Privacy Policy

Directly from you: Information you type, photos you upload, and voice input you provide during coaching conversations.

From Apple HealthKit: Health and fitness metrics, synced only with your explicit permission through Apple's Health app. You choose exactly which categories to share.

From calendar integration: Event data from your device calendar, synced only when you enable this feature. If you connect Google Calendar, event data is retrieved from the Google Calendar API only after you grant permission through Google's OAuth consent screen (see Section 6).

From your device sensors: GPS location while you record an outdoor activity, used to draw your route and compute distance and pace.

By text message: If you link your phone number, messages you send to Vora's number are received and processed like chat messages (see Section 10 for how they are transmitted).

From app usage: Workout logs, food logs, chat interactions, and functional analytics generated as you use the app.

App functionality: To provide personalized workout plans, track progress, sync with your calendar, and send notifications.

AI coaching: To power our chat and voice coaching features with personalized recommendations based on your health data and goals.

Analytics: To calculate streaks, progress metrics, and improve our training algorithms (using aggregated, de-identified data).

Account management: To manage your account, provide customer support, and send essential communications.

Safety & security: To secure your account, prevent abuse, and ensure data integrity.

HealthKit Data Protection: Your health data is never used for advertising, marketing, or data brokerage. We only use it to provide health and fitness coaching within the app.

We read health data to show you dashboards, create personalized workout plans, and provide AI coaching. We may write limited data back to Apple Health (like completed workouts) to keep your records consistent.

You control all HealthKit permissions through Apple's Health app. If you revoke access, data syncing stops immediately. You can request deletion of stored health data as part of account deletion.

How we use it: We use this data solely to provide user-facing features you request: displaying your schedule inside Vora, planning workouts around your existing commitments, and adding workout events you create to your Google Calendar. If you use AI coaching features, your upcoming events (titles and times) may be shared with the AI service providers described in Section 9, acting on our behalf, solely to provide scheduling-aware coaching responses.

What we never do: We do not use Google Calendar data for advertising. We do not sell it or transfer it to data brokers or other third parties. We do not use it to train AI models, and we do not allow our service providers to do so. Humans do not read this data except with your explicit consent, for security purposes, to comply with applicable law, or as part of aggregated, anonymized internal operations.

Storage & security: OAuth access and refresh tokens are stored encrypted on our servers and are used only to sync your calendar data. Synced events are stored in our database with encryption at rest and in transit.

Disconnecting & deletion: You can disconnect Google Calendar at any time in the app (Settings → Calendar). When you disconnect, we revoke our access tokens with Google and immediately delete all synced Google Calendar events and connection data from our systems. You can also revoke Vora's access at any time from your Google Account permissions page. All Google user data is also deleted as part of account deletion (Section 12).

Vora's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use it: We use Google Health data solely to provide user-facing features inside Vora: computing your daily pillar scores (Sleep, Recovery, Activity), showing health trends in the Biology section, rendering post-workout summaries with heart-rate-zone breakdowns, and personalizing strain calculations. Aggregated and anonymized metrics may be used to maintain and improve Vora's scoring algorithms and to monitor service health. If you use AI coaching features, relevant health metrics may be shared with the AI service providers described in Section 9, acting on our behalf, solely to generate responses to your questions.

What we never do: We do not use Google Health data for serving advertisements. We do not sell, rent, or trade your Google Health data. We do not transfer it to third parties except as necessary to provide or improve Vora's user-facing features (e.g., encrypted database hosting), and only under contractual confidentiality and data-handling obligations. We do not use Google Health data to develop, improve, or train generalized AI or machine learning models, and we do not allow our service providers to do so. Humans do not read this data except (a) with your explicit consent, (b) for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) where the data is aggregated and anonymized for internal operations.

Storage & security: OAuth access and refresh tokens are stored encrypted on our servers and are used only to sync your Fitbit data. Synced health metrics are stored in our database with encryption at rest and in transit.

Disconnecting & deletion: You can disconnect Fitbit at any time in the app (Settings → Integrations → Fitbit). When you disconnect, we revoke our access tokens with Google and stop syncing further data; previously imported metrics remain associated with your Vora account until you request deletion. You can also revoke Vora's access at any time from your Google Account permissions page. All Google Health data is deleted as part of account deletion (Section 12).

Vora's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use it: We use Garmin data solely to provide user-facing features inside Vora: computing your daily pillar scores (Sleep, Recovery, Activity), showing health trends in the Biology section, filling your workout history and calendar so you do not log the same session twice, rendering post-workout summaries with heart-rate-zone breakdowns and route maps, and personalizing the training Vora suggests, including easing back after a poor recovery night. Aggregated and anonymized metrics may be used to maintain and improve Vora's scoring algorithms and to monitor sync reliability. If you use AI coaching features, relevant health metrics may be shared with the AI service providers described in Section 9, acting on our behalf, solely to generate responses to your questions.

What we never do: We do not sell, rent, or trade your Garmin data. We do not use it for serving advertisements. We do not use it to develop, improve, or train generalized AI or machine learning models, and we do not allow our service providers to do so. We do not use it, and do not permit anyone else to use it, to determine your eligibility for credit, insurance, or employment. We do not transfer it to third parties except the service providers necessary to operate Vora, such as encrypted database hosting, and only under contractual confidentiality and data-handling obligations. Humans do not read this data except (a) with your explicit consent, (b) for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) where the data is aggregated and anonymized for internal operations.

Your consent, and withdrawing it: Connecting Garmin is optional and Vora works without it. You grant access on Garmin's authorization screen, you choose which data types to share, and you can narrow or withdraw that consent at any time, from Vora or from your Garmin Connect account, without losing access to the rest of Vora.

Storage & security: OAuth tokens are stored encrypted on our servers and are used only to sync your Garmin data. Synced metrics are stored in our database with encryption at rest and in transit. Our handling of Garmin data meets or exceeds the security requirements set by the Garmin Connect Developer Program.

Disconnecting & deletion: You can disconnect Garmin at any time in the app (Settings → Integrations → Garmin), and you can revoke Vora's access directly from your Garmin Connect account. Either way, we revoke our tokens, stop syncing, and stop processing new Garmin data for you. Previously imported metrics remain associated with your Vora account until you ask us to remove them. We retain Garmin data for as long as you maintain a Vora account, or until you exercise your right to delete it, whichever comes first. You can request deletion at any time (Section 13), and all Garmin data is deleted as part of account deletion (Section 12).

Garmin's own role: Garmin is an independent data controller for the data it holds, not Vora's service provider. Garmin's own collection and handling of your data is governed by the Garmin Connect Privacy Notice linked below, and rights you wish to exercise against Garmin are exercised through your Garmin account. Once data reaches Vora, Vora is the controller and this policy governs it.

Vora's use of data received from the Garmin Connect Developer Program APIs is limited to displaying and analyzing that data for the user who authorized it. We do not sell Garmin data, do not use it for advertising, and do not use it to train generalized AI or machine learning models. Garmin's own handling of your data is governed by the Garmin Connect Privacy Notice.

OpenAI

Processes your chat messages to generate coaching responses, analyzes photos you share (food, supplements, progress, workout screenshots) to provide feedback, and transcribes voice audio during voice coaching sessions. Only the content needed for each interaction is sent.

Anthropic

Reads documents you choose to upload, such as lab report PDFs and photos, to extract your biomarker values, units, and dates so Vora can organize and explain your results. Only the report content you upload is sent.

ElevenLabs

Generates spoken voice responses during coaching conversations and powers guided mindfulness audio sessions. Only the text of the response to be spoken is sent.

Tavily

Processes search queries when the AI coach looks up health and fitness research to answer your questions. Only the search query is sent, not your personal data.

We require our AI service providers to maintain appropriate security measures and to process your data only as directed by us for the purpose of delivering Vora's coaching features. None of these providers use your data for advertising or for purposes unrelated to Vora.

AI service providers: As described in Section 9, limited data is processed by AI providers solely to power coaching features.

Infrastructure providers: We use trusted cloud services for hosting, database management, and file storage to operate the app.

Push notifications: Device tokens are shared with Apple's push notification service to deliver app alerts you've opted into.

Messaging relay (Vora AI Text): If you link your phone number to text with Vora, messages to and from Vora's number are transmitted through Sendblue, our messaging infrastructure provider, solely to deliver this feature. You can disconnect your number at any time in Settings, which stops all messaging.

We do not sell your data. We do not transfer your information to third parties for their own marketing, monetization, or data brokerage purposes.

Advertising measurement: With your permission through Apple's App Tracking Transparency prompt, we use AppsFlyer to measure which ad campaigns bring people to Vora, using device identifiers and subscription events only. Your health data, lab results, location, and messages are never shared with advertisers or ad networks.

Storage: Your data is stored on cloud servers with encryption at rest and in transit. Some data is cached locally on your device for performance.

Security measures: We use industry-standard security practices including HTTPS encryption, secure authentication, and access controls.

Third-party standards: We require our third-party service providers to maintain appropriate security measures and to process data only as instructed by us. For details on how each AI provider handles data, you can review their privacy policies: OpenAI Privacy Policy, Anthropic Privacy Policy, ElevenLabs Privacy Policy.

While your account is active: We retain your data for as long as you maintain an active account, in order to provide our services.

Account deletion: You can delete your account at any time by going to Settings → Account → Delete Account in the app, or by contacting us at privacy@askvora.com. When you delete your account, we remove your data from our systems within 30 days, except where retention is required by law.

Voice audio: Voice recordings are processed in real-time to generate transcripts and responses, and are not retained as audio files after processing.

Third-party providers: AI service providers may retain limited processing logs in accordance with their own data retention policies. We encourage you to review their policies linked in Section 11 for details.

Access & correction: You can view and edit your profile information, workout data, and preferences within the app.

Data export: You can request a copy of your data by contacting us.

Account deletion: You can delete your account and all associated data as described in Section 12.

HealthKit control: You control all health data permissions through Apple's Health app settings. You can grant or revoke access to individual data categories at any time.

Communication preferences: You can manage notification settings within the app.

Vora is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it promptly.

Children should use the app only with appropriate parental consent where required by law.

Vora operates globally and processes data in the United States and other countries where our service providers are located.

If you are in the European Union or United Kingdom, you have additional rights under GDPR/UK GDPR, including the right to access, correct, delete, restrict processing, object to processing, and data portability. You also have the right to lodge a complaint with a supervisory authority.

We may update this privacy policy from time to time. We will post the new effective date in the app and on our website. For material changes, we may provide additional notice through the app or email.

Continued use of Vora after changes become effective constitutes acceptance of the updated policy.

For privacy questions: privacy@askvora.com
For data deletion requests: privacy@askvora.com
General support: support@askvora.com

Last updated: August 28, 2026