Privacy

Your meal photos stay on your phone. The estimate is computed on the device, and there is no upload path for images anywhere in VitaProva.

No meal photo leaves your phone

Recognition, depth, volume, density and the nutrition look-up all run locally. This is not a setting you have to find and it is not a promise about our intentions: there is no endpoint that accepts image data, no photo-submission programme, and no "help improve the model" flow in any build. A network test runs over every flow in the app — capture, logging, editing, telemetry, bundle updates, purchases and deletion — and fails the release if any image data appears on the wire.

What does leave the device — the complete list

These are all of them. Nothing else leaves the device.

1. The barcode of a packaged food. If you scan a barcode, that number is sent to Open Food Facts to look up the product. The barcode goes; nothing about you goes with it.
2. Counts and timings, on an allowlist. To know whether the product works we collect things that can be counted: how many estimates were confirmed, how long a capture took, which depth mode was used, which app and bundle version you are on, which onboarding step was reached. The allowlist is a fixed list, and anything not on it is rejected by our server rather than stored. It never includes a food, a weight in grams, a calorie value, a goal, your body weight, anything you typed into a search box, or anything a safeguard did.
3. Purchase verification. When you subscribe, a receipt is verified so your subscription can be recognised on your devices.
4. Model bundle downloads. The app downloads signed updates to its recognition and calibration data.
5. Crash and error reports. Sent to Sentry, our error-reporting provider, with no food data in them.
6. An App Attest exchange with Apple. A check that the app is genuine and running on a real device, which is what lets us run a service without accounts.
7. A waitlist code, if you have one and choose to enter it. Optional.

What this website collects

This section is about vitaprova.com, the site you are reading, not about the app. The list above describes your phone; this one describes this web server, so that neither is mistaken for the other.

• Your email address, if you join the waitlist, with your consent and the time you gave it. We use it to email you about the launch and nothing else, and every email carries an unsubscribe link.
• Errors on this site, reported to Sentry so we can fix them. These carry no form values and no email addresses.

This site sets no cookies, runs no analytics, and loads no third-party fonts, embeds or trackers — which is why you have not been asked to accept anything.

Your log is yours

Your food log is processed and stored on your device. There is no account in this release, so there is nothing for us to look up.

Export. You can export your data as a file produced on the device, in JSON and CSV, and hand it to whatever you like through the share sheet. There is no server-side export, because there is no server-side copy.

Encrypted sync, later. A future release will offer optional sync. Those copies are encrypted on your device before they are uploaded, with a key we do not hold, so we cannot read them. They contain no photos or thumbnails — the encrypted store holds your log entries, not your images, so sync is not a route by which a photo could leave your phone in any form. If you lose both your passphrase and your recovery code, the synced copy cannot be recovered — by you or by us — and the app will say so before you turn it on.

Deleting your data

You can delete VitaProva's data from your device at any time, and you can ask us to delete anything we hold using the deletion form.

Deleting your data does not cancel your subscription. Your subscription lives with Apple, not with us. Cancelling is done in your App Store settings, and Restore Purchases will always bring an active subscription back.

Backups

When we complete your deletion request, your data is removed from our live database within 30 days. Encrypted backup copies made before that point are kept for a short period and then destroyed automatically: daily backups for 30 days, and one weekly backup for up to 90 days. Those backups are encrypted and can only be opened with a key held offline — they are never used to look anything up, only to restore the whole database after a failure. If we ever do restore from one, we re-apply every deletion that had already completed.

Putting those together, the longest it can take from your request to the last encrypted copy of your data expiring is about 120 days: up to 30 days to complete the deletion in the live database, and up to 90 more for the oldest weekly backup taken before it to reach the end of its retention. We state the figure rather than leave you to work it out.

Where the nutrition data comes from

Energy and macronutrient values come from USDA FoodData Central, which is in the public domain, embedded in the app so it works offline. Packaged foods are looked up live from Open Food Facts, which is licensed under the Open Database Licence; we query it and never merge it into our own database.

Children

VitaProva is for adults. It is not intended for anyone under 18.

Contact

Questions about privacy: get in touch. VitaProva is published by CoreLink AI Technologies Limited, registered in England and Wales, company number 15841553.