VigorLens privacy policy

Information handled on the device

The native app stores meals, nutrient estimates, fluids, movement, food-tolerance observations, measurements, goals, reminders, favorites, summaries, and questions in an SQLCipher-encrypted SQLite database. Its key is generated on the device and kept in secure storage. Demonstration records stay separate from the personal journal. The browser preview stores sample data without encryption and is not the native privacy implementation. Local reminders use neutral text without a remote push service; device authentication can provide an additional screen lock.

Optional account and encrypted recovery

Core local use does not require an account. When an eligible native build enables the beta service, email sign-in through Amazon Cognito may process an email address, account identifier, and session and security information. Signing in does not automatically upload a record.

Only after confirmation, the device encrypts the complete record with AES-256-GCM using a key derived from your passphrase. The service stores ciphertext and recovery metadata, including an opaque owner identifier, revision, device identifier, and record date. Focalward does not receive the passphrase or derived key and cannot decrypt the record or recover a forgotten passphrase. Recovery is manual; a revision check prevents silent overwrites.

Optional meal-photo assistance

Selecting a photo does not transmit it. When the service is available, VigorLens asks for consent for the selected photo and optional note before sending them through its service to OpenAI. The image is resized and re-encoded and embedded metadata is removed. Your journal, goals, tolerance history, measurements, and care questions are not attached. Suggestions remain drafts; you review and edit food identity and portions before saving. Temporary copies are removed on a best-effort basis, but the original photo and operating-system caches are outside the app’s control. The provider setting requests no storage for model use; it is not a zero-retention guarantee, and abuse-monitoring retention may last up to 30 days subject to provider policy and exceptions.

Optional subscription and billing

When billing is enabled, Apple or Google processes purchases and RevenueCat supports subscription status and restoration. Purchases and Restore purchases do not require a VigorLens account. RevenueCat may receive an anonymous app-user billing identifier or a connected account identifier, purchase, transaction, product, entitlement, subscription information, and applicable SDK technical metadata needed for Plus. Signing in may associate billing information with the account. It does not receive your record, notes, contacts, photos, recovery passphrase, encryption key, or encrypted recovery document. The VigorLens service may retain normalized subscription status, access dates, safe provider identifiers, and bounded usage metadata.

An eligible trial begins only after you choose a subscription and confirm it with Apple or Google. Downloading the app, completing setup, signing in, or restoring a record does not start a new trial. The store shows trial eligibility, duration, localized price, renewal date, future charge, and cancellation terms. Subscriptions renew unless canceled through store settings. No new Focalward account trial is created; previously issued access retains its original expiry. Restore purchases checks subscription access and does not restore journal contents or a recovery passphrase.

Ending Plus stops new paid operations. It does not hide or delete existing device records, block review, export, or deletion, or prevent existing recovery downloads. Deleting the app account does not cancel a store subscription; manage that separately through Apple or Google.

Exports, backups, and sharing

Journal exports, sharing, and backups occur only when you request an export or share, or save an encrypted portable backup, or confirm an encrypted recovery upload. Separately consented meal-photo assistance also sends the selected image and optional note as described above; selecting a photo alone does not send it. Portable backups use passphrase-based AES-256-GCM encryption, and Focalward cannot recover that passphrase. The operating-system share sheet and destination you choose then handle the file or text. Files saved or shared outside the app must be removed from those destinations separately.

Optional beta website feedback

If you choose to send feedback through the invited beta website, Focalward receives your self-reported name, device and build details, checklist answers and comments, plus any screenshots with their comments and optional voice note you attach. Files stay in your browser until you send the report. Feedback is stored separately from your app journal and account in private Amazon Web Services storage for troubleshooting by authorized staff. Beta voice notes are not transcribed or sent to an AI provider. Reports and attachments become unavailable after 180 days; temporary staged uploads are scheduled for removal after one day. Database and object-storage cleanup is asynchronous, and protected backups may retain copies longer. In-app account or device deletion does not identify or delete a separate beta report; contact support@focalward.com for help requesting its deletion. Use fictional information and remove health details, names, messages, passwords and other sensitive information before sending.

How information is used

VigorLens uses information to provide the local journal, calculations, reminders, reviewed summaries, exports, optional account access and recovery, subscription access, and separately consented meal-photo assistance. Limited service metadata supports authentication, ownership checks, abuse prevention, and troubleshooting. It has no advertising or session replay; Focalward does not sell personal or wellness information or use it for cross-app advertising or tracking.

Retention and deletion

Device erasure removes the local record, encryption key, scheduled reminders, and app-created temporary export files on that device. It does not remove an optional account, encrypted cloud recovery, files shared elsewhere, or notifications already shown by the operating system.

Authenticated account deletion removes the current encrypted recovery record, account identity, and other account-scoped service data. Minimal permanent deletion markers retain an opaque owner identifier and deletion state to stop delayed or restored data from recreating the account. They do not contain entries, email, subscription balance, or ciphertext. Encrypted historical bytes may remain in protected service backups for up to 35 days. Security records and independent providers may retain information under their policies or legal obligations.

In VigorLens, completing in-app cloud account deletion also clears this device’s journal, sign-in, and recovery keys. Export anything you want to keep first. If cleanup is interrupted, finish the prompted device cleanup before using the journal again.

How to delete your account or data →

Your choices and security

You can use local features without an account, leave recovery disabled, revoke device permissions, export, erase device data, and delete an authenticated account. No device, software, transmission, or storage system is completely secure; protect your device, passphrases, exports, and chosen sharing destinations.

Children, changes, and contact

VigorLens is intended for adults and is not directed to children. Focalward does not knowingly solicit children's personal information through it. This policy may change as features, providers, or legal requirements change; the effective date will be updated.

Questions or privacy requests: support@focalward.com.