Privacy Policy
Last updated 28 September 2026
Penwise is published by Version Two s.r.o. (“we”). This policy explains what Penwise does with your information. The short version: your health data stays on your phone, and we never receive it.
We operate no server for your records
Penwise has no backend for the things you record. There is no Penwise account, no login, and no database of your history that we control. Every dose, weight, symptom, craving, note and measurement you record is written to an app-private database on your own device and stays there. We cannot read it, and we could not hand it over if we were asked to.
What we collect
No health data, no usage analytics, no advertising identifiers and no crash reports. Penwise contains no analytics SDK and no advertising SDK, and no third party receives anything about you.
There are two exceptions: the referral codes that let creators be paid, and the newsletter, if you ask for it. Neither ever involves anything you record in the app, and both are described in full in the next two sections.
Referral codes and creator links
We pay creators who send people to Penwise, so we have to be able to tell which creator sent you. There are two paths, and both of them talk only to a server of ours.
In the app. If you enter a code from a creator, or if you installed from a creator link on Android and Google Play passed us the campaign, Penwise sends us that code or campaign together with an install id. The install id is a random value your own device generated for itself. It is not derived from you, from an account, or from anything about your phone, and it is the only identifier Penwise ever sends anywhere. The same value goes to the App Store or Google Play with a purchase, which is how a creator can be paid without us learning who bought.
To read the campaign on Android, Penwise uses Google's Install Referrer library. It is read once per install, and Penwise acts on it only when the campaign is one of ours.
On this website. When you open a creator link here, we record that the click happened: the campaign, the time, the store you were sent to, your language, your country, the page that referred you, your browser's user agent string, and a one-way hash of your IP address. We keep a hash rather than the address so that repeat clicks can be told apart without us holding the address itself. After 90 days we delete the hash, the user agent and the referring page; what stays is the campaign, the time, the store, the language and the country.
None of this ever includes your health data, and there is no Penwise account for it to attach to. If you never open a creator link and never enter a code, none of it happens.
The newsletter
The newsletter is optional and separate from the app. If you enter your address in the form on this website, we store the address, the language you were reading in, the page you signed up from, and the time and IP address of the consent itself. We keep that IP because it is what evidences the consent, and it is used for nothing else.
Sending is handled by MailWell, at mailwell.sk, which Version Two s.r.o. also operates. Your address, your language and the sign-up source are passed to it, and nothing else is. MailWell sends the confirmation mail, and you join the list only once you click the link in it.
Every message carries an unsubscribe link, and unsubscribing removes you from the list. Your health data is never part of any of this: it never leaves your phone, and there is nothing that connects it to a newsletter address.
Health app data
If you connect Apple Health or Health Connect, Penwise reads only the measurement types you approve:
- Body weight
- Body fat percentage
- Lean body mass
- Water intake
- Nutrition entries
- Resting heart rate
Access is read-only. Penwise never writes to Apple Health or Health Connect. Data read this way is stored on your device with the rest of your record and is never transmitted anywhere. You can revoke access at any time in the system Health settings, and you can disconnect inside Penwise.
Watch companions
The Wear OS and watchOS companion apps exchange data only with the Penwise app on your paired phone, over the platform’s own device-to-device transport. That exchange does not pass through us.
Backups and exports
Penwise can export your record as a file, optionally encrypted with a password you choose. The export is written wherever you tell your device to put it. If you place it in a cloud folder, that copy is governed by that provider’s terms, not ours. The encryption key is derived from your password and never leaves your device, so a lost password means an unreadable backup: we cannot recover it for you.
Purchases
Penwise+ is sold through the App Store and Google Play. Those stores handle the entire transaction. We never see your card details, billing address or any other payment information. Your subscription status is verified on your device against a receipt issued by the store.
Children
Penwise is not directed at children and is not intended for use by anyone under 18. We do not knowingly process any data from children.
Your rights
Because we hold no data about you, there is nothing for us to disclose, correct, export or erase on request. Everything is in your hands: Settings contains an export tool and a “Delete all data” action that clears the entire on-device database.
Changes
If this policy changes, the updated version ships with the app update and the date above changes with it.
Contact
Version Two s.r.o.