Privacy Policy
Last updated: 26 September 2026
Wellora is a weight, calorie and workout tracker. To do that it has to store information about your body and habits, which the law treats as sensitive. This policy explains exactly what we collect, why, who else handles it, and how you control it. The short version: we use your data to run the app for you, we never sell it or use it for advertising, and you can have it deleted at any time.
1. Who we are
Wellora (the website at wellora.ink and the Wellora iOS app, together the "Service") is operated by its individual developer, a private person based in Ukraine, who is the controller of your personal data ("we", "us").
For anything related to your privacy or this policy, write to support@wellora.ink. We answer within 30 days, and usually much sooner.
2. What we collect
Account information:
- Your email address and, if you sign in with Google or Apple, the name and profile photo that provider shares with us.
- A unique account identifier created by our authentication provider (Firebase Authentication). Your password, if you use one, is handled by Firebase and never stored or seen by us.
Health and body information you enter:
- Date of birth (from which your age is calculated), gender, height, starting weight, goal weight and whether you aim to lose or gain.
- Every weigh-in you log, with its date.
- Food entries (names, amounts, calories), saved ingredients and meals, and your daily calorie goal.
- Workouts (type, duration, intensity, sets, repetitions, estimated calories, notes) and your weekly training plan.
- Activity descriptions and notes you give the AI coach, and the analyses it returns to you.
Weight, body measurements, diet and exercise can reveal information about your health. Under the GDPR and Ukrainian law this is a special category of personal data, and we process it only because you choose to provide it for the purpose of using the Service (see section 4).
Social and profile information, only if you use these features:
- Your public profile: display name, photo, bio, status, theme, the blocks you choose to show, and, only if you add it, a free-text location.
- Friends and friend requests, competitions you create or join, and the invite link through which you joined (so the person who invited you can be credited).
In-app progress: points, daily streak and check-ins, achievements, reward cards, card packs, profile themes and their history.
Messages you send us: feedback tickets, the replies, and any screenshots you attach.
Settings and preferences: language, units, dashboard layout, and notification preferences (which reminders, on which days and at what time).
Device and technical information:
- Browser, operating system, device type, screen size, language, time zone and app version, recorded when you sign in or open the app, so we can support the platforms people actually use and diagnose problems.
- On the web, a push-notification token if you allow notifications. On iOS, whether you allowed reminders, and a random installation identifier that is not linked to advertising and is used only so the app recognises its own changes when syncing.
- Your approximate city, derived from your IP address by our hosting provider, is used only to suggest a location if you choose to fill in the location field. If you ask the app to use your precise location for that field, your coordinates are sent through our server to OpenStreetMap's Nominatim service to find the city name, and are not stored.
- Counts of AI requests and their technical usage (for example the number of tokens processed), to enforce fair-use limits. We do not keep a separate log of what you asked.
We do not use advertising identifiers, advertising cookies or cross-site tracking, and we do not buy data about you from anyone.
3. How we use it
- To provide the Service: store your log, draw your charts, calculate BMI, pace, calorie balance and progress, and keep your data in sync between the website and the app.
- To generate AI coaching, calorie estimates and workout suggestions when you ask for them (see section 5).
- To run the social features you use: show your profile to the people allowed to see it, run competitions and leaderboards, and credit referrals.
- To run the rewards system: award points, streaks, achievements and cards.
- To send the reminders you switched on. On iOS these are scheduled on your phone; on the web they are sent as push notifications.
- To answer your feedback and support requests, and to show you service announcements.
- To keep the Service secure, prevent abuse (for example referral farming or exceeding AI limits), and fix problems.
- To understand overall usage through privacy-friendly, aggregated analytics (Vercel Web Analytics, which does not use cookies).
We do not sell your personal data, we do not share it for advertising, and we do not use it to make decisions that have legal or similarly significant effects on you. AI output in Wellora is advice you are free to ignore, not an automated decision about you.
4. Legal bases
Where the GDPR or the Law of Ukraine "On Personal Data Protection" applies, we rely on:
- Performance of our contract with you (the Terms of Service) for account data, your logs and the features you use.
- Your explicit consent for health-related data. You give it by entering that information to use the Service, and you can withdraw it at any time by deleting the data or your account. Withdrawal does not affect processing that happened before.
- Our legitimate interests in keeping the Service secure, preventing abuse, and understanding which devices and features are used, balanced against your rights.
- Compliance with legal obligations, where the law requires us to keep or disclose information.
5. AI features
When you ask for an AI analysis, a calorie lookup or workout coaching, we send the information needed for that answer to an AI model provider. Depending on the feature this can include your age, gender, height, weight history, goal, recent food and workout entries, and the notes you wrote. We do not send your email address or name.
The providers we use are Google (Gemini), OpenAI, Groq and Mistral AI; which one answers a given request depends on the feature. They process the request to return an answer. How long a provider keeps request data, and whether it may use it to improve its services, is governed by that provider's API terms; we do not send them your name or email, and we do not ask them to keep your data for any purpose of ours.
AI features are optional and may be limited per week. AI output can be wrong; see the Terms of Service.
7. International transfers
Our providers store and process data on servers that may be located outside Ukraine and outside the European Economic Area, including in the United States. Where the law requires it, these transfers are protected by the providers' Standard Contractual Clauses or equivalent safeguards.
8. How long we keep it
We keep your data for as long as your account exists, because your history is the product: charts, streaks and progress are built from it.
When you ask us to delete your account, we delete your profile and everything linked to it within 30 days. Copies may remain in our providers' backups or security logs for a limited period afterwards, and then expire. We may keep a minimal record where the law requires it or to resolve a dispute. Aggregated statistics that can no longer identify you may be kept.
Feedback conversations are kept while your account exists so we can follow up, and are deleted with it.
9. Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data (most of it you can edit yourself in the app);
- have your data deleted;
- restrict or object to certain processing;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time;
- lodge a complaint with a supervisory authority: in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in the EU or UK, the data protection authority where you live.
To exercise any of these, email support@wellora.ink from the address linked to your account. We may ask you to confirm your identity. We do not charge for this.
11. Security
Data travels over encrypted connections and is stored with our providers, who encrypt it at rest. Access to the database from browsers and apps is restricted by security rules so that people can read only their own data; all changes go through our server, which checks who is making them. No system is perfectly secure, but if a breach affects your data we will notify you and the authorities as the law requires.
12. Children
The Service is not for children under 13, and our sign-up requires a date of birth at least 13 years ago. If you are under 16, or under the age of digital consent where you live, you may use Wellora only with the permission of a parent or guardian. If you believe a child has given us personal data without the required permission, contact support@wellora.ink and we will delete it.
Wellora is not designed to support people with, or at risk of, eating disorders. Please see the health notice in the Terms of Service.
13. Changes to this policy
We will update this policy when the Service changes. The date at the top shows the latest version. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect.
14. Contact
Questions, requests or complaints: support@wellora.ink.