Privacy policy
How Parkday collects, uses, and protects your personal information.
1. Introduction
This Privacy Policy ("Policy") outlines the practices of Parkday, Inc. ("Parkday", "we", "us", or "our") regarding the collection, use, disclosure, and protection of personal information obtained through the Parkday platform, including our website located at https://heyparkday.com, mobile applications, and all other related services (collectively, the "Service"). This Policy is incorporated by reference into our Terms of Service.
By accessing or using the Service, you agree to the terms of this Policy and consent to the collection and processing of your information in accordance with this Policy and applicable laws.
2. Information We Collect
2.1 Account and Identity Verification Data
We collect personal information necessary to register and authenticate users through Google Single Sign-On (SSO), including:
- Full name
- Email address
- Profile metadata (e.g., photo)
We do not collect or store your Google SSO password.
2.2 Dietary Preferences and Allergy Data
Users may voluntarily provide dietary preferences, food allergies, or exclusions ("Dietary Data"). We use Dietary Data to tailor menu recommendations and flag potential allergens.
To generate these recommendations, Dietary Data may be processed by third-party service providers acting on our behalf, including cloud AI providers (e.g., Microsoft Azure OpenAI Service). These providers process Dietary Data solely to deliver the Service, under contractual confidentiality and security obligations, and are prohibited from using your data to train their models or for any purpose of their own.
Dietary Data is not shared with restaurants in identifiable form, is not used for advertising, and is not sold.
2.3 HealthKit & Apple Health (Food/Nutrition Only)
Scope. Connecting Apple Health ("HealthKit") to Parkday is optional. We only access Health data after you grant explicit permission.
Health Data We Access (Read & Write). With your permission, Parkday may read and write the following HealthKit nutrition data types:
- Dietary Energy (calories)
- Dietary Protein
- Dietary Carbohydrates
- Dietary Fat (total)
Parkday does not access steps, heart rate, or other HealthKit categories at this time.
Purpose of Use. Solely to: (i) display your nutrition/dietary history, (ii) track goals and trends you request (calories/macros), and (iii) improve the accuracy of in-app nutrition insights and logging. We do not use Health data for advertising, marketing, or profiling, and we do not sell Health data.
No Analytics or AI Processing of Health Data. HealthKit-derived data is never sent to our analytics providers (including PostHog and Mixpanel) or to third-party AI providers. It is processed only on your device and on Parkday's own servers to operate the features described above.
Consent & Control. Manage permissions in Settings → Health → Data Access & Devices → Parkday (or in the Health app). You can revoke permissions or disconnect HealthKit in-app; Parkday will stop accessing Health data when disconnected.
Processing. Parkday calculates your meal macros and writes them to Apple Health via HealthKit. If you enable reading, Parkday will read only the nutrition types you permit. HealthKit data may be transmitted to Parkday's servers solely to operate these features, is encrypted in transit and at rest, and can be revoked anytime in iOS Health settings.
Third-Party Sharing. No sharing of Health data with advertisers, data brokers, analytics providers, AI providers, or social networks. Cloud hosting providers acting on our behalf may store Health data under confidentiality and security obligations, solely to deliver the Service. Any sharing beyond such processors occurs only with your separate, explicit consent identifying the data and purpose.
Retention & Deletion. We retain Health-derived data only as needed to provide enabled features. Request deletion by emailing app@heyparkday.com or by deleting your account; we will remove Health-derived data from our servers within a reasonable period, subject to legal obligations.
Security. Health data is encrypted in transit (TLS) and at rest. Access is limited to personnel with a business need.
Accuracy & Medical Use. Parkday is not a medical device and does not provide medical advice. Do not rely on Parkday for diagnosis or treatment decisions.
Legal & Compliance. Parkday is not a HIPAA-covered entity. Our handling of HealthKit data is governed by this Policy, Apple's HealthKit terms, and applicable laws.
2.4 Technical and Usage Data
We automatically collect technical information about your use of the Service, including:
- IP address and approximate location
- Browser and device information
- Operating system details
- Page/feature interaction data and session duration
2.5 Analytics and Tracking Technologies
We use cookies and product analytics tools — currently PostHog and Mixpanel — to maintain session integrity, understand feature usage, diagnose issues, and improve the Service.
Analytics data consists of usage events and technical data (Section 2.4). Health data (Section 2.3) is excluded from analytics. We do not use analytics for advertising or sell analytics data. You may disable cookies via your browser settings.
On our public marketing website, we also use a visitor-identification service (Claydar) that collects technical data described in Section 2.4 to help us understand which companies are visiting our site and to follow up with prospective customers. This tool runs on our public marketing pages only — it is not present inside the logged-in Service — and it never receives Dietary Data or Health data.
2.6 Information You Submit Through Our Website
If you request a trial, book a demo, contact us, or unlock content on our marketing website, we collect the information you submit — such as your name, work email address, company, team size, and anything you include in a message. We use this information to respond to you, to provision the demo or trial you requested, and for related sales follow-up. It is processed by service providers that deliver these features on our behalf (for example, email delivery and scheduling). Some website forms are protected by Cloudflare Turnstile, a bot-protection service that processes technical data (Section 2.4) to distinguish people from automated traffic.
3. Purposes for Data Use
Your personal data may be used for the following purposes:
- Operating and maintaining the Service
- Personalizing your experience, including AI-assisted menu recommendations and allergen flagging
- Responding to inquiries and demo or trial requests
- Fulfilling obligations to employer clients
- Ensuring platform security
- Conducting analytics and diagnostics
- Complying with legal obligations
We do not use your data for advertising, and we do not sell your data.
4. Data Sharing and Disclosure
We do not sell your data. We share personal information only:
- With service providers acting on our behalf under confidentiality and security obligations, limited to what is needed to deliver the Service. Current categories: cloud hosting and infrastructure, product analytics (PostHog, Mixpanel), website visitor identification (Claydar), email delivery and scheduling, and AI processing for recommendations (e.g., Microsoft Azure OpenAI Service). AI providers are contractually prohibited from using your data to train their models.
- As required by law or court order
- In the event of a corporate transaction (e.g., acquisition)
- With your express consent
Health data is never disclosed to analytics or AI providers, never used for advertising, and never sold.
5. Data Retention
We retain personal data as long as necessary to provide the Service or as required by law. Deletion requests can be sent to app@heyparkday.com.
6. Your Rights and Choices
Depending on your jurisdiction, you may have the right to:
- Access or correct your personal information
- Request deletion of your data
- Object to or restrict processing
- Withdraw consent (where applicable)
- Lodge a complaint with your data protection authority
To exercise any of these rights, contact app@heyparkday.com. We respond to verified requests within the timelines required by applicable law.
7. International Data Transfers
The Service is operated from the United States and intended for users of our US-based corporate clients. Your data is processed in the United States. Where applicable law requires safeguards for international transfers, we implement them.
8. Children's Privacy
The Service is not intended for users under 18. We do not knowingly collect personal information from children.
9. Data Security
We implement technical and organizational safeguards to protect your data, including encryption in transit and at rest and access controls. However, no method of transmission is 100% secure.
10. Changes to this Policy
We may update this Privacy Policy from time to time. Changes will be effective upon posting. Material updates will be communicated directly.
11. Contact
For any privacy questions or data requests, contact: app@heyparkday.com
