Privacy Policy

Vimly. Last updated November 9, 2026.

Who we are

Vimly is made by Jason Luo, an independent developer in Ohio, United States ("we", "us"). This policy covers the Vimly iPhone app, its Apple Watch app, widgets and Siri shortcuts, and the Vimly website. For European and UK data protection law, Jason Luo is the controller of the personal data we handle (mainly the backup of your log if you choose to sign in, and emails you send us). Contact: support@getvimly.com.

The short version

You do not need an account: Vimly works fully on your iPhone without one. Signing in with Apple is optional and only adds a backup of your log. There is no advertising, no analytics and no tracking, and we never sell your data. If you do not sign in, your log lives only on your iPhone and we cannot see it. If you choose to sign in with Apple, a copy of your log is backed up to our server so you can get it back on a new phone; you can delete that copy and your account at any time in Settings. Anything Vimly reads from Apple Health stays on your iPhone and is never backed up or sent to us. Otherwise, data leaves your phone only when you choose: a meal photo or description you ask Vimly to estimate (after you say yes), a barcode or food name you look up, anything you export yourself, and anything you put in an email to us.

What Vimly stores on your phone

Your profile (units, sex, birth date, height, starting weight, goal weight, activity level, goal, pace and lifting days), the meals you log (names, calories, protein, carbs, fat and any photo you attach), your weigh-ins, lift days, workouts, lifts and personal records, the activities you log (kind, length, distance and calories), water, your routines and workout plan choices, your settings and reminder times, and the targets worked out from them. If you turn on Apple Health, the workouts, daily active energy and daily steps read from it are kept here too. This is stored in the app's private storage on your iPhone. Unless you sign in to turn on the optional backup (see “Account and optional backup”), there is no copy anywhere else, so we cannot see it, recover it or hand it to anyone.

Meal ideas and the workout plan maker are worked out on your phone from lists built into the app. Nothing is sent anywhere to make them.

If you use iCloud Backup or back up your iPhone to a computer, that backup can include Vimly's data on your phone. Device backups are controlled by you and Apple under Apple's terms, not by us.

Account and optional backup

Signing in with Apple is optional. Vimly works fully on your phone without it, and an account only adds the optional backup of your log. You can sign in when you first open Vimly or later in Settings > Account; Vimly asks you to agree to the backup before you first sign in.

What Apple gives us: a user ID that is unique to Vimly and, if you choose to share it, an email address. You can hide your real address, in which case we get an Apple relay address that forwards to you. We do not get your Apple password, your Apple Health data or anything else from your Apple Account.
What is backed up once you sign in: a copy of the log saved on your phone, which means your profile (units, sex, birth date, height, weights, goal, pace, activity level and lifting days), your meals and their nutrition, weigh-ins, workouts, lifts and records, routines and plans, activities you log by hand, water, targets, and app settings (such as reminder times and whether you allowed meal estimates). With it we store when it was saved, the app version and a revision number. Changes are uploaded a few seconds after you make them, or when you are next online.
What is not backed up: meal photos, and anything read from Apple Health (Health workouts, active energy, steps, and the lift days and activities Vimly takes from them). After you restore on a new phone, Vimly reads Health again there if you turn it on.
Where it is kept: with Supabase, our hosting provider, on servers in the United States (Amazon Web Services, Ohio). Supabase handles it for us under its data processing terms. It travels over encrypted connections (HTTPS) and Supabase encrypts stored data. Database rules let only your signed-in account read or change your copy; no other user can. We and Supabase can technically reach the stored data to run and secure the service, but we do not look at your log unless you ask us to help with a problem, it is needed to keep the service secure, or the law requires it.
Sign-in records: Supabase's sign-in system keeps records such as when you signed in and the network (IP) address used, for security.
What it is used for: only to keep your log backed up, keep it the same on your devices, and restore it. Not for advertising, not sold, not used to profile you and not used to train AI.
Signing out stops the backup and keeps the log on your phone. The copy in your account stays until you delete the account.
Deleting your account: Settings > Account > Delete account deletes the backup and your sign-in account straight away. The log on your phone stays; “Delete all my data” clears the phone. Copies in our hosting provider's own backups are deleted within six months, and its short-lived logs expire on their normal schedule. Removing Vimly under Sign in with Apple in iOS Settings ends its link to your Apple Account but does not delete the backup: use Delete account, or email support@getvimly.com and we will delete it.
If we ever stop offering backups, we will tell you in the app first, give you time to export, and then delete the copies.

What Vimly does not collect

Vimly does not collect your location, contacts, photo library (beyond a photo you pick), browsing history or advertising identifier. It has no advertising, analytics or tracking code, does not use cookies or tracking pixels, and does not ask to track you across other companies' apps and websites. Vimly and its website do not track you across other apps or sites, so Do Not Track signals have no effect.

Meal estimates (AI)

Vimly can estimate the calories and macros in a meal for you.

When you ask for an estimate, the photo (shrunk to a small size) or your description (up to 280 characters), plus a random ID for this install, is sent over an encrypted connection to Vimly's estimation service, which runs on Supabase. The service sends the meal (not the install ID) through OpenRouter, an AI routing service, to an AI model made by Anthropic (Claude), which reads it and returns calories and macros. OpenRouter may run the model at Anthropic or at a cloud company that hosts Anthropic's models (such as Amazon Web Services or Google Cloud). Vimly asks your permission before the first time, and you can turn it off at any time in Settings. Logging by hand and re-logging never need it.

What is kept: Vimly's service does not save your photo or description after it replies. To limit abuse it counts requests per day, using the random install ID and your network (IP) address. The counts are kept for up to two days under a one-way code made from the ID and the address, never the address itself. The hosting provider may keep short-lived technical logs (such as the time and network address of a request) for security. OpenRouter and the model provider handle the meal under their own commercial terms, which may let them keep it for a limited time for safety and abuse checks; under those terms it is not used to train AI models. The estimate request is not tied to your account, even if you are signed in, and it is never used for advertising. The meal you save, with its numbers, becomes part of your log like any other meal. AI is used only to read the meal you send; it is not used to profile you or to decide anything about you, and you always review the numbers before they are saved. Privacy policies: OpenRouter https://openrouter.ai/privacy and Anthropic https://www.anthropic.com/legal/privacy

Camera and photos

Vimly asks for the camera during setup, and uses it only when you scan a barcode or a nutrition label, or take a meal photo. A photo you pick comes through Apple’s photo picker, which hands Vimly only that photo. A nutrition label photo is read on your phone by iOS and deleted once read; only a barcode number found in it is looked up, as described below. A meal photo you add stays on your phone with that meal and is never uploaded to your account backup. It leaves your phone only if you ask for a photo estimate, as described above.

Food lookups

When you search for a food or look up a barcode, the search words or barcode number are sent to Open Food Facts (openfoodfacts.org), a public food database, which can see your network address like any website. No profile or log data is sent. Food data comes from its contributors and can be wrong.

Apple Health

Vimly reads Apple Health only if you connect it, during setup or in Settings, and only after you allow it in Apple's own permission screen. It reads three things: your workouts (kind, start time, length, distance and the active energy recorded for each), your active energy per day and your steps per day, for the last four weeks and as new data arrives. It uses them only to show the calories you burn, your net calories, your steps and your activities, and to find lift days. It never writes to Health.

What it reads stays on your iPhone. It is not included in your account backup, and it is never sent to us, the estimation service or anyone else. It is never used for advertising, marketing or data mining, never used to decide anything about you, and never sold. It is included in “Export my data” if you choose to export, and, like everything on your phone, it can be part of your own iPhone backup.

Turning Apple Health off in Vimly's Settings stops Vimly reading it and counting it; “Delete all my data” removes what was read. You can also change what Vimly may read in iOS Settings > Health > Data Access & Devices > Vimly.

Apple Watch, widgets, Live Activities and Siri

If you use the Vimly Watch app, Home Screen widgets, the rest-timer Live Activity, or Siri and Shortcuts, Vimly shares a small summary (today's calories and protein eaten and left, water, and a rest timer) with them on your own devices. It does this through Apple's system services: a shared storage area on your iPhone that only Vimly's own parts can read (an App Group), and Apple's private link between your iPhone and your Watch. Nothing goes to a Vimly server. When you speak to Siri, Apple handles your voice under Apple's privacy policy.

Reminders and notifications

If you allow notifications during setup, turn on reminders or start a rest timer, Vimly schedules notifications on your phone. They do not use a server, and Vimly does not send marketing notifications. You can turn them off in Vimly's Settings or in iOS Settings.

Exporting your data

“Export my data” in Settings makes a copy of your log (a JSON file and spreadsheet files), including what Vimly has read from Apple Health, and opens the iPhone share sheet. The files go only where you send them, and whoever receives them handles them under their own terms. Keep them somewhere safe: they hold health information.

“Restore from export” lets you pick a Vimly export file with Apple's file picker. It replaces the log on this phone with the one in the file, on the phone; nothing is sent anywhere to do it. If you are signed in, the restored log is then backed up like any other change (without Apple Health data).

Crash reports and App Store data

Vimly has no analytics or crash-reporting code of its own. If you turned on “Share With App Developers” in iOS Settings > Privacy & Security > Analytics & Improvements, Apple may share crash logs and diagnostics with us; Apple says these do not identify you. Apple also gives developers totals such as downloads, sales and app usage from people who agreed to share it. We use these only to fix problems and understand the app's reach. Apple's privacy policy covers this: https://www.apple.com/legal/privacy/

If you join the TestFlight beta, Apple shares with us your name and email if you were invited by email, crash reports, basic device and usage details, and any feedback or screenshots you choose to send, under Apple's TestFlight terms. We use them only to test and improve the app.

Rating requests

After you have logged on several days, Vimly may ask you to rate the app using Apple's standard rating sheet. Apple controls how often it appears and handles your rating.

Emails to us and the website

If you email us, we receive your email address and whatever you write, plus the app and iOS version if you leave that option on in Contact support. We use it only to answer you and fix problems, and delete it when you ask or when it is no longer needed.

The website has no accounts, forms, cookies, analytics or advertising. Like any website, its hosting provider may keep short-lived server logs (such as network address and pages requested) for security and to keep the site running.

We do not sell personal data, share it for cross-context behavioral advertising, or let anyone track you across apps or websites. The only outside parties involved are Apple (which runs the App Store, iOS, Siri, Sign in with Apple and TestFlight), Supabase (our hosting provider), OpenRouter and the AI model provider (Anthropic, or a cloud company that runs its models) and Open Food Facts, only as described above. Supabase acts as our service provider (processor) under its data processing terms: it may use the data only to provide its service to us. OpenRouter and the AI model provider receive only the meal you send, only to return an estimate, under their own terms; you approve this in the app before the first estimate. We only use providers whose terms commit them to keep the data confidential and secure and to use it only to provide their service to us, apart from the limited safety checks described below. Each has its own privacy policy (Open Food Facts: https://world.openfoodfacts.org/privacy).

We may disclose information we hold if the law requires it, to protect someone's safety, or to enforce our terms. If Vimly is sold or transferred, what we hold (account backups and support emails) may move with it, and this policy will still protect it.

How long data is kept

Your log stays on your phone until you delete it or the app. If you sign in, the backup and your account are kept until you delete the account (or ask us to), and are then deleted straight away; sign-in records and provider logs are kept only for the providers' limited security periods (we delete sign-in records linked to you when you ask), and copies in our hosting provider's backups are deleted within six months. We do not delete a backup just because you have not used it, but if we stop offering backups we will tell you first and then delete them. Estimate requests are not saved by Vimly; daily counts are kept for up to two days, under a one-way code rather than the install ID or network address; hosting and AI provider logs follow those providers' short retention periods. Support emails are kept only as long as needed to help you, or as the law requires.

Security

Your log is protected by your iPhone's own security, such as your passcode, Face ID and the way iOS keeps each app's files private. Keep your phone locked and up to date. Anything Vimly sends travels over encrypted connections (HTTPS). A backup in your account is protected by Sign in with Apple, encryption of stored data at our hosting provider, and database rules that stop other users reading it. No app or service can promise perfect security, so we cannot guarantee it, but we keep the data we handle to a minimum.

If there is a breach of security of personal or health information we hold (including any sharing of it that you did not authorize, not only hacking), we will tell you without unreasonable delay, and in the US within 60 days of finding it, and we will tell the US Federal Trade Commission (under its Health Breach Notification Rule) and other authorities as the law requires. In Europe and the UK, we will tell the data protection authority within 72 hours where required, and tell you without undue delay when the risk to you is high.

Your choices and deleting your data

In Settings, “Delete all my data” removes your profile, meals, photos, weigh-ins, workouts, activities, water, lift days, settings and install ID from this phone at once (and clears the widget, Siri, notification and Live Activity copies; remove the Vimly Watch app to clear the watch), and cannot be undone. Deleting the app does the same, though copies may remain in your own iPhone backups. The estimation service does not store your meals, so there is nothing there to delete. “Delete all my data” also signs you out, so the emptied phone is never uploaded; it does not delete the backup in your account. To delete that, use Settings > Account > Delete account, which deletes the backup and the account at once and cannot be undone. Sign out stops the backup and leaves both copies as they are. Health data in the Health app is yours and is not touched. “Export my data” gives you a copy first. To delete emails you sent us, or anything else we hold, email support@getvimly.com.

Health information (consumer health data)

Calories, meals, weight, body measurements, workouts and activity can count as “consumer health data” under laws such as Washington's My Health My Data Act, Nevada's consumer health data law and similar state laws. This section is Vimly's Consumer Health Data Privacy Policy under those laws.

What we collect: only if you sign in to turn on the optional backup, the backup of your log described in “Account and optional backup” (your body details, birth date and sex, meals and nutrition, weigh-ins, workouts and lifts, activities you log by hand, and the goals and targets worked out from them). If you allow meal estimates, the meal you send passes through our estimation service for that one request and is not kept. If you email us about your health or your log, we receive what you write. We do not receive, store or share Apple Health data: it is read on your phone only.
Sources: you, and what Vimly works out on your phone from what you enter.
Why: to back up and restore your log, to run the features you ask for (such as meal estimates), and to answer your emails. Never for advertising.
Who it is shared with: our processor Supabase, Inc. (stores the backup and runs our services, https://supabase.com), only to provide the service; and, with your consent in the app, OpenRouter, Inc. (routes a meal you send for an estimate, https://openrouter.ai) and Anthropic, PBC (makes the AI model, https://www.anthropic.com), or a cloud company that runs Anthropic's models for OpenRouter, only to return the estimate. We have no affiliates, we never sell consumer health data, and we do not use geofences around health care locations.
Consent: we collect consumer health data only with your consent: agreeing to the backup in the app before you first sign in, after it tells you what the backup holds, and allowing meal estimates. You can withdraw it at any time by deleting your account (Settings > Account > Delete account) or by turning meal estimates off in Settings. Signing out stops any further collection.
Your rights: you can ask us to confirm whether we collect, share or sell your consumer health data, to see it, to get the list of everyone we shared it with (named above) and how to contact them, to delete it, and to withdraw consent, and you can appeal our answer, as described in the next section. When you ask us to delete, we delete your data and your account straight away and tell our processors to delete it too; copies in their backups are deleted within six months. If we deny your appeal, you can complain to your state attorney general: in Washington, https://www.atg.wa.gov/file-complaint; in Connecticut, https://portal.ct.gov/ag; in Nevada, https://ag.nv.gov. You will not be treated differently for using these rights.

Your privacy rights (US states)

Residents of California (CCPA/CPRA), Washington, Nevada, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with privacy laws have rights over their personal data. Some of these laws may not apply to a developer of our size, but we honor these rights for everyone:

Know and access: what personal data we hold about you, where it came from, why, and who it goes to.
Delete it, and correct it.
Opt out of sale, sharing for targeted advertising, and profiling. We do none of these, so there is nothing to opt out of.
Limit the use of sensitive personal information. We use it only to provide the service you ask for, and never to infer things about you, so there is nothing to limit.
Not be treated differently for using any of these rights.

What we collect, by category (in the last 12 months): identifiers (if you sign in, the Apple user ID for Vimly and your email or Apple relay address; network address in sign-in records); a random install ID and network address, briefly, for estimates; health and body information and your birth date and sex, which are sensitive personal information (the backup of your log, if you sign in); photos (a meal photo you send for an estimate, not kept); and the content of messages you send us and of meal estimate requests. Sources: you, and Apple when you sign in with Apple. Purposes: providing the app and the backup, security and preventing abuse, and answering you. We disclose these categories only to the parties named in “Who we share data with”, for those purposes. We have not sold or shared personal information as those laws define it, and we do not knowingly sell or share the data of anyone under 16. How long we keep each kind is set out in “How long data is kept”.

To make a request, email support@getvimly.com from an address we can reply to (for your backup, the email linked to your account helps us find it). We may ask a question to confirm it is you, and an authorized agent can ask for you with your permission. We answer within 45 days (or tell you if we need up to 45 more). If we decline, you can appeal by replying with “Appeal” in the subject; if you are unhappy with the result of the appeal, you can contact your state attorney general (for example in Washington, https://www.atg.wa.gov/file-complaint; in Connecticut, https://portal.ct.gov/ag; in Nevada, https://ag.nv.gov).

If you are in the European Economic Area, the UK or Switzerland, the GDPR, the UK GDPR or Swiss law gives you extra protections.

Controller: Jason Luo, support@getvimly.com.
On your phone: your log is processed on your own device, by you, and we receive it only if you sign in to back it up. Apple Health data never leaves your phone.
Lawful bases: the backup of your log relies on your explicit consent (GDPR articles 6(1)(a) and 9(2)(a)), which you give by tapping “I agree” before the first sign-in and can withdraw at any time with Settings > Account > Delete account; meal estimates rely on your explicit consent (which also covers any health information in the meal), and you can withdraw it in Settings at any time; sign-in records and abuse limits (install ID and network address) rely on our legitimate interest in security and preventing abuse (article 6(1)(f)), and you can object by email; support emails are handled in our legitimate interest in answering you; and we keep records when the law requires it. Withdrawing consent does not affect processing before it.
Providing data: you do not have to give us any personal data to use Vimly. The backup and meal estimates need the data described above and cannot work without it.
Your rights: access, correction, deletion, restriction, portability (“Export my data” gives you your log in a reusable format), objection, and withdrawing consent at any time without affecting earlier processing.
Where your data goes: Vimly is run from the United States. Data Vimly's services handle is processed in the United States: the backup and the estimation service at Supabase (US region, Ohio), and, for meal estimates, OpenRouter and Anthropic (or a cloud company that runs its models) in the US. Where UK law requires a safeguard for this transfer, the provider's data processing terms supply it. The US may not protect personal data as strongly as your country, and US authorities may be able to request it.
No automated decisions: Vimly works out your targets with formulas on your phone. This has no legal or similarly significant effect, and you can change any target by hand.
Requests: email support@getvimly.com. We answer within one month, or tell you within that month if a complex request needs up to two more.
Complaints: tell us first if you can. You also have the right to complain to your local data protection authority (in the UK, the Information Commissioner's Office, ico.org.uk).

Children

Vimly is for people 13 and older. Once a birth date under 13 is entered, setup stays closed on that phone. We do not knowingly collect personal information from children under 13, as required by the US Children's Online Privacy Protection Act (COPPA). The app asks for a birth date only to set safer targets and to keep out anyone under 13; it stays on the phone, and is in your backup only if you sign in. If you believe a child under 13 has given us personal information, email support@getvimly.com and we will delete it. Teens aged 13 to 17 should read this policy with a parent or guardian. Where the law sets a higher age for consenting to the use of health data (16 in some places), people under that age should use the optional backup and meal estimates only with a parent's consent. Vimly works fully on the phone without them. We never sell or use any teen's data for advertising.

If this policy changes

If a future version collects or shares anything new, we will update this policy before it ships, change the date below, and, for anything that sends new data off your phone, ask you in the app before the first time. We will not use data we already hold in a new way without asking you first. The current version is always in the app under Settings and on the Vimly website, and earlier versions are available on request.

Contact

Questions or requests about privacy: support@getvimly.com (Jason Luo, Ohio, United States). This policy takes effect on, and was last updated, November 9, 2026.