Privacy
Last updated 25 July 2026
Velavera is an early prototype. This page describes what the app actually does with your data today — not what we plan to build. Where something is not built yet, it says so plainly.
This policy covers the Velavera app — the signed-in product you are using here. It does not cover velavera.ai, our separate marketing and waitlist site, which is a different codebase with its own data practices.
Some of what you give us is health information, including responses to a wellbeing questionnaire about eating. We have tried to describe how that is handled precisely rather than reassuringly.
What we collect
- Account and identity. Your email address, sign-in credentials and session, handled by Clerk (see below). Your Clerk account id is the key every other record below is filed under.
- Health and nutrition inputs. What you type into the projection tool: height, weight, age, sex, activity level and your daily calorie target.
- Body-composition readings. If you use the pose test: the estimated body-fat range, the waist-to-shoulder ratio behind it, a confidence figure, and when each reading was taken. The photograph itself is processed in your browser and is never uploaded or stored.
- Wellbeing screening result. Before the body-composition tools open, we ask the five SCOFF questions. We store only the outcome and the score — your individual yes/no answers are worked out in your browser and never sent to us.
- Training activity. Only if you connect Strava: the type, duration, distance and calorie figure of your recent activities, plus your Strava athlete id and name.
- Your meal plan. The generated week, the dietary restrictions it was built from, and the calorie target it was built at.
Why we collect it
To personalise your plan, and for nothing else. Your height, weight, age, sex and activity level produce a calorie target; recent training adjusts that target upward on heavier weeks; your dietary restrictions filter which recipes can appear. Your meal plan is saved so that refreshing the page restores it instead of regenerating it.
The wellbeing screening exists for a different reason. Tools that estimate body composition can be actively harmful to someone at risk of an eating disorder, so a positive screen withholds those tools and shows support resources instead.
Where it is stored
In a Supabase Postgres database hosted in West EU (Ireland), eu-west-1. Authentication data is held by Clerk.
Who can reach it
Every table has row-level security switched on with no access policies, which means the public API keys used by browsers are denied outright — nothing can be read directly from the database by a client, including one holding your session.
All access runs through a server-only key that is never sent to the browser. Because that key has full access by design, each request checks who you are and restricts every query to your own account. On 25 July 2026 we tested that isolation against a table holding more than one person’s data: a deletion removed only the calling user’s row and left the other account untouched.
Who else sees your data
Four companies process data on our behalf. Nobody else receives it.
- Clerk — your full identity: email address, sign-in credentials and session. They provide our authentication.
- Supabase— everything listed under “What we collect” except your Clerk credentials. They host the database.
- Strava — only if you choose to connect it. We exchange OAuth tokens with them and read your recent activities. The long-lived token that would let anyone re-enter your Strava account stays on our server and is never sent to your browser; only a short-lived access token is.
- Spoonacular — your dietary restrictions and calorie targets, so it can return matching recipes. No name, email or account identifier is attached to those requests.
- Anthropic — the generated plan (meal titles, calorie figures, your target, and the labels of your restrictions) so it can write the short summary paragraph. No name, email or account identifier is attached.
We do not sell your data. We do not share it with advertisers or data brokers. This app carries no analytics SDK and no advertising or tracking code — there is none in its source.
Our separate marketing site at velavera.ai does use Meta Pixel for advertising measurement. That site is a different codebase and its data practices are not covered by this policy.
Deleting your data
Four things you can delete yourself, right now:
- Body-composition history— the “Clear history” button on the Pose Test page removes every reading.
- Strava connection— the “Disconnect” button on the Connections page removes the stored tokens and athlete details.
- Physique projection inputs— the “Data & Privacy” section on the Connections page removes your height, weight, age, sex, activity level, and calorie target.
- Saved meal plan — the same section removes your saved week, the dietary restrictions it was generated from, and its calorie target.
Your screening result is the exception, and this is deliberate rather than an oversight. We do not let you delete it, because deleting it would let someone erase a positive screen and immediately retake the questionnaire answering differently — removing a protection that exists for people at risk of an eating disorder. We decided that keeping that record intact matters more than making it self-service. If you want it removed, email us and we will discuss it with you rather than simply deleting it.
Deleting your account now deletes your data with it. Removing your account from the account menu takes your login away immediately, and the records we hold against it — your projection inputs, your saved meal plan, your pose readings, and your Strava connection — are removed automatically as part of that. Your screening result is the one thing this does not remove: the exception above applies to account deletion too, so that record stays with us after your login is gone, and deleting your account is not a way to clear a positive screen and start over.
We have proved this end to end on our development setup, where a real deletion removed the records it covers. The same cleanup still has to be switched on for the live sign-in system, so treat it as newly shipped rather than long-proven. If you want confirmation that your rows are gone, or you deleted your account before this shipped, email hello@velavera.ai and we will check by hand. We are not going to promise a fixed turnaround, because we have not built the tooling that would let us guarantee one.
What we do not claim
We hold no formal security certifications — no ISO 27001, no SOC 2. We have not been independently audited. What is described above is what the code does; it is not a certified guarantee, and we would rather say that than imply otherwise.
Contact
For anything on this page — deletion, a copy of your data, or a question about how something works — email hello@velavera.ai.