Privacy Policy
Celevo Co., Ltd. ("we", "us") takes your privacy seriously. This policy explains what we collect, why, and the choices you have. We comply with the Google API Services User Data Policy.
1. Information We Collect
- Email address and name (provided by Google Sign-In, or entered by you when signing up with email)
- Password (email sign-up only — stored as a one-way hash; we never store or see the plain text)
- Year of birth and sex
- Height, weight, and health goals
- Sleep records (duration, condition, energy)
- Exercise records (type, duration, intensity)
- Supplement intake records
- Alcohol and smoking records
- Weight records (weight by date, notes, target weight)
- Supplement label images (analyzed by AI and not retained)
- Food photos for meal logging (optional — stored in private storage accessible only to you, and deleted with your account)
- AI assistant conversations (what you ask the in-app coach and what it answers — kept so the next conversation has context; a turn flagged as a crisis conversation is stored without its text)
- Health goals and facts you write for the assistant (saved only when you fill in the form — the assistant proposes but never writes to it on its own)
- Community profile (handle, display name, and an optional profile photo — your real name and email are never shown)
- Community posts, comments and attached photos (visible to members of the group you post in — see section 13)
Everything under "Optional" is collected only if you enter it. The app is usable without any of it.
2. Health Data
The records listed above describe your health and habits. We treat them as sensitive and handle them under the following rules.
- We use them only to display your records, calculate your health score, and generate personalized insights inside the app
- We do not use them for advertising or marketing, and we do not combine them with advertising identifiers
- We do not sell or rent them to anyone (see Section 8)
- Access is restricted by Row Level Security so that only your account can read your records — except for what you deliberately attach to a community post, which members of that group can see (Section 13). Nothing is shared automatically
- You can delete any record in the app at any time, and delete everything by deleting your account
Menstrual cycle tracking has been removed
The menstrual cycle feature was removed from the app on August 2, 2026 and is no longer offered anywhere. No cycle data is collected, transmitted, or stored on our servers. Records created before that date remain encrypted at rest and are deleted when you delete your account; you can also ask us to delete them at any time.
To be precise about what that encryption does and does not do: it is not end-to-end encryption. The key is held per account in our database, so someone with full database access could in principle combine them. It protects against storage-level exposure, not against us.
Apple Health (HealthKit) and Health Connect
Only if you turn on health integration yourself, we read the following activity data from Apple Health (iOS) or Health Connect (Android) on a read-only basis: step count, workouts, active energy, heart rate during workouts, and workout distance. On iOS, if you grant them, we also read sleep stages, cardio fitness (VO2 max) and resting heart rate.
- This data is used only to display your exercise records and calculate your health score
- We never use health app data for advertising or marketing, never sell or share it, and never combine it with advertising identifiers
- The integration is optional and you can revoke permission at any time (iOS: Settings → Privacy & Security → Health / Android: Health Connect app)
- The app never writes any data back to HealthKit or Health Connect
3. Google Account Data (Google Sign-In)
Google user data we access
When you sign in with Google, we access the following.
- Email address
- Name and profile picture (where provided)
- Google account identifier (ID)
The scopes we request are limited to openid, email, and profile — all non-sensitive scopes.
How we use it
This data is used only to (1) identify you and create/sign in to your account, (2) manage multiple profiles, and (3) synchronize your data across devices. We use it for no other purpose.
Sharing
We do not sell, rent, or share Google user data with third parties, and we do not use it for advertising or marketing. It is processed only by the service providers listed in Section 8, and only as needed to operate the service.
Policy compliance
Our access to, use, storage, and sharing of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.
4. How We Use Your Information
- Identifying you and providing the service
- Providing personalized health analysis and insights
- Analyzing weight trends and managing your goals
- Synchronizing your data across your devices
- Improving the service and producing aggregate statistics
5. Data Storage and Security
- All data in transit is encrypted with TLS (HTTPS).
- Data is stored with Supabase and restricted by Row Level Security so that only your account can access your data. The one exception is what you deliberately attach to a community post, which becomes visible to members of that group (see section 13) — nothing is shared automatically.
- Authentication is by Google Sign-In or email sign-up. Social sign-in collects no password; email passwords are stored by our authentication provider (Supabase) as a one-way hash, so neither we nor the provider can read or recover the plain text. Authentication tokens and sessions are handled securely.
6. Data Retention
- Deleted immediately when you delete your account (except where law requires us to retain something, for the required period)
- Inactive accounts: three years after last sign-in
- AI assistant conversations: kept for 90 days from when they are saved, then deleted automatically. You can delete them in the app at any time before that
7. We Do Not Sell Your Data
We do not sell your personal information or your health data, and we do not share it for cross-context behavioral advertising. We have never done so. If that ever changes, we will say so here before it takes effect and obtain any consent the law requires.
8. Sharing and Service Providers
We do not provide your data to third parties for their own purposes, except where required by law. We use the following service providers, who process data only on our behalf.
- Google LLC — sign-in authentication
- Google LLC — website visit analytics / Google Analytics 4 (website only, not in the app)
- Microsoft Corporation — website usage analytics / Microsoft Clarity (website only, not in the app)
- Supabase Inc. — data storage and synchronization (servers in Seoul, South Korea)
- Vercel Inc. — website and API hosting (API runs in Seoul, South Korea; delivered over a global edge network)
- Google Gemini — AI analysis of supplement label and food images, and research summaries (not retained after processing)
- Apple — payment processing for in-app purchases
9. Where Your Data Is Stored
The records you sync — your account, health records, and photos — are stored on servers in Seoul, South Korea, operated on our behalf by Supabase Inc. Our API also runs in Seoul, hosted by Vercel Inc. (a U.S. company) and delivered over a global edge network, so your requests pass through the edge location nearest you. Sign-in, analytics, and AI analysis are handled by Google LLC in the United States. Wherever you use the app from, your information is transferred across these locations under appropriate safeguards.
10. Your Rights and Data Deletion
You can, at any time:
- Request access to the personal information we hold about you
- Request correction or deletion of that information
- Request that we stop processing it
- Delete your account and all associated data
How to delete: In the app, go to [Profile → Delete account permanently] to immediately and permanently delete your account and all data, including information from your Google account. You can also email contact@vivledia.com and we will process the request promptly.
11. Children's Privacy
This app is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has provided us information, contact us at the address below and we will delete it.
12. Usage and Diagnostic Data
We collect usage statistics and error diagnostics to improve the app and fix crashes.
- What we collect: which features and screens you used, app version, and error messages
- These records carry an account identifier, so they are pseudonymous, not anonymous
- Automatic error reports do not include your email address. Your email is attached only when you contact us through "Send feedback", so we can reply
- We do not use this data for advertising and do not share it with advertising networks
On our website (vivledia.com) — the marketing pages and the Insights blog — we use Google Analytics 4 to measure visits, and Microsoft Clarity to understand how the site is used.
- What Google Analytics collects: pages visited, time of visit, referring source, device and browser type, and approximate location (city level)
- What Microsoft Clarity collects: how the site is used — clicks, scrolls, and page movements, shown to us as aggregated heatmaps and session replays. Text you type into forms is masked by default and is not part of the recording
- Both use cookies, but neither loads until you choose "Accept" in the cookie banner — until you make a choice we treat it as a decline
- If you choose "Decline" we set no cookies at all. If you accepted earlier and then decline, we switch Google Analytics off, stop the Clarity recording, and delete the cookies already stored (
_ga,_clck,_clsk) - Your choice is saved in your browser, so it applies per browser and per device, and you can reopen it at any time with the "Cookie settings" link at the bottom of the vivledia.com marketing pages
- These website records are not joined with your app account
- Processors: Google LLC and Microsoft Corporation (servers in the United States)
The Insights blog uses the same banner and carries over the choice you made on the marketing pages. Separately, you can also block cookies in your browser settings or install the Google Analytics Opt-out Add-on.
Neither Google Analytics nor Microsoft Clarity runs inside the app. They load only when you visit vivledia.com in a web browser, never within the iOS or Android app.
Because this data can reveal that you used a health feature, it is also disclosed in our Consumer Health Data Privacy Policy.
13. Community (Group Sharing)
The community is optional. If you do not use it, nothing in this section applies and none of your records are visible to anyone else.
Who can see what
- Groups can only be joined with an invite code. They are not discoverable by search, and there is no public feed.
- Posts, comments and attached photos are visible only to members of the group you posted in.
- Other members see the handle, display name and avatar you chose. Your real name and email are never shown.
- If you upload a profile photo, it is stored so that anyone who has its direct link can view it, including people outside the community. Remove the photo in your profile settings to stop sharing it.
Attaching your records to a post
- You choose, for each post, whether to attach a record such as your score, sleep, exercise or a meal. Nothing is shared automatically.
- An attached record is frozen into the post as it was at that moment. Editing or deleting the original record later does not change what the post shows — to stop sharing it, delete the post.
- Attached photos are kept in private storage that only group members can read, and are served through temporary links that expire.
Deleting and leaving
- Deleting a post removes it from the group, along with the photos attached to it.
- Leaving a group does not remove posts you already made. Leaving stops future sharing; to remove past posts, delete them first.
- Deleting your account removes your community profile together with the posts and comments you wrote.
Reporting, blocking and the rules
- You must agree to the community rules before creating a community profile. Harassment, hate, sexual content and impersonation are prohibited without exception.
- You can report any post or comment, and block anyone you do not want to hear from. A blocked member's posts and comments stop being visible to you.
- A post reported by three different members is hidden automatically, ahead of manual review.
- We review reports within 24 hours, remove content that breaks these rules, and restrict community access for the member responsible.
14. Contact
For any privacy question or request, contact us at contact@vivledia.com.
15. Changes to This Policy
If we change this policy we will give notice in the app or by email before the change takes effect.