Privacy policy

Life OS is a health, fitness and wellbeing app for iPhone. It handles some of the most sensitive information a phone holds, and this document is written to describe what the app actually does rather than to reserve every right a policy could reserve.

The short version. Almost everything stays on your iPhone. Nothing goes to an AI model until you allow it: the app shows exactly what is sent and to whom before the first request, and Settings, Privacy, turns it off again. With your permission, what your ELO needs to answer you goes to our server on Cloudflare and to one AI model: an open model run by Cloudflare Workers AI, or Google's Gemini on Google's paid terms. Neither is allowed to use it to train models. A backup of your day-to-day records is sealed on your iPhone before it leaves, with a key kept in your iCloud Keychain, so we cannot read it. You can delete your account, and everything we hold for it, in the app. There is no advertising or tracking, and the only usage measurement is an anonymous count of which features are opened, which you can switch off.

Who this is from

Life OS is an independent app published on the Apple App Store by its developer. Questions about this policy, requests about your data, or anything else, go to s0533495227@gmail.com and are answered by the person who wrote the app.

1. What stays on your iPhone

The app's records live in an on-device database. That includes everything you log and everything it computes: meals and their nutrients, water, workouts and lifts, sleep records and scores, recovery and strain figures, journal entries, your wardrobe and outfits, laundry state, posture measurements, checklist and streak state, targets, settings and layout.

That database is not synced to iCloud. Health information stays on the phone, as Apple requires; the encrypted backup described below is how it moves to a new iPhone.

Measured entirely on device, never transmitted

• Posture. Head angle, trunk lean and hip offset are computed from an Apple Vision body-pose read of your photo, on the phone. The photo is not uploaded.
• Rep counting during a session, from body pose, on the phone.
• Garment colour, read from your clothing photo on the phone before anything else happens.
• The first-pass food classifier, which runs locally and offline. The cloud service is only a fallback.
• Speech for the wake phrase and for calls with your ELO on an iPhone with Apple Intelligence, turned into text on the phone. Dictation and journal recordings are different, see section 3.
• Calendar events are read on the phone to work out your day. They are not stored by us. If you allow your ELO to use AI models, today's events it needs to answer you are sent with that request, as described in section 3.

2. Apple Health

With your permission, Life OS reads a wide set of HealthKit data so that it can compare today against your own normal rather than a population average: body measurements; active, resting and dietary energy; steps, distance, exercise and stand time; heart rate, resting heart rate, heart rate variability and heart-rate recovery; VO₂ max, respiratory rate and blood oxygen; body and wrist temperature; walking and running form metrics; time in daylight and audio exposure; sleep analysis and mindful sessions; workouts and Apple's own activity-ring goals; and the nutrients other apps have written.

With your permission it writes back workouts, active energy, bodyweight, water and the nutrients from meals you log, each behind its own switch in Settings, so you can let it read without letting it write.

HealthKit data is read into the app on your device. The only part of it that leaves the phone is the summary the coach reads to answer you, listed in section 3, and that is behind a switch you control. Apple requires, and this app observes, that health data is never used for advertising or sold to anyone. You can withdraw any individual permission at any time in the iPhone Health app, under Sharing then Apps.

3. What leaves your device, and why

Life OS uses a small backend we operate on Cloudflare for the features that need a model too large to sit on a phone, and to hold the few records listed here. Every AI request below is sent only after you have allowed your ELO to use AI models; until then nothing is sent to one, and Settings, Privacy, “Share with AI models” turns it off at any time.

Who receives what you send to an AI model

• Cloudflare, Inc. runs our backend and, through Workers AI, the open models that answer by default (from Meta, Mistral, Qwen, OpenAI's Whisper for speech, and Deepgram for voice). Cloudflare states that it does not use this content to train any AI model or to improve any Cloudflare or third-party service.
• Google LLC, through the Gemini API, only on Google's paid terms, under which Google does not use what is sent to improve its products.

We send personal data to no other AI company. If that ever changes, the app will say so and ask again before anything is sent, and this policy will name the company first.

What is sent	Why, and what happens to it
A message to your ELO, and the context it needs	What you type or say, any photo or file you attach, and the parts of your day it needs to answer: sleep, heart rate and heart rate variability, workouts and activity, meals and water, weight, cycle and mood check-ins, your notes, to-dos and calendar events, and what you have told it about yourself. Assembled on the phone; anything unavailable is left out rather than sent as a zero. Sent to one of the AI services above to produce the reply, and not stored by us afterwards.
Dictated speech and journal recordings	When you dictate, or ask for a journal recording to be transcribed, the audio is sent to be turned into text by Whisper on Cloudflare Workers AI and the text comes back to you. The audio is not stored by us. Without permission, or without a connection, the phone's own speech recognition is used instead. A journal recording you keep stays on your iPhone.
A meal, clothing, equipment or washing-machine photo	Sent when you scan something the on-device classifier could not identify, to be named and estimated by a vision model from the list above. The result comes back for you to review. The image is not stored after the request is answered.
An account	Only if you sign in with Apple or Google. The provider gives the app a stable identifier, which is registered so your subscription and backup can find you on a new phone. Your name and email are sent only if the provider passes them. Sign in with Apple lets you hide your real address behind a relay one. You can delete the account in the app (section 9).
Your creator code	Only if you join the Earn program: your own code, so subscribers you refer can be credited to you. Codes do not change what anyone pays in the app.
An approximate location	Only for weather, and only to look up today's forecast. Coordinates are rounded to roughly a kilometre and not stored. Background location is used only with automatic run detection turned on.
A sealed backup of your day-to-day records	Journal entries, meals, water, groceries, dreams, checklist state, wardrobe entries and workout days, sent in the background so a lost or replaced phone is not a total wipe. The backup is encrypted on your iPhone (AES-GCM) with a key kept in your iCloud Keychain, or on the phone if iCloud Keychain is off, before it is sent; we store only the sealed file and cannot read it. Kept until you delete your account.
A snapshot for the web dashboard, and a pairing code	Only if you open the web dashboard from the app. A short-lived code pairs a browser to your account for thirty days; once paired, today's summary is refreshed to the backend so that browser can show it. Ending the pairing in the app, or letting the thirty days lapse, stops it.
Anonymous feature counts	Which Spaces and features are opened, as an event name and a short label (for example “space opened: sleep”), with a random id made on this iPhone. Never any content or health figure, never linked to your account. Settings, Privacy, “Help improve the app” turns it off.

These requests are made over HTTPS. Nothing here is sold, shared for advertising, or used to profile you. Health data is used only to provide the app's own features to you, as Apple requires.

4. What is not collected

• No third-party analytics kit. The only measurement is the anonymous feature count described in section 3, which you can switch off.
• No advertising kit, ad identifier, or advertising network.
• No third-party tracker, session recorder, crash-reporting network or attribution kit.
• No selling, renting or sharing of personal data with data brokers. Health data in particular is never used for advertising, and never will be.
• No cross-app or cross-site tracking of you.

Apple separately provides the developer with aggregate, anonymised App Store figures such as downloads, crashes and subscription counts, which are not linked to you and cannot be traced back to an individual.

5. Permissions the app asks for

Permission	Used for
Health	Reading the data listed above and writing back what you log. Optional. The app works without it, with fewer numbers.
Camera	Scanning meals and clothing, and taking the posture photo once you are framed.
Photo library	Picking an existing photo of a meal, a garment or gym equipment.
Microphone and speech	Dictation, and the conversation coach. Turned into text on the device.
Calendar	Reading today's events to decide whether you are dressing for a wedding or the gym. Titles are matched on the phone and discarded.
Location	Today's weather for outfit choice. Background location only for opt-in automatic run detection.
Motion	Apple's own motion-activity classification, only with automatic run detection on.
Contacts	Only if you choose a contact card as your profile picture. It reads the photo from that one card and nothing else.
Notifications and alarms	Reminders, the day rewind, and setting your wake alarm through the system so it rings on silent.

Every one of these can be refused, and changed later in iPhone Settings. Refusing one disables the feature that needs it and nothing else.

6. Search, widgets and the Watch

The app indexes some records into Spotlight so you can find them from the home screen: lifts, meals and journal entries. It deliberately does not index your weight, body measurements or recovery scores. The test applied was whether you would be unhappy to see it on a borrowed phone. The index is wiped when you erase your data.

Widgets and the Apple Watch app read a small shared summary written into a private app group on your device: today's calories, protein, water, ring values and checklist progress. It does not leave the device either.

7. Subscriptions

Pro is offered as an auto-renewing subscription sold through Apple. Apple processes the payment, and the app never sees your card, billing address or Apple ID password. Subscription status is verified with Apple rather than stored as a local flag. Refunds and cancellations are handled in your Apple account.

8. Children

Life OS is not directed at children and is not intended for anyone under 13. If you believe a child has used the app and provided personal data, write to s0533495227@gmail.com and it will be removed.

9. Your control over your data

• See it. Everything the app holds about you is visible in the app itself. There is no hidden profile.
• Delete your account. Settings, Account, Delete account. After you confirm with Apple or Google, we delete your account and everything stored for it on our server: the account record and sign-in links, the sealed backup, the web dashboard snapshot, push tokens, connected-service tokens and anything your ELO keeps on our server. What is on your iPhone stays until you delete the app. If you joined the Earn program, records of commissions and payouts are kept as long as the law requires.
• Delete what is on the phone. Settings has an erase option that clears the on-device database and the Spotlight index. Deleting the app removes the local store.
• Stop the sending. Turn off “Share with AI models” in Settings, Privacy, and nothing goes to an AI model. Turn off Health sharing and the app stops reading Health immediately.
• Ask. Email the address above for anything else, including a copy of what we hold.

Depending on where you live you may have statutory rights of access, correction, deletion, portability and objection. Most are exercised directly in the app; for anything held in the backend, use the deletion above or email the address above.

10. Retention

On-device records are kept until you delete them or delete the app. The account identifier and referral code described above are kept while the account exists. The sealed backup is kept until you delete your account. The web-dashboard snapshot and pairing token expire on their own after thirty days regardless of use. Photos, recordings and messages sent for processing are not retained by us after the request is answered. Cloudflare and Google may keep a request briefly for abuse monitoring under their own terms, and do not use it to train models.

11. Security

Requests to the backend are made over HTTPS. On-device data sits inside the app's own sandbox and is covered by iOS file protection and your device passcode. The backup is sealed on your iPhone before it is sent, so what we hold is ciphertext we cannot read. The web-dashboard snapshot lives in our Cloudflare account, keyed to your account identifier rather than your name; it is not end-to-end encrypted, but it is not analysed, browsed routinely, or shared with anyone. The web dashboard itself is reachable only with a pairing code generated by your own phone and a token that expires after thirty days. No system is perfect, and nothing here is a guarantee against every possible failure, but the design decision that matters most is that most of your history is not held centrally at all — only the parts described in section 3 are, and each is there for a stated reason.

12. Changes to this policy

If what the app does with data changes, this page changes with it and the date at the top is updated. A change that materially expands what leaves your device will be described in the app's release notes as well.

13. Contact

s0533495227@gmail.com for privacy questions, data requests, and corrections to anything on this page.