Velora Privacy Policy

Effective Date: 14 September 2026

1. Introduction

This Privacy Policy explains how Velora (the "Application"), developed and operated by Doğaç Oğuz ("Data Controller", "we", "us"), collects, uses, stores, and protects information. Velora is offered as a Freemium service and is provided "AS IS." By using the Application you agree to the practices described herein.

2. Information We Collect

3. On-Device AI Processing

Velora uses Apple Intelligence (on-device Foundation Models) to generate workout insights in real time. This processing happens entirely on your device: no health data is transmitted to any external server for AI processing. AI-generated insights are informational only and may be inaccurate, incomplete, or unexpected. We do not guarantee the accuracy of any AI-generated content.

4. Apple Health Integration

When you connect Velora with Apple Health:

• You choose exactly which data types to share via iOS permission dialogs
• You can revoke access at any time through Settings → Privacy & Security → Health
• Health data is accessed for the sole purpose of delivering fitness insights within the app
• The app also writes alcohol consumption, water intake, and body weight records back to Apple Health when you log them
• Velora widgets read step data directly from Apple Health to show live counts; this happens on your device only
• We comply with Apple's HealthKit usage guidelines: HealthKit data is never used for advertising, never sold, and never shared with third parties except as required to provide the app's core functionality

5. Third-Party Services

Velora integrates the following services, each governed by their own privacy policies:

• Firebase Analytics (Google): anonymous usage analytics
• Firebase Crashlytics (Google): crash reporting
• Firebase Remote Config (Google): feature flags only
• Apple: App Store / StoreKit for subscription purchases and CloudKit for the optional iCloud backup, governed by Apple's privacy policy

These services may collect device identifiers and aggregated usage data per their own policies. We do not share your health data, location, or profile photo with any third party, except your own iCloud account when you enable backup.

6. Background Processing & Notifications

• The app may run periodic background tasks to monitor workout completions and sync step counts to widgets
• Local notifications may be sent for workout summaries, milestones, streaks, and water reminders. The app sends no push notifications, and you control local notifications via notification settings
• No background data is sent to external servers

7. Widgets & App Group Data

Step counts, water and alcohol intake, daily goals, and language preference are shared with Velora widgets via a secure App Group container on your device. Widgets also query Apple Health directly for live step counts. None of this data leaves your device.

8. Data Storage & Security

• Local-first: Health data, profile photo, and preferences remain on your device
• Encryption: Data is encrypted in transit (TLS) and at rest (iOS Data Protection)
• iCloud backup (Velora Pro, optional): Stored in your private iCloud database using Apple's encryption; we cannot read it. You can turn it off at any time in Settings
• No custom backend: Velora does not operate its own servers. All server-side processing is handled by Google/Firebase infrastructure and, for purchases and the optional iCloud backup, by Apple
• No sale: We never sell your personal information

9. Legal Basis for Processing (KVKK / GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, Switzerland, or Türkiye, our legal bases for processing are:

• Explicit Consent: for health data access (granted via iOS permission dialogs)
• Legitimate Interest: for crash logs and anonymized analytics needed to maintain and improve the app
• Contract Performance: for core app functionality you request when using the service, and for the Velora Pro subscription you purchase

10. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: request a copy of the data we process about you
• Rectification: correct inaccurate personal data
• Erasure: request deletion of your data
• Portability: receive your data in a portable format
• Restrict Processing: limit how your data is used
• Object: object to processing based on legitimate interest
• Withdraw Consent: revoke previously given consent at any time
• Lodge a Complaint: file a complaint with your local data protection authority

California Residents (CCPA/CPRA): You have the right to know, delete, and opt out of the sale of personal information. We do not sell your personal information.

To exercise any of these rights, contact us at dnf.velora@gmail.com. You can also revoke Health permissions in iOS Settings, turn off iCloud backup in the app's Settings (which stops syncing), or delete the app to remove all on-device data. Data already backed up to iCloud can be removed from your iCloud settings.

11. Data Retention

• On-device data: Retained until you delete the app or manually clear data
• iCloud backup data: Retained in your iCloud until you turn backup off and delete it, or delete the app's iCloud data from your iCloud settings
• Analytics & crash logs: Retained by Firebase for the minimum period needed for diagnostics, then automatically purged per Google's retention policies

12. International Data Transfers

Firebase Analytics, Crashlytics, and Remote Config may transfer aggregated/anonymized data to Google servers located outside your country of residence, including the United States. These transfers are covered by Google's data processing terms and standard contractual clauses. Apple (iCloud, App Store) processes purchase and backup data on its own infrastructure, which may also be located outside your country, under Apple's privacy policy.

13. Children's Privacy

Velora is not directed to children under 13 (or under 16 in the EEA). We do not knowingly collect data from children. If we discover that a child has provided personal data, we will delete it promptly.

14. Changes to This Policy

We may update this Policy periodically. The current version is always published at https://velorahealthcompanion.com/privacy-policy/, and we update the Effective Date at the top of this page when it changes. Continued use after changes constitutes acceptance of the revised Policy. Material changes will be highlighted with a notice.