Vitals Privacy Policy

Last updated 24 October 2026

No ads, no tracking, no account. Vitals is a fitness tracker, and your food log, workouts and health data stay on your phone. This page says exactly what is stored, what leaves the device, and when.

What stays on your device

Your food log, bodyweight, workouts, cardio, sauna and cold sessions, routines, supplement schedule, water and electrolyte intake, water bottles, check-ins and how you feel, fasting plans, meal prep batches and their shopping list, meal and progress photos, body measurements, meals still being worked out, products you checked lately, and your profile (height, age, sex, activity level, goals) are stored only on your iPhone. Recovery, insights and gut and mood patterns are worked out on the phone from that data. There is no account, and this data is not uploaded anywhere by default.

Your meal prep shopping list goes to Apple Reminders only when you tap Send to Reminders. Vitals adds its items to a list called Vitals and never reads your other reminders. Reminders syncs through your own iCloud account, not through us.

The app's data files, including your photos and its daily copies, are protected by iOS encryption: after your iPhone restarts, they cannot be read until you unlock it for the first time. After that first unlock they stay readable while the phone is locked, so reminders, widgets and the rest timer keep working. They are included in your device backups, which are controlled by your own iCloud or computer backup settings.

Apple Health

If you turn on Apple Health syncing, Vitals writes the food (calories, protein, carbs, fat, fiber, sugar, sodium and potassium), water, bodyweight and workouts you log into Health, with the distance of any cardio. It reads your bodyweight, body fat percentage, steps, active and resting energy, VO2 max, resting heart rate, heart rate variability and sleep to keep your targets accurate and to score your recovery. For the Activity screen it also reads the workouts other apps recorded, with their heart rate and distance, your flights climbed and time in daylight, and where a recorded walk or ride started, so its weather can be looked up. Apart from that start point, rounded and sent to Apple Weather once you turn weather on (see Weather and location), this exchange happens entirely on your device. Health data is never sent to our servers, never used for advertising or marketing, and never shared with anyone else. The one exception is a weigh-in Vitals brought in from Health: it becomes part of your log, and Ask your data can include it in the summary it sends when you ask (see The AI features).

The AI features

Some features send text or an image to Anthropic's Claude API through a small server we run:

• Describe what you ate, or Say it, sends the description you type or say, and any photos you attach. Those can be photos of the meal itself, not only of a label, and they carry whatever the camera saw. Building a saved meal or a meal-prep batch from words or a photo sends the same.
• Photograph a nutrition label sends the photo of the label. With no connection, or once the month's AI actions are used, the label is read on your phone with Apple's text recognition and the photo is not sent.
• Photograph a supplement sends the photo of the bottle or label.
• Estimating micronutrients runs automatically after a meal is analysed, and sends the names and serving sizes of the foods in that meal.
• Check a claim sends the claim you type, plus abstracts retrieved from the public research literature.
• Opening a research topic sends the topic and its abstracts, without you tapping anything further.
• Ask your data sends the question you type and a short summary of the logs that question needs, worked out on your phone: daily food and water totals, workout sessions (name, muscle groups, sets, volume), weigh-ins, your targets and goal, and which supplements you logged on which days. Only the topics and dates the question is about are included. Food names, doses, photos and readings from Apple Health such as steps or heart rate are never included; a weigh-in Vitals brought in from Apple Health is part of your log and can be. It asks before the first one.
• Read a workout from a screenshot sends the screenshots you pick, up to four, so the exercises and sets on them can be read into a workout you check before it is saved.

With Say it, your iPhone turns your voice into text. While you talk, the sound is kept in a temporary file on the phone so that, when you tap Done, all of it can be checked once more and no words are missed; the file is deleted as soon as that check is done. Where your iPhone cannot do this on the phone (iPhones before iOS 26, some languages, or until Apple's speech model has downloaded), Apple's speech service does it, the same as dictation: the audio goes to Apple with a fixed list of food words to listen for. Food and saved meal names from your log are used as words to listen for only when recognition runs on the phone, and stay there. Apple handles its part under its own privacy policy, and none of it reaches us. Only text is sent to us: your list, plus what the recogniser heard and up to three other readings of it, so a misheard food can be caught. No audio is sent to us.

Nothing else is attached. Your name and account are never included, and your weight, workouts, check-ins and the rest of your log are included only by Ask your data, as described above. Our server forwards the request and returns the answer. It does not store what you sent. It keeps the answer, and nothing else, for up to 15 minutes so that a request repeated by mistake is not charged twice, then deletes it.

The description and the claim are free-text fields, so they carry whatever you actually type into them, and a label photo carries whatever the camera sees, including any text printed on the packet. Don't type anything into these fields you wouldn't want read by Anthropic's API.

When a meal names a restaurant, chain or brand, Claude may look that item up on the web to use its published nutrition. The search is run by Anthropic and carries words about the food, such as "Big Mac", never your name, your device or the rest of your log.

Anthropic processes these requests to produce a response. Anthropic does not train its models on data submitted through its API. See the Anthropic Privacy Policy.

To stop one person from exhausting the shared service, each request carries a random identifier generated on your device the first time the app runs, and, once you subscribe, the Apple-signed receipt for that subscription. Neither is your name, your email or your Apple ID, and neither is a device identifier issued by Apple. They do travel together, so requests from one subscriber can be counted as one subscriber. Our server and its hosting provider also see your IP address, as any web request does.

Those counters are kept in an online database. Before you subscribe, the counter still has to tell one caller from another, and for that it uses a scrambled version of your IP address (a salted one-way hash). The address itself is never saved, only the scrambled version, and it cannot be turned back into the address. Once you subscribe the counter is keyed on the subscription instead. The subscription counter expires after 62 days and the per-caller counter after 48 hours, both automatically.

Barcodes and research

Scanning a barcode sends the barcode number to Open Food Facts, a public food database, at up to three of its servers. A product with nutrition numbers that you checked in the last 30 days, or any product you checked while you have no connection, is answered from a copy kept on your phone, and nothing is sent. Checking a claim or opening a research topic sends search terms to Europe PMC, a public research database. Neither request carries your name, your device identifier or your subscription, but both, like any web request, reveal your IP address to whoever operates that database.

Weather and location

Weather is optional and stays off until you turn it on, which asks for your location, only while you use the app. After that, for a walk, run or ride another app recorded, Vitals uses the point where its route started, read from Apple Health. For today's UV and rain, and for sessions you log in Vitals, it uses where your phone is.

Either way the position is rounded to about a kilometre and sent to Apple Weather (WeatherKit), which is Apple, not us. It never reaches our server and is not stored. Only the weather that comes back is kept on the phone.

Version checks

Vitals checks whether a newer version is out in two ways, without you tapping anything. It asks our server which version is the oldest still supported, when the app opens and at most every six hours; the request carries no identifier, receipt or token, and nothing about it is logged. Once a day it asks Apple's public App Store lookup for the current version, sending the app's bundle name and your iPhone's region setting to Apple. Like any web request, both reveal your IP address to whoever receives them. If a version is no longer supported, the app asks you to update and still lets you export your data.

Your subscription

Vitals is a subscription. Apple processes the payment and we never see your card, your billing address or your Apple Account.

To check that a subscription is active, the app sends our server the signed receipt Apple issues for it. That receipt contains an identifier for the subscription, which we store to count your monthly AI actions and to stop one person using the shared service without limit. It is not your name, your email or your Apple ID, and it is not linked to anything you log.

Offer codes. After a purchase, the app sends our server the App Store's signed receipt once, so we can count which offer, if any, was used. We keep the subscription identifier, the offer name, the product and the date. No name, no email. This happens on every subscription, not only the ones that used a code, because the receipt is what tells us whether a code was used at all. The record is kept while the app is on sale, so the person whose code it was can be paid for the referral. It contains no name, email or Apple ID and is never linked to anything you log.

Subscription status. Apple tells our server when a subscription starts, renews, lapses or is refunded. We keep the latest of these against the subscription identifier for 400 days, so a refunded or ended subscription stops working. No name, no email.

Who handles it

Three companies run parts of the service for us. Each handles this data only to provide that service, and is bound by its terms with us to protect it at least as well as this policy does.

• Anthropic runs the AI. It receives what you send to an AI feature, deletes it within 30 days (up to 2 years if it is flagged under its usage policy), and does not train on it.
• Vercel hosts our server. It sees your IP address with each request, and our request logs there are deleted within 30 days.
• Upstash stores the counters, the scrambled IP addresses, the subscription status, the offer record described above, and each AI answer for up to 15 minutes so a repeat is not charged twice.

What we do not do

• No accounts, no passwords, no email collection.
• No analytics, no tracking, no advertising, and no code from other companies built into the app (no third-party SDKs).
• No selling or sharing of your data. There is nothing to sell.
• No health or fitness data used for marketing, ever.

Deleting your data

Delete all data in Me, Settings removes your profile, food log, favorites, meal prep batches, weight history, supplements and their logs, workouts, cardio, sauna and cold sessions, routines, hydration and your bottles, daily check-ins and symptom logs, fasting plans, mobility history, your training schedule, your saved research, your meal and progress photos, your body measurements, meals still being worked out and the products you checked lately, along with this app's own settings and notification choices. A shopping list you already sent to Reminders stays in Reminders and has to be removed there.

Deleting the app removes the rest of what is stored in its container. Data you wrote to Apple Health stays in Health and has to be removed there, in the Health app. If you shared a workout file with someone, that copy is theirs and we cannot reach it.

The AI usage and rate-limit counters expire on their own, and the subscription status after 400 days. The affiliate record does not. To have any of them removed, email us with roughly when you subscribed or last used an AI feature and we will delete them.

Cancelling your subscription is done in the App Store, under your Apple Account, not in Vitals. Apple holds the subscription; we never see your payment details.

Children

Vitals is rated 18+ and is not intended for anyone under 18. We do not knowingly collect information from anyone under that age. Its nutrition targets are adult reference intakes and do not apply to children. If you believe a child has been using the app, email us and we will help remove what is on the device.

Changes

If this policy changes in a way that affects what leaves your device, the date at the top will change and the app will be updated to point here.

Terms of Service

The Terms of Service cover the health disclaimer and the rest of what you're agreeing to by using the app.

Contact

Questions about this policy: support@vitalsfitness.app