Privacy receipt
Last updated 24 October 2026
No ads, no tracking, no account. Your food log, workouts and health data stay on your phone, and we never see them.
In plain words
- Vitals goes online when you use a feature that needs it: the AI features, scanning a barcode, searching research, weather if you turn it on, or subscribing. Apart from that it makes two small checks of its own, to see whether a newer version of the app is out. Neither carries anything about you.
- Each one sends only what it needs to answer you, like the meal you described or the barcode you scanned. Never the rest of your log, except the short summary Ask your data sends with your question (call 14).
- AI requests pass through our server to Claude, Anthropic's AI. We do not keep what you sent. So that a request repeated by mistake is not charged twice, our server keeps the answer for up to 15 minutes and then deletes it. Anthropic deletes what it received within 30 days.
- Our server keeps a few counters, like how many AI actions you have left this month, your subscription's status from Apple, and a note of which offer code, if any, was used when you subscribed. None of it has your name or email.
- Nothing tracks you. There is no analytics, no advertising, and no code from other companies built into the app.
Below is the full list, counted from the code, with the technical detail.
The technical detail
1. Describe or say a meal
POST to our server, which forwards to Anthropic's Claude API. Sends the description you typed or said and any photos you attached. Also used when you describe a prepped batch. When the meal names a restaurant, chain or brand, Claude may search the web for that item's published nutrition; Anthropic runs the search, and it carries words about the food only. With Say it, your iPhone turns speech into text on the phone. Where it cannot (iPhones before iOS 26, some languages, or until Apple's speech model has downloaded), Apple's speech service does it, as with dictation: the audio goes to Apple with a fixed list of food words to listen for. The audio is kept in a temporary file on the phone only until the text is ready, then deleted. Only text is sent to us: your list, plus what the recogniser heard and up to three other readings of it, so a misheard food can be caught.
2. Read a nutrition label
POST to our server, then Claude. Sends the photo of the label. With no connection, or once the month's AI actions are used, the label is read on the phone with Apple's text recognition instead, and this call is not made.
3. Read a supplement label
POST to our server, then Claude. Sends the photo of the bottle or label.
4. Estimate micronutrients
POST to our server, then Claude. Runs automatically after a meal is analysed. Sends the names and serving sizes of the foods in that meal, and nothing else about you.
5. Check a claim, or open a research topic
POST to our server, then Claude. Sends the claim you typed and the abstracts fetched in call 7.
6. Barcode lookup
GET https://world.openfoodfacts.org/api/v2/product/<barcode>.json, falling back to the us.openfoodfacts.org andworld.openfoodfacts.net hosts if the first does not know the product. Sends the barcode digits and the user agent stringVitals/1.0 (personal iOS app), a label that says the request comes from Vitals. It carries no device identifier and no subscription. A product with nutrition numbers checked in the last 30 days is answered from a copy on the phone, and this call is not made.
7. Research search
GET https://www.ebi.ac.uk/europepmc/webservices/rest/search. Sends the search terms and the same user agent string. No device identifier and no subscription.
8. Subscription check
There is no separate call. The Apple-signed receipt for your subscription travels as a header, x-vitals-entitlement, on calls 1 to 5, 9, 11 and 14, so the server can confirm you are entitled and count your monthly AI actions. Apple's own StoreKit talks to the App Store for the purchase itself, which is Apple, not us, and we never see your card or your Apple Account.
9. Offer attribution
POST to /api/attribution on our server. After a purchase, the app sends our server the App Store's signed receipt once, so we can count which offer, if any, was used. We keep the subscription identifier, the offer name, the product and the date. No name, no email. The record is kept while the app is on sale.
10. Weather
Apple Weather (WeatherKit), only after you turn weather on. Sends a position rounded to about a kilometre: where a walk or ride another app recorded started, read from Apple Health, or your phone's location while you use the app. It goes to Apple, never to our server, and the position is not stored. Weather data: Weather.
11. Read a workout from a screenshot
POST to our server, then Claude. Sends the screenshots you pick (up to four), so the exercises, sets and weights on them can be read into a workout you check before it is saved. Nothing else from your log goes with them.
12. Update check
GET https://api.vitalsfitness.app/api/min-version, when the app opens and when you come back to it, at most every six hours. A bare request: no device identifier, no build token, no subscription. The answer says which version is the oldest still supported. Nothing about the request is logged.
13. New version lookup
GET https://itunes.apple.com/lookup, Apple's public App Store lookup, at most once a day, so the app can say when a newer version is out. Sends the app's bundle name and your iPhone's region setting, to Apple, never to us.
14. Ask your data
POST to our server, then Claude. Sends the question you typed and a short summary the phone works out for it: daily food and water totals, workouts (name, muscle groups, sets, volume), weigh-ins, your targets and goal, and which supplements you logged on which days, only for the topics and dates the question is about. Never food names, doses, photos or other Apple Health readings. It asks before the first one. There is no history on the phone, and our server keeps only the answer, for up to 15 minutes.
What travels on calls 1 to 5, 9, 11 and 14
- A random identifier generated on your device the first time the app runs. It is not your name, your email, your Apple ID, or an identifier issued by Apple.
- A build token that is the same for every copy of the app.
- Your Apple-signed subscription receipt, once you subscribe.
- Your IP address, which any web request reveals to the server and its host.
What is never sent
- Your name, email, or Apple ID. There is no account, so there is nothing to send.
- Your food log, bodyweight, workouts, routines, supplements, water, or check-ins, apart from the summary in call 14. Food names from your log help Say it listen only when it runs on the phone; they never go to Apple's speech service.
- Anything read from or written to Apple Health, apart from the rounded route start in call 10, and a weigh-in Vitals brought in from Health, which call 14 can include.
- Your contacts, or your photo library apart from photos you pick for an AI feature.
- Your location, to us or anyone else. The one exception is call 10, a rounded position sent to Apple Weather.
- Your advertising identifier. Vitals does not ask for one.
What is not in the app at all
- No analytics, of any kind, ours or anyone else's.
- No code from other companies built into the app (no third-party SDKs). The app has no outside dependencies at all.
- No crash reporting, no install tracking, no advertising, no trackers.
- Only two calls of its own, 12 and 13, the version checks. Every other call above starts from something you did, or follows it: call 4 follows a meal you analysed, call 9 a subscription you started, and call 10 refreshes the weather when you open Activity or an outdoor session. A meal you sent can finish being worked out after you leave the app, and a meal that could not be sent is sent again when the connection comes back. A vitamin estimate cut off by the app closing is asked again the next time it opens.
The full policy
The Privacy Policy covers storage, retention and deletion. This page covers the wire.
More
Pricing, plainly · What works in airplane mode · Terms