debut
Apply for the iPhone beta

By continuing you agree to the Terms and Privacy Policy.

Privacy Policy

Last updated: October 24, 2026

Effective date: [EFFECTIVE DATE].

Debut is an app for iPhone and a website, heydebut.com, made by Punch LLC, a [STATE] limited liability company ("Debut", "we", "us"). This policy explains what information Debut handles, where it goes, how long it's kept and the choices you have. It covers the Debut app and this website.

Our Consumer Health Data Privacy Policy also applies to you, wherever you live. It's written for Washington's, Nevada's and Connecticut's consumer health data laws. Our Terms of Use explain the rules for using Debut.

The short version

  • Your app data stays on your iPhone. Debut has no accounts and no cloud sync.
  • Some features use other computers, and only after you agree to share. Future you's images, clips and voice are made in Debut's studio, on a GPU server rented from Vast.ai. Future you's replies, nudges and weekly letters, and meal estimates, are written by Claude, Anthropic's AI. Some replies and meal estimates are made on your iPhone by Apple's on-device model, and nothing is sent for those.
  • What's sent isn't kept long. Debut's server doesn't store what passes through it. Debut's studio deletes what it receives within an hour. Anthropic keeps what Debut sends for up to 30 days, or up to 2 years if its safety systems flag it, and doesn't train AI on it.
  • Your face and voice need a written release. Debut measures your face or voice only after you agree to a biometric release, destroys the measurements right after each use, and never sells them.
  • No selling, no ads, no tracking. We don't sell your information or share it for advertising. The app and this website have no advertising, analytics or tracking software from other companies. Debut counts how its own features are used, with a random ID and no health data, and you can turn that off.
  • You're in control. In the app, Profile › Privacy & data lets you withdraw any consent, turn off usage counts, export your data or delete everything.

Who we are

Punch LLC makes Debut and is responsible for your information. Our address is [ADDRESS]. For questions or requests, email privacy@heydebut.com.

In the Debut app

What stays on your iPhone

What you add to Debut is kept on your iPhone, in the app's own storage, until you delete it: your profile (first name, birthday, sex, height, weight, goal and focus), weigh-ins, meals, workouts, plans, the reasons you pick and the if-then plans you make, the photos you choose for future you, the images, clips and voice lines made for you, your messages with future you and the photos you send in them, your consent answers and agreements, when your calls happened and how long they lasted, and the first-week steps you reach. Debut doesn't use iCloud or any other cloud storage or sync.

The photos you choose for future you, the photos you send future you, your voice recording and future you's spoken lines are kept out of your iPhone's backups. If you back up your iPhone, the backup includes Debut's other data, as it does for most apps, including your messages with future you and future you's images, clips and talking clips. Talking clips carry future you speaking in your voice.

Debut saves nothing about your body, meals or workouts without your consent to collect, which it asks for during setup, before it asks about you. If you withdraw it, Debut saves nothing new.

The consents and releases Debut asks for

Each one has its own screen that says what goes where, why and how long it's kept, and Debut saves your answer on your iPhone with the exact words you saw and the time. When the words change, the app asks you again before anything more is sent.

  • Terms of Use: at the start of setup, before anything else.
  • Consent to collect: during setup, before Debut saves anything about your body, meals or workouts.
  • Consent to share: the first time anything would go to Debut's studio or to Anthropic. Without it, nothing is sent, and Debut uses your iPhone's own model or its built-in lines.
  • Face release: a written biometric release, before Debut measures any face in the photos you choose. Without it, Debut doesn't make future you's images. Turning it off deletes the photos you chose for future you.
  • Voice release: a written biometric release, only if you choose to record your voice, before anything is recorded. Turning it off deletes your recording and everything made with it.

Apple Health

If you connect Apple Health, iOS asks your permission for each kind of data, and you can change it anytime in the Health app or in Settings.

  • Debut reads your weight, height, birthday and sex, to set up your plan and draw your trend, and your workouts and their active calories, to count each one toward your plan.
  • Debut saves to Apple Health the weigh-ins you log and, if you turn on Save to Apple Health in Profile, the workouts you log, with their active calories, and your meals' calories, protein, carbs, fat and fiber.

Debut uses Apple Health data only to provide Debut's features to you. It never uses it for advertising, marketing or data mining, never sells it, and never gives it to advertisers, data brokers or information resellers. It doesn't store it in iCloud.

With your consent to share, some of it leaves your iPhone, only for your own features. Your age, sex, height, weight and goal, which can come from Apple Health, go to Debut's studio to make your images. The number of plans you kept, which can include workouts from Apple Health, goes to Anthropic for future you's replies, nudges and weekly letters. For weekly letters, Debut's server gets the week's change in your weight trend, works out whether it's behind pace or changing fast, and tells Anthropic only that, never your weight or how much it changed.

Deleting your data in Debut, even with Delete everything, doesn't delete what Debut saved to Apple Health. You can remove that in the Health app.

Your calendar

If you turn on adding your workouts to your calendar, iOS asks you to let Debut use your calendars, so you can pick one. Debut adds your workout days as events (like "Debut · Lower body (15 min)") and moves or removes them when your plan changes. It changes only the events it added, and nothing from your calendar leaves your iPhone. If that calendar syncs, through iCloud, Google or a work account, the events go wherever it does, and anyone who shares it can see them. Delete everything removes the events Debut added; deleting the app doesn't.

Inviting a workout buddy

In Your plan, Invite a buddy writes a short message with your plan's days and time, a calendar file for those sessions and a link to Debut, then opens the share sheet. Debut sends nothing itself: who gets it is up to you.

Notifications

Debut's reminders and nudges, and the reminder before a free trial ends, are scheduled on your iPhone. Debut doesn't use a push notification service, so no notification token leaves your phone. Before iOS asks you to allow notifications, Debut says what future you will send. If you haven't answered when a free trial starts, its reminder arrives quietly, in Notification Center only. "Nudges from future you" in Profile turns the nudges off, and you can turn all of Debut's notifications off in Settings.

Photos of you

To make future you, you pick 3 to 5 recent photos of just you with the iPhone's photo picker. Debut sees only the photos you pick, and it doesn't ask for access to your photo library.

On your iPhone, Debut first finds where the faces are in each photo, to check that it shows one face that's big enough. That step only finds faces; it doesn't measure them. When a photo has other people in it, you crop it to just you, and only that crop is kept and sent. The check can miss a face that's very small or turned away, so pick photos where nobody else is close by. Debut keeps the crops on your iPhone, out of backups, until you remove them, turn off the face release or delete everything.

With your consent to share and your face release, the crops go to Debut's studio to make future you's images and clips. They go with your age, sex, height, weight, goal and track, how far ahead future you is, and the scenes to make, which Debut picks from your reasons (like time with your kids or your dog). A clip or a talking clip starts from an image Debut already made, which goes to the studio with it. You confirm that the photos are of you. They're used to make AI images and clips of you only for future you: never for ads and never to train AI. How Debut measures your face is in Biometric information, below.

Your voice

Voice cloning is optional. It needs your consent to share and the voice release. If you agree, you record yourself reading a short script. Debut checks the recording on your iPhone, and it stays there, out of backups.

To make future you speak, Debut sends the recording and the lines future you will say to Debut's studio, which makes the speech and the talking clips. The studio deletes the recording as soon as the speech is made, and everything else from the job within an hour. The speech and clips are kept on your iPhone, for your stories, calls and letters.

Your voice is used only so future you can talk to you in Debut: never for anyone else, never for ads, never to train AI, and never sold. Debut has no way to export the recording or the clips. If you share your monthly recap video, it carries future you's lines in your voice, with an AI label. The studio's voice software also adds an inaudible watermark to the speech it makes, marking it as made by AI.

Turning the voice release off in Profile › Privacy & data deletes the recording and everything made with it.

Talking with future you

Future you's replies, in messages and on calls, are written by Claude, an AI model made by Anthropic, when you've given the consent to share and Debut's server can be reached. Otherwise, on iPhones with Apple Intelligence turned on, Apple's on-device model writes them on your iPhone, and nothing it reads leaves your phone. Failing that, they're Debut's built-in lines. Writing to future you is for people 18 and older.

  • In messages, these go through Debut's server to Anthropic for each reply: your message, any message you quote and any photo you attach (shrunk to 1,280 pixels); the last 24 messages of your conversation, where a photo from earlier goes only as the words "a photo" and Claude's short note about it; your first name, coaching style, track, reasons and if-then plans; how your plan is going (the plans you've kept this week, and whether today is a plan day and you kept it); and today's meals logged, protein and workouts. Debut's server also sees your age, to check you're 18 or older, and whether you have Debut Premium, to apply the right daily allowance.
  • On a call, these go through Debut's server to Anthropic: what you say and the conversation so far, your first name, your reasons and if-then plans, your track and coaching style, how many plans you've kept, how many days a week you plan and how many weeks you're in, how far ahead future you is, your local time and time zone, and the captions of future you's recent moments.
  • When you tap play on a reply, its words go to Debut's studio, which says them in your voice, with your voice release.

Debut's server doesn't keep any of it, and calls aren't kept after they end. Your messages with future you, and the photos you send in them, stay on your iPhone, protected while it's locked, until you delete them or tap Delete everything. The photos are kept out of backups; the messages' words are part of Debut's other data, which your iPhone's backups include. When you send a photo, Claude writes a short note about what it shows, which is kept with the message. Export my data includes your messages' words and notes which ones had a photo.

If you add future you to Contacts, iOS saves the card, with future you's picture, in your contacts, which sync wherever your contacts do.

What future you remembers. With Let future you remember on, Debut keeps short notes about what you tell future you in messages, on calls and in Your why (like why you started, when you like to train and the people you mention, and health details only if you turn on Remember health details) on your iPhone only, sends the ones that matter with each request for future you's words through Debut's server, which doesn't keep them, to Anthropic, and deletes them all when you tap Forget everything in Profile › What future you remembers or Delete everything.

Your day, with each reply. With your consent to share, each message, call, weekly letter and nudge also sends Anthropic, through Debut's server, which doesn't keep it, a short summary of your day and week: the meals you logged, your calories against your budget (unless you've hidden calories and weight), protein, workouts, breathing and meditation minutes, how many plans you kept, which way your weight trend is going (never the number) and your personal bests, and, only if you turn on Remember health details, what you've shared about how you're doing.

If you might be in danger

Debut checks every message to future you on your iPhone first, for words that can mean thoughts of suicide or self-harm or an eating-disorder emergency. A message that matches isn't sent to Debut's server or to Anthropic: your iPhone answers it with a fixed reply that says future you is an AI and points you to 988 in the US and findahelpline.com elsewhere. Messages that are sent are checked again on Debut's server, for the same words and for softer signs that you're struggling with food, your body or your mood, and the AI that writes the replies is told to flag the same. When a check finds one, future you steps out of the conversation and points you to real help, as How future you handles a crisis in our Terms describes. The checks' results aren't saved, and Debut doesn't contact anyone. Debut's server keeps a daily count of how often it shows the crisis or support message, with nothing about who saw it.

Speaking to Debut

When you speak to Debut, Apple's speech recognition turns your words into text. On iPhones that can do it on the device, Debut has it run on your iPhone, and the audio stays there. On an iPhone that can't, the audio goes to Apple to be turned into text, under Apple's privacy policy. You can always type instead.

Nudges, check-ins and weekly letters

With your consent to share, Debut sends Anthropic your first name, track and coaching style, your reasons and if-then plans, your local time, the plans you kept and missed, how many days it's been since you last kept one, how many days you logged food and met your protein, your protein target and descriptions of future you's upcoming moments. For weekly letters, your iPhone also sends Debut's server your average calories, your calorie floor, how much your weight trend changed that week and your planned pace. The server works out whether your logged calories are under your floor and whether your weight trend is behind pace or changing fast, and sends Anthropic those answers and your calories, never the weight numbers; it keeps none of them. If you've chosen plans only, no calorie or weight information goes to Anthropic. Claude uses all this to write your nudges, check-ins and weekly letters. Without that consent, nudges and weekly letters use Debut's built-in lines.

Meal estimates and barcodes

With your consent to share, the meals you type, say or photograph go through Debut's server to Anthropic, which estimates what's in them. Without that consent, or when Debut's server can't be reached, Debut estimates the meals you type or say on your iPhone, from its built-in food list and, on iPhones with Apple Intelligence turned on, Apple's on-device model, and nothing is sent. Estimating a meal photo needs the consent to share. Debut doesn't save meal photos, and nothing is logged until you confirm.

When you scan a barcode, only its digits go to Debut's server, which looks the product up in Open Food Facts, a public food database. Barcode lookups need only your consent to collect. The server keeps each lookup for up to a day, by its digits only, and its request log doesn't say which product you looked up.

Your monthly recap

The monthly recap, part of Debut Premium, is made on your iPhone from your month. If you tap Share video, Debut makes the video on your iPhone, with an "AI" label on every frame and an end card that says "Made with Debut. Images and voice are AI.", and opens the share sheet. Debut doesn't upload it: where it goes is up to you. The file is removed from the app's temporary folder when the recap closes.

Debut Premium

Apple sells and bills Debut Premium, and Debut never sees your payment details. Your iPhone checks with Apple whether you have Debut Premium. With each message to future you, it tells Debut's server whether you do. Debut's server never receives your purchases or payment details.

Usage counts

So we can learn which features help, the app sends Debut's own server counts of which screens and features you use, such as finishing setup or starting a call, with the day and the app's version. Once you've confirmed your age they carry a random ID that the app makes on your iPhone; before that they carry no ID at all. The ID isn't tied to your name, Apple ID, device or advertising ID, and the server doesn't record your IP address with the counts. They never include health data: nothing about your weight, body, meals, workouts or Apple Health, no photos, nothing of your voice, nothing you say or send to future you, and not whether you logged any of them. They go only to Debut's server, never to another company, and we delete them 90 days after they're sent. They're on unless you turn off Share how I use Debut in Profile › Privacy & data; then the app stops sending them, forgets the ID and asks the server to delete what it received with it.

With a separate yes, which only test builds ask for at the moment, Debut's server also counts that you logged your first meal and your first workout, and each plan you keep, each with the day, so we can learn which first days keep people going. Never what you ate, your weight, a workout's details, photos, your voice, your words or Apple Health data, and only with the same random ID. Turning it off in Profile › Privacy & data deletes what the server received, and we delete these counts after 90 days anyway.

What Apple sends us

If you've turned on Share With App Developers in your iPhone's Analytics & Improvements settings, Apple sends us crash reports and app usage statistics, which Apple doesn't tie to you. In TestFlight, Apple also sends us the feedback, screenshots and crash reports you choose to send, with the name and email address TestFlight has for you.

Beta testers

TestFlight builds of Debut connect to Debut's server with a tester token, kept in your iPhone's Keychain, and Debut's server logs your tester name, instead of the random ID, with each request. Usage counts work the same as in App Store builds: they carry the random ID, not your tester name. We delete what we hold about testers within 30 days after the beta ends.

No ads or tracking

The app contains no advertising, analytics, attribution or tracking software from other companies. It doesn't use Apple's advertising identifier, it never asks to track you, and it doesn't ask for or use your location.

What Debut's server and studio keep

  • Debut's server, hosted by Vercel, passes requests on to Anthropic and to Debut's studio, and doesn't store what you send. Requests from the app carry the app's random ID (in beta builds, your tester token), so the server can apply daily limits and stop abuse. For each request, the server logs the time, that ID (in beta builds, your tester name), the feature, the studio job's number if there is one, how long it took and whether it worked or the AI declined to answer, never the content. Vercel processes your IP address to deliver the request, and keeps these logs for at most 30 days. The server also keeps counters for rate limits (for an hour) and daily limits (until midnight UTC).
  • Release records. When a studio job relies on your face or voice release, Debut's server records which release it was, its version, when you agreed to it on your iPhone, and when and how many jobs relied on it, with the app's random ID (in beta builds, your tester name). It holds nothing biometric and nothing you made. It's our record that you agreed, so it stays after Delete everything, and we delete it 5 years after the last job that relied on it.
  • Debut's studio is Debut's own software, running open AI models on a GPU server rented from Vast.ai, in the United States. It deletes the photos, recordings and details it receives when each job ends, and what it makes within an hour. Photos are re-saved without their metadata, such as where they were taken, before they're used. Your iPhone downloads what the studio made straight from the studio's server, through links that work for 10 minutes, so that server receives your IP address; the studio doesn't log it. The studio's logs contain no content.

On this website

The letter

The letter form at heydebut.com/letter asks three things: what you want to be able to do, why it matters, and how many days a week you can give it. Your answers go through our server to Anthropic, whose Claude model writes the letter. Debut doesn't store them, and Anthropic keeps them for up to 30 days, or up to 2 years if its safety systems flag it. The form asks you not to include health details, and Debut's server turns back answers with common health words before anything goes to Anthropic. It can't catch everything, so please leave health details out.

The email list

If you ask for your letter and plan by email, we store your email address, your confirmation that you're 18 or older, your consent to emails and the version of its wording, the campaign tag on the link that brought you here, and when you signed up, confirmed or unsubscribed. Nothing else is sent until you confirm your address from the first email. We don't store your letter: it travels encrypted inside the confirmation link. Once you confirm, Resend emails it to you, so Resend processes that email, with your letter and any words of yours it quotes, and keeps it for 30 days, as it does every email it sends. Every email carries a working unsubscribe link. If you ask us to email you the download link, we send one email and don't keep your address.

The beta application

The beta sign-up asks for your email and for you to confirm that you're 18 or older and live in the US. We send one email to confirm your address and store nothing until you tap its button. For now, while our email service is being set up, we save your sign-up when you send the form instead, and email you to confirm it once email is working. Then we store your email, the campaign tags on your link, when you confirmed and the version of the wording you agreed to, and we get an email telling us you signed up, with your email address, where you came from and when. After confirming, you can add, or skip, your iPhone model and iOS version, the tracks you're interested in and your training experience. We use them to decide who joins the beta and to invite you. If you're picked, we give your email address to Apple's TestFlight, so Apple can send your invitation.

Technical information

Vercel, our host, processes your IP address and basic request details to serve the site. To limit abuse, we store a keyed hash of your IP address, and of your email address when you sign up, never the addresses themselves, and delete them after two days. Campaign tags in links are read on our server. The site keeps its own daily totals of page views, taps on its download buttons, trips to the App Store from the site and scans of its QR code, each with the page or button and the campaign tag on the link that brought the visitor. They're totals only: no cookie, IP address, device or visitor ID is part of them, and we delete them after 400 days. To keep one visitor from inflating them, the server counts requests for a minute in memory, by a hash of the IP address and browser that can't be turned back into either, and stores nothing. The site sets no cookies, and has no ad pixels, analytics from other companies, session recording, chat widgets or third-party scripts; its fonts, images and videos come from this site. The one exception is Vercel's: if it has to check that a visitor is a person during an attack on the site, it sets a security cookie that remembers the check passed. If you close the offer bar, your browser remembers that on your device so it stays closed; it isn't sent to us.

Who receives information

We don't sell personal information, and we don't share it for advertising. These service providers handle it on our behalf, only to provide Debut, each under a contract that limits them to that use and requires them to protect it at least as well as this policy does:

  • Anthropic (AI text): future you's replies, with the photos you send in messages, nudges, check-ins, weekly letters and meal estimates in the app, and letters on this website, with the information described above. Under Anthropic's published terms for its API, it keeps what Debut sends for up to 30 days, or up to 2 years if its safety systems flag it (and its safety scores for up to 7 years), and it doesn't train its models on it.
  • Vast.ai (GPU servers): Debut rents the GPU server that runs Debut's studio from Vast.ai. The studio receives your photo crops, voice recording and the details described above, and deletes them on the schedule above.
  • Vercel (hosting): runs Debut's server and this website.
  • Neon (database): stores the website's email list and beta applications.
  • Resend (email): sends the website's emails, including your letter.

Apple, under its own terms, sells and bills Debut Premium and sends TestFlight invitations, and on your iPhone it runs Apple Health, its on-device model and its speech recognition, which on an iPhone that can't recognize speech on the device sends the audio to Apple.

Anthropic is the only AI company that receives anything from Debut: no other AI provider is used. Debut's server also asks Open Food Facts about barcode digits, without any information about you. We disclose information when the law requires it, or to protect someone's safety. If Debut is sold or merged, the information goes with it and this policy keeps applying to it; biometric information is never part of such a transfer, because we destroy it on the schedule in Biometric information.

Biometric information

Some of Debut's features measure your face or voice. Laws in Illinois, Texas, Washington, Colorado and elsewhere call these measurements biometric identifiers or biometric information (face geometry and voiceprints). Debut follows Illinois' Biometric Information Privacy Act for everyone, wherever you live. This section is Debut's written policy for them, including how long they're kept and when they're destroyed.

What Debut measures

  • Your face, on your iPhone. After you agree to the face release, Apple's Vision framework, running on your iPhone, measures faces: to tell which face is yours when you crop a photo with other people in it, and to blur anyone else in what the studio makes. The measurements exist only in memory during each check, and aren't saved or sent anywhere.
  • Your face, in the studio. While making your images and clips, Debut's studio measures your face from your photo crops, to keep your likeness and check that each picture and clip is you. An AI model there also describes your hair, facial hair, smile and eye color in words, to write and check the images. When the studio makes a clip, it measures the faces in the clip and in the image the clip starts from, to keep yours sharp and blur anyone else.
  • Your voice, in the studio. Each time future you speaks in your voice, Debut's studio measures your voice from your recording (a voiceprint).

Your release

Debut measures your face only after you agree to its face release, and your voice only after you agree to its voice release, each on its own screen with a switch that starts off. Each release says what's measured, why, who receives it and how long it's kept, and you agree by turning the switch on. Your answer is saved on your iPhone with the release's version and the time. Every studio job carries it, and Debut's server refuses a job without it and keeps the release record described above.

How we handle it

  • Only for future you. It's used only to make and check future you's images, clips and voice for you. It's never used to identify you to anyone, and never for ads or to train AI.
  • Never sold or profited from. We never sell, lease or trade it, or otherwise profit from it. Debut Premium charges for features, not for biometric data: the same measurements are made whether or not you pay.
  • Who receives it. Only Debut's studio, on the GPU server Debut rents from Vast.ai. We disclose it to no one else, unless a law, a warrant or a subpoena requires it.
  • Security. It travels encrypted, is processed only in memory on a server that requires an access token, never appears in logs, and is protected at least as carefully as the other confidential information we hold.
  • If something goes wrong. If we learn of a security incident that could have exposed biometric data, we'll contain and investigate it, and tell the people affected, and the regulators the law requires, without unreasonable delay and within 30 days, saying what happened and what they can do.

Retention and destruction schedule

We permanently destroy biometric identifiers and biometric information as soon as the purpose for collecting them is met, which is right after each use, and in every case within 3 years of your last interaction with Debut:

  • Face measurements on your iPhone: destroyed when each check ends, within seconds.
  • Face measurements and descriptions in the studio: kept only in memory, and destroyed when each studio job ends.
  • Voice measurements in the studio: kept only in memory while the lines they're made for are said, and destroyed right after, never more than 2 minutes after they're made.
  • Delete everything: destroys at once everything Debut keeps on your iPhone, and tells the studio to delete any job still there.
  • What they're made from: your photo crops and your recording aren't biometric identifiers themselves. On your iPhone, they stay until you delete them, turn off their release or tap Delete everything, and if Debut goes unused for 3 years, Debut deletes them the next time it opens. In the studio, they're deleted when the job ends (the recording as soon as the speech is made), and everything from a job within an hour.

Children

Debut is for people 18 and older, and its App Store age rating is 18+. It isn't directed to children, and we don't knowingly collect personal information from anyone under 13, or from anyone under 18 through the app. If your birthday shows you're under 18, setup stops and nothing you typed is saved. This website's email list and beta are for adults 18 and older. If you think someone under 18 has given us information, email privacy@heydebut.com and we'll delete it.

Your choices and rights

In the app, under Profile › Privacy & data:

  • Withdraw a consent or release: to collect, to share, the face release or the voice release. Withdrawing stops what comes next. Turning off the face release deletes the photos you chose for future you, and turning off the voice release deletes your recording and everything made with it.
  • Turn off usage counts.
  • Export my data: a file with your profile (name, birthday, height, weights, goal, pace and track), weigh-ins, meals, workouts, plans kept and if-then plans, your messages with future you, when your calls happened and how long they lasted, your first-week steps, and each consent answer with the words you agreed to. It notes that a recording exists. Your photos, the images, clips and voice lines made for you, and the recording stay in the app, where you can see them.
  • Delete everything: deletes your Debut data from your iPhone, including your photos, recording, messages and everything made for you; removes the calendar events Debut added; tells Debut's studio to delete any job still there; and starts setup over. It keeps the reminder before a free trial ends, so you aren't charged by surprise. It can't delete what Debut saved to Apple Health (remove it in the Health app), what Anthropic received (Anthropic keeps it for up to 30 days, or up to 2 years if its safety systems flag it), the release records and request logs on Debut's server (kept as "How long we keep it" says), or anything you shared yourself.

You can also change the Apple Health, camera, microphone, speech recognition, calendar and notification permissions in Settings. Deleting the app deletes what it kept on your iPhone, except a beta tester token in the Keychain, the events it added to your calendar and what it saved to Apple Health. To remove the events too, use Delete everything first.

By email, at privacy@heydebut.com, you can ask to see, correct or delete what we hold about you, get a copy of it, or withdraw a consent. For the app, we hold nothing about you beyond request logs, release records and usage counts, which carry only the app's random ID, and, for beta testers, your tester name; we'll tell you if that's all we have. For the website, we'll ask you to write from the email address you used, to confirm it's you. We confirm we got your request within 10 business days and answer within 45 days, and we can extend that once by 45 days when we need to, telling you why.

Rights where you live. Depending on where you live (including California, Colorado, Connecticut, Oregon, Texas, Virginia and other states), you have the right to know what personal information we collect, use and disclose; to access it and get a copy; to correct it; to delete it; to opt out of its sale, of sharing for targeted advertising and of profiling; and to limit the use of sensitive personal information. We offer these rights to everyone. We don't sell or share personal information, or use it for targeted advertising or profiling, and we use sensitive personal information only to provide the features you ask for. We won't treat you differently for using your rights. An authorized agent can make a request for you with your signed permission, and we'll ask you to confirm it.

Global Privacy Control. Because we don't sell or share personal information, there's nothing for a Global Privacy Control signal to opt you out of, and the app and this website work the same with it on.

Do Not Track. Debut doesn't track you across other companies' apps or websites, and no other company can collect information about your activity on Debut over time or across other sites or apps. So the app and this website work the same whether or not your browser sends a Do Not Track signal.

Appeals. If we decline your request, you can appeal by replying to our answer. We'll answer your appeal within 45 days, and if we deny it, you can contact your state's Attorney General.

Notice for California residents

This section is also our notice at collection: the app's consent screens and this website's forms link to this policy before anything is collected. In the last 12 months, Debut collected the categories of personal information below. We didn't sell any of it or share it for cross-context behavioral advertising, and we don't sell or share the personal information of anyone under 16. We use sensitive personal information only to provide the features you ask for, as California's rules allow, so we don't offer a separate "Limit the use of my sensitive personal information" link.

Identifiers

  • What: your email address (on this website), your IP address, the app's random ID and, in beta builds, a tester token and tester name.
  • Where it comes from: you, your iPhone and your browser.
  • Why: to deliver requests, limit abuse, send the emails you ask for, run the beta and count how Debut is used.
  • Who receives it: Vercel; Vast.ai, whose server sees your IP address when your iPhone downloads from the studio; Neon; Resend; and, for TestFlight invitations, Apple.
  • How long we keep it: your email until you unsubscribe, then a record that you did; the hashed IP address and email for two days; request logs at Vercel for at most 30 days; usage counts for 90 days; release records until 5 years after the last job that relied on them; tester names until 30 days after the beta ends.

Customer records

  • What: your first name and, on this website, your email address.
  • Where it comes from: you.
  • Why: to put your name in your plan and in future you's words, and to email you.
  • Who receives it: with your consent to share, Anthropic (your first name); Neon and Resend (your email address).
  • How long we keep it: on your iPhone until you delete it; at Anthropic, for up to 30 days, or up to 2 years if its safety systems flag it; your email address as Identifiers says.

Characteristics of protected classifications

  • What: your age, from your birthday, and your sex.
  • Where it comes from: you, or Apple Health if you connect it.
  • Why: to set up your plan and make future you's images.
  • Who receives it: with your consent to share, Debut's studio, on Vast.ai's server.
  • How long we keep it: on your iPhone until you delete it; at the studio, under an hour.

Health information (sensitive)

  • What: your weight, height, goal, meals, workouts, plans kept and Apple Health data in the app, and what you tell future you about your health. The website collects none.
  • Where it comes from: you, your iPhone (which works out your trend and the plans you kept), and Apple Health if you connect it.
  • Why: to provide your plan and Debut's features, and to run the beta.
  • Who receives it: with your consent to share, Debut's studio (on Vast.ai's server) and Anthropic, as this policy describes, through Debut's server on Vercel, which keeps none of it.
  • How long we keep it: on your iPhone until you delete it; at the studio, under an hour; at Anthropic, for up to 30 days, or up to 2 years if its safety systems flag it.

Biometric information (sensitive)

  • What: the face and voice measurements described in Biometric information.
  • Where it comes from: made from the photos you choose and your recording.
  • Why: only to make and check future you's images, clips and voice.
  • Who receives it: only Debut's studio, on Vast.ai's server.
  • How long we keep it: in memory only, destroyed right after each use, as the schedule in Biometric information says.

Audio, electronic and visual information

  • What: the photos you choose for future you, the photos you send future you, meal photos, your voice recording, and the images, clips and voice made from them.
  • Where it comes from: you; Debut's studio makes the images, clips and voice.
  • Why: to make future you, to answer your messages and to estimate meals.
  • Who receives it: your photo crops and recording go to Debut's studio, and the photos you send future you and meal photos go to Anthropic, all through Debut's server on Vercel, which keeps none of them.
  • How long we keep it: on your iPhone until you delete it (meal photos aren't kept); at the studio, under an hour; at Anthropic, for up to 30 days, or up to 2 years if its safety systems flag it.

Internet or other electronic network activity

  • What: requests to Debut's server and this website, and usage counts.
  • Where it comes from: your iPhone and your browser.
  • Why: to run and secure Debut, and to learn which features help.
  • Who receives it: Vercel.
  • How long we keep it: rate-limit records for an hour; daily counts until midnight UTC; request logs for at most 30 days; usage counts for 90 days.

Commercial information

  • What: whether you have Debut Premium.
  • Where it comes from: Apple, through your iPhone.
  • Why: to turn on Debut Premium and apply the right daily allowance.
  • Who receives it: no one. Apple has your purchase, and we don't receive it.
  • How long we keep it: on your iPhone. Debut's server sees it only with each message to future you, and doesn't keep it.

Inferences

  • What: whether your weight trend is behind pace or changing fast, and whether your logged calories are under your floor, worked out from your logs; and checks of what you say to future you for signs of a crisis or of struggling with food, your body or your mood.
  • Where it comes from: your iPhone and Debut's server, from your logs and what you say; Anthropic's model also flags messages that suggest you might be in danger.
  • Why: only to write your weekly letters and to point you to help.
  • Who receives it: with your consent to share, the letter's flags go to Anthropic.
  • How long we keep it: the letter's flags aren't kept after each request; the checks aren't kept, apart from a count with nothing about you.

Your California rights. You have the right to know what personal information we collect, use and disclose; to access it and get a copy; to correct it; to delete it; to opt out of its sale or sharing; and to limit the use of sensitive personal information. Use them in the app, in Profile › Privacy & data, or by emailing privacy@heydebut.com, as "Your choices and rights" describes. We won't treat you differently for using them, and an authorized agent can ask for you. We don't share personal information with other companies for their own direct marketing. We review this policy at least once every 12 months.

How long we keep it

  • On your iPhone: until you delete it. The photos you chose and your recording also go once Debut has gone unused for 3 years.
  • Debut's studio: what it receives, until each job ends; what it makes, up to an hour; face and voice measurements, as Biometric information says.
  • Debut's server: no content; request logs at Vercel for at most 30 days; rate-limit records for an hour; daily counts until midnight UTC; barcode lookups for up to a day; usage counts for 90 days; release records until 5 years after the last job that relied on them; tester names until 30 days after the beta ends.
  • Anthropic: for up to 30 days, or up to 2 years if its safety systems flag it, and its safety scores for up to 7 years.
  • This website: letter answers aren't kept by us. Unconfirmed email sign-ups are deleted after 30 days. The email list is kept until you unsubscribe, and then we keep a record that you did, so we don't email you again. Resend keeps each email it sends for 30 days. Beta applications are kept until the beta ends, then deleted within 90 days, or sooner if you ask us or withdraw your consent. Hashed IP addresses and email addresses are kept for two days.

Security

Information travels encrypted (HTTPS). Debut's server and studio accept requests only with an access token, except the studio's download links, which are signed and stop working after 10 minutes. On your iPhone, Debut's data is protected by iOS, and the tester token is kept in the Keychain. Confirmation links in our emails carry a one-time code that we keep only as a hash, and unsubscribe links are signed. No system is perfectly secure. If we learn of a breach that affects your information, we'll tell you, and the regulators the law requires, without unreasonable delay.

Where information is processed

Debut is run from the United States. Debut's server and this website run on Vercel in the United States, and Neon and Resend keep the website's data in the United States. Debut's studio runs on a GPU server rented from Vast.ai in the United States. Anthropic processes requests in its own and its cloud providers' data centers, under its commercial terms. If you use Debut from outside the United States, your information goes to these places.

Changes to this policy

When this policy changes, we'll post the new version here and update the dates at the top. If a change affects what we collect, share or keep, or your rights, we'll tell you in the app or by email before it applies. Debut won't collect or share your information in a new way without asking for your consent first. A consent you gave in the app counts only for the words you agreed to: when those words change, the app asks you again before anything more is sent.

Contact

Punch LLC, [ADDRESS]. Email privacy@heydebut.com.

Usage counts. We count how the app is used (for example, that setup was finished or a call started), using a random ID that isn't linked to your name, and never with your health data. We don't use third-party analytics. We delete these counts within 90 days. You can turn this off in Profile › Privacy & data.