Privacy Policy

Last updated 14 October 2026

Vitals is a nutrition tracker made by Adam Thwaites, an individual developer in the United Kingdom. This policy explains what the app stores, what leaves your phone, and what it never does.

What stays on your phone

The app keeps its own database on your device. Unless you sign in, that database is the only place your information exists, and nobody else — including us — can reach it.

• Everything you log: foods, portions, meals and the day they belong to
• Your targets, and the height, weight, age and activity level used to work them out
• Weight, water and any other measurements you record
• Which foods you have looked up, so they can be offered again

If you create an account

An account exists for one reason: so your diary survives a lost or replaced phone, and appears on more than one of your devices. If you never sign in, the app works fully and nothing is uploaded.

When you do sign in, the information above is copied to our database, which is run by Supabase and hosted in London. Each account can reach only its own rows; this is enforced by the database itself rather than by the app asking politely, and it is tested.

• Your email address, so the account can be identified and recovered
• The food and measurement records described above
• Nothing else. No contacts, no location, no advertising identifiers

Signing in

There are three ways in, and none of them involves a password:

• Sign in with Apple. If you use Hide My Email, we only ever see the relay address Apple gives us
• Sign in with Google, which tells us your email address and nothing more
• Email, where we send a six digit code. We store the address; there is no password to lose

The camera and barcodes

The camera is used to read barcodes, and for nothing else. The picture is examined live on your phone to find the numbers: no photograph is taken, saved, or sent anywhere.

The barcode number itself is sent to Open Food Facts to look up the product. That request carries the barcode and nothing identifying you.

Where nutrition data comes from

The app ships with its reference data inside it, so looking up a food needs no network and tells nobody what you ate.

• McCance and Widdowson's The Composition of Foods Integrated Dataset, © Crown copyright, used under the Open Government Licence v3.0
• USDA FoodData Central, which is in the public domain
• Open Food Facts, used under the Open Database Licence, for packaged products looked up by barcode

Subscriptions

Subscriptions are handled by Apple, through RevenueCat. We are told whether a subscription is active; we never see your card details, and Apple never gives them to us.

What we never do

• We never sell your information, or share it for advertising
• There are no adverts in the app
• We do not send what you eat to any artificial intelligence service
• We do not use third party analytics or tracking. If that ever changes, this policy changes first

Your rights

Under UK data protection law you can ask for a copy of what we hold, ask for it to be corrected, or ask for it to be deleted.

Deleting your account inside the app removes your records from our database. If you would rather ask, email Vitals.help@outlook.com and it will be done within 30 days. Deleting the app alone removes everything held on that phone, but does not delete an account if you made one.

Records are kept for as long as the account exists, and removed when it is deleted.

Children

Vitals is not intended for children under 13, and we do not knowingly collect information from them.

Changes, and how to reach us

If this policy changes in a way that matters, the date at the top changes and the app will say so. Older versions are not kept secret; ask and you will be told what changed.

Adam Thwaites — Vitals.help@outlook.com