Privacy Policy

1. Introduction

Vireska, Inc. ("Vireska," "we," "us," or "our") operates the Vireska mobile application and the Vireska website (together, the "Service"). Vireska is an AI-assisted fitness and nutrition coaching product: it helps you plan and track workouts, log meals and nutrition, monitor your progress, and chat with an AI Coach for personalized guidance.

This Privacy Policy explains what information we collect through the Service, why we collect it, how we use and share it, how we protect it, and the choices and rights you have over it. It applies to everyone who creates a Vireska account or otherwise uses the Service.

By using Vireska, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree with this policy, please do not use the Service.

2. Information We Collect

2.1 Account Information

When you create a Vireska account, we collect your email address and a securely hashed password (for email/password sign-up), or, if you sign in with Apple or Google, the name and email address those providers share with us and an identifier that links your Apple or Google account to your Vireska account. We never receive or store your Apple ID or Google account password.

2.2 Profile and Fitness Information

During onboarding and in your profile settings, you may provide information such as your name, age, gender, height, weight, target weight, activity level, fitness goals, experience level, available equipment, preferred workout location and schedule, dietary preferences and restrictions, and similar preferences. This information is used to personalize your workouts, nutrition guidance, and AI Coach conversations. All of these fields are optional except where the app indicates they are required to complete onboarding.

2.3 Workout Information

We store the workout plans you follow (including AI-generated plans), the individual exercises within them, and your logged workout sessions — including exercises performed, sets, reps, weight, and completion status — so you can track your training history and progress over time.

2.4 Nutrition Information

We store the nutrition plans you follow (including AI-generated plans), the meals within them, and the meals you log — including foods, quantities, and estimated calories and macronutrients — along with your nutrition-related goals and preferences.

2.5 Body Measurements

We store body measurements you choose to log, such as weight, target weight, and — where the app supports it — other body measurements. This information is used to display your progress over time and, where relevant, to personalize AI-generated recommendations.

2.6 Health Information

The fitness, nutrition, and body-measurement information described above may be considered health-related information in some jurisdictions. We collect only what you choose to provide directly in the app, plus the heart-rate data described below if you grant Apple Health permission. We do not collect medical records, diagnoses, or clinical health data from any healthcare provider.

2.7 Apple Health / HealthKit

If you grant permission, Vireska reads your heart-rate data from Apple Health to display it on your dashboard and use it for activity insights. This is the only category of HealthKit data Vireska requests — Vireska does not request your steps, sleep, workouts, weight, or any other Health data category.

• HealthKit access is entirely optional and requires your explicit permission, granted through Apple's own permission prompt.
• You can review or revoke this permission at any time in iOS Settings → Privacy & Security → Health → Vireska, or in the Health app under Sharing → Apps.
• Vireska does not write, update, or delete any data in Apple Health — it only reads heart-rate data with your permission.
• Heart-rate data read from Apple Health is not used for advertising and is not sold or shared with third parties for their own purposes.

2.8 Photos and Camera

Vireska requests camera and photo-library access so you can scan a meal photo for nutrition analysis (Nutrition Scan) and attach photos to AI Coach conversations. When you scan a meal, the photo is uploaded to a private, per-account storage location and sent to our AI provider to generate an estimated nutrition breakdown, which you can review and edit before saving. If you save the resulting meal log, the photo is retained with that entry so you can view it later; if you discard the scan without saving, the app makes a best-effort deletion of the uploaded photo. Photos are never made public — each photo is accessible only to your own account through a short-lived, authenticated link.

2.9 AI Coach Conversations

Messages you send to the AI Coach — and any photo attachments you include — are stored so your conversation history is available the next time you open the app, and so the AI Coach can refer back to earlier context in the same conversation. These messages may reference the fitness, nutrition, or health information described above, since that is the point of the feature. You can delete individual saved facts the AI Coach has remembered about you from the app's memory settings, and deleting your account (see "Account and Data Deletion" below) permanently deletes all AI Coach conversation history.

2.10 Technical Information

Like most apps, we automatically collect some technical information needed to operate the Service reliably and securely: device type and operating system version, app version, IP address, and general diagnostic/error information generated while using the app.

2.11 Analytics

We use PostHog, a product analytics provider, to understand how the app is used and to improve it. PostHog analytics are limited to high-level, categorical product events — for example, that an onboarding step was completed, a workout was logged, or a purchase screen was viewed — identified by your account ID.

• We do not send raw fitness, nutrition, or health values (such as your specific weight, calories, or meal contents) to PostHog as event data — only that an event of a given type occurred.
• PostHog Session Replay (screen-recording analytics) is disabled and is not used in Vireska.
• We use analytics to understand feature usage, diagnose problems, and prioritize improvements — not to build advertising profiles, and not to sell data to advertisers.

2.12 Subscription Information

We store your subscription status (for example, active, trialing, or canceled), the plan you are subscribed to, and renewal/expiration dates, so the app and our servers can determine whether you have access to Premium features. On iOS, subscriptions are purchased and billed entirely through Apple's In-App Purchase system via RevenueCat, our subscription-management provider; on Android and the web, subscriptions may be billed through Stripe. Vireska does not receive or store your payment card number, bank details, or other full payment credentials — those are handled entirely by Apple, Google, or Stripe, as applicable. We do receive limited billing metadata from these providers (such as subscription status, renewal date, and, for Stripe, an invoice/payment record) needed to grant and maintain your access to Premium features.

3. How We Use Your Information

We use the information described above for the following purposes:

• Providing the Service — operating your account, syncing your data across your devices, and delivering the core features of the app.
• Authentication — verifying your identity when you sign in, via email/password, Apple Sign In, or Google Sign In.
• Creating and maintaining your profile — storing the onboarding and preference information you provide.
• Personalizing workouts and nutrition guidance — using your goals, preferences, and history to tailor plans and recommendations to you.
• Generating AI Coach responses, AI-generated workout plans, and AI-generated nutrition plans — sending relevant profile and conversation context to our AI provider to produce personalized output.
• Nutrition Scan — analyzing a food photo you submit to estimate its nutrition content.
• Tracking your progress — displaying your workout history, nutrition history, and body-measurement trends over time.
• Displaying health information you choose to connect — such as heart-rate data from Apple Health, if you grant permission.
• Processing subscriptions and purchases, and verifying and restoring your Premium entitlement across devices.
• Improving app functionality and fixing bugs — using diagnostic information and aggregate analytics.
• Security and fraud prevention — detecting and responding to abuse, unauthorized access, or violations of our Terms of Use.
• Debugging and customer support — investigating issues you report to us.
• Analytics — understanding feature usage and engagement, as described above.
• Legal compliance — meeting our legal obligations, responding to lawful requests, and enforcing our agreements.

4. AI and Automated Processing

Vireska uses artificial-intelligence-powered functionality — the AI Coach chat, AI-generated workout plans, AI-generated nutrition plans, and Nutrition Scan's food-photo analysis. These features work by securely sending relevant information you provide (your profile and preferences, your conversation messages, or a food photo you submit) from our backend to a third-party large-language-model provider (currently Google's Gemini API), which returns a generated response, plan, or nutrition estimate. Your Gemini/AI provider credentials are never present in, or accessible from, the mobile app itself — all AI requests are made server-side, by our backend, on your behalf.

AI-generated content — including chat responses, workout plans, nutrition plans, and nutrition estimates from a photo — is produced by an automated system and can be inaccurate, incomplete, or inappropriate for your specific situation. AI output is not medical advice, is not a diagnosis, and is not a substitute for professional medical, nutritional, or fitness guidance. You should use your own judgment when following AI-generated recommendations and consult a qualified healthcare professional before making significant changes to your exercise, nutrition, or health routine, especially if you have a medical condition or other health concerns.

We do not control, and cannot make representations about, whether our AI provider uses submitted data to train its own general-purpose models, beyond what that provider discloses in its own terms. We do not ourselves use your data to train any AI model that we operate, and we do not sell your AI conversation content to third parties.

5. Data Sharing and Third Parties

We do not sell your personal information. We share information only with the service providers below, each of which processes data solely to help us operate the Service, and only to the extent necessary for that purpose.

5.1 Supabase

Our database, authentication system, and file storage provider. Supabase hosts your account, profile, workout, nutrition, progress, and AI-conversation data, and enforces per-account data isolation at the database level (see "Data Security" below).

5.2 Google (Gemini API)

Our AI provider for the AI Coach, AI-generated plans, and Nutrition Scan's photo analysis, as described in "AI and Automated Processing" above.

5.3 Google Sign-In and Apple Sign In

If you choose to sign in with Google or Apple, those providers authenticate your identity and share the name/email they permit for that purpose. We use this only to create and sign you into your Vireska account.

5.4 Apple Health

If you grant permission, Apple's HealthKit framework provides your device's locally stored heart-rate data to the Vireska app, as described in "Apple Health / HealthKit" above. This exchange happens on your device, governed by Apple's own platform permissions.

5.5 RevenueCat

Our subscription-management provider for iOS (and, where applicable, Android) In-App Purchases. RevenueCat receives your app-level user identifier and purchase/entitlement events from Apple's App Store (or Google Play) and reports your subscription status back to our backend so we can grant Premium access.

5.6 Apple App Store (and Google Play)

If you subscribe on iOS or Android, Apple or Google processes your payment directly — we never see or store your card details. They share limited billing events (such as purchase, renewal, and cancellation) with RevenueCat, which relays subscription status to us.

5.7 Stripe

Our payment processor for web and Android subscriptions purchased outside of Apple's or Google's in-app billing. Stripe processes your payment method directly; we receive only subscription/billing status and invoice metadata, never your full card number.

5.8 PostHog

Our product-analytics provider, as described in "Analytics" above.

5.9 Resend

Our email-delivery provider, used to send account-related emails such as password resets, email verification, and service notifications.

We may also disclose information where required by law, to protect the rights, property, or safety of Vireska, our users, or others, or in connection with a merger, acquisition, or sale of assets (subject to this Privacy Policy continuing to apply to your information).

6. Data Security

We implement reasonable technical and organizational safeguards designed to protect your information, including:

• Encryption in transit via HTTPS/TLS for all communication between the app, our backend, and our service providers.
• Encryption at rest for data stored in our database and file storage.
• Row-Level Security (database-enforced access rules) so that, in the ordinary course of the Service, an account can only read or modify its own data — not another user's.
• Server-side authorization checks on every request, so premium-gated features and account actions are verified against your real, authenticated session rather than trusted from the app alone.
• Least-privilege credential handling — privileged operations (such as processing subscription webhooks or account deletion) run only on our servers, never with credentials exposed to your device or browser.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will take appropriate steps consistent with applicable law.

7. Data Retention

We retain your account, profile, workout, nutrition, progress, and AI-conversation data for as long as your account remains active, so the Service can continue to function and so your history remains available to you.

When you delete your account (see "Account and Data Deletion" below), this data is deleted from our production database immediately. Some information may briefly persist in database backups or server logs for a limited operational period before being fully purged in the ordinary course of our backup rotation, and analytics events already recorded in PostHog are retained under PostHog's own retention settings rather than being individually purged on deletion.

We have not yet defined a fixed maximum retention period for every category of data beyond "for as long as your account is active." We recommend adopting an explicit retention schedule (for example, a defined backup-purge window) as the product matures, and this policy will be updated to reflect that once defined.

8. Account and Data Deletion

You can permanently delete your Vireska account, at any time, from inside the app: open Profile → Settings → Delete Account, and confirm the deletion.

Deleting your account permanently removes your authentication credentials and cascades to delete every record tied to your account, including your profile, workout and nutrition plans and logs, progress and body-measurement history, AI Coach conversations, subscription records, and notification preferences. This action is immediate and cannot be undone from within the app.

Limited exceptions may apply where we are legally required to retain certain records (for example, financial/billing records Apple, Google, or Stripe retain independently for tax or compliance purposes), which are outside our direct control and governed by those providers' own policies.

9. Your Rights and Privacy Choices

Depending on where you live, you may have rights over your personal information, which typically include the right to:

• Access the personal information we hold about you — most of which you can already view directly in the app.
• Correct inaccurate information — by editing your profile, logs, and preferences in the app.
• Delete your information — by deleting your account, as described above.
• Withdraw a permission you previously granted — for example, revoking Apple Health, camera, or notification access in your device settings at any time.
• Ask us a question about how your information is handled, or raise a privacy concern.

To exercise any of these choices, or with any privacy question, contact us at hello@vireska.com. Because Vireska is used by people in different countries and regions, we aim to honor these rights broadly, but we do not claim compliance with any specific privacy law (such as the GDPR or CCPA) unless and until we have completed the corresponding legal review.

10. Children's Privacy

Vireska is not directed to, and is not intended for use by, children under the age of 16, and we do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has created an account or provided us information, please contact us and we will take steps to delete it.

11. International Data Transfers

Vireska is operated from the United States, and the service providers listed above (including Supabase, Google, RevenueCat, Stripe, PostHog, and Resend) may process and store information on servers located in the United States or other countries where those providers operate infrastructure. By using the Service, you understand that your information may be transferred to, stored in, and processed in a country other than the one in which you reside, which may have different data-protection laws.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Service or our data practices. If we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice in the app or by email. Your continued use of the Service after a change takes effect constitutes your acceptance of the updated policy.

13. Contact

If you have questions about this Privacy Policy or how we handle your information, contact us at hello@vireska.com.