VitaMe Privacy Policy
1. Summary
- Your entries are stored in your account on servers in the EU (Frankfurt). We do not sell your data, show ads or read the advertising ID.
- AI and voice features only run if you grant the "AI understanding" permission. While it is off, your messages, entries and voice are not sent to any AI or voice service.
- Photo storage, location, analytics and crash reports each need their own permission, and all of them are off by default.
- You can download your data in the app and delete your account in the app or by email.
2. Who is responsible
EKOSEPET ONLİNE ALIŞVERİŞ REKLAM DANIŞMANLIK HİZMETLERİ PAZARLAMA TİCARET LİMİTED ŞİRKETİ ("APPWO", "we"), Esentepe Mah. Kasap Sk. Altınay İş Merkezi No: 8-10, İç Kapı No: 7, Şişli/İstanbul, Türkiye. Contact: [email protected].
3. Data we process
Account
You can sign in with email and password or as a guest. For account holders we process your email address; for everyone we process your birth year (for the 18+ check). A display name and profile photo are optional. The profile photo is stored under an unguessable name in storage that anyone with the link can open; if you do not want that, do not add a profile photo.
Care and observation entries
The entries you make for areas such as skin, hair, teeth, muscles, legs and abdomen, routines, mood check-ins, notes, optional cycle tracking and your permission choices. These entries may contain information that relates to health.
Photos
Only if you grant the "Photo history" permission, photos you upload are kept in private storage and shown only to you through time-limited links.
Voice
When you use push-to-talk, your recording is sent to ElevenLabs to be turned into text. The recording is not stored on our server, and the temporary file on your device is deleted once it has been transcribed.
Location
Only if you grant both the "Location Data" permission and the device location permission, your approximate location is used for humidity and UV values. Coordinates are rounded to about 11 km and are not written to your account; only the humidity and UV values are saved. We do not request precise location.
Robot chat
Your conversations with the robot, and memory notes the robot suggests and you approve, are stored in your account.
Notifications
Reminders are scheduled on your device. We do not send remote notifications or collect push tokens.
4. Artificial intelligence
While the "AI understanding" permission is on, the robot, skin scan and style studio send the following to an AI model: your message and up to 6 earlier messages, a summary of the last seven days of entries (counts and status labels only), weekly counts if you ask for them, and any photo you send. Patterns such as email addresses, phone numbers and ID numbers are masked before sending; your name and other details in free text are not masked. Your account ID is not sent.
Requests go through OpenRouter only to endpoints that do not collect or retain data (zero data retention); if no such endpoint is available, the request is not processed. For knowledge search, a masked search phrase goes directly to OpenAI. How long OpenAI and ElevenLabs keep the data they receive is governed by their own policies.
If you turn the permission off, entries and reminders keep working, but none of your data goes to AI or voice services. The crisis phrase check works regardless of the permission and sends no data to third parties.
5. Android permissions
- Camera: taking photos and scanning barcodes.
- Microphone: push-to-talk.
- Approximate location: humidity and UV.
- Notifications: reminders on your device.
We do not request storage, phone state, precise location or advertising ID permissions.
6. Services that receive data and transfers abroad
The services below process your data only on our behalf and for the stated purpose. Some are outside Türkiye; we rely on your explicit consent for transfers abroad. The legal basis for transfers will be finalised after legal review.
| Service | Purpose | Data sent | Location |
|---|---|---|---|
| Supabase | Hosting, database, file storage, sign-in | Account and app data, photos | EU (Frankfurt) |
| OpenRouter (routes to OpenAI, Anthropic or Google models) | Robot chat, skin scan, style studio | Masked messages, entry summary, optional photo | USA |
| OpenAI | Knowledge search (embeddings); one style studio route | Masked search phrase; style studio photo | USA |
| ElevenLabs | Speech to text; voicing fixed robot phrases | Push-to-talk recording (not stored) | Outside Türkiye |
| MET Norway | Humidity and UV values | Location rounded to about 11 km, sent via our server | Norway |
| Open Beauty Facts | Product barcode lookup | Barcode number | France |
| PostHog (EU) | Usage statistics; only with analytics permission | Listed event names, anonymous device ID | EU |
| Sentry | Crash reports; only with "Crash reports" permission | Technical error details | EU |
| RevenueCat | Subscriptions; only once purchasing opens | Random user ID, purchase record | USA |
PostHog and Sentry only run if you grant the matching permission and the service is enabled in the app. Purchasing is closed in this version, so no data goes to RevenueCat.
7. How long we keep data
- Account data and entries: while your account exists or until you delete them.
- Chat: until you delete it. If you turn on "Word deletion" mode, the text of later messages is deleted after 24 hours.
- Photos: until you delete them or the period you choose in the app ends.
- Data export download link: 7 days.
- Notification counter: 90 days. Anonymous security records: 180 days.
- Account deletion: access ends immediately, you can undo it within 30 days, then it is permanent. Records we must keep by law (such as invoices) are kept for the legal period. Backups are erased when their cycle ends.
8. Security
Your session is kept in your device's secure key store. App data is excluded from Android cloud backup. Photos are kept in private storage and opened through time-limited links. Health details, messages, notes and voice are never written to the short-lived cache on your device.
9. Your rights
Under Article 11 of the Turkish Personal Data Protection Law (KVKK), and other applicable law, you can ask whether your data is processed, request information, learn the purpose and recipients, and ask for correction, deletion and for recipients to be notified. In the app:
- Privacy center: turn each permission on or off separately.
- Download My Data: get all your data as a ZIP file.
- Delete my account: see Account and data deletion.
You can send requests from your registered email address to [email protected]; we reply within 30 days at the latest.
10. Age limit
VitaMe is for people aged 18 and over. We ask for your birth year before an account is created; if you are under 18, no account or entries are created.
11. Ads and analytics
The app contains no ads or ad SDKs and does not read the advertising ID. Usage statistics and crash reports are only collected with your permission and are off by default.
12. Changes
If this policy changes, the date and version at the top of this page are updated. We announce important changes in the app. The notification method will be finalised after legal review.
13. Contact
EKOSEPET ONLİNE ALIŞVERİŞ REKLAM DANIŞMANLIK HİZMETLERİ PAZARLAMA TİCARET LİMİTED ŞİRKETİ, Esentepe Mah. Kasap Sk. Altınay İş Merkezi No: 8-10, İç Kapı No: 7, Şişli/İstanbul, Türkiye. [email protected]
Last updated: October 5, 2026