Privacy Policy

Who we are

Voco is built and operated by Saketh Thippireddy, an individual doing business as Voco, based in Texas, United States ("Voco," "we," "us"). For privacy purposes, that individual is the data controller of the personal data described here. Questions go to hello@voco.fit (see Contact).

Some of the data Voco handles relates to your body and diet, so we also publish a dedicated Consumer Health Data Privacy Policy. It covers the same practices described here, in the format some state health-privacy laws require.

What we collect

We collect what the app needs to work, and that is it:

• Your profile. Sex, age, height, activity level, your goal (lose, maintain, or gain), your pace, and your calorie and macro targets. You enter these during onboarding so Voco can calculate your plan.
• Your food logs. The description of each meal, including the text transcript of what you said or typed, plus the estimated foods, calories, macros, a confidence grade, the meal type, and the date. The transcript is kept with the log; see Voice recordings.
• Your workout logs, weight logs, and streak. What you tell Voco about workouts, your weight entries, and how many days in a row you have logged.
• Weekly summaries. A short AI-written recap of your week, built from your own logs.
• Food memory. If you correct a food's numbers, Voco remembers your correction so the same food comes back right next time. That memory is private to your account.
• Your subscription status. Whether you are on a trial, active, or expired, and when it renews or expires. Payment itself is handled by Apple; we never see your card details.
• Account identifiers. A random user ID and, once you create a permanent account, your email address or the identifier Apple or Google returns at sign-in. Apple's "Hide My Email" relay addresses work normally and are all we receive if you use one.
• Usage and crash data. Privacy-preserving analytics and crash reports that contain no meal text, no weights, and no email. See Analytics & crash reporting.
• Abuse counters. A daily count of AI requests per account, kept to stop abuse of the service.

We do not collect your contacts, photos, location, or any advertising identifier. There are no ad SDKs in the app, and we do not track you across other apps or websites.

Voice recordings

This is the part people care about most, so here is exactly what happens.

When you log a meal by voice, the app sends that short clip to our server, which passes it to a speech-to-text service and gets back a transcript. The transcript is then interpreted by an AI model into foods and estimated macros, and you confirm the result before it is saved.

The speech and language work is done by specialized US-based speech-to-text and AI providers acting as our service providers under data-processing agreements: one transcribes your audio (with an automatic backup if it is unavailable), and an AI model interprets the transcript into foods and macros. These providers state that data sent through their APIs is not used to train their models by default, and they may retain API inputs briefly (on the order of 30 days) for abuse monitoring under their own policies. We are honest about the boundary: "not stored" is our guarantee about Voco's systems; what happens inside a provider's short processing window is governed by their terms.

We do not create voiceprints, we do not use your voice to identify you, and Voco has no speaker-recognition features. Microphone access is used only while you are recording a log, and if you deny it, you can type instead; the app still works.

How we use your data

• To turn what you say or type into a food log with calorie and macro estimates, and to build your plan and show your progress, streaks, and weekly summary. This is the service you signed up for (in contract-law terms, processing necessary to perform our contract with you; for body and diet data, we rely on the consent you give by entering it for this purpose).
• To keep you signed in and sync your data across launches and reinstalls.
• To run your subscription and gate the paid features.
• To fix crashes and understand which features get used, so the app improves (our legitimate interest, using the stripped-down data described in Analytics).
• To prevent abuse of the AI pipeline (our legitimate interest, using the daily counters described above).

We do not sell your personal data. We do not share it for advertising. We do not use your health-related data for marketing or data mining. If a Global Privacy Control signal ever applies to you, there is nothing it needs to switch off, because there is no sale or ad-sharing to opt out of. Voco is not a healthcare provider and is not covered by HIPAA; we protect your data because it is the right way to build this, not because a hospital rulebook applies.

Where your data lives & security

Your profile, logs, and subscription state live in a PostgreSQL database hosted by Supabase in the United States (AWS us-east-2). Access is enforced at the database level by row-level security: every query runs as you, and the rules prevent one account from reading another's rows. The privileged server key that could bypass those rules never exists on your device; it lives only in our server functions and is used for narrow jobs like deleting your account.

On your phone, your login session is kept in the iOS keychain (via expo-secure-store), not general app storage. All traffic between the app, our servers, and our vendors is encrypted in transit.

No system is perfectly secure. Our approach is to collect little and lock down access, so a breach would have less to expose.

Third-party processors

A small set of vendors runs parts of the service on our behalf. Each receives only what its job needs:

• Supabase: database, authentication, and server functions. Holds your account, profile, logs, and subscription status.
• Speech-to-text providers (US-based): receive your voice clip, transiently, to transcribe it.
• An AI model provider (US-based): receives the transcript and interprets it into foods and estimated macros.
• PostHog: product analytics. Receives your random user ID and content-free usage events.
• Sentry: crash reporting. Receives technical crash reports tied to your user ID only.
• RevenueCat: subscription management. Receives your user ID and entitlement state.
• Apple: app distribution, Sign in with Apple, and payment processing. Your purchase is handled entirely by Apple.

These providers process data under their service terms and data-processing agreements. We do not let any of them use your data for their own advertising.

Analytics & crash reporting

We measure how the app is used so we can improve it, and we built the pipeline to be content-free by design:

• Usage analytics (PostHog). Events are things like "completed a log" or "viewed the summary," described with enums, counts, booleans, and durations. The event schema is a fixed list; there is no field that could carry a transcript, a food name, a weight, or an email. Your identity in the system is a random user ID.
• Crash reporting (Sentry). When something breaks we get a technical report stripped to your user ID: no email, no IP address, no personal content ("send default PII" is off).

Data retention & deletion

We keep your data for as long as your account exists, so your history and streak are there when you come back. Deleting a single log hides it immediately and permanently from your account; the row is retained internally until your account is deleted. Anonymous accounts that never sign up are purged automatically after 30 days.

You can delete your account from inside the app: Settings, then Delete Account. This deletes your login and, through database cascade rules, everything tied to it: profile, food logs and their transcripts, workout logs, weight logs, streaks, weekly summaries, food memory, and usage counters. It cannot be undone.

Three honest footnotes on deletion:

• Anonymous performance metrics keyed to a one-way hash of your user ID (timings, byte counts, no content) are retained; they cannot be traced back to you.
• If one of your confirmed foods was added, without any link to you, to the shared nutrition database that speeds up everyone's lookups, that de-identified entry remains.
• Our processors keep their own records on their own schedules: RevenueCat retains the purchase history Apple requires, and PostHog and Sentry age out their content-free records under their retention windows. Email us and we will pass a deletion request downstream to them.

Data export: email us and we will send you a portable copy of your data.

Your rights

We extend these to every user, wherever you live:

• Access the data we hold about you (request an export).
• Correct your data; most of it is editable directly in the app.
• Delete your account and its data any time, in the app.
• Export a portable copy on request.
• Object or restrict: tell us if you want a specific use of your data stopped, and we will respond honestly about what is possible.
• Withdraw consent for body and diet data at any time by deleting the data or your account.

If you are in the EU or UK, these map to your GDPR rights, and you also have the right to complain to your local supervisory authority (in the UK, the ICO). Voco is operated from the United States and your data is processed there. When our vendors move data internationally they rely on recognized safeguards such as EU standard contractual clauses or Data Privacy Framework certification. Voco's AI produces informational estimates that you review and can edit before saving; it makes no automated decisions with legal or similarly significant effects about you.

If you are in California or another US state with a privacy law, the practical answers are above: we do not sell or share your personal information, and access, deletion, correction, and portability are yours to use. We extend these voluntarily to everyone rather than gating them by state. Washington and Nevada residents: see the Consumer Health Data Privacy Policy.

To exercise anything the app does not already let you do directly, email hello@voco.fit. We do not discriminate against anyone for exercising a privacy right.

Children

Voco is not directed at children under 13 and is not intended for them. You must be at least 13 to use it, and onboarding asks your age as part of building your plan. We do not knowingly collect personal data from children under 13; if you believe a child under 13 has an account, email us and we will delete it.

Changes

If we change this policy, we will update the effective date at the top and post the new version at this address. For material changes we will make a reasonable effort to notify you in the app. Continuing to use Voco after a change means you accept the revised policy.

Contact

Questions, requests, or privacy concerns: hello@voco.fit. We aim to respond to privacy requests promptly, and within any deadline the law where you live sets.