Back

Privacy Policy

Last updated: April 22, 2026

1. Who we are

VECTYR ("we", "us", "our") provides AI-driven physique and performance coaching software. Contact: techwise.123321@gmail.com.

2. Data we collect

  • Account: email, display name, authentication tokens.
  • Profile: age, gender, height, weight, training experience, sport, dietary restrictions, goals.
  • Health & fitness data: workouts, sets, reps, RPE, body measurements, body fat (if you input it), nutrition logs, hydration, sleep quality, soreness, recovery scores, and progress photos. This is sensitive personal data.
  • AI inputs: meal photos, descriptions, and chat messages you submit to AI features are processed by our AI sub-processor (Google Gemini) to generate responses. Inputs are not used to train third-party models.
  • Payments: handled by Stripe — we never see card numbers. We receive subscription status and an opaque customer ID only.
  • Usage: anonymized analytics (PostHog) and crash reports (Sentry) to improve the product. No tracking pixels.

3. How we use it

To deliver the service: generate adaptive programs, track progress, power the AI coach and meal scan, process subscriptions, prevent abuse, and detect bugs. We do not sell personal data, share it for cross-context behavioral advertising, or use your health data for advertising.

4. Legal basis (EU/UK users)

We process your data based on (a) contract — to provide the service you signed up for; (b) consent — for sensitive health data, AI processing of inputs, and progress photos (you can withdraw at any time by deleting the data or your account); (c) legitimate interests — for fraud prevention, security, and product improvement; (d) legal obligation — for tax, accounting, and lawful requests.

5. Sharing & sub-processors

We share data only with the following sub-processors, each bound by data-processing agreements:

  • Supabase — hosting, database, authentication, file storage (progress photos).
  • Stripe — payment processing and subscription management.
  • Google Gemini — AI coach, meal scan analysis, progress notes.
  • USDA / OpenFoodFacts — read-only food database lookups (no personal data shared).
  • PostHog — anonymized product analytics.
  • Sentry — error and crash reporting.

We may disclose data if required by law, valid legal process, or to protect the rights, safety, or property of users, the public, or VECTYR.

6. Data retention

We retain account and activity data for as long as your account is active. After deletion, data is removed within 30 days from primary systems and within 90 days from encrypted backups. Anonymized aggregate data may be retained indefinitely. Payment records are retained as required by tax and accounting law.

7. Your rights

Subject to your jurisdiction, you may have the right to:

  • Access a copy of your data — Profile → Export Data (full JSON export).
  • Rectify inaccurate data — edit in Profile or contact us.
  • Delete your account and data — Profile → Settings → Delete Account.
  • Restrict or object to certain processing — contact us.
  • Withdraw consent at any time (does not affect prior lawful processing).
  • Lodge a complaint with your local data protection authority (EU/UK).

California (CCPA/CPRA), Colorado, Connecticut, Virginia, Utah residents: you have additional rights to know, delete, correct, opt out of sale or sharing (we do not sell or share for cross-context behavioral advertising), and limit use of sensitive personal information. Contact us to exercise these rights. We do not discriminate against users who exercise their privacy rights.

Requests are honored within 30 days (45 for CCPA, extendable once).

8. Security

All traffic uses TLS. Database access is enforced by row-level security so users can only access their own records. Progress photos are stored in a private bucket and served only via short-lived (1-hour) signed URLs tied to your authenticated session. No system is 100% secure — promptly notify us of any suspected breach.

9. International data transfers

Your data may be processed in the United States and other countries where our sub-processors operate. Where required (EU/UK → US), transfers are protected by Standard Contractual Clauses or equivalent safeguards.

10. Children

VECTYR is not directed to users under 16 and we do not knowingly collect data from anyone under 16. If you believe a minor has created an account, contact us immediately and we will delete the data. Do not upload progress photos of minors under any circumstances.

11. AI processing disclosure

When you use AI features (Coach, Meal Scan, progress notes), your inputs (text, images) are sent to our AI sub-processor for inference. AI outputs are estimates, may be inaccurate, and are not medical or professional advice. Inputs are not used to train third-party AI models and are not retained beyond what is required to return the response.

12. Changes

We will notify you in-app or by email at least 14 days before material changes take effect.