Privacy Policy

The short version

VICTORIA doesn't have user accounts, and there's no sign-up or password. Your food diary, goals, and weight log are stored only on your own iPhone, using the on-device storage built into iOS — we never see them, and none of what you log sits on a server for us to lose or misuse. A few things do leave your phone, each explained below: a label photo you choose to scan, a food name you search for, a daily check with the App Store for a newer version of VICTORIA, basic details about your phone and your subscription, and, only if you tap Allow on Apple's tracking question, your phone's advertising identifier.

What stays on your device

When you use VICTORIA, the following is created and stored locally, on your iPhone only:

• Your name and email, if you enter them in Settings
• Everything you log — foods, amounts, dates, and the nutrition facts attached to them
• Your nutrition goals and any schedule you set up for them
• Your body-weight entries, if you use that feature
• Photos of labels you've scanned, kept as part of that food's entry in your own library

None of this is uploaded to us, backed up to our servers, or visible to anyone but you. Deleting the app from your phone deletes this data along with it.

When you scan a nutrition label

Scanning a label sends one photo off your device. Here's exactly what happens: the photo you take is sent to our scanning service, which forwards it to OpenAI, a third-party AI company whose technology reads the label and extracts the nutrition facts (serving size, calories, fat, carbs, and protein). Those numbers are sent back to your phone and pre-filled onto a review screen for you to check before saving.

Our own server does not store, log, or keep a copy of the photo at any point — it relays your request and forwards the response, nothing more. OpenAI does not use photos sent this way to train its models; under its published API data policy it may keep a copy for up to 30 days solely to monitor for abuse of its service, then deletes it. The photo is shared with OpenAI and no one else, under OpenAI's own data-processing terms, which bind it to keep the photo confidential and secure and to use it only to return the reading — protection at least equal to what this policy describes. If a label reads ambiguously, the same photo may be sent to OpenAI a second time within that one scan to double-check the reading. The photo itself is only ever saved on your own device, as part of your personal food library, the same as everything else described above.

The first time you use label scanning, VICTORIA shows a one-time notice explaining this before any photo is sent, and you can withdraw that consent at any time (see Your choices below).

Searching the food database

Instead of scanning, you can search for a food by name. That search text is sent to the U.S. Department of Agriculture's FoodData Central database — a free, public government nutrition database — to look up matching foods. This is a standard database lookup; VICTORIA doesn't attach your identity to these searches in any way it controls.

Checking for a newer version

Once a day, VICTORIA asks Apple's App Store whether a newer version is available, sending only the app's name and your phone's region, so it can offer you the update. Nothing about you or what you log is included.

Your subscription and your phone's basic details

VICTORIA uses RevenueCat, Inc., a U.S. company many subscription apps use, to know whether you have an active subscription or free trial. When the app opens or comes back to the screen, it sends RevenueCat a random identifier created for this install, Apple's identifier for our apps on your iPhone, your iPhone model, iOS and app version, your App Store country and preferred languages, and your IP address. When you subscribe, renew or restore purchases, it also sends Apple's record of your VICTORIA purchases and of your download. It also sends reports about RevenueCat's own code in the app, such as how long a check took or an error code, which say nothing about you.

We call these your phone's basic details. We and RevenueCat use them to run the app and your subscription, to keep a purchase record for your install that we can look up (it holds no name or email), to count and study how VICTORIA's subscriptions are doing, to improve the app, to keep the service secure, and to measure which of our ads bring people to VICTORIA. Each answer RevenueCat sends about your subscription carries a seal; if the seal is broken, which usually means the answer was altered on the phone, VICTORIA asks you to try again instead of opening.

RevenueCat never receives your food diary. It processes this on our behalf, stores it in the United States (transfers from the EU are covered by Standard Contractual Clauses), and keeps it while VICTORIA uses RevenueCat. See RevenueCat's privacy policy.

Apple's tracking question and our ads

VICTORIA finds new people partly through ads, such as ads on the App Store. At the start of onboarding the app asks Apple's question "Allow VICTORIA to track your activity across other companies' apps and websites?". Either answer is fine: everything in VICTORIA works the same.

Whatever you answer, Apple's ad service gives the app a token saying which of our App Store ads, if any, led to your download, and the app passes it to RevenueCat so we can see which ads bring people who subscribe.

If you tap Allow, the app also shares your phone's advertising identifier, and Apple adds when you saw or tapped the ad. We and the companies that run our ads may use them to measure our ads and to show you ads for VICTORIA and others that fit you better.

Your food diary, and the goal, age, weight or other health answers you give in the app, are never used for advertising and never sent to an ad company, whatever you answer. You can change your answer at any time in your iPhone's Settings, under Privacy & Security, Tracking.

If you ask Apple for a refund

Refunds of App Store purchases are decided by Apple. When you ask Apple to refund a VICTORIA purchase, Apple may ask us, within 12 hours, for information to help it decide. RevenueCat answers for us, from its record of your purchase. It tells Apple that you agreed to this sharing when you accepted our Terms of Service, whether you received the subscription you paid for, and whether a free trial was offered before you were charged. We may also tell Apple whether we'd prefer the refund to be granted or declined. Nothing you log in VICTORIA, such as your food diary, goals or weight, is ever part of this, since we don't have it. It goes only to Apple, only when you ask for a refund, and only for that request, and Apple makes the decision under its own policies.

Statistics from Apple

If you've allowed your iPhone to share analytics with app developers (Settings, Privacy & Security, Analytics & Improvements), Apple gives us anonymous totals, such as how many people open the app and keep using it, and crash reports. Apple collects these, not VICTORIA, and we can't tell who they come from. You can turn this off in that same setting.

Camera access

VICTORIA asks for camera permission for one reason only: to let you photograph a nutrition label for scanning. It doesn't access your camera for anything else, and you're never required to grant it — you can always add foods by searching the database or entering them manually instead.

What VICTORIA doesn't do

The app shows no ads. It never sends your food diary anywhere, and never uses your health information for advertising. The one piece of outside code in it is RevenueCat, described above. It sends no push notifications. It does not read your contacts, location, photos library (beyond the single picture you choose to scan), or anything else on your phone.

If you contact us from inside the app

Settings offers a "Send Feedback / Contact Support" link that opens your Mail app with a message to us already started. To save you describing your setup, that message is pre-filled with the app version, your iOS version, your iPhone model, a random identifier the app generated on your device the first time you used that link — a string of letters and numbers that lets us match up two emails from the same install, and that is tied to nothing else about you — and the random identifier RevenueCat uses for your install (see Your subscription and your phone's basic details), so we can find your subscription record if you ask us to delete it. Nothing is sent unless you choose to send the email, and you can delete any of it from the message first.

Consumer health data (Washington and other states)

Some states, including Washington, have specific laws covering "consumer health data" — broadly, information that could indicate something about your health, which can include dietary and fitness information like the kind VICTORIA logs.

VICTORIA's design keeps this simple: the nutrition, weight, and goal information you log is stored only on your own device and is never collected, transmitted to, or retained by our servers. What does leave it is a label photo you scan, relayed to OpenAI as described above and not stored by us, and a food name you search for, sent to the USDA. RevenueCat receives no health information. We don't sell, rent, or share this information with advertisers, data brokers, or anyone else, because we don't have a copy of it to share in the first place.

Subscriptions & payment

VICTORIA is a paid subscription app: it is free to download, and after onboarding it requires a subscription, which begins with a free trial, paid through the App Store, with RevenueCat checking whether your subscription is active (see above). Your payment details are handled by Apple: neither VICTORIA nor RevenueCat ever sees your card. See the Apple Privacy Policy for how Apple handles that data.

Your choices

Withdrawing consent to label scanning. Scanning is always optional, and you agree to it the first time you use it. You can withdraw that consent at any time inside the app: in Settings, open New Food Defaults and tap Withdraw Consent. From then on no photo is sent until you agree to the notice again, which comes up the next time you scan, retake or change a label photo. You can also turn off camera access for VICTORIA in Settings on your iPhone — database search and manual entry keep working either way. Photos already read are not held by us, so there is nothing of yours on our side to delete.

Tracking. You can change your answer to Apple's tracking question at any time in your iPhone's Settings, under Privacy & Security, Tracking.

Your diary, goals and weight live only on your device, under your control, so there is nothing of them for us to export or delete. Uninstalling VICTORIA removes them entirely. The one record kept about you outside your phone is RevenueCat's record for your install (your subscription and your phone's basic details). Email support@joinvictoria.app, from the app's Contact Support link or with the Order ID from Apple's purchase email, and we'll delete it within 30 days. Deleting it doesn't cancel your subscription: Apple keeps its own purchase record, and tapping Restore Purchases brings your subscription back into VICTORIA. One thing outside our control: if you back up your iPhone to iCloud or to a computer, that backup is made by Apple under your own Apple Account and may include VICTORIA's data until the backup itself is replaced or deleted. If you'd rather keep the app but clear specific entries, you can delete them directly within VICTORIA at any time.

Changes to this policy

If this policy changes, we'll update the effective date at the top of this page. VICTORIA has no accounts, so we can't email you. Instead, if a change affects what leaves your phone, the app will tell you the next time you open it, and anything new that needs your agreement stays off until you give it.

Terms of use

Using VICTORIA also means agreeing to our Terms of Service, which covers things this policy doesn't — like our health/nutrition disclaimer, subscription terms, and limitation of liability.