Privacy policy

Who we are

Vuto is an AI calorie and nutrition tracker, run by Sid Verma, a sole proprietor in India, who decides how your data is used. This policy covers the Vuto app and the website at vuto.io. Questions, requests and complaints about privacy go to hello@vuto.io.

What we collect

Your account: your name, your email, and the Apple or Google account you sign in with. A password, if you set one, is stored only as a one-way hash.

Your profile, to work out your daily targets: date of birth, gender, height, weight, activity level, diet and goal.

Your meals: what you log, when you ate, and the photo if you took one. Before a photo leaves your phone, the app redraws it as a new, smaller image, so it carries no location or camera details.

Your phone number, only if you add it in Profile. It is optional and kept for SMS alerts, which are coming soon; you can delete it there at any time.

Your subscription: what you bought and when, from the App Store or Google Play. We never see your card details.

How you use the app, described below.

AI that reads your meals

When you photograph a meal or a product label, or type what you ate, Vuto sends that photo or text, with the time you ate, to Google Gemini or Anthropic Claude. They work out the food and the amounts, and Vuto shows the result for you to check before anything is logged.

The app asks your permission before the first one, and you can turn it off at any time in Account and privacy. The AI providers never get your name, email or account details. We use their paid services, whose terms don’t let them use what we send to train their models.

We keep the AI’s answer, without your name, for 14 days to check its quality. We don’t use your meal photos to train any AI model.

How the app is used

The app and the website record what happens in them, such as screens opened, meals logged and purchases started, with a random ID for the install, the app version, the phone’s system version, language and time zone. When you’re signed in, this is linked to your account so we can fix problems and improve Vuto.

It is never used for advertising or shared with advertisers, and we don’t track you across other companies’ apps or websites. The website keeps its random ID in your browser and sets no advertising cookies.

Adults only

Vuto is for people aged 18 and over, and so is every family member you add. Everyone confirms their date of birth when they set up, including on accepting an invite. We don’t knowingly collect data from children.

Family sharing needs each person’s own consent

When you add a family member, they accept the invite themselves and choose what you can see: a daily summary of calories, protein and whether they logged, and their meal photos only if they turn that on.

Nobody can consent on someone else’s behalf. Each person can withdraw consent in one tap, and access stops straight away. We check consent on every request to see another person’s data.

This is how we meet India’s Digital Personal Data Protection Act, 2023 and its 2025 Rules: consent that is specific to each person and to exactly what is shared, and as easy to withdraw as to give.

What we never do

We never sell your personal data, and never use your health data or photos for advertising. Product labels you submit to improve our food database are covered in the Terms.

Who processes your data for us

Google (Gemini) and Anthropic (Claude): read meal photos and text, as above.

Oracle Cloud: our servers and photo storage. Neon and MongoDB Atlas: our databases.

Apple and Google: sign-in, subscriptions through the App Store and Google Play, and notifications.

RevenueCat: keeps track of your subscription, under a random account ID.

Brevo: sends our emails, such as sign-in codes.

Each of them may use your data only to do this work for us, and must protect it at least as well as we do. Some of them process data outside India.

How long we keep it

Your account, profile and meals: until you delete them or your account.

A meal you remove, and any photo no logged meal uses: deleted within two days.

The AI’s answers: 14 days, without your name.

Usage records: 13 months. When you delete your account, they are cut off from it.

Payment records: as long as tax law requires (up to eight years), under an ID that doesn’t name you.

Deleting your account

In the app: You, then Account and privacy, then Delete my account. Your account, profile, meals and photos are erased straight away. Usage records are cut off from you, the AI’s answers expire within 14 days, and payment records are kept only as the law requires. Deleting doesn’t cancel a store subscription: cancel it in the App Store or Google Play.

Can’t open the app? Ask at vuto.io/delete-account and we’ll delete it for you.

Your rights

You can see and correct your data in the app, delete it, and withdraw any consent, in the app or by writing to hello@vuto.io. We reply within 30 days. Outside India, the laws where you live (such as the GDPR) may give you further rights, and we honour them.

Changes

If we change this policy in a way that matters to you, we tell you in the app before it applies.