Effective date: 2026-06-11
Linden estimates your heart rate, heart rate variability (HRV), and respiratory rate from short video of your face using your phone’s front camera. The video itself is captured, processed, and deleted entirely on your device — it is never stored and never transmitted, and we never see your face. Your measurement history lives on your phone. We have no user accounts and we never sell your data. Two narrow things do leave your device: anonymous crash reports and usage analytics that keep the app reliable, and — only if you subscribe to Linden Plus and opt in — a small set of derived numbers our AI coach uses to write a weekly recap. Both are described in full below.
Linden saves the following to your phone’s local storage so that the app can work between sessions. None of it leaves your device unless you explicitly choose to export and share it yourself.
Linden requires access to your phone’s front camera to perform measurements. Each scan reads short video frames purely to compute the small numerical brightness averages described above. No video is stored, transmitted, or sent anywhere. iOS will ask you to grant camera permission the first time you scan, and you can revoke it any time in Settings → Linden → Camera.
To keep Linden reliable, we collect crash reports and anonymous usage events through Sentry. A scan event includes the heart-rate estimate (rounded), the signal-confidence score, why a scan was rejected (if it was), capture duration, coarse buckets such as age range and skin-tone band, and app and device information. These events are tied to a random identifier generated on your device — never your name, email, or Apple ID — and are never used for advertising or cross-app tracking. Your camera video and raw scan signals never leave your phone. If you send us written feedback from the Profile screen, we receive the text you typed along with the same random identifier and app version.
If you subscribe to Plus and turn on the AI coach, then when you request a weekly recap we send a small set of derived numbers — your average resting heart rate with its range and trend, how often you checked in, your streak count, and a relative time window such as “the last 30 days” — together with your random identifier to our server, which passes them to our AI provider to write the recap. Your video, raw scan data, name, email, health conditions, and exact dates are never sent. Our server stores none of this — it keeps only anonymous counters that limit request rates. You can turn the coach off at any time in Profile; this deletes the recap saved on your phone, and future recaps are written on-device.
Because your profile and measurement history are stored locally on your phone, the way to delete everything Linden knows about you is to delete the Linden app. iOS will remove all local storage when you uninstall. Anonymous analytics events that were already sent carry only the random identifier and cannot be tied back to you.
Linden has a debug “Export raw captures” button under Profile. If you choose to use it, your device’s Share Sheet appears so you can send the file (e.g., via Mail or AirDrop) to a recipient of your choosing. Linden does not send the file anywhere automatically. Once you have shared the file, what happens to it is governed by the platform you used to share it (e.g., Apple Mail, AirDrop), not by Linden.
Linden is not directed to children under 13 and we do not knowingly collect information from anyone under 13.
Linden is a wellness and self-tracking tool. It is not a medical device, it is not intended to diagnose, treat, cure, or prevent any disease, and its measurements should not be used as a substitute for advice from a qualified medical professional.
If we change this policy in any substantive way, we will update the effective date at the top of this document and, where reasonable, surface the change inside the app.
If you have questions about this policy, email relorbany@hotmail.com.
This policy applies to the Linden iOS app. Published by the Linden Team.