Privacy Policy

2. VitalFill (mobile app)

VitalFill has no account. There is no sign-up, no login, no name, and no email address. We cannot identify you, and we hold no profile that could be linked back to you.

2.1 Information stored only on your device

The following never leaves your phone. It is held in the app's local storage and is erased when you delete the app:

• Your profile: age, sex, height, weight, activity level, and whether you are pregnant or breastfeeding. These are used solely to calculate your personal daily nutrient targets from published NIH Dietary Reference Intakes.
• Your food log and any weight entries you record.
• App preferences, such as your selected nutrient.

We hold no copy of any of this. We cannot recover it for you, and it is not backed up to our servers.

2.2 Information sent to our servers

• Food searches and barcodes. When you search for a food or scan a product barcode, the search text or barcode number is sent to our server to look up nutrition data. These lookups are not logged against you.
• A device identifier. We use the identifier your operating system provides to apps from our company (Apple's identifierForVendor, or its Android equivalent). This is not your advertising ID and cannot be used to identify you personally. We use it for exactly two purposes: enforcing daily limits on AI-assisted scans, and checking whether an active subscription belongs to your device.
• Photo scans (optional). If you photograph a food, that image is sent to our server and forwarded to Anthropic's Claude API, which identifies the food so we can match it against the USDA database. The image is processed in memory and is never written to disk or retained by us.
• Voice logging (optional, Pro). Speech is converted to text on your device by your operating system. No audio recording is ever transmitted to us or to anyone else. Only the resulting text — for example, "two eggs and a slice of toast" — is sent to our server and forwarded to Anthropic's Claude API to interpret the foods and quantities. That text is processed in memory and is not retained by us.

2.3 What we retain on our servers

Only two things, and neither contains personal information:

• A daily count of AI scans, stored against an irreversible SHA-256 hash of the device identifier. These counters are deleted automatically after two days.
• A cached yes/no flag recording whether a device has an active subscription, refreshed approximately hourly.

We do not keep server logs of your food searches, your photos, your speech, or your food log.

2.4 Subscriptions

Optional VitalFill Pro subscriptions are sold and processed by Apple (App Store) or Google (Play Store) and managed on our behalf by RevenueCat, Inc. We never see or store your payment details. RevenueCat receives the device identifier described above so that a purchase can be associated with your device.

2.5 Camera and microphone

VitalFill requests camera access only for barcode and photo scanning, and microphone and speech-recognition access only for voice logging. Both are optional and the app works fully without them. Nothing is captured unless you actively start a scan or press the voice button.