Does my health data leave my phone?
Not unless you use a feature that needs it to. Velisa has no account and no analytics of any kind, and everything you log is stored in a database inside the app's own private storage on your iPhone. Four features can send something out, each one because you used it:
Nothing here is ever used for advertising, sold, or shared with a data broker. Velisa's server keeps counts and costs, never the contents of what you asked.
Velisa is an iOS app for tracking training, sleep, nutrition and recovery, built by a single independent developer. It is not backed by a company with a data team, a marketing department, or a reason to want your data for anything other than showing it back to you.
Everything you log — workouts, food entries, weigh-ins, sleep sessions pulled in from a connected source, and every score Velisa computes from them — is written to a SQLite database inside Velisa's own private container on your iPhone. All of the computation happens there too: every marker, baseline, trend and score you see on the Today, Body and Insights screens is calculated on the phone from that local database, and no part of it is uploaded to be computed somewhere else.
Velisa does run one small server, at velisa.app, and it exists for exactly one reason: to hold the Anthropic API key that the Coach needs, so that you don't have to. It is not a sync server, not a backup, and not a copy of your database. It receives a summary only at the moment you ask the Coach a question, and it does not keep it — see What velisa.app stores below for the exact list of what it does keep.
Velisa does not use Apple's iCloud sync (CloudKit) to copy or share your data between devices — there is no code in the app that does this, and nothing about your data syncs anywhere on its own.
One honest nuance worth stating plainly: if you have iPhone Backup turned on in your iPhone's own Settings (to iCloud, or to a computer), your regular phone backup will include Velisa's local database — the same way it includes most other apps' local data on your phone. That is a feature of how iOS backs up your device generally, not something Velisa does on its own, and Velisa has no separate switch for it because it isn't a separate thing Velisa is doing. Apple Health data itself is different: Apple excludes the Health app's own store from iCloud backups automatically, independent of anything Velisa does.
Deleting the app deletes the local database immediately. A phone backup made before that, if you have one, still holds a copy until you overwrite it with a new backup or delete the old one yourself — the same as for any other app.
What Velisa reads (with your permission, granted per data type in the iOS permission screen): heart rate, resting heart rate, heart-rate variability, respiratory rate, blood oxygen, steps, active energy, VO₂ max, and sleep (duration, efficiency and stage). Read-only by default.
What Velisa can write, only if you turn it on: Settings has a toggle, off by default, for writing your logged workouts back to Apple Health. If you turn it on, a workout you finish in Velisa is written to Apple Health as a workout session, together with the active energy burned during it — but only when Velisa has a real, measured calorie figure for that session. If it doesn't, the workout is written without one rather than with a guessed number. Velisa's own computed scores — Recovery Score, Velisa Age, and everything else in Scoring — are never written to Apple Health; they stay inside Velisa.
Health data read through HealthKit is never used for advertising or marketing, never shared with a third party for those purposes, and never written to iCloud by Velisa. It is also never sent anywhere on its own: the only way a figure that originated in Apple Health leaves your phone is if you ask the Coach a question, in which case it may appear in the summary described below — as a daily figure or a median, never as the raw samples Health gave us.
Velisa does not access your location, your microphone, or your contacts. The camera is used only for the scanner (below).
If you choose to connect a Whoop account (Connected Sources in Settings), you sign in through Whoop's own login screen — Velisa never sees or stores your Whoop password. Whoop hands back an access token, which Velisa stores in your iPhone's Keychain and uses to pull your own recovery, sleep, workout, day-strain and body-measurement data, plus your Whoop profile name and email, from Whoop's API — so Velisa can show it next to everything else you log. Disconnecting removes the stored token immediately. This is a read connection: Velisa does not send data to Whoop, only the standard sign-in exchange.
Amazfit Helio data reaches Velisa the same way Apple Watch data does — through Apple Health, once Zepp (Amazfit's own app) has written it there — subject to the same read-only rules above. A Bluetooth chest strap connects directly, phone to strap, with no server involved on either side.
There is also a direct-Bluetooth path to Whoop and Amazfit hardware that bypasses Apple Health and Whoop's own API entirely — but it only exists in the developer's own personal build (compiled with a flag named PERSONAL_BUILD), which by its own build rules is never distributed to TestFlight or the App Store. It has no bearing on the app anyone else installs, and is mentioned here only so this page stays complete rather than convenient.
The Coach is a chat screen that can answer questions about your own data. It is optional — every other part of Velisa works fully without ever opening it, and it sends nothing until you type a question and send it. But it is the one feature that routes your health data through a server, so this section is the longest on the page.
Where it sends things. Velisa offers three ways to run the Coach, and the one a fresh install uses is the first:
velisa.app/api/coach, a small server the developer runs on Cloudflare, which attaches the developer's own Anthropic API key and forwards the request to Anthropic's API. The reply streams back the same way. Velisa's server is a pass-through with a spending limit on it; the reason it exists is that an API key cannot safely be compiled into an app that anyone can unzip.Whichever you pick is shown in the Coach's own footer on every single reply, so it is never ambiguous which one answered.
What is actually in the summary. A compact JSON snapshot of derived figures — never a raw sample stream. Specifically:
missing, naming what Velisa does not have, so the model says "I don't know" instead of guessingExplicitly not included: your name, any Velisa-internal identifier, any device identifier, raw minute-by-minute sensor readings, your food diary entry by entry, or the free-text notes you attach to workouts and foods. Workout session names are included, as listed above — if you name a session something you would rather not send, that is the one field to know about. Before anything is sent, the Coach's "What gets sent" screen shows you the literal payload — the same bytes, not a paraphrase — so none of this is a promise you have to take on faith.
What Anthropic then has. Once a request reaches Anthropic, what happens to it there is governed by Anthropic's own privacy policy and terms (anthropic.com). Velisa has no visibility into or control over their retention. This is true on all three routes above except the local one, and it is the same company either way — the only difference is whose key pays for it.
This is the part a "no server" claim used to paper over, so it is spelled out field by field.
It does not store what you asked or what you were told. No prompt text, no snapshot, no image data, and no model output is written to any database or log by Velisa's server. It receives the request, forwards it, streams the answer back, and keeps only the meter reading.
What it does keep, in a Cloudflare D1 database:
Your IP address is used, in memory, to rate-limit device enrollment to five per hour — a spam control. It is not written into either table.
Velisa's server runs on Cloudflare, and Cloudflare operates its own network-level infrastructure and protections as the hosting provider, governed by Cloudflare's own terms. That is the same relationship any website has with its host.
The session token your phone uses to talk to that server expires after seven days and is stored in your iPhone's Keychain, readable only while the phone is unlocked and never synced to iCloud.
Velisa's food scanner has three modes. Two never leave your phone: scanning a barcode and reading a printed nutrition panel are both decoded on-device using Apple's own Vision framework. The third mode — photographing the front of a pack so Velisa can figure out what product it is — does send a photo off the device, down the same route the Coach uses. On a default install that means the photo goes to velisa.app, which forwards it to Anthropic; if you've set your own Anthropic key, it goes to Anthropic directly.
That photo is downscaled before it's sent (capped at roughly 1024 pixels on the long edge, well below a full photo's resolution — plenty to read a brand name off a box, nowhere near enough detail for much else) and is never saved anywhere by Velisa, before or after sending, and never written to any database by velisa.app. It exists for the length of that one request and nowhere else.
The model is asked for identity only — brand, product name, variant, pack size, and a barcode if one happens to be legible — and is structurally unable to return a nutrition figure: the format it must answer in has no field to put one in. Every calorie and macro number you see always comes from a database lookup afterward (the bundled offline database, your own saved foods, or a live lookup), never from the photo-identification step itself.
Scanning a barcode first checks a nutrition database bundled inside the app, which works with no internet connection at all. If the product isn't in that bundled slice, Velisa sends the barcode number to Open Food Facts' public database — a plain, unauthenticated lookup, no account or key involved. Only the barcode number travels; nothing about you does.
There is a separate setting, off by default, for offering to send a confirmed nutrition panel back to Open Food Facts when it didn't have a product you scanned. It only ever runs when all of these are true: you've turned the setting on, Open Food Facts genuinely didn't have the product, and you've then read the pack yourself and confirmed the numbers. You see the exact fields before anything is sent. What's included: the barcode, the numbers on the pack, the product name/brand/size you typed, and Velisa's own app-identity fields — the app name, the app version, and a random per-install UUID that Open Food Facts asks for so a bad batch of submissions can be traced and reverted. What never travels: any Velisa user id, any device identifier, any location, anything about your diary, weight, goals or health, and no images of the pack.
Every line above is about the app on your phone. The one part of velisa.app that does collect a name and an email is the waitlist form on the homepage — see Joining the waitlist below for exactly what that involves.
This is about velisa.app the website, not the app on your phone — the app still has no account and no analytics, unchanged by anything below.
If you use the "Join the waitlist" form on this site, it stores your name and email address, the time you submitted, and two small operational fields: which part of the page the form was in, and a yes/no flag noting whether the submission came in unusually fast — a soft signal used only to help spot automated spam, never used to block a submission or shown to anyone as a judgement about you. All of it lives in a database called D1 that Cloudflare (the same company hosting this website) runs on this project's behalf. Nobody else has access to it: not sold, not shared, not handed to a mailing-list or marketing tool, and not linked to anything you do inside the app itself — the app never sends your email anywhere, so there is nothing to link it to.
To keep the form from being spammed, the request that submits it is also checked against a hashed, short-lived record of your IP address, kept for up to 10 minutes and never stored next to your name or email.
Your only reason to be on this list is to hear when Velisa ships, once. We'll delete the whole table once that email goes out, or once this project is retired, whichever comes first — and you can ask to be removed sooner, any time, the same way as everything else on this page: email [email protected] and we'll delete your row directly.
Handled entirely by Apple through the App Store's in-app purchase system. Velisa never sees a card number, a billing address, or any payment detail — Apple is the merchant of record and hands Velisa only a signed receipt saying whether this Apple Account currently holds an active subscription. There is nothing for Velisa to hold, and nothing it could leak, because it never touches your payment information at all. The app starts with a free 30-day trial that needs no card up front; a subscription is required to keep most of the app working after that, but exporting your own data stays free permanently, even if the app is otherwise locked.
Velisa is not directed at, or marketed to, children. Using it meaningfully requires setting up your own training and nutrition profile, connecting your own wearable or health data, and — after a 30-day trial — a paid subscription, none of which describe a child user. Velisa does not knowingly collect data from children, and no part of the app is designed with a child audience in mind.
Because the only complete copy of your data is the one on your own phone, most of what a privacy law asks for — see it, get a copy, delete it — is already true right now, under your own control:
The services Velisa can send data to at your own direction — Anthropic, Whoop, and Open Food Facts — each hold and govern whatever you sent them under their own privacy policies. Velisa doesn't operate any of those services and can't delete data on your behalf from one of them; to have a copy removed from their side too, you'll need to go through that provider directly (for example, your own Whoop account settings, or your own Anthropic console).
On your phone: for as long as you keep it there. Velisa doesn't age data out or delete it on a schedule — a fact you logged five years ago is still there unless you remove it or delete the app.
On velisa.app: the device record and the daily usage counts described above, which are kept while the service runs so that quotas and costs stay enforceable. There is nothing else there to retain, because the content of your Coach requests is never written down.
Third-party credentials live in the iPhone Keychain, never in a plain settings file. If you set your own Anthropic key it is stored at the strictest protection level Apple offers for this: unreadable while the phone is locked, excluded from iCloud Keychain sync, and never carried into a restore onto another device. The hosted Coach's install id and session token are held the same way, and the session token expires after seven days regardless. The Whoop token is also Keychain-protected and excluded from iCloud Keychain sync, though — unlike the Anthropic key — it can be included in an encrypted local backup you make of your own phone, the same as most apps' saved sign-in tokens; it is never synced automatically across your devices either way. All network requests, to velisa.app and to every third party named on this page, are made over HTTPS.
If what Velisa collects or sends changes, this page changes with it and the "last updated" date at the top moves. The August 2, 2026 revision is an example of that working: the hosted Coach changed where data goes, and this page was rewritten to match rather than left as the more flattering older text. If you're on the waitlist above, we'll also email you once, when Velisa ships — that's the one mailing list this site runs, and it only ever sends that single message. Otherwise there's no recurring mailing list, so the date at the top is still the signal for everything else.
Questions about this policy or how Velisa handles data can be sent to [email protected].
This policy describes exactly what the app's code does, checked against the source by the person who wrote it — it is not legal advice, and this is not a substitute for a lawyer's review if you need one for a specific question. The entity publishing this app is Behlaah Dossaji, and any dispute arising from it is governed by the laws of India, with jurisdiction in the courts of Karnataka.