numon attempts to revoke WHOOP and Google Health access where supported and disables the local integration connection.

Security

Numon uses access controls, server-side storage, encrypted credential payloads, and scoped integrations to reduce the risk of unauthorized access. No internet service can guarantee perfect security.

Contact

For privacy requests, contact Numon through the Telegram bot and mention privacy support. Include enough detail to identify the relevant Telegram account or connection.