Privacy Policy

1. Who we are

NowWhat is made by Waypoint Systems LLC, Germantown, Tennessee, United States. Waypoint Systems LLC decides what information NowWhat collects and why, which makes it the controller of that information.

This policy covers the NowWhat iPhone app, the web app at app.getnowwhat.app, and this site.

Write to us at support@getnowwhat.app about anything in this policy.

2. What you give us, and why

What you track in NowWhat, your checklist, your notes, your progress, and the details you give about your situation, is saved on your device and in your NowWhat account. That includes the stage of care, the state and county you are in, the kind of insurance involved, medications you record, the Plan Ahead checklist, and anything you type into a note.

We use it for one thing: to run the guide. It decides which stage you see, what Morgan knows about your situation when you ask a question, and which state rules are looked up for you.

Some of what you enter describes another person's care. We treat that as sensitive, we never sell it, and we never use it for advertising. NowWhat is not a healthcare provider and is not covered by HIPAA, so what you write here is not a medical record.

3. Your account

NowWhat creates an account for you the first time you use it, without asking for a name, an email, or a password. That account is an identifier and nothing more.

If you add an email address, we use it to send you a sign-in link so your notes follow you to another device and come back if you lose your phone. There is no password, so there is none for us to store or for anyone to steal.

If you subscribe, we record that you have an active trial or subscription and which plan it is. Payment happens through Apple, and Apple does not give us your card details.

4. What Morgan sends

When you ask Morgan something, your question goes to Anthropic, the company whose AI writes Morgan's answers, along with your state and county, insurance, stage of care, and Plan Ahead progress.

Anthropic deletes it within 30 days and does not use it to train its AI, keeping it longer only if its safety systems flag it or the law requires it. We keep no copy of your questions on our servers.

Morgan's answers stay on your device, and in the iPhone app your recent questions stay with them so you can read them without a signal. Both are removed when you sign out or delete your data. The Medicaid details Morgan looks up for you are saved to your account so you do not have to wait for them twice.

Answers to questions that are the same for everyone in a place, such as the Medicaid rules for a county, are kept on our server so the next person asking does not wait. Those are stored under the place and the question type only. Nothing you typed is stored with them and nothing personal is in them.

5. Keeping out bots

When NowWhat signs you in or sends you a sign-in link, a check from Cloudflare, called Turnstile, confirms a person is using the app rather than a program. It looks at your device's internet address and browser and connection details, never anything you type.

Cloudflare also keeps those signals to improve its bot detection, and says it cannot identify you from them.

6. How we learn what helps

We count how the app is used, such as which screens are opened and which buttons are tapped, with PostHog, and on the web also with Vercel. That never includes recordings of your screen, and it never includes anything you type.

We do not use advertising trackers, we do not track you across other apps or websites, and NowWhat carries no advertising.

7. The companies that handle information for us

These are the only companies that see any of it, and each one only sees what its job needs. All of them process it in the United States.

• Supabase: your account and the data you save, stored and locked to your account.
• Anthropic: the question you ask Morgan and the context above, to write the answer. Deleted within 30 days, never used to train its AI.
• Cloudflare: the bot check at sign-in, which sees connection details and nothing you type.
• PostHog: counts of screens opened and buttons tapped.
• Vercel: hosting for the app and the website, and the same kind of counts on the web.
• Resend: delivery of your sign-in emails.
• Apple: your purchase, if you subscribe on an iPhone. Apple bills you and handles refunds under its own terms and privacy policy.

8. What we never do

We never sell your information. We never share it with advertisers or data brokers. We never use what you write to train an AI model. The only companies that handle it are the ones named above, and only to run NowWhat.

NowWhat does not ask for or store your passwords. For those we point you to the password manager already built into your phone, Apple Passwords or Google Password Manager, which is encrypted and shareable with family on your terms.

9. How long it is kept

What you save stays until you delete it. There is no expiry and no clean-up that removes your notes behind your back.

When you use Delete All My Data, your checklist, notes, progress, and everything you told Morgan are removed from the device and from your account straight away, and your other devices clear their copies the next time they open. When you use Delete my account, the account itself goes with them. We remove both from our systems and from routine backups within 30 days.

Your questions at Anthropic are deleted within 30 days as described above. Sign-in emails leave a delivery record with Resend for a short period so we can tell whether a link was sent. Counts of screens opened and buttons tapped are kept under our settings with PostHog and Vercel, are not tied to your notes or your questions, and are not used to identify you.

10. Deleting your information, and your choices

Settings, then Delete All My Data, removes what you entered. Settings, then Account, then Delete my account, removes the account as well. Neither needs our help and neither can be undone.

You can use NowWhat without giving an email at all. If you added one, you can ask us to remove it.

Depending on where you live, you may also have the right to ask what we hold about you, to receive a copy, to correct it, or to ask us to delete it. Write to support@getnowwhat.app and we will do it, and we will not charge you or treat you differently for asking.

11. Children

NowWhat is for adults looking after someone. It is not directed to children, and we do not knowingly collect information from anyone under 13. If you believe a child has given us information, write to support@getnowwhat.app and we will delete it.

12. Security

Everything travels over an encrypted connection. Your account data is held by Supabase with access rules that limit each account to its own rows, and access to our systems is limited to the people who run NowWhat.

No system is perfect, and we will not pretend otherwise. If something happens that affects your information, we will tell you and say what we know.

13. Changes to this policy

If this policy changes we will post the new version here with a new effective date. If the change matters to what happens to your information, we will tell you in the app rather than expecting you to check.

14. Contact

Waypoint Systems LLC, Germantown, Tennessee, United States. support@getnowwhat.app.