Effective November 10, 2026 · Version 2026-11-10.1
Google sign-in provides an account identifier and email address; we do not request Gmail access. We store a session token hash, email, account identifier, expiration, and temporary sign-in security information. When you save, we store the protocols, injection logs, inventory, measurements, schedules, and notes you submit. We also store the accepted Terms version, your account identifier, and a server-recorded acceptance time.
We use this information to authenticate you, keep account records separate, store and retrieve your profile, record agreement to the Terms, and operate and secure the service. Personal records are not placed in the public library merely because you save them. The current app does not implement advertising trackers or sell saved health records.
Cloudflare hosts the service and D1 database; Google provides authentication. These providers may process operational information under their own policies, including connection details and logs. Processing may occur outside your location. Cloud profiles are not end-to-end encrypted; Dragonlim and authorized service providers may technically access stored information as needed to operate the service, respond to requests, or comply with law. The service is not represented as a HIPAA-compliant medical-record system.
A Secure, HttpOnly sign-in cookie keeps you signed in for up to seven days. A short-lived authentication cookie and server record protect sign-in. If you edit a sample while signed out, the app can temporarily keep the unsaved protocol form in this tab’s session storage and restore it after login; restoration expires after thirty minutes. Earlier versions may have left guest records in browser local storage. Signed-in records are kept in page memory until explicitly saved to cloud and are not written to guest local storage by this version. Exported backups are files you control.
Cloud profiles are retained until deleted or the service is discontinued, subject to legal and backup limitations. Expired session and temporary sign-in records are cleaned during subsequent sign-in activity. Sign-out invalidates the current session. You can export your data in Settings. To request access, correction, or deletion of your stored account records, contact [email protected] from your account email; we may verify identity before acting. Provider backups or records required by law may persist for a limited period. Do not include sensitive records in your initial email request.
We use account-scoped access checks, protected session cookies, and version checks on saves. No online system guarantees confidentiality or availability. Secure your Google account, avoid shared-device exposure, and maintain backups. The app is for adults eighteen and older; do not submit children’s records.
Material changes will be described in an updated notice. Contact Andy Lim, operator of Dragon Optimize under Dragonlim, at [email protected] for privacy questions. Effective November 10, 2026.