What we do and don't with your data.

Vayl exists to organize the transcript your body has been writing for years. To do that, you trust us with categories of data that are sensitive by every legal definition that matters: biometric, health-adjacent, and behavioral.

This page describes how Vayl uses your data. The date of its latest change is at the bottom.

Data we collect

• Account: email, hashed password (Supabase Auth), username, sex, date of birth, height, language, time zone and unit preferences.
• Logs you create or import: training and cardio sessions, meals, hydration, what you take, supplements, sleep, lab results, weight, body measurements, DEXA records, glucose, blood pressure, HRV/RHR and other vitals, symptoms, injuries, menstrual period records, mindful sessions, goals and schedules.
• Health imports: only if you connect the Apple Health app and grant permission (your Apple Watch data arrives through it). Vayl reads what you authorize, and writes back only the mindful minutes of sessions you complete.
• Location: Vayl does not track your live location. With your permission, it imports the routes saved with workouts in the Apple Health app, by your watch or another app. A route is stored with its workout, included in your export and deleted with your account.
• Progress photos: only the photos you take in the app, stored in your account.
• Purchases: Apple handles the payment, so we never see a card number. Vayl receives and stores Apple's signed record of each purchase (product and transaction identifiers, subscription dates, renewal and refund status). That record is what opens the web terminal for the same account.
• Website usage telemetry (PostHog, active): page views and interaction events on the public pages of vayl.pro, stored under a first-party identifier in a cookie and in local storage. No log content and no health data are ever sent. Session recording is off. We honour Do Not Track: with it enabled, nothing is collected.
• Website error reports (Sentry): errors from vayl.pro, with performance tracing and session recording off.
• iPhone app: no advertising SDK and no product-analytics SDK. It carries a crash reporter (Sentry) that sends crash reports linked to your account ID, with screenshots and screen recordings off. Version 1.0 also sends performance traces, profiling samples and an installation identifier; version 1.0.1 turns those off. Sentry is declared in the app's privacy manifest.

Where it lives

Supabase Postgres stores your account and logs in Ireland (eu-west-1), encrypted at rest. PowerSync keeps a read-only sync copy in the United States. On your iPhone, logs are stored locally in SQLite and synced when online, so the app works offline.

Services that process data for Vayl

Vercel hosts the website. Supabase provides the database, sign-in and file storage. PowerSync syncs your records. Sentry receives error reports. PostHog receives website usage events. Apple handles purchases. Open Food Facts receives food searches and scanned barcodes.

What we never do

• Sell or rent your data. Not to advertisers, not to insurers, not to anyone.
• Train AI models on your data.
• Share your data beyond the services listed above.

Deletion and retention

Deleting your account now starts locking it and queues the erasure of your logs and photos, which is designed to finish within a few hours; a session that is already open can stay valid until it expires. If you schedule deletion instead, it starts after the 30-day grace period. Billing and deletion-audit records are kept, with the identifiers they need. Backups, the sync copy and crash reports expire on their own schedules.

Your rights

Vayl is for adults 18 and over. From the iPhone app you can export your logs as CSV or JSON. The file is generated on your device and leaves it only if you share it. Progress photos are listed as file references, not included as images; the detailed sleep-stage timeline is not in the file (stage totals are), and neither are records not yet synced to that iPhone. You can delete your account in the iPhone app (avatar, then Profile, then Delete Account), now or with a 30-day grace period. Deleting the account does not cancel an Apple subscription: only you can do that, in your Apple Account settings. You can also request deletion by emailing privacy@vayl.pro. Under GDPR (EU) and LGPD (BR) you have the right to access, rectification, erasure, portability, and objection to processing.

Contact

João Batisti, founder. Lisbon, Portugal. privacy@vayl.pro.

Last updated · 2026-10-10