Privacy Policy

Effective date: 21 May 2026 Last updated: 2 October 2026

This Privacy Policy explains how the Evora apps for iPhone (iOS) and Android ("Evora", "we", "us") process information when you use them. Where the two apps differ, this policy says so. Evora is a calm AI health companion that helps you log meals, hydration, sleep and body data and provides personalized insights. Privacy is a core design principle: your logs stay on your device, and only the features that need our servers send data to them.

1. Who we are

Controller: KSol.IT Maximilian Kenfenheuer maximilian.kenfenheuer@ksol.it

If you have any question about this policy or your data, please contact us at the address above.

2. Summary at a glance

Evora does not use third-party analytics, third-party advertising networks or cross‑app/cross‑site tracking, and it does not use the advertising identifier (IDFA on iPhone, the Android advertising ID on Android). We do not sell your data.

3. Data we process

3.1 Data you enter into the app

• Profile: optional display name, height, weight, target weight, health goals, dietary preferences, allergies, dislikes, cuisines, pantry items. On iPhone, biological sex is read from Apple Health if you allow it. On Android, you can enter biological sex and year of birth during setup (Health Connect does not provide them).
• Logs: meals (name, meal type, time, items with portions, calories and nutrients), drinks (amount and type: water, coffee, tea, juice, other), sleep (bedtime, wake time, quality rating), body weight.
• Settings: reminder times, hydration reminder window, AI settings.

This data is stored locally on your device — on iPhone with Apple's SwiftData framework, on Android in the app's private database. It is not synced to iCloud or to our servers. It is included in your device backup according to your backup settings (iOS backup, or Google backup on Android); on Android, the app's login tokens and account credentials are excluded from it.

3.2 Apple Health (HealthKit) and Health Connect

If you grant permission, Evora reads from Apple Health (iPhone) or Health Connect (Android):

• Active energy burned (on iPhone also basal energy), step count
• Resting heart rate and heart rate variability (HRV); on iPhone also heart rate
• Sleep (sleep analysis or sleep sessions)
• Nutrition and hydration: energy, protein, carbohydrates, fat, water (including values logged by other apps)
• Weight and height; on iPhone also biological sex
• Workouts (on Android: exercise sessions), and the distance covered inside a workout — never across your day

If "Write meals to Apple Health" or "Write meals to Health Connect" is on, Evora writes there so your logs stay in one place:

• Nutrition for each meal: energy, protein, carbohydrates, fat (on Android also name, meal type, saturated fat, sugar, fibre and sodium)
• Water
• Weight (when you log weight)
• Sleep (when you log sleep)

To keep the home view current, Evora uses background delivery on iPhone; on Android it checks Health Connect for changes about once an hour, also in the background if you allow background reading. Raw records from Apple Health or Health Connect never leave your device. Only when you use cloud coaching or cloud meal planning (Pro, with cloud AI switched on) do we send aggregated values derived from them for that one request: steps, active energy, sleep duration and times, resting heart rate, heart rate variability (HRV), body weight and height, biological sex, your workouts of the last 7 days with their type, duration and distance, and nutrition logged in other apps (see §3.6). Health data is never used for advertising and never sold. Records that Evora writes are tagged so they can be removed when you delete the corresponding entry in the app (on Android also replaced when you edit it). After a reinstall, Evora can restore your meals, drinks and sleep (on Android also weight) from the records it wrote; on Android it reads their history for this if you allow it.

3.3 Camera and photos

The camera is used, with your permission, to scan barcodes and — with Evora Plus — to photograph a meal for recognition. On Android, instead of taking a photo you can pick one with the Android photo picker; Evora only receives the photo you pick and does not need access to your photo library. With cloud AI, a meal photo is sent to our analysis service (see §3.6) for one-off analysis; with on‑device AI, it is analysed on your device and does not leave it (see §3.5). Either way it is not stored, neither on our servers nor in the app. Barcode scanning happens on your device (on Android with Google ML Kit, running offline); only the barcode number is used (see §3.4).

3.4 Barcode scanning

When you scan a product barcode, only the barcode number is sent from your device to Open Food Facts — a free, public, crowd-sourced food database — to look up product name, brand, ingredients and nutrition. No personal data is sent. Open Food Facts' privacy policy is available on their website.

3.5 On‑device AI

Evora's own on‑device models. In AI settings you can choose where Evora's AI runs: in the cloud (§3.6) or on your phone. To run it on your phone, you download Evora's own AI models once (about 1 to 3 GB). They are downloaded from Hugging Face (Hugging Face, Inc., USA), where they are published; like any web server, Hugging Face receives your device's IP address and the request for the file, and nothing else — no account, no health data, no content. The models are kept in the app's storage on your device and can be deleted in AI settings at any time. Which models and versions are current, the app learns from Evora's server: at each start it asks, sending its device token and the version of its model format, and nothing else. When a newer model is published, the app offers it (you can also keep an older version in AI settings); the small language file for your app language, a few megabytes, it downloads by itself, the same way from Hugging Face.

With on‑device AI, meal-plan ideas, full recipes, product ratings, the coach's insights and meal recognition from photos or text are generated entirely on your device: your photos, descriptions, profile and health values are not sent anywhere for this. The one exception is nutrition for a recognized meal: the app sends the recognized food names and estimated amounts (e.g. "rice, 150 g") — never the photo or your description — to our server, which looks up their nutrition values in USDA FoodData Central and Open Food Facts (§3.6) and caches the values per food name, without any link to you. Nothing from on‑device AI goes into the anonymized training data described in §3.6.

Apple Foundation Models (iPhone). The text of the daily briefing notification — and, where Evora's own text model is not downloaded, the coach insights and meal-plan ideas — are generated with Apple Foundation Models, which run entirely on your device, where your iPhone supports Apple Intelligence. Where Apple Intelligence is not available, Evora uses rules on your device instead. No prompt, input or output leaves your device for this processing.

Rules on your device (Android). When the cloud coach is not used (without a Pro subscription, or with cloud AI switched off) and Evora's own text model is not downloaded, coach insights are produced by rules that run entirely on your device; so is the text of the daily briefing notification. Nothing leaves your device for this processing.

3.6 Cloud AI analysis service

Some features require server-side processing. The Evora analysis service is operated by KSol.IT in the EU. Every cloud AI feature requires a subscription and respects the "Cloud AI" switch in AI settings; with it switched off, the AI features run on your device instead (§3.5), and nothing is sent for AI processing.

• Meal text analysis (Plus): we send the free-text description you typed (e.g. "chicken salad with rice, 400g") and your preferred language. The service returns structured nutrition data.
• Meal image analysis (Plus): we send the meal photo and your preferred language. The service returns the recognized food and nutrition.
• Coaching summaries (Pro): we send the aggregated metrics needed for a personalized insight — today's meals and nutrition totals, daily totals of the last 30 days, hydration, weight trend, height, biological sex (on Android, if you entered it), goals and diet, and the daily values derived from Apple Health or Health Connect listed in §3.2.
• Meal plans and recipes (Pro): we send the meal slot, language, dishes to avoid, your pantry, diet style, allergies, intolerances, dislikes and cuisines, your targets and today's intake, on Android your age (derived from the year of birth, if you entered it) and biological sex, plus the recovery, weight and workout values derived from Apple Health or Health Connect listed in §3.2. Generated recipes are kept on our server without any link to you and can be suggested to other users.
• Product rating (Pro): when you rate a scanned product, we send the product details returned by Open Food Facts (barcode, title, brand, nutrition, ingredients) together with your primary goal, diet and calorie/protein targets. We do not send your daily intake, history or recovery data for this call. The service caches the rating by barcode + language + goals so identical scans are answered instantly.

To find nutrition values for the foods it recognizes, the service looks up the food names (never your description or photo) in USDA FoodData Central and Open Food Facts. It does the same for the food names and amounts the app sends after an on-device recognition (§3.5); these lookups are cached per food name, without any link to you.

What we do not send to the service: your name, e-mail, Apple ID or Google Account, advertising identifiers, raw records from Apple Health or Health Connect, your full meal history, or photos that are not part of an analysis request. When the coach addresses you by name, the app sends only a placeholder and fills in your name on your device.

Request data for AI analysis is processed transiently and not persisted as user history — apart from short-term operational logs, per-installation usage counters (see §5) and the anonymized training data described below.

Anonymized training data (opt-in). To improve Evora's AI — in particular to train a smaller model that runs entirely on your device — we keep an anonymized copy of cloud AI requests and the AI's answers (text only), but only if you have explicitly switched this on. It is off by default; without your consent, no copy is kept. Before a record is stored, everything that could link it to you or your installation is removed: no installation key, token, IP address or exact time is stored (only the calendar date), names are replaced by randomly chosen example names, and time zone, e-mail addresses and phone numbers are removed. The copy can contain the health values sent with the request (see §3.2), but without any link to you. Meal photos are never stored. Because the records cannot be attributed to you, we cannot find, export or delete an individual record.

You give and withdraw your consent in Profile → Privacy & AI → AI settings → Improve Evora's AI. Withdrawing it stops any further copies; copies stored before cannot be deleted because they can no longer be attributed to you.

Server-side AI inference is performed by trusted sub-processors (LLM and vision providers) under data-processing terms that prohibit use of submitted content for training their models. See §6.

3.7 Your meal library and anonymous account

When you tap Save to library on a meal, the meal (title, description, weight, nutrition and items) is stored on our server so you can find it again in the food search. When you search the library, your search term is sent to our server, which also asks USDA FoodData Central and Open Food Facts for matching foods.

Saved meals belong to an anonymous account that the app creates automatically the first time you save or search. The account consists of a random ID and a random secret. It contains no name, e-mail address, phone number, Apple ID or Google Account. The secret is stored on our server only as a cryptographic hash. On iPhone, the app keeps the ID and secret in your iCloud Keychain, so a reinstall or your other devices signed in to the same Apple ID can open the same library; Apple stores this end-to-end encrypted. On Android, the app keeps them encrypted on your device and in Google's Block Store, so a reinstall, or a new phone set up from this one, can open the same library; when your device backup is on and your phone has a screen lock, Block Store keeps this end-to-end encrypted. Only you can see and change the meals in your library.

Reset local data (Profile → Privacy & AI → Privacy controls) deletes the account and every meal saved in it on our server, and removes the ID and secret from your iCloud Keychain (iPhone) or from your device and Block Store (Android).

3.8 Notifications

Evora's reminders (weight, sleep check-in, daily coach briefing, hydration) are scheduled locally on your device. No push token and no reminder content is sent to us, to Apple or to Google for this.

3.9 In‑app purchases

Purchases (Plus / Pro subscriptions) are handled by Apple via StoreKit 2 on iPhone and by Google via Google Play Billing on Android. We do not receive your payment information. The app checks with Apple or Google Play on your device which subscription is active; our servers do not receive your purchase data.

3.10 Diagnostics

Evora does not use third-party analytics or crash-reporting SDKs (no Firebase, no Sentry, no Mixpanel, no Meta SDKs; the iPhone app contains no Google SDKs). If you opted in to share crash data with Apple via iOS Settings, Apple may share aggregate, anonymized crash reports with us via App Store Connect. If you opted in to share usage and diagnostics data with Google in your Android settings, Google may share aggregate crash and performance reports with us via the Google Play Console.

3.11 Advertising in the free version

Without a subscription, Evora shows ads: a banner above the tab bar (iPhone) or navigation bar (Android) and a card on the Home screen. They are served by KSol Mobile Ads, our own ad server operated by KSol.IT — not by an advertising network. As soon as you subscribe to Plus or Pro, the app no longer loads the ad module and sends nothing to the ad server.

For the free version, the ad server receives:

• a random installation ID generated by the ad module and stored only in the app; it is not the advertising identifier (IDFA or Android advertising ID), is not shared with other apps and is deleted when you delete the app;
• which ad was requested, shown and tapped, and in which placement, and — if you subscribe after using the free version — that a subscription was bought and its price, so we can see which ad led to it;
• technical data every request carries: platform, operating-system, app and ad-module version, language and region setting.

The ad server does not receive your health data, your logs, your profile, your meal library or your account. Ads are not personalized on the basis of your behaviour in other apps or websites, and there is no cross-app tracking (on iPhone: no tracking in the sense of Apple's App Tracking Transparency).

3.12 Device integrity (app authentication)

To protect the analysis service from abuse and to control the cost of AI processing, the app verifies that it is a genuine, unmodified copy of Evora running on a genuine device before it calls our API — on Android also that it comes from Google Play. On iPhone this uses Apple's App Attest (DeviceCheck) framework; on Android it uses Google's Play Integrity API and a key in the Android Keystore:

• A cryptographic key is generated on your device (on Android in its secure hardware). On iPhone, an attestation is verified by Apple and by our API. On Android, Google confirms once through Play Integrity that the app and device are genuine, our API checks that verdict, and requests that trigger AI processing are additionally signed with the key. Our API then issues short-lived tokens used to authenticate subsequent requests.
• The attestation contains no personal information and does not identify you. It is tied to the app installation, not to your identity, and is used to authenticate requests, apply per-installation rate limits and link the installation to your anonymous library account (§3.7).
• No shared secret is embedded in the app; the token-signing key stays on our server.

4. Legal bases (GDPR, EU/EEA)

Where GDPR applies, we rely on the following legal bases (Art. 6 / Art. 9 GDPR):

• Performance of the contract (Art. 6(1)(b)): providing the features you requested (logging, AI analysis of content you submit, your meal library and the anonymous account behind it, subscriptions).
• Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)) for health data and Apple Health or Health Connect permissions, the camera, notifications, cloud processing of health-related data and — only if you switch on "Improve Evora's AI" — the anonymization of your cloud AI requests for training (see §3.6). You can withdraw consent at any time via iOS or Android settings, Health Connect or in‑app settings.
• Legitimate interest (Art. 6(1)(f)) for operating the service securely (device-integrity attestation, rate limiting, usage counters, short-term logs to protect against abuse and control processing cost) and for financing the free version through ads from our own ad server without tracking (§3.11).

Health data is Article 9 special-category data. It is processed only on the basis of your explicit consent. Raw records from Apple Health or Health Connect never leave your device; aggregated values derived from them are only sent for cloud coaching and meal planning that you use (§3.2).

5. How long we keep data

• On-device data (app database, settings, downloaded AI models): kept until you delete the entry, reset local data or uninstall the app.
• Meal library and anonymous account: kept until you delete a meal or reset local data (§3.7). On iPhone, the credentials in your iCloud Keychain stay until the reset or until you remove them in the Passwords app. On Android, the credentials on your device and in Block Store stay until the reset; Block Store also keeps them after you uninstall the app, so a reinstall finds your library.
• Analysis service data: meal text, image and coaching content is processed transiently and is not stored as user history. Operational logs (timestamps, request size, status codes — no content) are kept up to 30 days for security and abuse prevention, then deleted. Per-installation usage counters (number of AI requests and processing units per day, no content) are kept for cost control.
• Ad data (free version): ad events are kept on the ad server for up to 90 days and then deleted; only aggregated statistics without the installation ID remain.
• Anonymized training data (only with your consent): kept as long as it is useful for developing Evora's AI models. It contains no link to you and is therefore no longer personal data.
• Sub-processor data (LLM providers): no retention for training; transient processing only.

6. Sub-processors and third parties

We use the zero data retention / no training modes of AI providers where available.

7. International transfers

Evora's analysis service and ad server are operated by KSol.IT in the EU. AI sub-processors may process content outside the EU/EEA (e.g. in the United States). Where applicable, transfers are protected by EU Standard Contractual Clauses and additional safeguards. Queries to USDA FoodData Central (United States) contain only food names. Downloading the on-device AI models from Hugging Face (United States) transmits only your device's IP address and the file request. Apple and Google process data according to their own terms.

8. Security

• All network communication uses encrypted transport (HTTPS/TLS), with certificate pinning to our analysis service.
• Requests to our analysis service are authenticated using Apple App Attest (iPhone) or Google Play Integrity and a key in the Android Keystore (Android), and short-lived, server-issued tokens. No shared signing secret is stored in the app.
• App data is stored in the app's protected storage; tokens and account credentials are stored in the iOS Keychain, or encrypted with a key held by the Android Keystore.
• Health data is gated by the operating system's permission system.

No system is perfectly secure. Please keep your device updated and protect it with a passcode, Face ID or screen lock.

9. Your rights

Under GDPR (and equivalent rights in other regions, including the UK GDPR and CCPA in California), you have the right to:

• Access your data
• Correction of inaccurate data
• Deletion ("right to be forgotten")
• Restriction of processing
• Portability
• Objection, including to legitimate-interest processing such as ads
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

You can exercise most of these rights directly in the app:

• Delete individual entries in Evora (meals, drinks, sleep, weight).
• Reset all data: Profile → Privacy & AI → Privacy controls → Reset local data. This deletes all data on your device, your settings, your meal library and anonymous account on our server, and the account credentials in your iCloud Keychain (iPhone) or on your device and in Block Store (Android). Records already written to Apple Health or Health Connect stay there; delete them in the Health app or in Health Connect if you want to. Deleting the app removes the on-device data but not your meal library.
• Revoke permissions (Health, Camera, Notifications): on iPhone in iOS Settings → Privacy & Security or iOS Settings → Evora; on Android in Settings → Apps → Evora → Permissions, or in Health Connect.
• Stop ads: any subscription removes them.
• Manage your subscription: on iPhone in iOS Settings → [your name] → Subscriptions; on Android in Google Play → Payments & subscriptions → Subscriptions.

For any request that cannot be fulfilled directly in the app, contact maximilian.kenfenheuer@ksol.it. We respond within 30 days.

10. Children

Evora is not directed at children under 16. We do not knowingly process data of children under 16. If you believe a child has provided data, please contact us so we can delete it.

11. Automated decision-making

Evora's AI features produce informational suggestions about meals, hydration and recovery. They are not medical advice and have no legal or similarly significant effect on you. You can ignore any suggestion. Evora does not perform profiling within the meaning of Art. 22 GDPR.

12. Not a medical device

Evora is a wellness and self-tracking app. It is not a medical device and does not diagnose, treat, cure or prevent any disease. Always consult a qualified healthcare professional for medical decisions.

13. Changes to this policy

We may update this policy as the app evolves. When we do, we will update the "Last updated" date above and, for material changes, notify you in-app.

14. Contact

KSol.IT — Maximilian Kenfenheuer Email: maximilian.kenfenheuer@ksol.it