Privacy Policy
Last updated 14 October 2026 · New Zealand and Australia launch
Vayloza needs food and account information to turn receipts into a pantry and meal plan. We do not sell individual receipt, allergy, diet or nutrition histories to advertisers. Billing is handled by Stripe for website/direct-app purchases and by Google Play for Play Store purchases. Vayloza does not store raw card details.
What we collect
Depending on how you use Vayloza, we may collect your email address and password hash; country, goal, eating style, calorie and protein targets, budget, allergies, dislikes, household size, cooking preferences, preferred supermarkets and optional progress entries such as weight or notes; optional strength-programme preferences, exercises completed, repetitions and workout history; device push-subscription endpoints or Firebase device tokens only when you enable notifications; receipt OCR text and parsed grocery items; pantry, meal-plan, shopping-list and meal-consumption information; basic service events needed to operate and secure the product; and, where applicable, Stripe customer/subscription identifiers or Google Play purchase-verification identifiers and subscription status.
Receipt images
Receipt photos are used to perform OCR. The current design deletes the temporary uploaded receipt image after OCR processing. Parsed receipt text and grocery data may remain in your account so your pantry, corrections and history can work.
Why we use it
We use this information to authenticate your account, recognise groceries, maintain your pantry, personalise diet-aware meal suggestions, generate shopping lists, calculate estimated nutrition and budget information, provide billing, show optional progress information, organise optional bodyweight workouts, send your chosen reminders through browser push services or Firebase Cloud Messaging, record retailer handoffs, troubleshoot the service and improve product matching.
Where data is handled
The Vayloza application database is currently hosted with Fly.io in Sydney, Australia. Stripe processes website/direct-app subscription payments and associated billing information. Google Play processes purchases made through the Google Play version. GitLab and Render are used in the software deployment process. If you enable push notifications, Google Firebase Cloud Messaging or a browser/platform push provider may process your device push token and notification payload solely to deliver the requested reminder. Service providers may process limited information necessary to provide their services.
Retailer links and commissions
Vayloza may show links to supported supermarkets. If an approved referral or affiliate arrangement is connected, the link is labelled and Vayloza may earn a commission when you use it. Retailer payments do not change the diet rules or nutrition ranking used for your meal recommendations. We record basic handoff information so the shopping feature and partner reporting can work. Retailers operate their own checkout, pricing, availability and privacy practices.
Optional progress information
Weight and progress notes are optional. If you choose to enter them, Vayloza stores them with your account so you can view your history. You can use the meal-planning features without entering weight.
Optional strength training and phone reminders
Training is optional and can be turned off without losing access to nutrition planning. If you enable it, Vayloza stores your selected programme, training days, exercises logged and completion history. Reminder categories are optional, require notification permission and can be changed or disabled in the app. Device tokens and browser subscriptions are used for delivery, not advertising. You can revoke notification permission in device settings; sign-out and account deletion also remove applicable app-linked registrations. Reminder timing and delivery can vary with your device, connectivity and service availability.
Advertising and sale of personal food data
Vayloza is designed as a paid service rather than an advertising-data business. We do not sell individual food, receipt, allergy or nutrition histories to advertisers. If that model ever materially changes, this policy and the collection notice will be updated before the change applies.
Your choices
You can edit profile information in Settings. Vayloza provides an account-data export and an in-app account deletion control. You can also use the Vayloza account deletion page to start an account/data deletion request outside the app. Where applicable, you may also request access to or correction of personal information.
Security and retention
We use password hashing, HTTPS, restricted service credentials and other reasonable safeguards. No internet service can guarantee absolute security. We keep account data while it is needed to provide the service, meet legal/accounting obligations or resolve legitimate disputes, then delete or de-identify it where appropriate.
Adults only
Vayloza is currently intended for people aged 18 and over.
Questions or complaints
For privacy questions, access/correction requests or complaints, contact hello@vayloza.com. We will review the issue and respond as reasonably practicable. New Zealand users may also contact the Office of the Privacy Commissioner, and Australian users may contact the Office of the Australian Information Commissioner where applicable.
This policy is intended to explain Vayloza’s current handling practices clearly. It is not a substitute for individual legal advice.