Privacy policy

Voima: Gym & Calorie Tracker
Last updated: 24 October 2026

This policy explains what information Voima uses, where it goes and the choices you have. We've tried to keep it short and plain.

The short version

• Your food, training, weight, sleep and other logs are stored on your iPhone (and on your Apple Watch if you use the watch app). We can't see them.
• There is no account, no email and no password. Voima gives your phone a random anonymous ID instead.
• When you choose to use an AI feature (for example "Snap a meal"), the photo, file, link or words you give it are sent to our server and on to our AI provider, Anthropic, to work out the answer. We don't keep the photo or words afterwards.
• Apple Health data never leaves your phone through Voima. It is never sent to our server, never shared with third parties, never sold and never used for advertising.
• No ads, no tracking, no analytics tools. We don't sell your data.

Who we are

Voima is made by Jonathan Biggs, a sole trader based in the United Kingdom ("we", "us"). For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), we are the controller of the personal data described in this policy.

Contact: [email protected]

What stays on your phone

Voima stores the following in a private database on your iPhone. It is not sent to us.

• Your setup details: sex, age, height, activity level, goal, daily targets, units, start and goal weight, food allergies and preferences you tick, sleep goal, reminder settings, and when you agreed to the terms.
• Food logs, saved meals, takeaway menus and dishes, water and body weight.
• Gyms, machines, exercises, machine photos, sets, rest timer settings, cardio and class sessions.
• Information read from Apple Health (see below), used on the phone to show your activity, workouts, sleep score, calories in vs out and targets.

If you use the Apple Watch app, your phone sends your current gym's machines, recent weights and Pro status to the watch over Apple's own phone-to-watch connection. Sets you log on the watch are sent back to your phone the same way. None of this passes through our servers.

Backups and PDF reports are files that Voima makes on your phone. They contain your logs (which may include weight, workouts and other information that came from Apple Health). They only go where you choose to send or save them (for example iCloud Drive, Files or email), and are then covered by that service's terms.

What leaves your phone, and why

1. AI features (only when you use one)

When you tap an AI feature, Voima sends what you've given it to our server, which passes it to Anthropic's Claude AI to work out the result:

Photos are shrunk on your phone before sending. Nothing from Apple Health, your logs, your targets, your allergies or your profile is sent with these requests.

• Our server (Supabase) passes the request to Anthropic and sends the answer back. We do not store the photo, file, link or words.
• Anthropic processes the request to produce the answer. Under Anthropic's commercial terms, inputs are not used to train their models. Anthropic may keep requests for a limited time for safety and abuse monitoring, in line with its own retention policy, before deleting them. Anthropic does not receive your anonymous ID from us.

Voice: "Tap to talk" uses Apple's speech recognition to turn your voice into text. On newer iPhones this happens on the phone; on older ones Apple may process the audio. Only the resulting text is sent to us, and only if you go on to use the AI estimate.

2. Anonymous ID and AI usage counts (Supabase)

The first time you use AI (or when subscriptions start up), Voima signs in to our server anonymously: no name, email or password, just a random ID created for your phone. Our server, run on Supabase with data stored in the EU (Ireland), keeps:

• your anonymous ID;
• how many AI uses you've made each day and in total, and how much AI processing (tokens) they used, so we can apply the Voima Pro daily limit (10 a day) and an overall cost cap;
• a short-lived copy of whether you have Voima Pro and when it renews or ends, so we don't need to ask RevenueCat on every AI request.

Like most online services, our server and its hosting provider may briefly record technical information such as your IP address and request times in security and error logs.

3. Subscriptions (Apple and RevenueCat)

Voima Pro is bought through Apple. Apple handles payment; we never see your card details or Apple ID. We use RevenueCat to check whether you have an active subscription. RevenueCat receives your anonymous ID and the purchase details from Apple (product, price, dates, trial and renewal status, country/store) and records them against that anonymous ID. RevenueCat also receives technical information from the app (such as app version, device model and iOS version) needed to run its service.

4. Barcode lookups (Open Food Facts)

When you scan a barcode, the app asks Open Food Facts (a free, open food database run by a non-profit in France) for that product. Only the barcode number is sent, along with the technical details any web request includes (such as your IP address). We don't send anything else.

5. Apple Health

If you allow it, Voima reads from Apple Health: steps, active and resting calories, workouts, body weight, sleep, heart rate and resting heart rate. It writes to Apple Health the protein, carbs, fat, fibre and calories you log, and (from the Apple Watch app) your gym workouts with their active calories.

We promise that data from Apple Health:

• is used only on your device, to provide Voima's features;
• is never sent to our servers or to any third party, including our AI provider;
• is never sold, and never used for advertising, marketing or data mining;
• is never used to work out anything about you for anyone else.

You can change what Voima can access at any time in the Health app (Sharing → Apps → Voima) or in iPhone Settings.

6. Camera, photos, microphone and notifications

Voima uses the camera, photo library and microphone only when you choose a feature that needs them. Photos you take of machines stay on your phone unless you use them for an AI feature. Reminders, the rest timer and the burn-goal notifications are scheduled on your phone. The only notifications sent from our server are gym update notifications (see section 7), and only if you add a gym from Find your gym and allow notifications.

7. Community features (only if you use them)

• Find your gym (ready-made gyms): gym staff who publish a gym sign in with Apple. We store their Apple sign-in identifier (and the email or private-relay email Apple may share), and the gym's name, town, approximate location, machines, photos and logo. Published gyms are public in the app. Location and other metadata are removed from gym photos and logos. If an editor deletes their data, the gym stays available to members and passes to another editor or to Voima.
• Gyms you add and update notifications: which directory gyms you added and the version you have, and, if you allow notifications, your device's push token and app language, used only to send gym updates (delivered by Apple Push Notification service). "Gyms near me" sends an approximate location (about 1 km) that is used for the search and not stored.
• Workouts you submit, reactions and comments: stored with your anonymous ID and the display name you choose, and shown publicly once approved or checked. Comments are checked automatically before they appear, using Anthropic's Claude (the comment text and display name are sent to Anthropic for this).
• Reports and blocks: what you reported or blocked. Reports are reviewed by Voima within 24 hours; reported comments are hidden until reviewed.
• Deleting: "Delete my server data" and "Reset app" also delete your comments, reactions, submissions, reports, blocks, followed gyms, push token and editor access.

What we don't do

• No advertising and no ad networks.
• No tracking across other companies' apps or websites, and we never ask for permission to track.
• No analytics or crash-reporting tools.
• No selling or renting of personal data.
• No accounts for members. Only gym staff who publish a gym sign in (with Apple). Names are only the display names you choose for community features.

Our legal bases (UK GDPR)

• Contract – to provide the features you ask for: running AI requests, applying your AI allowance, and checking and providing your Voima Pro subscription.
• Legitimate interests – to keep the service secure, prevent abuse and control running costs (for example the daily limits and security logs). We've balanced these against your interests; the data involved is minimal and anonymous.
• Explicit consent – if anything you choose to send to an AI feature reveals information about your health, you choose to send it, and you can simply not use AI features. Apple Health access is only ever based on the permission you give in iOS, and stays on your phone.
• Legal obligation – where we must keep records, for example for tax (Apple keeps the purchase records for subscriptions).

How long we keep things

• On your phone: until you delete it, reset the app or delete Voima.
• AI photos, files, links and words: not stored by us. Anthropic may keep them for a limited time under its retention policy, then deletes them.
• AI usage counts and token totals: kept while you use the app, and deleted within 24 months of your last AI use, or sooner if you ask.
• Pro status copy: refreshed every few minutes when you use AI; deleted with your anonymous ID.
• Community data: submitted workouts, comments and reactions are kept while they're shown and deleted when you delete your data; reviewed reports are deleted after 12 months; push tokens are deleted after 6 months without use.
• Server security and error logs: kept briefly by our hosting provider (typically days to weeks).
• Subscription records: kept by Apple and RevenueCat for as long as needed to provide and account for your subscription, under their own policies.

Who we share data with

We only share data with service providers that help us run Voima, under contracts that require them to protect it:

We may also disclose information if the law requires it.

International transfers

Some providers are based in, or process data in, the United States. Where personal data goes outside the UK, we rely on appropriate safeguards, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses included in our providers' data processing terms, or the UK–US data bridge where the provider is certified under it.

Your rights

Under UK data protection law you have the right to ask for access to your data, to have it corrected or deleted, to restrict or object to its use, and to data portability. You can also withdraw consent at any time.

Data on your phone is fully in your control:

• Delete individual items in the app.
• Settings → Reset app deletes everything Voima has stored on this phone, deletes this phone's AI usage records on our server, and starts setup again.
• Settings → Delete my server data deletes this phone's AI usage records and Pro status copy on our server straight away, without touching the data on your phone.
• Deleting Voima from your iPhone (and Apple Watch) removes all of its data from the device.

Data on our server: the quickest way is Settings → Delete my server data (or Reset app), which deletes them immediately. You can also email [email protected] with the subject "Delete my data". If you have (or had) Voima Pro, include the order ID from Apple's receipt email, which lets us find your anonymous ID. We'll delete the ID, its usage counts and its Pro status copy within 30 days. Without the ID we may not be able to identify you, and deleting the app means the ID is lost; records not linked to anyone are deleted on the retention schedule above. Subscription records held by Apple and RevenueCat are needed to provide your subscription; you can cancel the subscription any time in your Apple ID settings.

If you're unhappy with how we've handled your data, please contact us first. You also have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk, 0303 123 1113.

Children

Voima is meant for adults. Setup asks you to confirm you are 18 or over. It is not for children and we don't knowingly collect data from anyone under 16. If you think a child has used Voima's AI features, contact us and we'll delete the related server records.

Security

Data on your phone is protected by iOS. Data sent to our server travels over encrypted connections (HTTPS). Our server tables can only be reached by our own server code, not by the app directly. No system is perfectly secure, but we keep what we hold to a minimum.

Changes to this policy

If we change this policy we'll update the date at the top, and tell you in the app if the change is significant.

Contact

Jonathan Biggs (Voima), United Kingdom
Email: [email protected]