Privacy policy

Life OS is a health, fitness and wellbeing app for iPhone. It handles some of the most sensitive information a phone holds, and this document is written to describe what the app actually does rather than to reserve every right a policy could reserve.

The short version. Almost everything stays on your iPhone and, if you leave sync on, in your own private iCloud. There is no Life OS server holding a copy of your health history. Three things leave the device: photos you choose to scan, the text of a message you send the coach with the context lines that go with it, and, only if you sign in, an account identifier. There is no analytics, advertising or tracking software of any kind built into the app.

Who this is from

Life OS is an independent app published on the Apple App Store by its developer. Questions about this policy, requests about your data, or anything else, go to s0533495227@gmail.com and are answered by the person who wrote the app.

1. What stays on your iPhone

The app's records live in an on-device database. That includes everything you log and everything it computes: meals and their nutrients, water, workouts and lifts, sleep records and scores, recovery and strain figures, journal entries, your wardrobe and outfits, laundry state, posture measurements, checklist and streak state, targets, settings and layout.

If iCloud sync is on, and it is optional, that database syncs through your own private CloudKit database. Settings reports which store actually opened rather than which switch is flipped. That is your iCloud account, governed by Apple's terms, reachable from your other signed-in devices. The developer has no access to it and no ability to read it.

Measured entirely on device, never transmitted

• Posture. Head angle, trunk lean and hip offset are computed from an Apple Vision body-pose read of your photo, on the phone. The photo is not uploaded.
• Rep counting during a session, from body pose, on the phone.
• Garment colour, read from your clothing photo on the phone before anything else happens.
• The first-pass food classifier, which runs locally and offline. The cloud service is only a fallback.
• Speech. Dictation and the conversation coach turn speech into text on the device. The audio and the transcript stay there.
• Calendar titles, matched on the phone to work out today's occasion and then discarded. Nothing about your calendar is stored or sent.

2. Apple Health

With your permission, Life OS reads a wide set of HealthKit data so that it can compare today against your own normal rather than a population average: body measurements; active, resting and dietary energy; steps, distance, exercise and stand time; heart rate, resting heart rate, heart rate variability and heart-rate recovery; VO₂ max, respiratory rate and blood oxygen; body and wrist temperature; walking and running form metrics; time in daylight and audio exposure; sleep analysis and mindful sessions; workouts and Apple's own activity-ring goals; and the nutrients other apps have written.

With your permission it writes back workouts, active energy, bodyweight, water and the nutrients from meals you log, each behind its own switch in Settings, so you can let it read without letting it write.

HealthKit data is read into the app on your device. It is not uploaded to any server by Life OS. Apple requires, and this app observes, that health data is never used for advertising or sold to anyone. You can withdraw any individual permission at any time in the iPhone Health app, under Sharing then Apps.

3. What leaves your device, and why

Life OS uses a small backend the developer operates on Cloudflare to run the features that genuinely need a model too large to sit on a phone. Here is every one of them.

What is sent	Why, and what happens to it
A meal photo	Sent when you scan a plate and the on-device classifier could not identify it. It is passed to an AI vision provider to be named and estimated, and the result comes back for you to review. The image is not stored by the service after the request is answered.
A clothing, equipment or washing-machine photo	Same path, same treatment. Sent to be identified, not kept.
Your message to the coach, plus its context lines	The context is assembled on the device from your own records: recovery, strain, sleep, targets and remaining macros, today's session, water, wardrobe counts, posture, recent journal moods. Anything unavailable is omitted rather than sent as a zero, and the health block is gated by a switch you control. It is sent to an AI provider to produce the reply.
An account identifier	Only if you use Sign in with Apple. Apple gives the app a stable identifier for you, and the app registers it so your referral code and subscription entitlement can be recognised across a reinstall. Your name and email are sent only if Apple passes them, and only to attach to that account. Sign in with Apple lets you hide your real address behind a relay one.
A referral code	Your own code, or one a friend gave you, checked against the referral service so a reward can be credited. A code carries no health data.
An approximate location	Only when you use weather-aware outfits, and only to look up today's forecast. Coordinates are rounded to roughly a kilometre before use, and are not stored. Background location is used only with automatic run detection turned on, and only once motion data already suggests a run has started.

These requests are made over HTTPS. The backend exists to relay a request to an AI provider and return the answer. It is not a place your health history is accumulated. Your logs, scores, sleep records and history are never uploaded to it.

4. What is not collected

• No analytics or product-telemetry kit is built into the app.
• No advertising kit, ad identifier, or advertising network.
• No third-party tracker, session recorder, crash-reporting network or attribution kit.
• No selling, renting or sharing of personal data with data brokers. Health data in particular is never used for advertising, and never will be.
• No cross-app or cross-site tracking of you.

Apple separately provides the developer with aggregate, anonymised App Store figures such as downloads, crashes and subscription counts, which are not linked to you and cannot be traced back to an individual.

5. Permissions the app asks for

Permission	Used for
Health	Reading the data listed above and writing back what you log. Optional. The app works without it, with fewer numbers.
Camera	Scanning meals and clothing, and taking the posture photo once you are framed.
Photo library	Picking an existing photo of a meal, a garment or gym equipment.
Microphone and speech	Dictation, and the conversation coach. Turned into text on the device.
Calendar	Reading today's events to decide whether you are dressing for a wedding or the gym. Titles are matched on the phone and discarded.
Location	Today's weather for outfit choice. Background location only for opt-in automatic run detection.
Motion	Apple's own motion-activity classification, only with automatic run detection on.
Contacts	Only if you choose a contact card as your profile picture. It reads the photo from that one card and nothing else.
Notifications and alarms	Reminders, the day rewind, and setting your wake alarm through the system so it rings on silent.

Every one of these can be refused, and changed later in iPhone Settings. Refusing one disables the feature that needs it and nothing else.

6. Search, widgets and the Watch

The app indexes some records into Spotlight so you can find them from the home screen: lifts, meals and journal entries. It deliberately does not index your weight, body measurements or recovery scores. The test applied was whether you would be unhappy to see it on a borrowed phone. The index is wiped when you erase your data.

Widgets and the Apple Watch app read a small shared summary written into a private app group on your device: today's calories, protein, water, ring values and checklist progress. It does not leave the device either.

7. Subscriptions

Pro is offered as an auto-renewing subscription sold through Apple. Apple processes the payment, and the app never sees your card, billing address or Apple ID password. Subscription status is verified with Apple rather than stored as a local flag. Refunds and cancellations are handled in your Apple account.

8. Children

Life OS is not directed at children and is not intended for anyone under 13. If you believe a child has used the app and provided personal data, write to s0533495227@gmail.com and it will be removed.

9. Your control over your data

• See it. Everything the app holds about you is visible in the app itself. There is no hidden profile.
• Delete it. Settings has an erase option that clears the on-device database and the Spotlight index. Deleting the app removes the local store, and turning off iCloud sync and deleting the app's iCloud data removes the synced copy.
• Stop the sending. Turn off the coach and do not scan photos, and nothing goes to the AI service at all. Turn off Health sharing and the app stops reading Health immediately.
• Ask. If you signed in with Apple and want the account record and referral code deleted from the backend, email the address above with the request and it will be deleted.

Depending on where you live you may have statutory rights of access, correction, deletion, portability and objection. Because the app holds your records on your own device rather than on a server, most of those are exercised directly in the app. For anything held in the backend, email the address above.

10. Retention

On-device records are kept until you delete them or delete the app. Backend records are limited to the account identifier and referral code described above and are kept while the account exists. Photos and coach messages sent for processing are not retained by the service after the request is answered. The AI providers used to answer them apply their own short operational retention for abuse monitoring under their own terms.

11. Security

Requests to the backend are made over HTTPS. On-device data sits inside the app's own sandbox and is covered by iOS file protection and your device passcode. iCloud sync uses your private CloudKit database. No system is perfect, and nothing here is a guarantee against every possible failure, but the design decision that matters most is that there is very little to steal centrally, because the health history is not held centrally.

12. Changes to this policy

If what the app does with data changes, this page changes with it and the date at the top is updated. A change that materially expands what leaves your device will be described in the app's release notes as well.

13. Contact

s0533495227@gmail.com for privacy questions, data requests, and corrections to anything on this page.