Privacy notice

Veyrova is operated by Ajdin Šabanović, registered at Slatinski Put, Sarajevo, Bosna i Hercegovina. For data protection purposes that entity is the controller: it decides what is collected and why.

Questions about this notice, or a request about your data, go to ajdina750@gmail.com. We aim to answer within 30 days.

Veyrova is operated from Bosnia and Herzegovina and is offered to people in the European Economic Area, so two regimes are relevant: the Bosnian Law on Protection of Personal Data, supervised by the Personal Data Protection Agency of Bosnia and Herzegovina, and the EU General Data Protection Regulation, which applies to offering a service to people in the EEA regardless of where the operator sits. Where they differ, the stricter rule is applied.

Only what a daily plan needs. Grouped by why it exists:

• Account. Email address and an authentication record held by Supabase Auth, or the account Apple or Google confirms when you sign in with them. Passwords are never seen by Veyrova: they are hashed and stored by Supabase, and the app only ever hands over what you type at sign-in.
• Profile and goal. Year of birth, height, the parameter used by the energy formula, activity level, goal, body focus areas, time zone, language and units. These drive the calorie and macro calculation. For the training programme: the days and times you train, how long a session can be, the equipment you have, the split and focus you choose, and the muscle groups you leave out or want first.
• Body measurements. Weight and waist entries you record, and the trends derived from them.
• Nutrition. Meals you log, with the food, the portion in grams and the time. Dietary rules you set: halal preference, allergies, excluded ingredients, eating pattern, meals per day, cooking time, budget and disliked foods. What you tell the coach about how you eat: your usual meals and foods, how often they should come back, fast food, snacks, sweets, and whether you take whey or creatine.
• Weekly plan. The week of meals and training made for you, and what you do with it: a meal you swap, like, dislike, find too complicated or do not have, a dish you hide, and a session you skip or move, with the reason you give.
• Ratings. Stars you give a recipe or your week, the reasons you pick and an optional note. Other people see only a recipe's average and the number of ratings, never who gave them.
• Apple Health. Only if you allow it: the active energy and the step count Apple Health holds for the day. The day's active energy is sent to Veyrova to adjust that day's calorie target. The step count stays on your phone and is only shown there.
• Food photographs. When you use the scanner, the image you take. It is uploaded to private storage, analysed, and used to propose foods and portions. We keep the photographs privately and review them to make the scanner more accurate.
• Training. Sessions, exercises, sets, repetitions, load, reps in reserve, rest, plans generated for you, the weekly programme and its deload weeks, and the morning check-in about sleep, energy and soreness. Physical limitations and problematic movements you record so plans avoid them.
• Coach messages. What you ask the coach and what it answers. When you tell the coach you ate something or did an activity, it can log it for you, and you can undo it.
• Reminders. A push token for your device, so the app can remind you before a timed session and in the evening. You can switch reminders off in your phone's settings at any time.
• Technical. App version, platform, and error reports when something crashes. Error reports are sent to Sentry and can include the screen name and a stack trace. Where product analytics are switched on, the app records which screens and features are used, without the content of what you log.

Health information. Some of the above, in particular injuries, physical limitations and detailed nutrition records, can be treated as health data, which has extra protection under the GDPR. Veyrova collects it because you enter it so the plan can avoid hurting you. The legal basis for that specific category still needs confirmation by a qualified adviser, and is listed as an open item in the site audit.

• To provide the service you asked for (performance of a contract): account, profile, goal, training and nutrition records, plan generation, the coach.
• To keep the service working and safe (legitimate interests): crash reports, abuse and rate limiting, and the daily token cap on AI usage.
• To meet legal obligations: records tied to purchases, where those exist.
• With your consent: optional product emails, and any processing of health information that requires explicit consent once confirmed.

Veyrova does not profile you for advertising, does not sell data, and does not share your records with data brokers.

Your training plan, your weekly programme and your meal plans are built by Veyrova's own rules from its own databases. They are not written by a model. A model is used for five things, always reached from Veyrova's own server: the coach's answers, a short explanation of your week, new recipes for the shared recipe library when it has none that fits a plan, reading a photograph of a meal, and estimating a dish the food database does not have. The app never talks to a model directly, and no API key ever ships inside the app.

What the model receives:

• For the coach and the explanation of your week: your training and nutrition context as figures and short codes: targets, day type, the fatigue estimate, your dietary rules, what you have logged, and the last few weeks of sessions in summary form.
• For a new recipe: the kind of meal, the calories and protein it should carry, and the dietary rules it has to respect. Not who it is for: the recipe is written for the shared library, and anyone whose plan it fits can be given it.
• For a photograph: the photograph, and nothing about who you are.
• A hashed identifier instead of your user id, used only for the provider's own abuse monitoring.

What it does not receive: your name, email address, or any account identifier.

Nothing the model says about a number is trusted. Calories, macronutrients, portions and fatigue are calculated by Veyrova from its own database, and a recipe or plan that breaks the rules is rejected. Token counts and approximate cost are logged; prompt text is not.

Veyrova runs on services that process data on its instructions. Each one is used for a specific job and receives only what that job needs.

• Supabase. Database, authentication and private file storage, including food photographs.
• Railway. Hosting for the Veyrova server.
• Google. The model that reads a photograph of a meal. The photograph itself is sent to Google for that reading, along with nothing about who you are: no name, no email, no account identifier. Google returns the foods it recognises and an estimate of how much of each is on the plate. The calories and macros are then looked up in the food database rather than taken from the model. If you sign in with Google, Google also confirms your account to Veyrova.
• OpenAI. The language model behind the coach, the explanation of your week and new recipes for the shared library, receiving the context described above. When a scanned dish is not in the food database, it also receives the dish's name and description to estimate its values, which you confirm before they are used. It does not receive your photographs.
• Expo. Delivery of reminders to your device. It receives your device's push token and the text of the reminder.
• Sentry. Crash and error reporting.
• PostHog. Product analytics inside the app, where enabled.
• Apple. App distribution, Sign in with Apple if you use it, Apple Health on your phone if you allow it, and payment for purchases made through the App Store. Veyrova never sees your card details.
• RevenueCat. Subscription state: which plan you have, a trial, renewals and cancellations, as the store reports them.

The exact list, regions and contractual terms for each processor still need confirming against the live configuration, and the transfer safeguards below depend on that answer. This is recorded as an open item rather than presented as settled.

This website is separate from the app. It sets no analytics or advertising cookies, embeds nothing from third parties, and loads no external scripts. See the cookie notice.

Several of the processors above are established outside Bosnia and Herzegovina and outside the EEA, principally in the United States. Transfers of that kind need a lawful mechanism, usually the European Commission's standard contractual clauses together with an assessment of the destination country, or an adequacy decision where one exists.

The mechanism relied on for each processor has still to be confirmed and recorded. Until that is done, this notice does not claim a particular safeguard is in place.

• Account, profile, training and nutrition history: while your account exists, because the plan is built from your history.
• Food photographs: kept privately while your account exists, and deleted with it. We review them to make the scanner more accurate. You can delete your account at any time.
• Coach messages: kept so the conversation makes sense and so quotas can be enforced.
• Your answers about how you eat, weekly plans and ratings: while your account exists, because each week is built from them.
• Push token: until you switch reminders off, sign out or delete your account.
• Crash reports: kept for the provider's standard retention period.
• After you delete your account: personal data is deleted or anonymised, except anything a law requires to be kept, such as records tied to a purchase.

Under the GDPR and the Bosnian data protection law you can ask for access to your data, a copy in a portable form, correction of anything wrong, deletion, restriction of processing, and you can object to processing based on legitimate interests. Where processing rests on consent you can withdraw it at any time, and withdrawing it does not make what happened before unlawful.

Write to ajdina750@gmail.com. Some of this is already in the app: you can edit your profile, goal, limitations, dietary rules and your answers to the coach yourself, change your password, and delete your account from the account screen.

If you think your data has been handled badly you can complain to a supervisory authority: in Bosnia and Herzegovina the Personal Data Protection Agency, and in the EEA the authority where you live or work.

• Traffic between the app and the server is encrypted in transit.
• Keys with elevated privileges, including the AI provider key and the database service key, exist only on the server. They are never bundled into the app.
• Food photographs are held in private storage, reached with short-lived signed links.
• Database access rules restrict rows to the account that owns them.
• Passwords, tokens and prompt contents are never written into logs, and signing out clears the local copy of your data from the device.

No system is perfectly secure. If you find a vulnerability, please report it to ajdina750@gmail.com before disclosing it publicly.

Veyrova is not built for children. It is intended for people aged 16 and over, and where local law sets a higher age for consenting to this kind of service, that higher age applies. If you believe a child has created an account, write to ajdina750@gmail.com and it will be removed.

When this notice changes, the review date at the top changes with it. For a change that materially affects how your data is used, you will be told in the app before it takes effect.