Privacy policy

Who we are

Vytos is a product of Atto, run by Ranielli Montagna Desenvolvimento de Software Ltda. (RM Software), a company based in Paraí, RS, Brazil (Brazilian company number (CNPJ) 67.919.685/0001-45). RM Software is responsible for your data: it decides how your data is used, always as described here. In this policy, "we" and "us" mean RM Software.

For any question or request about your data, write to contato@vytos.com.br.

What Vytos keeps

• Your account: the email you sign in with, the account name if there is one, and when the account was created.
• Your weight and your habits: what you log, and what the phone app brings in on its own from Apple Health or Health Connect, only when you allow it.
• From your chats with the mascot, only what becomes data: day notes (like a meal you mentioned), what the mascot remembers about you and the weekly recaps. The chat itself stays only on the device where you had it.
• Your settings: goals, reminders, times, theme, language and units, and the date of your consent.
• The devices that get your notifications, and a history of what was sent.
• How much AI you used each day: the model, the amount and the cost, never the text.

Why

• To show your day, your progress and your weekly recap, on your phone and on the web.
• To send reminders at the times you pick, only when something is still missing.
• So the mascot can understand what you write and answer you.
• To keep a copy on the server, so you don't lose anything and can see it all on the web too.

Your weight and your habits are health data. Vytos only keeps them with your consent, asked for separately when you start.

Your chats with the mascot and AI

When you write to the mascot, the text goes through the Vytos server, which strips out what isn't needed and sends it to Anthropic's AI (Claude) only to understand it and answer. The text never goes straight from your device to Anthropic.

The server doesn't keep the chat: it keeps only what becomes a day note or something the mascot remembers.

We accepted Anthropic's data processing agreement and asked for zero data retention, so that Anthropic doesn't keep what it receives. And Vytos doesn't use AI services that train on the data we send.

On the phone, your voice becomes text on the device itself. The audio never leaves your phone.

Who else gets data

Only what's needed for the app to work:

• Anthropic, which gets what you write to the mascot, as explained above.
• Resend, the sign-in email service, which gets your email address to send you the code.
• The notification services that carry notifications to your device: Expo's on the phone, and your browser's on the web.
• The App Store, Google Play, RevenueCat and Stripe (on the web), when you subscribe: they handle the purchase and the subscription.
• Cloudflare, which stores the daily backup of the server's database and counts visits to the website (see "Visits to the website").

Where your data lives

On your device (on your phone, or in this browser on the web) and on the Vytos server. The server's database is backed up once a day to storage outside it, at Cloudflare.

Data travels between your device and the server over an encrypted connection (HTTPS).

Vytos is run from Brazil, so your data may be stored and processed outside the United States.

What you can do

Anytime, in the app itself:

• Export everything that's yours to a file, in You > My data.
• Withdraw your health data consent without deleting your account, in You > My data: your health logs are deleted, here and on the server; your account and settings stay, and syncing pauses until you consent again.
• Delete your account and all your data, here and on the server, in You > My data.
• See and delete what the mascot remembers about you, one item at a time, in You.

Whatever you delete is also gone from the daily backup within 30 days.

For anything else about your data, write to contato@vytos.com.br.

What Vytos doesn't do

• Vytos doesn't sell your data.
• The app has no ad pixels or ad tools, and nothing in it tracks you for ads.

Consumer health data

Consumer health data is personal data, linked to you, about your physical or mental health. Some US states, like Washington with its My Health My Data Act, have laws for it. Here is what Vytos does with it, all in one place.

What we collect, and where it comes from:

• Your weight and your weight goal, from what you log and, if you allow it, from Apple Health or Health Connect through the phone app.
• Your habits and what you log for them (like water or steps), from you and, if you allow it, from those same health apps.
• What becomes data from your chats with the mascot: day notes (like a meal you mentioned), what the mascot remembers about you and your weekly recaps.
• What you write to the mascot, which passes through our server to Anthropic so the mascot can answer. The server doesn't keep the chat.
• Support mode: if something you write suggests you're going through a hard time, Vytos switches to support mode for 7 days (the mascot doesn't talk about weight, goals or numbers) and keeps the date it ends. Withdrawing your consent clears it.

Why: only to run Vytos for you. We use it to show your logs and your progress, send your reminders, let the mascot answer you and keep a copy so nothing is lost.

Who gets it, besides us:

• Anthropic, which gets what you write to the mascot only to answer you, under the zero data retention we asked for.
• The notification services (Expo on the phone, your browser's service on the web), which carry your reminders. A reminder can name a habit and say how far along you are (like how much water you've had so far), and one asks for today's weight.
• Cloudflare, which stores the daily backup of the server's database.

The payment and sign-in email services (the App Store, Google Play, RevenueCat, Stripe and Resend) never get your consumer health data.

We never sell your consumer health data, and we don't use it or share it for ads.

Your consent and your choices:

• You agree before we collect it, in the consent step when you start.
• You can get a copy anytime: export everything to a file in You > My data.
• You can delete it anytime: delete your account in You > My data, or delete what the mascot remembers about you, one item at a time, in You.
• You can withdraw your consent anytime in You > My data: your health logs are deleted, here and on the server, and syncing pauses until you consent again.

Whatever you delete is also gone from the daily backup within 30 days.

To ask anything else, like confirming what we have about you or who received it, write to contato@vytos.com.br.

Health breach notification

If your health data is ever breached, meaning someone gets it without your permission (through an attack, a leak or a disclosure we didn't authorize), we'll tell you without unreasonable delay and no later than 60 days after we find out.

We'll tell you by email, at the address you sign in with. The notice will say what happened and when, what data was involved, what we're doing about it, what you can do to protect yourself and how to reach us.

We'll also notify the Federal Trade Commission (FTC), as its Health Breach Notification Rule requires, and the media when the rule calls for it.

Children

Vytos is for adults 18 and over and isn't meant for children. We don't knowingly collect data from anyone under 18. If you think someone under 18 has an account, write to contato@vytos.com.br and we'll delete it.

Visits to the website

On vytos.com.br (the website, outside the app), we count visits with Cloudflare Web Analytics. It works without cookies, builds no profile and doesn't follow you across other sites: it keeps only totals, like how many visits a page had, where they came from (for example, Instagram), the type of device and the load time.

We use these numbers to improve the website. If you don't want to be counted, block static.cloudflareinsights.com in your browser or write to contato@vytos.com.br.

When this text changes

The new version appears on this page, with the date at the top.