Viora is an Android fitness and nutrition diary published and operated by Hassan Shahzad. Privacy contact: chhxnshah@gmail.com.
Summary
Viora is local-first. Your diary (meals, workouts, measurements, photos) is stored on your device. Viora does not host your full health diary on Viora servers. Limited account, subscription, operational, and user-requested AI data is processed as described below. Viora does not contain advertising or behavioral analytics SDKs.
Information Viora processes
Google account
Sign-in with Google is required. Viora receives your Google account identifier, email address, and display name (if provided) to create your app session, manage AI access, and operate optional Google Drive backup.
Data stored on your device
- Profile details you enter, food diary, workouts, water, fasting, sleep/steps summaries, weight, and body measurements
- Progress and food photos you choose to save
- Viora settings and session information
Camera, selected photos, and barcodes
Viora uses the camera only when you choose to capture a food/progress photo or scan a barcode. When choosing an existing photo, Viora uses the Android system photo picker rather than broad photo-library access. A scanned product barcode is sent to Open Food Facts to retrieve product and nutrition information. The barcode result is saved to your local diary only when you choose to save it.
Health Connect
If you grant permission, Viora reads the Health Connect types used by its fitness features: steps, distance, total and active calories burned, exercise sessions, sleep sessions, weight, heart rate, and floors climbed. Viora does not write to Health Connect and does not request background Health Connect access. Free accounts request steps only; paid accounts can choose to grant the additional types. This data is used to show activity in Viora. If you explicitly choose to generate a Viora AI Monthly Progress Report, its activity summary may include steps derived from Health Connect and is processed as described under Viora AI below. Viora does not sell Health Connect data or use it for advertising, credit, insurance, employment, or other eligibility decisions.
Viora AI
When you request an AI feature, the information required for that request is sent through the Viora Cloudflare Worker to an AI provider. This can include:
- Age, height, weight, sex, fitness goal, and optional target weight when calculating daily nutrition targets
- Food descriptions and, when you choose to share one, a food photo when estimating nutrition
- A Monthly Progress Report summary containing the selected dates, goals, weight changes, body-measurement changes, nutrition, hydration, activity, and training totals
Text requests and Monthly Progress Report summaries are normally processed by DeepSeek. Optional food photos are processed by Google Gemini, which may also be used as a fallback for eligible text requests. Viora does not intentionally write AI request content or photos to its Cloudflare D1 database. AI providers receive the request content needed to produce the result and process it under their own terms and privacy practices. When you report a result, Viora stores your selected reason, the generated output you flagged, your account identifier, and review status for investigating safety and quality concerns. The original prompt or photo is not included in that report. Viora also keeps operational usage metrics (such as request counts, provider/model, and token estimates) tied to your account for limits, abuse prevention, and product operation. AI usage and report records remain until account deletion unless retention is required for security, fraud prevention, or legal compliance. AI results are estimates and are not medical advice.
Subscriptions
Viora uses RevenueCat to operate subscriptions and unlock paid features. Viora provides RevenueCat with your Viora account identifier, email address, display name, and subscription or purchase status. RevenueCat processes this information for Viora to manage entitlements, purchases, and restoration.
Google Drive backup (optional)
If you enable backup, encrypted copies of your diary and related files are stored in your Google Drive app data folder (not a normal visible Drive folder). Encryption keys related to backup are stored in that same app data area and may be cached securely on your device. Anyone with access to your Google account may be able to access those backups.
Viora delivery and network information
Expo delivers app updates, and some exercise illustrations may be loaded from GitHub-hosted public content. These services, as well as the services listed below, may receive ordinary network information such as your IP address, request time, app/runtime version, and device or browser information when a request is made. Viora does not use this information for behavioral advertising.
How Viora uses information
- Provide and secure Viora (sign-in and account-scoped local data)
- Provide AI estimates and analysis when you request them
- Review AI results that you choose to report for safety or quality concerns
- Manage subscriptions and paid-feature access
- Enable optional encrypted backup/restore
- Operate account features, limits, and reliability
Sharing
Viora shares data only as needed to provide the requested features:
- Google — Sign-In, optional Drive app data, and Gemini (via the Viora Worker) for photo Food AI and eligible fallback requests
- DeepSeek — text Food AI requests sent through the Viora Worker
- Cloudflare — hosts the Viora API Worker and account/usage records used for authentication, feature access, and AI proxying (not your full on-device diary)
- RevenueCat — manages subscription status, purchases, restoration, and paid-feature access
- Open Food Facts — receives a scanned barcode to return public product and nutrition data
- Expo and GitHub — deliver app updates and public exercise media, respectively
Viora does not sell personal information.
Google API data
Viora uses Google account information for sign-in and account operation, and uses the Drive app-data scope only for the optional backup/restore feature. Sign-In and Drive content is not sent to AI providers. User content sent to Gemini is limited to the AI requests described above. Viora’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Security
Data in transit uses HTTPS/TLS. Local data is protected by the device and by requiring Google sign-in to unlock your diary in Viora. Optional Drive backups are encrypted before upload.
Retention and deletion
- On device: Uninstalling Viora removes local diary data and related local caches.
- Google account access: You can revoke Viora’s access in your Google Account security settings.
- Drive backups: You can disable backup in Viora and/or remove app data via Google Drive / Google Account controls.
- Account and operational records: Account, AI usage, reported AI results, and subscription-mirror records are retained while your Viora account exists. Provider and infrastructure logs may be retained separately under the provider’s policies. Limited records may be retained where required for security, fraud prevention, disputes, or legal compliance.
- Delete account: Use Profile → Account → Delete account in Viora to delete your local data, configured encrypted Drive backup, Viora account, AI usage and report records, subscription mirror, and to request deletion of the identified RevenueCat customer record. If you cannot access Viora, follow the instructions on the account deletion page. Account deletion does not cancel an active Google Play subscription and does not delete records created by other apps in Health Connect.
Age suitability
Viora is intended for users aged 13 and older. Viora is not designed or marketed as a children’s service.
Changes
This policy may be updated when Viora’s features or data practices change. The effective date at the top will change, and material changes will be communicated through Viora or this website where appropriate.
Contact
Questions about privacy: chhxnshah@gmail.com