Privacy policy

Who this covers

Axis is operated as a personal project by Nathan Horowitz. It is invite-only and in beta. If you are using it, someone gave you a code. Questions go to nhorowitz@pm.me.

What Axis stores

• Account details. Your email address and a password hash, handled by Supabase Auth. Axis never sees your password.
• Workspace data. Everything you type into Axis: tasks, projects, notes, events, goals, transactions, contacts, decisions, bookmarks, media, prompts, and schedule blocks.
• Health data. If you turn on Health: workouts and sets, meals and macros, sleep, weight and measurements, progress photos, recovery sessions, injuries, symptoms, supplements and medications you record, blood panel values you enter, and your circadian profile.
• Photos. Meal photos and progress photos are stored in a private Supabase storage bucket, namespaced to your user id.
• An audit log. A timestamped record of actions taken in your own workspace, visible only to you.

Axis does not use analytics, tracking pixels, advertising identifiers, or third-party cookies. The only cookies set are the session cookies Supabase needs to keep you signed in.

Where it lives

Most of Axis is local-first: your workspace is held in your browser’s local storage and mirrored to a Supabase Postgres database so it follows you between devices. Health is the exception — it is stored only in Postgres, because a training log has to be identical everywhere and would drift badly if it were cached locally.

Every table uses row-level security keyed to your user id. Another signed-in user cannot read your rows even if they know their ids.

The AI assistant

When you use the assistant, a food photo, the program generator, or the lab explanation, the relevant content is sent to OpenRouter, which routes it to Google’s Gemini 3.6 Flash. That includes whatever you typed, the page context Axis attaches, and any file or image you attached.

Axis does not send your whole workspace. It sends the specific data the feature needs — for a lab explanation, the marker values and ranges; for a training program, your goals, equipment, and injuries. You can turn off automatic page context in Settings.

Model providers have their own retention policies, which Axis does not control. Treat anything you send to the assistant as leaving your own database. If something is too sensitive for that, don’t put it in a prompt.

Other services

• Supabase — database, authentication, and file storage.
• Vercel — hosting. Vercel keeps standard server logs, which include IP addresses.
• OpenRouter and Google — the AI model, as described above.
• Web search — when you ask the assistant to search, your query goes to a search provider.

Health data specifically

Health entries — including anything you record about medications, symptoms, or lab results — are treated as ordinary user data in your own database. Axis is not a covered entity, this is not a HIPAA-regulated service, and no clinical safeguards apply beyond the access controls described above. Record what you’re comfortable recording.

Axis is not a medical device. Nothing it displays or generates is medical advice, a diagnosis, or a treatment recommendation.

Your control

• Export. Settings has a one-click JSON export of your whole workspace.
• Delete. Clearing your data in Settings wipes the workspace. To delete your account and every row attached to it, email nhorowitz@pm.me and it will be removed.
• Correct. Everything in Axis is editable by you, directly.

Retention

Data is kept until you delete it or ask for your account to be removed. There is no automatic expiry. Backups may persist for a short window after deletion before rotating out.

Children

Axis is not intended for anyone under 16 and is not knowingly offered to them.

Changes

If this policy changes in a way that affects how your data is handled, the change will appear in the changelog and the date at the top of this page will move.