Your video never leaves your phone. The scan is processed on your device and deleted. We never see your face.
In one paragraph
Linden estimates your heart rate, heart rate variability (HRV), and respiratory rate from short video of your face using your phone's front camera. The video itself is captured, processed, and deleted entirely on your device — it is never stored and never transmitted, and we never see your face. Your measurement history lives on your phone. We have no user accounts and we never sell your data. Two narrow things do leave your device: anonymous crash reports and usage analytics that keep the app reliable, and — only if you subscribe to Linden Plus and opt in — a small set of derived numbers our AI coach uses to write a weekly recap. Both are described in full below.
What Linden stores on your device
Linden saves the following to your phone's local storage so that the app can work between sessions. None of it leaves your device unless you explicitly choose to export and share it yourself.
- Profile information you enter during onboarding: a name, an age range, a sex-at-birth selection, an optional Fitzpatrick skin-tone selection, optional self-reported medications and health conditions, and your reason for using Linden.
- Measurement history: the heart rate, HRV, and respiratory rate values produced by each scan, plus the date and time of the scan.
- Notification preference: whether you opted into a daily reminder, and the time of day you chose.
- Raw capture data for the most recent scans (up to 20). This contains the per-frame red/green/blue brightness averages from the small region of your face the camera sampled. It does not contain video, photographs, audio, or anything that could identify you visually. Raw capture data exists so you can export it for personal review or to help us improve Linden's accuracy when you choose to share it.
What Linden does not do
- We do not collect your name, email address, phone number, or any other contact information.
- We do not create an account for you.
- We do not run advertising and we do not track you across other apps or websites. The analytics we do run (described below) are anonymous — they are tied to a random identifier generated on your device, never to you.
- We do not store your video or transmit it anywhere, ever.
- We do not sell, rent, or share your personal data with third parties. The service providers that process the anonymous data described below (crash reporting, AI recap generation) act on our instructions and never receive your identity.
Camera access
Linden requires access to your phone's front camera to perform measurements. Each scan reads short video frames purely to compute the small numerical brightness averages described above. No video is stored, transmitted, or sent anywhere. iOS will ask you to grant camera permission the first time you scan, and you can revoke it any time in Settings → Linden → Camera.
Crash reports and anonymous usage analytics
To keep Linden reliable, we collect crash reports and anonymous usage events through Sentry. A scan event includes the heart-rate estimate (rounded), the signal-confidence score, why a scan was rejected (if it was), capture duration, coarse buckets such as age range and skin-tone band, and app and device information. These events are tied to a random identifier generated on your device — never your name, email, or Apple ID — and are never used for advertising or cross-app tracking. Your camera video and raw scan signals never leave your phone. If you send us written feedback from the Profile screen, we receive the text you typed along with the same random identifier and app version.
AI coach (Linden Plus, opt-in)
If you subscribe to Plus and turn on the AI coach, then when you request a weekly recap we send a small set of derived numbers — your average resting heart rate with its range and trend, how often you checked in, your streak count, and a relative time window such as "the last 30 days" — together with your random identifier to our server, which passes them to our AI provider to write the recap. Your video, raw scan data, name, email, health conditions, and exact dates are never sent. Our server stores none of this — it keeps only anonymous counters that limit request rates. You can turn the coach off at any time in Profile; this deletes the recap saved on your phone, and future recaps are written on-device.
How to delete your data
Because your profile and measurement history are stored locally on your phone, the way to delete everything Linden knows about you is to delete the Linden app. iOS will remove all local storage when you uninstall. Anonymous analytics events that were already sent carry only the random identifier and cannot be tied back to you.
If you choose to share an export
Linden has a debug "Export raw captures" button under Profile. If you choose to use it, your device's Share Sheet appears so you can send the file (e.g., via Mail or AirDrop) to a recipient of your choosing. Linden does not send the file anywhere automatically. Once you have shared the file, what happens to it is governed by the platform you used to share it (e.g., Apple Mail, AirDrop), not by Linden.
Children
Linden is not directed to children under 13 and we do not knowingly collect information from anyone under 13.
Medical disclaimer
Linden is a wellness and self-tracking tool. It is not a medical device, it is not intended to diagnose, treat, cure, or prevent any disease, and its measurements should not be used as a substitute for advice from a qualified medical professional.
Changes to this policy
If we change this policy in any substantive way, we will update the effective date at the top of this document and, where reasonable, surface the change inside the app.
Contact
If you have questions about this policy, email support@linden-app.com.
This policy applies to the Linden iOS app. Published by the Linden Team.