Valutri (“we”, “us”, “the app”) is a general-wellbeing app that helps you pursue a personal wellbeing goal through food guidance, a meal scanner, and Coach, a supportive AI chat companion. This policy explains what data the app handles, where it goes, and the choices you have.
1. What data Valutri collects
Your profile
Age band, sex, height and weight (optional), dietary pattern, allergens, an optional free-text health note, and your chosen wellbeing goal. You provide this during onboarding and can change it any time in Settings.
Food photos (Scanner)
A photo you take to check how a meal aligns with your goal.
Coach conversations
Messages you send Coach, and a short rolling memory summary Coach keeps of recent context (your goal, recent events you’ve mentioned, patterns it’s noticed). You can view or delete this at any time from Settings → What Coach remembers.
Consistency log
The dates you mark as “logged” against your goal.
Device identifier
A random identifier generated on first use and stored on your device. This is not a user account: it isn’t linked to your name, email, or any other identity. It exists only so our backend can apply fair-use limits per device.
What we do not collect
We do not ask for your name, email address, or any account credentials to use the free tier. We do not use third-party analytics or advertising SDKs.
2. How your data is used, and where it goes
Valutri is built to keep as much as possible on your device. The sections below describe the two categories of data flow.
Stays on your device only, never transmitted
Your full profile, consistency log, plan history, scan history (text only, no photos), and Coach conversations and memory summary are stored in your device’s local storage. None of this is sent anywhere unless you explicitly use the “Export my data” feature (which shares a PDF you generate and send yourself; it does not go through us) or generate a plan, run a scan, or message Coach, as described below.
Your permission before anything is sent
Nothing described in this section leaves your device until you have explicitly agreed to it. During setup Valutri shows you a dedicated screen that names the AI service (Claude, run by Anthropic), lists exactly what would be sent, and asks you to agree. If you don’t agree, nothing is sent: plan generation, meal scanning and Coach simply stay switched off, and the rest of the app works without them.
You can withdraw that permission at any time from Settings → Privacy & info → What leaves your device → AI processing. Withdrawing takes effect immediately: the app stops sending anything to Anthropic from that moment. If we ever change what is included in these requests, we will ask you again rather than relying on your earlier agreement.
Sent to generate a result, never stored on our servers
- Generating a plan: your age band, sex, dietary pattern, allergens, goal, and optional health note are sent to our backend, which forwards them to Anthropic’s Claude API to generate your food guide. The response is returned to your device; nothing is retained on our servers afterwards.
- Scanning a meal: a compressed photo, your goal, and your dietary constraints are sent to our backend and forwarded to Claude’s vision model. We never store the photo. It is not written to any database or file storage of ours, and is discarded as soon as the result is returned.
- Messaging Coach: your recent messages (the last ~12 turns), your memory summary, your goal, and a summary of your plan are sent to our backend and forwarded to Claude to generate a reply. As above, nothing is stored server-side: our backend holds no conversation history at all. The reply is streamed back to your device, which is solely responsible for storing it locally.
- Coach check-in reminders (optional): if you turn this on, the same memory-based process generates one to three short reminder lines, which your device schedules as local notifications. These are delivered by your phone’s operating system with the app fully closed. There is no push-notification server, and no record of your notification schedule leaves your device.
In every case above, our backend (a Cloudflare Worker) exists only to hold the Anthropic API key securely and apply fair-use rate limits; it does not log or retain the content of your health data, photos, or conversations. We log only anonymous technical metrics (response time, token counts, pass or fail of automated safety checks) for cost monitoring and reliability, never the content itself.
How long Anthropic keeps this content
We want to be precise about this, because “we don’t store it” is only half the picture. Anthropic processes these requests on our behalf, and under their standard API terms they automatically delete inputs and outputs within 30 days of receiving or generating them. So a photo you scan, or a message you send Coach, may exist on Anthropic’s systems for up to 30 days after the request, even though it never persists on ours.
Two exceptions apply, set by Anthropic rather than us: content flagged by their automated trust-and-safety systems as breaching their Usage Policy may be retained for up to 2 years (and the related safety classification scores for up to seven years), and content may be retained where the law requires it.
Anthropic does not use this content to train their models without express permission, which we have not given.
3. Third parties
- Anthropic (Claude API) processes plan, scan, and Coach requests as described above, under their own data-processing terms. Inputs and outputs are deleted within 30 days, with the trust-and-safety and legal exceptions set out in section 2. Their commercial retention policy is published at privacy.claude.com and their privacy policy at anthropic.com/legal/privacy. Anthropic acts as our processor under a data-processing agreement that binds them to confidentiality, security and deletion obligations equivalent to those in this policy, restricts them to processing the data solely to return your result, and prohibits using it to train their models. We do not share your data with any third party that offers a lower standard of protection than we apply ourselves.
- RevenueCat processes premium subscription status if you purchase Premium, via Apple’s App Store or Google Play billing. We do not receive or store your payment details; that is handled entirely by Apple and Google.
- Cloudflare hosts our backend (the Worker described above) and, incidentally, may log standard infrastructure request metadata (IP address, timestamp) as part of normal web hosting. This is not used to build a profile of you.
We do not sell your data, and we do not share it with data brokers or advertisers.
4. Your rights (UK GDPR and equivalent)
- Access and export: use “Export my data” in Settings to generate a PDF of your stored profile and history at any time.
- Deletion: use “Delete all my data” in Settings to permanently and immediately erase everything stored on your device, including your profile, history, and all Coach conversations and memory. This cannot be undone. Because nothing is retained server-side, there is nothing further to delete on our end once you do this.
- Coach memory specifically: Settings → What Coach remembers lets you view or clear Coach’s memory and conversation history independently of a full data wipe.
- Notifications: you can turn Coach check-ins off entirely, or adjust their frequency and delivery window, from Settings → Coach. Your device’s own notification permission settings always take precedence.
For any privacy request or question, email support@xeraxoncare.co.uk. If you are in the UK or EEA and have concerns about how your data is handled, you can also contact the Information Commissioner’s Office (or your local data protection authority).
5. Special category data
Two kinds of special-category data under UK GDPR may pass through Valutri:
- Health information: your optional health note, your allergens and intolerances, and anything you choose to tell Coach.
- Information revealing religious or philosophical beliefs: if you select a faith or culture dietary preference (Halal, Kosher, Jain, Buddhist vegetarian, or no alcohol), that choice may reveal a religious or philosophical belief. We use it for one purpose only: making sure your food guide respects it, including in cooking ingredients.
Both follow the same on-device-first, never-retained-server-side approach described in section 2. Every field involved is optional, and you are never required to disclose anything to use Valutri’s core features.
If your health note or a Coach conversation suggests a history of disordered eating, the app enables a supportive, stricter mode (no numeric targets, gentler Coach responses, softened scanner) and signposts professional support. This is a safety feature, not a diagnosis, and nothing about it is sent anywhere beyond what is already described in section 2.
6. Children’s privacy
Valutri is intended for adults aged 18 and over, and is rated 18+ on the App Store. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided information through the app, please contact support@xeraxoncare.co.uk and we will help you clear it. Because the app stores data on the device rather than in an account, “Delete all my data” in Settings erases it immediately.
7. Changes to this policy
If we make a material change to how Valutri handles your data, we will update this page and note the new “Last updated” date. Continued use of the app after a change constitutes acceptance of the updated policy.
8. Contact
Questions, privacy requests, or anything else: support@xeraxoncare.co.uk. You can also visit our support page.
Valutri is made by Xeraxon Care.