Velora uses cloud AI to read your meals, so some data does leave your device. This policy explains exactly what, where it goes, and the control you have over it.
Last updated: June 2026
Velora ("the App") is operated by Velora Health ("we", "us", "our"). This policy covers the Velora iOS app and its backend service at api.velorahealth.io. Velora is a wellness and food-diary tool, not a medical device (see our Terms of Use).
We collect only what's needed to run the food-symptom analysis:
We do not collect advertising identifiers, contacts, or precise location.
When you log a meal by photo, the image is compressed on your device (to about 768px) and sent over an encrypted connection to our backend together with your sign-in token. There it is passed to a third-party AI vision provider to identify ingredients:
After analysis, the image itself is discarded - we do not store your meal photos long-term or in any image cloud bucket. We retain only the parsed result (ingredient names and labels) and a perceptual hash, which lets us recognise a repeat meal without re-analysing it. These AI providers process the image to return ingredients and do not use your data to train their models for our integration.
If you grant permission, Velora reads - read-only - your sleep and menstrual cycle data from Apple Health. These are summarised (e.g. hours slept, cycle phase) and used purely as statistical confounders, so the app can tell when a symptom may be linked to poor sleep or your cycle rather than a food.
Velora never writes to Apple Health, and Health data is never used for advertising or sold or shared with third parties. You can revoke access anytime in iOS Settings → Health → Data Access & Devices.
Your logs are stored in an encrypted PostgreSQL database hosted on Google Cloud Platform, associated with your anonymous account identifier. Data is transmitted over TLS. A copy of your meals, symptoms and context is also cached locally on your device (Apple SwiftData) so the app works offline and syncs when you reconnect.
We share data only with the providers needed to deliver the service, acting as our processors:
We do not use third-party advertising, analytics or crash-reporting SDKs, and we never sell your data.
We keep your account and logs until you delete them. You can erase everything at any time using Delete account in the app's Settings, which removes your data from our servers; deleting the app also removes the local copy. You may also email us to request deletion.
Depending on where you live (e.g. under GDPR or CCPA), you have the right to access, correct, export or delete your personal data, and to object to certain processing. We do not sell personal information. To exercise any right, use in-app deletion or contact us at the address below.
Velora is not directed at children under 13 (or the minimum age required in your country) and we do not knowingly collect their data.
If we make material changes we will update the "Last updated" date above and, where appropriate, notify you in the app. Continued use after changes constitutes acceptance of the updated policy.