Legal

VEXO Privacy Policy

Version: 1.0  ·  Effective date: August 1, 2026

This Privacy Policy explains how SummitSync LLC (“SummitSync,” “VEXO,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information through the VEXO mobile application, the VEXO website, and related services (collectively, the “Services”).

VEXO is initially offered only in the United States and is intended for users age 18 and older.

For information specifically about consumer health data and rights under Washington’s My Health My Data Act, see our separate Consumer Health Data Privacy Policy.

1. Information We Collect

A. Account and identity information

We may collect:

• email address, including an Apple private relay email if you use Sign in with Apple;
• first name, last name, and display name;
• VEXO/Supabase user identifier;
• sign-in and authentication information;
• account creation date;
• subscription tier; and
• account and consent settings.

We do not receive your Apple ID password.

B. Profile, body, and goal information

You may provide or confirm:

• age in years;
• biological sex selection;
• height;
• current weight;
• target weight;
• activity level;
• fitness or weight goal;
• optional goal timeline;
• recovery equipment; and
• other profile settings needed to provide requested features.

Some profile fields may be shown with suggested or default values. You are responsible for reviewing and confirming information that VEXO uses for calculations or plans.

C. Dietary preferences and excluded foods

We may collect:

• dietary-restriction selections;
• preferred protein choices;
• carbohydrate and cooking preferences;
• free-text excluded foods; and
• other meal or recipe preferences.

VEXO does not maintain a separate comprehensive medical-allergy record. Dietary selections and excluded-food text may nevertheless reveal sensitive health or dietary information.

D. Activity and wellness logs

You may record:

• food;
• workouts;
• recovery activities;
• hydration;
• sleep;
• alcohol;
• weight measurements; and
• free-text notes associated with those records.

These records may contain health, fitness, nutrition, lifestyle, or other sensitive information.

E. Profile photo

If you choose to upload a profile photo, VEXO stores it in private, access-controlled cloud storage and retrieves it using authorized, short-lived links.

Authorized infrastructure personnel and service providers may access the photo only as necessary to operate, secure, maintain, or support the Services.

F. Apple Health information

If you choose to connect Apple Health and grant permission, VEXO may access selected health and fitness information, including:

• current weight;
• sleep;
• steps;
• active energy; and
• workout information.

At launch:

• Apple Health workout and activity records are used on-device and are not transmitted to SummitSync’s servers or Anthropic;
• Apple Health information may inform calculations performed on your device;
• Apple Health may suggest a current-weight value on your device;
• only the current weight you review and confirm as your VEXO profile weight may be transmitted for AI plan generation; and
• VEXO does not transmit the underlying Apple Health weight record, weight history, sample identifier, source device, or measurement timestamp to Anthropic.

VEXO does not use Apple Health information for advertising, marketing, cross-app tracking, or use-based data mining, and does not sell Apple Health information.

You can manage Apple Health permissions through Apple’s system settings.

G. AI plan information

If you affirmatively permit VEXO to use Anthropic to generate a personalized plan, VEXO sends Anthropic:

• profile information, including age, biological sex, height, confirmed current weight, target weight, activity level, goals, goal timeline, and recovery equipment;
• dietary preferences and free-text excluded-food information; and
• approximately seven days of food, manually logged workout, sleep, recovery, and alcohol information.

VEXO does not intentionally send Anthropic your name, email address, avatar photo, VEXO account identifier, Apple Health workout or activity records, or Apple Health measurement history.

No Anthropic request is made unless a current affirmative permission record exists. You may decline or later withdraw permission. Declining or withdrawing prevents future AI plan requests but does not automatically delete a plan generated before withdrawal.

H. Recipe-search information

When you request recipe or nutrition results, VEXO may send Edamam:

• recipe search terms;
• macro ranges;
• dietary labels; and
• related recipe-filter information.

VEXO does not intentionally send your VEXO user identifier to Edamam with a recipe request.

I. Subscription information

Apple processes App Store purchases and payment information.

RevenueCat and VEXO may receive or maintain:

• VEXO user identifier;
• product and subscription identifiers;
• subscription tier;
• purchase and renewal status;
• entitlement status; and
• transaction or receipt information made available through Apple.

VEXO does not receive or store your full payment-card number.

J. Product analytics

PostHog analytics are optional and off by default. If you opt in, VEXO may collect events such as:

• app opened;
• account created;
• onboarding completed;
• plan generated;
• paywall shown;
• subscription started;
• screen viewed; and
• feature-engagement events.

PostHog may receive the VEXO/Supabase user identifier and the following account properties:

• whether the account is a compensated tester;
• account creation date; and
• current subscription tier.

VEXO configures analytics to exclude health values, health-related free text, Apple Health data, automatic capture, and session replay. Session replay is disabled, so VEXO does not create PostHog session recordings.

You can withdraw analytics permission in the app. Withdrawal stops future analytics collection but does not delete analytics data collected before withdrawal. Previously collected events remain subject to the retention period described below.

If you delete your VEXO account through the app's account-deletion flow, VEXO immediately removes your PostHog person profile and initiates deletion of the associated analytics events. PostHog completes event deletion asynchronously.

K. Website and technical information

The VEXO website is a static site hosted by Netlify, which provides hosting, edge/CDN services, and SSL. Netlify may process standard technical information such as:

• IP address;
• browser and device type;
• date and time;
• pages or files requested;
• referring page; and
• security or error information.

Netlify retains website access logs, including visitor IP addresses, for less than 30 days.

The live website does not use analytics or advertising pixels and does not intentionally set cookies, `localStorage`, `sessionStorage`, or other persistent browser identifiers. The website self-hosts its fonts and does not load Google Fonts.

The homepage contains one waitlist email form processed through Netlify Forms. Waitlist submissions are stored for up to 30 days and then deleted. They are not transferred to beehiiv or another email-list provider. Support and contact links use your own email client rather than a website contact form.

2. Sources of Information

We collect information:

• directly from you;
• from your use of the Services;
• from Apple through Sign in with Apple, StoreKit/App Store, and Apple Health when you authorize access;
• from service providers that operate features on our behalf; and
• from automated calculations or inferences based on information you provide or confirm.

3. How We Use Information

We use personal information to:

• create, authenticate, and administer accounts;
• provide profile, tracking, nutrition, fitness, recovery, and planning features;
• calculate calorie, macro, activity, and other wellness targets;
• generate a requested AI-personalized plan;
• provide recipe-search and meal-related features;
• process and manage subscriptions;
• synchronize information across authorized devices;
• provide support and respond to requests;
• maintain safety, security, fraud prevention, and system integrity;
• troubleshoot and improve the Services;
• comply with law and enforce our agreements; and
• perform analytics when you opt in.

We do not use consumer health data for targeted advertising.

4. How We Disclose Information

We may disclose information to the following service providers, acting on our behalf and subject to applicable contractual restrictions:

Supabase

Supabase provides authentication, database, and storage infrastructure. It stores account information, confirmed profile information, user-entered logs and notes, subscription tier, and private avatar files.

Anthropic

With your explicit permission, Anthropic processes the profile, dietary, and recent-log information described above to generate a requested personalized plan.

Under Anthropic’s standard commercial API configuration, Anthropic generally deletes API inputs and outputs from its backend within 30 days. Anthropic may retain limited information longer when necessary to enforce usage policies or comply with legal obligations.

Anthropic does not use VEXO’s commercial API inputs or outputs to train its general-purpose models by default. SummitSync has not opted into model-training, feedback, or other data-sharing programs for production VEXO data.

Edamam

Edamam processes recipe searches, macro ranges, dietary labels, and related recipe filters to return requested recipe or nutrition results.

PostHog

If you opt in to analytics, PostHog processes the limited analytics information described above. VEXO does not intentionally send health values, health-related free text, or Apple Health data to PostHog.

RevenueCat

RevenueCat processes subscription, entitlement, product, and purchase-status information used to provide paid access.

Apple

Apple provides App Store billing, StoreKit, Sign in with Apple, Apple Health permissions, and related platform services under Apple’s policies.

Netlify

Netlify hosts the VEXO website, provides edge/CDN and SSL services, processes standard website access logs, and processes the homepage waitlist form. Waitlist submissions are retained for up to 30 days and then deleted.

Legal, safety, and corporate disclosures

We may disclose information when reasonably necessary to:

• comply with law, legal process, or valid governmental requests;
• protect the rights, safety, and security of users, SummitSync, or others;
• investigate fraud, security incidents, or violations;
• enforce agreements; or
• complete a merger, financing, acquisition, reorganization, bankruptcy, or transfer of assets, subject to applicable law and appropriate protections.

5. What We Do Not Do

VEXO does not:

• sell personal information or consumer health data;
• use Apple Health information for advertising, marketing, cross-app tracking, or use-based data mining;
• use commercial Anthropic API inputs or outputs for generalized model training;
• permit Anthropic to use them for general model training under the current configuration;
• send health values or Apple Health data to PostHog;
• use advertising identifiers such as IDFA; or
• use personal information for cross-app or cross-site tracking.

6. AI Permission and Withdrawal

Before sending personal information to Anthropic, VEXO presents a disclosure and requests your explicit permission.

VEXO records the disclosure version, your choice, and the time of the event. You can withdraw AI permission through Settings. Withdrawal blocks future AI requests.

AI permission records remain linked to your account while it is active and are deleted with your account, subject to backup-deletion timing and any limited legal obligation that cannot be waived.

7. Retention

We retain information only for the periods reasonably necessary for the purposes described in this Policy, including providing the Services, maintaining security, complying with law, and resolving disputes.

Our retention approach is:

• account, profile, and user-entered product information: while your account is active, unless you delete individual information or request account deletion;
• avatar: until replaced or the account is deleted;
• Anthropic inputs and outputs: generally deleted by Anthropic within 30 days under the standard commercial API configuration, subject to limited usage-policy and legal exceptions;
• AI permission history: while the account is active, then deleted with the account;
• PostHog event and analytics data: retained under the current PostHog Cloud Free-plan default for one year; after one year, PostHog may move the data to cold storage and may permanently delete it under its service policies;
• website access logs: retained by Netlify for less than 30 days;
• waitlist submissions: retained in Netlify Forms for up to 30 days and then deleted;
• purchase and subscription records: for the period required to administer entitlements and satisfy legal, accounting, fraud-prevention, and dispute obligations;
• Terms-acceptance and minimal legal-compliance records: for the life of the account and up to seven years after account closure, where permitted by law;
• deletion audit records: a minimal record consisting of an internal user identifier, timestamp, deletion action or systems addressed, and outcome or status, retained for four years after the deletion event; and
• backups: deleted or overwritten according to our backup cycle and, for authenticated Washington consumer-health deletion requests, within no more than six months.

8. Account Deletion and Privacy Requests

You may request account deletion through the app or by emailing info@vexoapp.ai.

Upon authenticated deletion through VEXO's account-deletion flow, we delete the Supabase authentication account, profile, user-entered logs and notes, weight records, avatar and its stored reference, and AI-permission records from active VEXO systems. We also immediately remove the PostHog person profile and initiate deletion of the associated analytics events, which PostHog completes asynchronously. We direct other applicable processors and service providers to honor the request, subject to limited legal exceptions.

Deletion from archived or backup systems may be delayed until the systems are restored or overwritten, but Washington consumer-health backup deletion will not be delayed more than six months after authentication of the request.

We may retain limited information when required by law or necessary for security, fraud prevention, exercising or defending legal claims, or documenting contractual acceptance. This includes the limited four-year deletion audit record described above. We do not include names, email addresses, health information, profile properties, logs, AI content, or other deleted account content in that audit record, and we will not use retained information for unrelated purposes.

9. Your Choices and Rights

Depending on your location and applicable law, you may have rights to:

• access personal information;
• correct inaccurate information;
• obtain information about collection and disclosure;
• request deletion;
• withdraw consent or permission for future processing;
• receive information about recipients;
• appeal a denial of a consumer-health request; and
• receive a portable copy where applicable.

To submit a request, use available in-app controls or email info@vexoapp.ai. We may take reasonable steps to authenticate your request.

For Washington consumer-health rights and response periods, see the Consumer Health Data Privacy Policy.

10. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including access controls, encryption in transit and at rest where supported, private storage for avatars, and service-provider controls.

No system can guarantee absolute security.

11. Children

VEXO is not intended for anyone under 18. We do not knowingly permit a person who provides an age under 18 to use the Services.

If you believe a person under 18 has provided personal information, contact info@vexoapp.ai.

12. International Use

VEXO is initially offered only in the United States. We do not presently offer a functional VEXO web application outside the United States.

13. Changes to This Policy

We may update this Policy. We will post the updated version with a revised effective date and provide additional notice when required.

If a change materially affects how we collect, use, or disclose personal information, we will obtain additional permission where required before applying the new practice.

14. Contact

SummitSync LLC

Washington, United States

Email: info@vexoapp.ai