Privacy Policy

Last Updated: October 22, 2026 • Effective Date: October 22, 2026

1. Overview & Scope

This Privacy Policy explains how VitalsFlow ("we", "us", or "our") collects, uses, protects, and discloses information when you use our mobile application and related online services ("App" or "Services"). By installing or using VitalsFlow, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect and How We Use It

Depending on how you use VitalsFlow, we collect the following categories of data:

A. Health, Fitness & Biometric Data

If you grant permission via Google Health Connect (Android) or Apple HealthKit (iOS), VitalsFlow reads the following parameters:

• Sleep Architecture: Sleep duration, deep sleep, and wake times to calculate your circadian phase and morning readiness.
• Heart Rate & Autonomic Tone: Resting heart rate and Heart Rate Variability (HRV rMSSD) to evaluate physiological recovery.
• Physical Activity: Step counts and active calorie burn to calculate weekly Dynamic Total Daily Energy Expenditure (TDEE).
• Body Weight: Scale weight to compute your Exponentially Weighted Moving Average (EWMA) true-weight trend curve.

Policy Note on Health Data: We strictly adhere to the Google Play Health Connect Permissions policy. Biometric and health data is processed on-device to power your personalized readiness, circadian timeline, and metabolic estimations. We never use health data for advertising, marketing, or automated profiling.

B. Nutrition & Habit Information

• Meal descriptions, timestamped food logs, macro breakdown (protein, carbs, fats), and calorie totals entered by you.
• Habit and task titles, scheduled circadian window targets, and completion records.

C. Device Permissions

• Camera: Used exclusively on-device when you choose to scan a food barcode or photograph a meal plate. Captured camera frames are processed locally or via secure cloud proxy solely to detect ingredients and calculate macros. Images are never retained, published, or sold.
• Microphone / Speech: Used exclusively when you tap the dual-logging microphone button to dictate meals and completed tasks. Audio is transcribed in real-time and immediately discarded. No audio recordings are permanently stored.

D. Account & Authentication Information

• If you choose to use local-only guest mode, no email or personal account credentials are required or collected.
• If you choose to enable Cloud Sync and Backup, we collect your email address and authentication ID via Google Sign-In or secure authentication token.

E. In-App Purchases & Subscriptions

VitalsFlow offers optional Pro subscription tiers processed securely through Google Play Billing and the RevenueCat SDK. VitalsFlow never receives, processes, or stores your credit card numbers or payment details. Google Play manages payment processing under its own terms and security safeguards.

3. Data Storage, Security & Encryption

We treat data security with the highest engineering rigor:

• On-Device Encryption: Local data is stored in a structured SQLite database protected by AES-256 database-level encryption.
• In-Transit Encryption: All communications between your device and optional cloud synchronization servers utilize Transport Layer Security (TLS 1.3) with pinned certificates.
• Cloud Isolation: Remote backups are governed by PostgreSQL Row-Level Security (RLS) policies, ensuring that each authenticated user can only access their own synchronized records.

4. Zero Third-Party Advertising & No Data Selling

We do not sell, rent, trade, or monetize your personal or biometric information. VitalsFlow contains zero third-party tracking libraries, zero ad SDKs, and zero social media data-mining trackers.

5. Data Retention and Account Deletion

We retain your information only for as long as necessary to provide the Services to you:

• Local Data: Retained on your device until you uninstall the app or use the in-app "Delete All Data" feature.
• Cloud Data: Retained until you request account deletion. You can permanently delete your entire account and all associated cloud sync data directly within the app under Settings ➔ Danger Zone ➔ Delete All Account & Cloud Data, or via our web request page at Account & Data Deletion.

6. Children's Privacy

VitalsFlow is intended for adults and adolescents aged 13 and above (or 16 where required by local law). We do not knowingly collect personal data from children under 13. If you become aware that a child has provided us with personal data, please contact us immediately.

7. Your Rights (GDPR & CCPA Compliance)

Depending on your jurisdiction, you have the following rights regarding your data:

• Right to Access & Portability: You can export your full nutrition diary, weight history, and task logs in JSON/CSV format at any time from within the app.
• Right to Rectification: You can edit or correct any meal log, weight entry, or personal target directly in the user interface.
• Right to Erasure ("Right to be Forgotten"): You have the absolute right to have all your data permanently purged from both your device and cloud storage.

8. Changes to This Privacy Policy

We may update our Privacy Policy periodically. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top. We encourage you to review this policy periodically.

9. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our Data Protection Officer at:

Email: shrulabh25@gmail.com
Subject: VitalsFlow Privacy & Data Protection
GitHub: github.com/Shrulabh25/VitalsFlow