What we do and don't with your data.

Vayl exists to organize the transcript your body has been writing for years. To do that, you trust us with categories of data that are sensitive by every legal definition that matters: biometric, health-adjacent, and behavioral.

This page is intentionally short. It's the truth about how your data flows, and it will get longer (subprocessor list, retention windows, DPA) as Vayl ships paid plans. Every addition is dated on this page.

Data we collect

• Account: email, hashed password (Supabase Auth), display name if provided.
• Logs you create: training sessions, meals, what you take, supplement logs, sleep, biomarkers, weight, HRV/RHR.
• Wearable imports: only if you explicitly connect a source (HealthKit, Apple Watch). Vayl reads what you authorize, nothing else.
• Website usage telemetry (PostHog, active): page views and interaction events on vayl.pro, stored under a first-party identifier in a cookie and in local storage. No log content and no health data are ever sent. Session recording is off. We honour Do Not Track: with it enabled, nothing is collected. The iPhone app ships no advertising SDK and no product-analytics SDK. It does carry a crash reporter (Sentry), which is how a crash becomes a fix, and which is declared in the app's privacy manifest.

Where it lives

Supabase Postgres in Frankfurt (eu-central-1), encrypted at rest. Sync via PowerSync (read-only mirror). Logs you create on iOS are stored locally in SQLite and synced when online, so your phone is offline-first.

What we never do

• Sell or rent your data. Not to advertisers, not to insurers, not to anyone.
• Train AI models on individual user data without explicit, granular consent per dataset.
• Share with third parties beyond the subprocessors required to run the product (hosting, auth, sync).
• Retain data after you delete your account (30-day grace for accidental deletion, then hard-deleted).

Your rights

You can export everything you've logged from the iPhone app, in CSV or JSON. The file is generated on your device. You can request deletion by emailing privacy@vayl.pro. Under GDPR (EU) and LGPD (BR) you have the right to access, rectification, erasure, portability, and objection to processing.

Contact

João Batisti, founder. Lisbon, Portugal. privacy@vayl.pro.

Last updated · 2026-07-27