Privacy Policy, Peeled Back Layer by Layer

Base layer: no account

Vitality Ledger has no sign-up, login, or profile. We do not run our own server that stores your meals, workouts, water, or drafts. There are no in-app purchases in this release.

Layer 1: what stays on your iPhone

Vitality Ledger keeps these in its private app storage on this device:

• meal lines you save for each sitting;
• workout stamps (sport kind and duration);
• water sips and the day totals used for your week recap;
• optional draft memory of earlier confirmed AI lines for the same day and channel;
• your choice to share draft data with cloud AI.

Typing a meal, tapping a water cup, and logging a workout without AI all happen on the device.

Layer 2: what leaves the device, and only after you allow it

Optional draft helpers use third-party cloud AI. Before the first outbound draft, Vitality Ledger shows a consent screen; nothing is sent unless you tap Allow. After that:

• Photo draft — the app reads text on this phone from your meal, workout, or water photo (on-device OCR). DeepSeek receives that OCR text, today’s date, the channel (meal, move, or water), the meal sitting when relevant, and earlier confirmed summaries for that day and channel. The photo image file itself stays on this phone.
• Dictation draft — the spoken audio clip you record is sent to StepFun for transcription. The transcript is then sent to DeepSeek with the same date and channel context as above.
• Read-aloud after confirm — when you save a confirmed AI draft, the confirmed ledger line text may be sent to StepFun text-to-speech so the app can speak it back. Local playback uses the returned audio.

DeepSeek and StepFun process requests under their own privacy policies and may do so outside your country, including in China. Vendor policies are linked from the Allow screen and from Me. We do not use these requests for advertising.

You can withdraw consent at any time: Me → turn off AI data sharing. Vitality Ledger then stops further outbound drafts. Typing, cup taps, and workout logging keep working.

Layer 3: camera, Photos, and microphone

Camera opens only when you choose a photo draft. Album picks use the photo library when you import. Microphone opens only when you dictate. After you confirm a draft that includes a photo, the app may ask for add-only Photos access to save that picture into your library; declining keeps the ledger line and leaves the photo out of Photos.

Layer 4: what never happens

No advertising, cross-app tracking, analytics SDKs, data sales, or health-kit clinical uploads. Vitality Ledger is a personal log, not a medical device.

Layer 5: your choices

Camera, microphone, and Photos permissions can be changed in iOS Settings. Delete individual meals, workouts, or water rows in the app. Deleting the app erases everything Vitality Ledger stored on the device.

Layer 6: children

Vitality Ledger is not directed to children under 13, and we do not knowingly collect their information.

Flatten: changes and contact

We will post changes here with a new effective date. Privacy questions: tally@fernpantryhq.com.