This policy explains what VITORY collects, why, who receives it and what you can do about it. We have tried to describe what the app actually does. We don't sell your data and we don't run ads.
VITORY is run by Shlomo Shalev Peretz ("SSP", "we", "us"), an individual registered in Israel as an exempt dealer (osek patur). SSP is the controller of your personal data, the owner of the database under Israeli law, and the person to contact.
Address: Hatomer 20, Beit Shean, Israel
Email: support@vitory.app
UK and EU representative. Businesses outside the UK and EU that offer services to people there generally need a representative in each. We will name ours here once appointed. Until then, please contact us directly.
This policy covers the VITORY iPhone app, the website at vitory.app and our support channels. Washington and Nevada residents should also read the Consumer Health Data Notice.
| Category | What it includes | Why we use it |
|---|---|---|
| Account | Email address; a password, stored in hashed form by our login provider; name, if you give one or Apple or Google supplies one; an Apple or Google account identifier and Apple private-relay email, if you use them; your account ID. | Create and secure your account, sign you in, greet you, contact you about the service. |
| Body and fitness details (sensitive) | Sex, age, height, weight, weigh-ins, activity level, training habits, goal, pace, and the calorie, protein, carb and fat targets worked out from them. | Calculate your targets, build your plan, and suggest changes you can accept or undo. |
| Allergies, diet and food rules (sensitive) | Allergies and intolerances, including any you type; your diet; gluten-free and dairy-free choices; halal or kosher-style rules, which may reveal religious belief; dislikes; how you like to eat and prepare food. | Filter recipes and build a plan that follows them. |
| Eligibility and consent | That you confirmed the 18+ and health check, and when and to which version of the wording you consented. We don't record which condition, if any, stopped someone. | Run the safety check and show that you consented. |
| App activity | Plans, grocery lists, saved recipes, cooked recipes, recipes you import with their source links, and settings. Meal logs and grocery ticks stay on your device and aren't sent to us. | Provide the features you use, on your devices. |
| Support | Chat messages, screenshots you attach, and emails. | Answer you and fix problems. |
| Usage analytics | Events such as "plan generated" or "meal cooked", some with a detail such as a recipe name or a plan choice, linked to your account or, for guests, a random ID stored on the device. Never your weight, allergies, diet or free-text answers. You can turn this off in Profile → Usage analytics. | Understand which features work, and improve them. |
| Free-week records | That a free week was used and when, your account ID while you have an account, and coded (hashed) versions of your email address and of a random ID stored in your phone's Keychain. | Keep the free week to one per person. |
| Purchases | Subscription status, product, dates and App Store purchase events from Apple through RevenueCat. We never receive your card details. | Give you what you paid for, handle disputes, keep tax and accounting records. |
| Technical | Crash reports (device model, app version and what failed, sent without your name, email, account ID or request details). Our providers also process IP addresses and request logs when your device connects. | Keep VITORY secure and working. |
| Website | Cloudflare Web Analytics measures visits to vitory.app in aggregate. We don't use advertising cookies. | Understand how many people visit. |
We get this from you, from your device as you use VITORY, from Apple or Google if you sign in with them, and from Apple and RevenueCat about purchases. Providing it is voluntary, but VITORY can't build a personal plan without your body and food details, and an account needs an email address.
We don't collect data from Apple Health or Google Fit, your precise location, your contacts or your photo library (only the images you choose to attach). Notifications are scheduled on your device, not sent from a marketing list. We don't use advertising or cross-app tracking, and we will only send you marketing email with your prior consent.
Before the app asks for your body, allergy or food details, it asks you to tick a separate box agreeing to VITORY using them to work out your targets and build your plan. We keep a record of that consent. You don't have to agree, but we can't make a personal plan without it.
You can withdraw at any time in Profile → Health data consent. VITORY can't plan without these details, so for an account this deletes the account, and for a guest it clears your answers from the device. Withdrawing doesn't affect what we did before. If you would rather keep your login and have only these details removed, email us.
VITORY works out your targets and plans automatically, using formulas you can see. This doesn't produce legal or similarly significant decisions about you, and you can change the inputs or the result at any time.
We don't sell your personal data and we don't share it for advertising. We use these providers to run VITORY, and they may use it only to provide their services to us:
| Provider | What it does | What it receives |
|---|---|---|
| Supabase | Database, login, file storage | Your account and app data, including sensitive details, and support chats and screenshots. |
| Cloudflare | Hosting for the website and the small services the app calls (support, recipe import, sharing, billing, the recipe catalog), plus website analytics | Requests passing through it, including IP addresses and what the service is handling at that moment. |
| Anthropic | AI for support chat and recipe import | See "AI" below. |
| RevenueCat and Apple | Subscriptions | Your account ID and purchase information. Apple is the seller and handles your payment under its own privacy policy. |
| Apple and Google sign-in | Login, if you choose it | The information needed to sign you in. |
| Resend | Your email address and the content of account emails and support replies, and alerts to our team that include your message. | |
| Sentry | Crash reports | Device model, app version and what failed. We remove identifiers before a report leaves your phone. |
| OpenAI | Creates recipe images in advance | Recipe descriptions only. No personal data. |
We also disclose data if the law or a valid legal process requires it, or where needed to protect someone's safety or our legal rights. If VITORY moves to a company that SSP controls, or to a business that takes it over, your data would move with it under this policy, and we would tell you first (see Section 18 of the Terms).
Anthropic's commercial terms don't allow it to train its models on this content, and it says it deletes API inputs and outputs within 30 days, with exceptions such as usage-policy enforcement and legal requirements. Screenshots you attach aren't sent to AI. Our recipes are written in advance with AI, using no personal data.
Sharing a recipe creates a link that expires after 7 days. It shows the recipe, not who you are, though we keep your account ID against it until then to apply the monthly limit.
We are based in Israel, which the European Commission recognises as providing adequate protection (reconfirmed in January 2024). Most of our providers process data in the United States and possibly other countries, where privacy law may be less protective than yours. For transfers from the UK or EU, we rely on an adequacy decision or on safeguards such as the European Commission's Standard Contractual Clauses and the UK Addendum in our providers' data terms. You can ask us for details.
| Data | How long |
|---|---|
| Account, body and food details, plans, saved recipes, imports, support chats and screenshots | Until you delete them or your account. We don't yet delete inactive accounts automatically. |
| Guest answers, meal logs and grocery ticks | On your device, until you sign out, clear them or delete the app. |
| Free-week records (coded email and device ID) | Up to 2 years after the free week ended, then deleted. The account link is removed when you delete your account. These codes can't be turned back into your email or device ID without a secret key only our server holds, but we still treat them as personal data. |
| App Store purchase records | Up to 7 years, for tax, accounting and disputes. |
| Usage analytics | Up to 2 years. Events linked to your account are deleted with it. Guest events carry only a random ID and aren't connected to your account when you delete it. |
| Copies at providers | Anthropic: as described above. Crash reports, logs and any backups: for the provider's retention period, then removed. |
Go to Profile → Delete account. It happens straight away in the app, with no email step. We delete your account, your answers, plans, weigh-ins, saved recipes, imports, support chats and screenshots, and your linked usage events, and we revoke Sign in with Apple. We keep only the free-week and purchase records above, and whatever a law requires us to keep. It doesn't cancel an App Store subscription, which you cancel in Apple's settings. Apple and RevenueCat keep their own purchase records. Email us if you want us to ask RevenueCat to erase yours.
We use encryption in transit, per-user access rules in our database, hashed free-week records and restricted access to our systems. No system is perfectly secure, so we can't promise absolute security. If a breach affects you, we will notify you and the relevant authorities as the law requires.
Everyone can: see and edit your answers in Profile; download your account data from Profile → Export my data; turn off usage analytics; withdraw consent; and delete your account. For anything else, including a copy of what the export leaves out, email support@vitory.app. We will reply within 30 days, or within the shorter period your law requires. We may need to confirm the request comes from your account email. We won't treat you differently for using your rights.
You can ask for access, correction, erasure, restriction and portability of your data, object to processing based on legitimate interests, and withdraw consent at any time. You can complain to your data protection authority, such as the UK Information Commissioner's Office or the Irish Data Protection Commission.
Under the Privacy Protection Law, 5741-1981, you can inspect your information and ask us to correct or delete it. You can complain to the Privacy Protection Authority.
Depending on your state, you may have rights to know, access, correct, delete and get a copy of your data, and to opt out of sale, targeted advertising and certain profiling. We don't sell your data, use it for targeted advertising or profile you in ways that produce legal effects, and we use sensitive data only to provide the service you asked for. We honour these requests whether or not your state's law applies to a business of our size. If we refuse a request, you can appeal by emailing us, and we will reply in writing. You can use an authorized agent where the law allows. Washington and Nevada residents have the further rights in the Consumer Health Data Notice.
You can ask to access and correct your information, and you can complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner, the Office of the Australian Information Commissioner, or the New Zealand Office of the Privacy Commissioner.
VITORY is for adults aged 18 and older and isn't directed to children. We don't knowingly collect personal information from anyone under 18, including children under 13 as covered by the US Children's Online Privacy Protection Act. If you think a minor has given us information, contact us and we will delete it.
The app stores your answers, plan, meal log and settings on your device so that it can work offline. It also stores a random ID for the free week (in the Keychain, which survives deleting the app) and a random ID for guest analytics. These aren't used for advertising, and we don't track you across other companies' apps or websites, so we don't respond differently to "Do Not Track" signals.
If we change this policy, we will post the new version with a new date, and tell you in the app or by email if the change is material. If we want to use sensitive details for a new purpose, we will ask for your consent first.
Shlomo Shalev Peretz (SSP)
Hatomer 20, Beit Shean, Israel
Email: support@vitory.app
© 2026 Shlomo Shalev Peretz (SSP). VITORY and the VITORY logo are trade marks of SSP. All rights reserved.