Privacy Policy

On this page

This Privacy Policy describes how personal information is collected, used, disclosed, and protected when you use the Veltza mobile application and related services (the “Service”). By using the Service, you agree to this Privacy Policy.

1. Who we are (data controller)

The Service is operated by Bursan Anamaria (“we,” “us,” or “our”), sole proprietor, with principal place of business at Str. Ion Budai Deleanu nr. 20, ap. 1, 300146, Timișoara, Timiș, Romania. The product brand name is Veltza.

Contact: support@veltza.app
Website: https://veltza.app

If you are in the European Economic Area or United Kingdom, you may lodge a complaint with your local data protection authority. In Romania, the supervisory authority is the ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal).

2. Information we collect

2.1 Account and profile

Email address and password (email sign-up), or authentication data from Google or Apple Sign-In
Display name and optional profile photo (avatar)
Onboarding details such as age, gender, height, weight, and fitness goal
Timezone and notification preferences
Subscription status (free or Veltza Pro), synced via app stores and RevenueCat
Affiliate or referral codes and referral attribution

2.2 Health and fitness data

Veltza is a fitness and wellness app. With your permission, we process health-related information you provide or sync, including:

Workout logs (exercises, sets, reps, weight, duration, volume)
Nutrition logs (calories, macros, meal labels, hydration)
Body progress entries (weight, body fat percentage, progress photos)
Program enrollment and training history
Streak and habit activity (Rest Days, Comebacks, Recovery Week)
Personal records, rank points, integrity score, league participation, and achievements
Optional wearable and platform health data from Apple Health or Google Health Connect when you connect: steps, active energy, resting heart rate, heart rate variability (HRV), sleep stages (deep, REM, core/light), bedtime and wake time, recovery and sleep scores, and related snapshot data

We do not collect precise GPS location for tracking your movements. Camera, photo library, and microphone access are used only with your device permission (barcode scanning, meal photos, profile and community images, coach voice dictation).

2.3 AI Coach data

If you use Veltza Coach (a Veltza Pro feature), we process:

Messages you send to Coach and Coach replies
AI-generated memory summaries derived from your workouts, nutrition, hydration, health sync, and coach history
Recent fitness, nutrition, hydration, and health context used to personalize responses
Meal photos or barcode data you submit for logging assistance
Usage metadata (model type, token counts, estimated API cost) for rate limits and abuse prevention

2.4 Voice input

If you dictate messages to Coach, your device’s speech recognition service (Apple Speech on iOS or Google Speech on Android) processes microphone audio to produce a text transcript. The transcript is sent through our Service to Coach and may be transmitted to Anthropic to generate replies. We do not store raw audio recordings on our servers.

2.5 Community and social features

Posts, captions, images, likes, polls, and comments you create
Follow relationships and public profile information (display name, avatar, goal, rank, integrity score) visible per app settings
Reports and blocks related to moderation

2.6 Device, technical, and analytics data

Device type, operating system, and app version
Push notification tokens (stored on our servers to deliver notifications you enable)
Diagnostic, crash, and performance logs necessary to operate and secure the Service
Product analytics via PostHog (EU-hosted at eu.i.posthog.com): funnel events, feature usage, and a persistent analytics identifier. When you sign in, we may associate your user ID and email address with analytics events

2.7 Payment information

Purchases of Veltza Pro are processed by Apple App Store or Google Play. We do not receive your full payment card number. We receive subscription status and purchase identifiers through RevenueCat.

2.8 Waitlist (if applicable)

If you joined a pre-launch waitlist, we may have collected your email address and optional name to send launch-related communications.

3. Artificial intelligence and automated processing

Veltza uses artificial intelligence and automated systems. This section describes what they do, what data they use, and what decisions they influence — as required for transparency under consumer protection and privacy laws.

3.1 AI systems we use

Veltza Coach — conversational fitness and nutrition assistance
Instant Log — meal photo or barcode analysis to propose nutrition entries
Automated moderation — text rules and image review before community posts and avatars are published
Coach memory — compressed summaries of your activity to personalize Coach over time
Gamification automation — streak scoring, rank points, seasons, and integrity score calculations

3.2 Data sent to Anthropic

Coach, Instant Log, image moderation, and coach memory features transmit data to Anthropic (Claude models) via API, including: your messages, fitness and nutrition logs, health sync summaries (such as steps, sleep, resting heart rate, HRV), coach history, meal photos (which may incidentally include background people or scenes), and images submitted for moderation.

3.3 What AI influences — and what it does not

Training and nutrition suggestions, meal logging proposals (you must confirm before saving), and content approval or rejection
Personalization of Coach replies based on your history and optional health data

AI outputs are not medical diagnoses, emergency triage, or binding decisions with legal effect. Coach is not a human and is not a licensed health professional.

3.4 How we use AI data

Prompts and context are processed under Anthropic’s commercial API terms to generate responses for you
We do not sell your personal information or health data for advertising
We do not use your data to train our own foundation models
Coach availability may be subject to monthly usage limits; when limits apply, Coach may be temporarily unavailable until the next reset period

3.5 Opting out of AI processing

You can avoid Coach and Instant Log by not using those features, disconnect health integrations in Settings, and delete your account to remove stored coach history and memory. See Section 9 for account deletion.

4. How we use information

Provide, maintain, and improve the Service
Authenticate you and secure your account
Sync workouts, nutrition, streaks, programs, and ranks across your devices
Operate Veltza Coach, Instant Log, and optional health integrations
Run product analytics (PostHog) to understand feature usage and improve the app
Process referral attribution and award rank points per program rules
Send push notifications you opt into (streak reminders, social activity, coach, achievements)
Process subscriptions and restore purchases
Moderate community content and enforce our Terms of Service
Comply with law and respond to lawful requests

We do not sell your personal information. We do not use your health data for third-party advertising or offer walls.

5. Legal bases (EEA/UK users)

Where GDPR applies, we rely on:

Contract — to provide the Service you request
Consent — for optional features (health sync, push notifications, camera/photos/microphone, AI Coach)
Legitimate interests — security, fraud prevention, product analytics, moderation, and service improvement (balanced against your rights)
Legal obligation — where required by law

Health and fitness data may be treated as sensitive; we process it only as needed to deliver features you enable. You may withdraw consent at any time in app settings or by disconnecting integrations.

6. How we share information (processors)

We share information only with service providers that help us operate the Service, under contractual safeguards:

Supabase — authentication, database, file storage, and serverless functions
Anthropic — AI Coach, meal vision analysis, image moderation, and coach memory processing
PostHog (EU cloud) — product analytics and funnel events
RevenueCat — subscription management
Apple — Sign in with Apple, App Store billing, Apple Health (if enabled), speech recognition (if used), push delivery via APNs
Google — Google Sign-In, Play billing, Health Connect, ML Kit barcode scanning, Android speech recognition, push delivery via FCM
Expo / EAS — push notification delivery infrastructure
USDA FoodData Central — food search queries (text only; not your identity)
Open Food Facts — barcode and food lookup queries
Resend — transactional email (waitlist, launch communications)
Gmail SMTP — transactional email fallback

We may also disclose information if required by law, to protect rights and safety, or in connection with a merger or acquisition.

7. International transfers

Your data may be processed in the European Union, United States, and other countries where our providers operate. Where required, we use appropriate safeguards such as Standard Contractual Clauses for transfers outside the EEA. PostHog analytics for this Service is configured to use EU hosting where available.

8. Data retention

Account and profile data — while your account is active
Coach messages and memory nodes — until you delete them or delete your account
Health snapshots — until you delete your account or disconnect and clear related data
Community posts — until you delete them or delete your account (cascade deletion)
Analytics — event data may persist in PostHog in de-identified or aggregated form; we reset analytics identity on logout and sever the link to your account on deletion. Contact us to request additional erasure
Legal and security logs — as required for compliance, fraud prevention, or dispute resolution
Backups — limited rolling retention after deletion, then purged

9. Your rights and choices

Depending on your location, you may have the right to:

Access, correct, or delete your personal information
Export your data — all users may use Settings → Data → Export data in the app, or email support@veltza.app from your registered address for a copy within 30 days
Object to or restrict certain processing
Withdraw consent for optional processing
Lodge a complaint with your local data protection authority (including ANSPDCP in Romania)

Account deletion: Use our account deletion page, or Settings → Data → Delete account in the app (type DELETE to confirm). You can also email support@veltza.app if you cannot access the app.

California residents (CCPA/CPRA): We do not sell or share personal information for cross-context behavioral advertising. You may request access, deletion, or correction as described above.

Virginia (VCDPA) and Colorado (CPA): You have similar rights to access, delete, correct, and opt out of sale (we do not sell personal data). Contact support@veltza.app.

10. Security

We use industry-standard measures including encryption in transit (HTTPS/TLS), access controls, and row-level security in our database. No method of transmission or storage is 100% secure. If we become aware of a breach affecting your personal information, we will notify you and regulators as required by applicable law.

11. Children

The Service is not directed to children under 13 (or under 16 in the EEA where applicable). We do not knowingly collect personal information from children below those ages. Contact us if you believe a child has provided data and we will delete it.

12. Third-party links and food databases

Food search results may come from public databases (USDA, Open Food Facts). Their accuracy is not guaranteed. Third-party services have their own privacy policies.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version at this URL and update the “Last updated” date. Material changes may be communicated in-app or by email where appropriate.

14. Contact

Privacy questions or requests:
Bursan Anamaria
Str. Ion Budai Deleanu nr. 20, ap. 1, 300146, Timișoara, Timiș, Romania
support@veltza.app