Privacy Policy

Effective Date: July 4, 2026

Last Updated: July 4, 2026

Velora is owned and operated by Havra LLC (“Havra,” “Velora,” “we,” “us,” or “our”). This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you use Velora, our website at joinvelora.app, and related services (the “Service”).

Velora is an AI-powered fitness, nutrition, workout, body-progress, and coaching app. Velora is not a medical device, is not a HIPAA-covered entity, does not provide medical advice, and is intended only for users who are 18 years of age or older.

Our key commitments, up front:

• Encryption. Images and sensitive content you store are encrypted in transit (TLS) and at rest. Your progress photos, coach chats, and nutrition history are additionally encrypted on your device (AES-256) before they are uploaded, so our servers store only ciphertext they cannot read (see “Data Security”).
• Meal scans are deleted. Photos you submit for AI meal scanning are deleted promptly after the AI returns your result and are not retained afterward.
• AI for responses, not training. We send your data to our AI providers only to generate your response (“inference”), and we contractually restrict those providers from using your data to train, fine-tune, or improve their models. Providers may retain limited data briefly to operate the service and for security/abuse-monitoring, as described in “AI Processing and Our AI Providers.”
• No sale. We do not sell your personal information. We do not use your health, fitness, or account data for advertising. Our only advertising is optional rewarded video ads shown to free-tier users, described in “Advertising.”

If you have questions, contact us at: Havra LLC — support@joinvelora.app

1. Summary

Velora collects information you provide to create your account, personalize your nutrition/workout plan, scan meals, log workouts, track body progress, optionally track your menstrual cycle, and sync certain data across devices.

We do not sell your personal information, and we do not use your health or fitness data for advertising. We show optional rewarded video ads to free-tier users only; those ads involve an advertising partner that receives your device’s advertising identifier (see “Advertising”).

We do not keep meal photos as permanent storage. Meal-scan photos are temporary processing files that are deleted promptly after the scan result is returned to your device, and are automatically cleaned up after a short fallback period if delivery is interrupted.

We send your data to our AI providers only to generate your response (inference), and we contractually restrict them from using your data to train or improve their models.

We do not provide medical advice. Nutrition, calorie, workout, recovery, BMI, cycle, and body-related estimates are informational only.

2. Notice at Collection

At or before the point we collect your information, this Notice at Collection tells you what we collect and why. We collect the categories of personal information described in this Policy, including sensitive personal information (your account credentials and your health and fitness data). We use this information only for the business purposes described in this Policy, and we retain it only as described in our Data Retention schedule. We do not sell your personal information, and we do not use or disclose your sensitive personal information to infer characteristics about you. For free-tier users only, we share a mobile advertising identifier with our advertising partner to show rewarded ads; you can opt out (see “Advertising” and “Sale & Sharing”). You can exercise your privacy rights as described in “Your Privacy Rights & Appeals.”

3. Information We Collect

A. Account Information

Name; email address; password credentials handled through Supabase Auth or another authentication provider; date of birth; gender or body-calculation preference, where provided; profile photo, if you upload one; account status (active, terminated, or deleted).

B. Fitness, Nutrition, and Body Information

Height, weight, and target weight (or a “no target” preference); fitness goal; activity level, training experience, available training days, equipment access, and preferred workout style; workout logs and history (exercises, sets, reps, weights, duration, effort, notes); muscle groups trained, recovery/muscle-focus information, and personal records; meal logs; calories, macros, fiber, sugar, sodium, and nutrition estimates; food library entries, saved foods, and barcodes; progress photos, workout photos, and body-progress/fat-loss photos, if you upload them.

C. Meal Scan Information

A compressed meal photo; meal context/notes you provide; follow-up answers; a temporary scan job record; and AI-generated nutrition estimates. Meal-scan photos and scan-result data are used only to process the scan; after your device applies the result, Velora’s backend deletes the temporary meal photo and scan job result data. If delivery is interrupted, temporary cleanup is performed automatically after a short fallback period.

D. Barcode Information

Barcode number, product lookup result, product nutrition information, and saved barcode/product history if you save or log it. Barcode lookups send only the product barcode — not your identity or health data — to Open Food Facts, an independent third-party product database.

E. Photos and Media

You may upload profile photos, body-progress/fat-loss photos, workout photos, and meal-scan photos. How each type is processed, encrypted, and retained is described in “Photos & Images We Process.”

F. Device, Usage, and Technical Information

Device type and operating system; app version; crash/diagnostic events; feature usage; approximate timestamps; the IP address received by our backend or hosting providers; notification preferences; and scan timing/performance logs (without image bytes or private meal details). We use diagnostics to improve reliability, performance, security, and fraud prevention.

G. Payment and Subscription Information

Payment information is processed by Apple and our subscription manager (RevenueCat) under their own privacy policies. Velora does not directly store your full payment card information. We receive your subscription tier and entitlement status, and (for our subscription manager) an internal account identifier — never your name or email is used as that identifier.

H. Website and Waitlist Information

If you join a waitlist or contact us through joinvelora.app, we may collect your email address, your name (if provided), the signup source, and basic website usage information.

I. Menstrual Cycle Information (Optional)

If you choose to use cycle tracking, we process the cycle data you enter (period start/end, symptoms, notes) and the cycle estimates we calculate from it. This data is stored only on your device by default — it is not uploaded to our servers, and cloud sync for cycle data has not shipped. See “Consumer Health Data Notice” for details.

J. Apple Health Data (Optional)

If you connect Apple Health, we read a limited set of health metrics (such as sleep, heart-rate variability, resting heart rate, respiratory rate, steps, energy burned, VO2 max, and workouts) to compute your on-device wellness scores. Apple Health data and those scores stay on your device — they are not uploaded to our servers or shared with any third party or AI provider. We never write to Apple Health. See “Apple Health.”

K. Fraud-Prevention Identifiers

To enforce usage limits and prevent abuse (including for guests who are not signed in), we generate a device identifier that is immediately hashed (SHA-256) before use; we never store the raw identifier. IP addresses are used transiently for rate-limiting and are not logged or persisted in raw form by our application.

4. How We Use Information

We use information to: create and manage your account; verify your age eligibility; authenticate signups and logins; personalize calorie, macro, workout, cycle, and coaching recommendations; generate AI meal estimates; generate or recommend workouts; track meals, workouts, body progress, recovery, and (if enabled) cycle; display trends and progress; sync profile and progress photos where supported; provide notifications and reminders; send account, security, verification, and product emails; improve scan accuracy, app performance, and reliability; debug errors and prevent abuse; enforce our Terms; and comply with legal obligations. For free-tier users only, we use a mobile advertising identifier to show rewarded ads (see “Advertising”).

5. Photos and Images We Process

Velora processes three categories of images, each for a single, limited purpose:

• Meal-scan photos — analyzed by an automated AI model solely to estimate the food, portion, and nutrition content of your meal. Meal-scan photos are ephemeral: deleted promptly after the AI returns your nutrition result and not retained afterward.
• Profile photos — stored only to display your own account profile to you.
• Body-progress and workout photos — stored only so that you can view and compare your own self-selected progress over time. Not used for any identification, recognition, or matching purpose.

We do not use any of these images to identify you or anyone else, to perform facial recognition, or to train, develop, or improve any recognition system. We encrypt your images in transit and at rest using industry-standard methods (for example, TLS while transmitted and AES-256 while stored); progress, workout, and avatar photos are additionally encrypted on your device before upload so we store only ciphertext. We strip embedded metadata (such as location/EXIF data) from photos before storage — imported and captured images are re-encoded on-device and the original camera file (with its metadata) is never uploaded. No method of transmission or storage is 100% secure. We retain profile, progress, and workout photos while your account is active and delete them within our standard post-account-deletion window (currently up to 30 days), except where a longer period is required to comply with law, resolve disputes, or enforce our agreements.

6. Biometric Data — No Faceprints, No Facial Recognition

Velora does not collect, capture, purchase, receive through trade, obtain, store, retain, or use biometric identifiers or biometric information. Specifically, Velora does not collect or create faceprints, face templates, facial-geometry scans, scans of hand or face geometry, retina or iris scans, voiceprints, fingerprints, or DNA, and does not perform facial recognition, facial detection that derives geometry, or any form of biometric identification or matching. We do not use any photo or image you provide to identify you or any other person, to build a biometric template, or to train, develop, or improve any facial-recognition or person-recognition system.

As used here, “biometric identifier” and “biometric information” have the meanings given in the Illinois Biometric Information Privacy Act (740 ILCS 14/10), the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code §503.001), and Washington’s biometric-privacy statute (RCW 19.375). Photographs and information derived solely from photographs are expressly excluded from “biometric identifier” under those laws, and Velora derives no biometric template or geometry from any photograph. If we ever introduce a feature involving biometric identifiers, we will provide a separate written disclosure and obtain your separate, prior, written consent first, as required by applicable law.

7. AI Processing and Our AI Providers

Velora uses one or more third-party AI/model providers to estimate meal nutrition, generate or assist with workout plans, and provide coaching-style guidance. To generate your result, we send the information needed to perform that task to an AI inference provider, and — for a meal scan — a compressed, temporary image. We disclose this information to the AI provider only to perform that processing and return your result (“inference”).

Under our arrangements with these providers, each provider acts as our “service provider” (California) and “processor” (other states) and is restricted from: (1) selling or sharing the information; (2) using the information for any purpose other than performing the inference service for us — including a prohibition on using your data to train, fine-tune, develop, or improve the provider’s or any third party’s models; and (3) combining the information with other sources except as needed to perform the service. Providers may retain limited data for a short period to operate the service and to detect abuse, fraud, or safety violations, consistent with their standard commercial terms and applicable law; we do not permit longer retention for training or product-improvement purposes. Because of these restrictions and the limited inference purpose, our disclosure to an AI provider is a service-provider/processor relationship, not a “sale” or a “share” under U.S. state privacy law.

AI outputs may be inaccurate or incomplete and are estimates only. Our commitment to use your data only for inference describes how your data is handled; it is not a guarantee of accuracy. We do not claim AI outputs are medical, diagnostic, therapeutic, or professional advice. See our Terms of Service for the full AI and medical disclaimer.

8. Health, Fitness, and Sensitive Data

Some information Velora processes is “sensitive personal information,” including your account log-in credentials and your health and fitness information (body metrics, nutrition and meal logs, workout logs, progress photos, cycle data, and Apple Health metrics). We use sensitive personal information only for purposes that are exempt from the right to limit under California law: to provide the Velora services you request, to maintain security and prevent fraud, to debug and repair errors, for short-term transient use, and to ensure quality and safety. We do not use or disclose your sensitive personal information to infer characteristics about you, and we do not sell or share it.

Consent to process health & fitness data. Because Velora processes health and fitness information treated as “sensitive data” under the privacy laws of Virginia, Colorado, Connecticut, Oregon, Montana, Texas, and other states, we ask for your consent to process that data when you create your account and begin using the Velora coaching, nutrition, body-progress, cycle, and workout features. Optional features that involve additional health data — Apple Health and cycle tracking — require a separate, affirmative opt-in before any such data is processed. By providing consent and using these features, you consent to our processing of your health and fitness information for the purposes described in this Policy. You may withdraw consent at any time — as easily as you gave it — by turning off the relevant feature, by deleting the relevant data or your account in the app, or by contacting support@joinvelora.app; withdrawal does not affect processing that already occurred.

9. Apple Health

Velora includes an optional Apple Health integration. When you choose to connect it, Velora requests your permission before reading Apple Health data, and Apple Health data is shared with apps only when you grant permission for specific data types. Velora reads a limited set of metrics (such as sleep, heart-rate variability, resting heart rate, respiratory rate, steps, active/basal energy, VO2 max, and workouts) solely to compute your wellness scores on your device. Velora never writes to Apple Health. Apple Health data and the scores derived from it stay on your device — they are not uploaded to our servers and are not shared with any third party or AI provider. We will not use Apple Health data for advertising and will not sell Apple Health data.

10. Notifications

Velora may send local notifications for meal reminders, meal-scan completion and follow-ups, workout reminders, optional cycle reminders, and other app reminders you enable. You can manage notification permissions in iOS Settings and, where available, inside Velora.

11. How We Share Information

We share personal data only with vendors that help us operate Velora, and only as needed to provide the service, under contracts that require them to protect your data and use it only on our instructions. These include, for example:

• Supabase — authentication, database, and encrypted storage
• Render — application hosting
• Resend — transactional email (delivery of verification/account emails)
• Our AI/model inference providers — AI features (under the restrictions in Section 7)
• RevenueCat — subscription and entitlement management (receives an internal account identifier and purchase/subscription data — no health, fitness, or content data)
• Open Food Facts — barcode lookups (barcode only; no identity or health data)
• Cloudflare — website delivery and security
• Apple — in-app purchases and subscriptions, under Apple’s own privacy policy
• Start.io — mobile advertising partner for free-tier rewarded ads only (see “Advertising”)

We do not sell your personal information. Other than the advertising identifier shared with our advertising partner for free-tier ads (see “Advertising” and “Sale & Sharing”), we do not share personal information for cross-context behavioral or targeted advertising. We never share your health, fitness, meal, photo, cycle, or coaching data with advertisers. We may add, remove, or change service providers over time and will require comparable protections. We may also disclose information to comply with law; enforce our Terms; protect Velora, users, or others; and during a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards.

11A. Advertising (Free Tier Only)

Velora shows optional rewarded video ads to free-tier users only — for example, to unlock an extra meal scan. Paid subscribers (Lite, Premium, Max) never see ads, and our advertising software is not even initialized for them.

To serve these ads, we use Start.io as our advertising partner. When a free-tier user watches a rewarded ad, Start.io’s software receives your device’s mobile advertising identifier (IDFA) — only if you allow tracking through Apple’s App Tracking Transparency prompt — along with device and ad-interaction data, to select and measure ads. We ask for App Tracking Transparency permission before the advertising software is initialized. We do not share your name, email, health, fitness, meal, photo, cycle, or coaching data with Start.io or any advertiser. Ads are rewarded video only — no banners or interstitials — and you earn a reward only if you complete the video.

Because sharing an advertising identifier with an ad partner for personalized advertising may be treated as “sharing” for “cross-context behavioral advertising” or a “sale/share” under some state laws, we treat it that way and give you controls: you can decline Apple’s tracking prompt (or turn off “Allow Apps to Request to Track” in iOS Settings), and, on our website, we honor Global Privacy Control signals. You can also avoid ads entirely by subscribing to any paid tier.

12. Sale and Sharing of Personal Information

We do not sell your personal information. We do not “share” your personal information for cross-context behavioral advertising except for the limited advertising-identifier sharing with our advertising partner for free-tier rewarded ads, described in “Advertising.” That sharing never includes your health, fitness, or content data. We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects about you. We do not knowingly sell or share the personal information of consumers under 16 years of age (and Velora is limited to users 18 and older). If your browser or device sends an opt-out preference signal such as Global Privacy Control, we will treat it as a valid request not to sell or share; within the app, you may exercise the same choice by declining Apple’s tracking prompt or subscribing to a paid tier.

13. Data Retention

We retain each category of personal information only as long as reasonably necessary for the purposes described, then delete or de-identify it.

On account deletion we delete your account, profile, health/fitness data, chat history, and stored photos across our database and storage. Certain records may persist as required for legitimate purposes: de-identified analytics and abuse-prevention records (with your account identifier removed), anonymous scan corrections (which never contained an identifier), and the immutable administrative audit log described above. Residual copies in encrypted backups are purged on our normal backup-rotation cycle. We may retain information longer where required by law or to establish, exercise, or defend legal claims.

14. Your Privacy Rights and Appeals

Depending on your state or country, you may have rights to: know/access the personal information we hold about you; delete it; correct inaccurate information; obtain a portable copy; withdraw consent where processing is based on consent; object to or restrict certain processing; opt out of any sale, sharing, or targeted advertising; and limit the use of sensitive personal information (which our practices already satisfy).

You can delete your account and data directly in the app (Profile → Delete Account), and you can turn off optional health features (Apple Health, cycle tracking) at any time. To exercise your other rights — access, correction, a portable copy, or a formal consent withdrawal — email support@joinvelora.app; we handle these requests manually. We will verify your identity before responding and will respond within 45 days (California) or within the timeframe your state or country law requires, extendable as permitted with notice. You may use an authorized agent. We will not discriminate or retaliate against you for exercising your rights.

Appeals. If we deny your request, you may appeal by replying to our decision or emailing support@joinvelora.app with “Appeal” in the subject line; we will respond within 60 days. If we deny your appeal, you may contact your state Attorney General.

15. California Privacy Notice

If you are a California resident, this section provides additional information under the CCPA/CPRA.

Categories of Personal Information Collected: Identifiers (name, email, account ID, hashed device identifier, mobile advertising identifier for free-tier ads); customer records (profile/account information); protected classification information (age/date of birth, gender where provided); commercial information (subscription status); internet/network activity (app usage, diagnostics); geolocation (only if a feature requires it and you allow it — Velora currently requests no location permission); sensory/visual information (photos you upload); inferences (nutrition targets, workout recommendations, progress and wellness insights); and sensitive personal information (health/fitness data, body metrics, cycle data, Apple Health metrics, account login credentials).

Sources, Purposes, and Disclosure: We collect from you, your device, and the service providers listed in Section 11. We use it for app functionality, personalization, account security, customer support, analytics and debugging, fraud prevention, free-tier advertising, and legal compliance. In the preceding 12 months we disclosed personal information to the service providers/processors listed in Section 11 for these business purposes. We did not sell personal information. We shared one category — a mobile advertising identifier — with our advertising partner for free-tier cross-context advertising (see “Advertising”); you may opt out as described there.

Right to Limit Sensitive Personal Information: Because we use sensitive personal information only for permitted business purposes and do not use it to infer characteristics, the right to limit is already satisfied by our practices; you may still contact support@joinvelora.app to confirm or direct us, and we will honor your request.

Shine the Light: We do not disclose your personal information to third parties for their own direct marketing.

16. Other State Privacy Rights

If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another state with a comprehensive privacy law, you have rights to access, correct, delete, and obtain a copy of your personal data; to opt out of sale, targeted advertising, and profiling; and to appeal a denied request. We process your health and fitness information based on the consent described in Section 8. Free-tier users may opt out of targeted advertising as described in “Advertising.” To exercise your rights or appeal, contact support@joinvelora.app as described in Section 14.

17. Consumer Health Data Notice

Some of the information we process — including your body metrics, nutrition and meal logs, body-progress and workout photos, meal-scan photos, menstrual cycle data, Apple Health metrics, and health-related inferences — is “consumer health data” under the Washington My Health My Data Act, Nevada SB370, and the Connecticut Data Privacy Act. Our handling of consumer health data is described in our Consumer Health Data Privacy Notice, which controls for consumer health data if it conflicts with this Privacy Policy. Nothing in our Terms (including governing-law, arbitration, or class-waiver provisions) waives any non-waivable statutory consumer-health-data right.

18. Children and Age Requirement

Velora is intended for users 18 and older. When you sign up with email, we collect your date of birth and block accounts under 18. For sign-ups using Apple or Google, you agree in our Terms that you are at least 18. We do not knowingly retain accounts or data of anyone under 18; if we learn that a person under 18 has created an account, we will delete or deactivate it. Velora is not directed to children.

19. Data Security

We use reasonable, industry-standard administrative, technical, and organizational safeguards. These include encryption in transit (TLS) and at rest (provider-managed AES-256), plus client-side encryption (AES-256 on your device) for your progress/avatar photos, coach chat history, and nutrition history, so that our servers store only ciphertext they cannot read. The keys for that client-side encryption are stored only in your device’s Keychain and synced via iCloud Keychain; we never hold them. One important consequence: if you lose that key (for example, iCloud Keychain is disabled and your device is lost), your client-side-encrypted cloud data cannot be recovered by Velora — by design, because we never hold the key. We also use access controls, private storage buckets, row-level security, authentication, multi-factor authentication for administrative access, and limited retention for temporary scan data. Meal-scan photos are the one exception to client-side encryption — they are stored briefly in a private, access-controlled bucket in a form the AI can read, and deleted promptly after processing. No method of transmission or storage is completely secure; you are responsible for keeping your login credentials safe.

20. Data Breach Notification

If we discover a breach resulting in the unauthorized acquisition of your unsecured personal or health information, we will notify affected users without unreasonable delay and no later than required by applicable law, including (where applicable) the FTC Health Breach Notification Rule and state breach-notification laws. We will notify by email and/or in-app or website notice, and will notify the FTC and other authorities where required.

21. International Users

Velora is operated from the United States, and our providers may process data in the United States or other countries where they operate (our primary AI inference provider operates from Singapore). If you access Velora from outside the United States, your information may be processed in the United States or those countries. For EEA/UK users, we rely on legal bases such as performance of a contract, consent, legitimate interests, and legal obligations.

22. Changes to This Policy

We may update this Privacy Policy and will post the updated version with a new “Last Updated” date. If we make a material change that would reduce the protections that applied to personal data we already collected, or use previously collected data in a materially less-protective way, we will not apply that change to your previously collected data unless we first obtain your affirmative consent. We will provide advance notice of material changes by email or in-app notice before they take effect.

23. Contact