Privacy Policy

Version V1.0.0 · Effective 2026-07-15

vitalbay collects only what it needs to coach your strength training — your Apple or Google sign-in identity, the training profile you set up, your workout records, and, when you allow it, health data from Apple Health (heart rate, body weight, height, body fat percentage, lean body mass, and completed workouts); the coach's voice is pre-generated audio rather than live speech, we never sell your personal information, and you can access, correct, or delete your data at any time.

Introduction

vitalbay ("vitalbay", "we", "our", or "us") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard personal information in connection with the vitalbay iPhone application, its companion Apple Watch application, and related services (collectively, the "Service"). It applies to all users of the Service and should be read together with our Terms of Service.

The Service is developed and operated by SILVERDRAGON TECH PTE. LTD. (the "Operator"), a company registered in Singapore. Please read this policy carefully — in particular the text shown in bold — before using the Service. By using the Service you acknowledge that you have read and understood it.

Health and safety notice: vitalbay is a fitness coaching product, not a medical device or a medical service. Nothing it shows you — including heart rate, body metrics, or training suggestions — is a diagnosis, a treatment, or medical advice. Consult a physician before starting a strength-training program.

1. Data Controller

SILVERDRAGON TECH PTE. LTD. acts as the data controller for the personal information processed in connection with the Service. Where we process information solely on the documented instructions of a service provider or partner, we act as a processor; otherwise we determine the purposes and means of processing described in this policy.

2. Information We Collect

We collect the following categories of personal information:

Account and sign-in information. When you sign in with Apple or with Google, we receive the account identifier that provider assigns to you and, where the provider shares it, your email address (which may be an Apple private relay address if you choose "Hide My Email"). You may add an optional display name and avatar. We never receive your Apple ID or Google account password. The Global release offers only Sign in with Apple and Sign in with Google; it does not ask for a password or a phone number.

Training profile. When you set up the Service we ask for your gender, month and year of birth, training goals, and preferences, which we use to generate a personalized training plan.

Training data. The plans we generate and the records you log — exercises, reps, sets, and weight — together with your personal records, streaks, level and experience, your progress through the world-map regions, and the associated timestamps.

Device and technical information, such as device model, operating system version, app version, language, time zone, IP address, crash logs, and diagnostic data.

Usage information, such as which features you use, when a workout starts and ends, when you complete your profile, and level-up events. These events are generated by our servers as they process your requests; the app itself contains no analytics SDK and sends no tracking events of its own. They are handled on our behalf by our analytics service provider.

Health and fitness data (Apple Health)

Health data is the most sensitive category of information the Service touches, and we describe it in full here. Access to Apple Health (HealthKit) is optional: the Service asks for your explicit authorization, you can grant, refuse, or revoke it at any time in the iOS Health app, and vitalbay remains usable without it — you can enter your height and weight manually.

With your authorization, and only then, we read the following from Apple Health:

Heart rate — read during a workout, while you train with an Apple Watch, to show your live training intensity and to save your average and peak heart rate with the session summary.

Body weight

Height

Body fat percentage

Lean body mass

With your authorization, we write the following back to Apple Health:

Body weight and height — written when you record or update them in vitalbay, so that Apple Health stays consistent with what you entered.

Completed workouts — when you finish a training session with the companion Apple Watch app, it is saved to Apple Health as a workout, the same way Apple's own Workout app saves one. This is why "Workouts" appears in the Health authorization sheet; if you do not use the Apple Watch app, no workout is written.

Your heart rate is used only to show your training intensity during a session and to display your session summary and heart-rate history. It is never included in any usage or analytics event, never used for advertising or profiling, and never disclosed to advertisers or data brokers. We read and write no other Apple Health data type.

3. How We Use Your Information

We use personal information to:

provide, personalize, and improve the Service and your training experience;

generate your training plan and adapt your loads and progression from your profile and training history;

show your training records, progress, body metrics, and — where available — the heart rate recorded during a session;

authenticate you, keep you signed in, sync your training across your devices, and prevent fraud or abuse;

understand which features are used and how reliably the Service runs, through the usage events, crash logs, and diagnostic data described in Section 2;

communicate with you about the Service, including service and security notices and, with your consent where required, optional messages;

enforce our Terms and comply with applicable laws and lawful requests.

vitalbay is currently free to use and has no paid features, so we do not collect or store payment card details. We do not use your personal information for targeted advertising, we do not sell it, and if we ever want to use it for a purpose not stated in this policy we will ask you first.

4. Legal Bases for Processing (EEA/UK)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases:

Contract — to provide the Service you requested and to manage your account, training profile, and training records;

Consent — for your health data, which is a special category of personal data processed on the basis of the explicit consent you give through the Apple Health authorization prompt, and for optional messages and, where required in your jurisdiction, usage analytics; you may withdraw consent at any time;

Legitimate interests — to secure, analyze, and improve the Service, in a manner proportionate to your privacy rights;

Legal obligation — where we are required to process information to comply with applicable law.

Where we rely on consent, you may withdraw it at any time, which stops any further processing on that basis; where we rely on legitimate interests, you have the right to object.

5. How We Share Information

We do not sell your personal information. We share information only as described below:

Service providers that process data on our behalf under written contracts and only on our instructions, including cloud hosting, content delivery, analytics, and crash reporting.

App stores (Apple, Google) in connection with signing you in and verifying your identity.

Legal and safety disclosures, when we believe in good faith that disclosure is necessary to comply with law, enforce our Terms, or protect the rights, safety, or property of the Operator, our users, or others.

Business transfers. If the Operator is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to standard confidentiality undertakings and to this policy.

With your consent or at your direction.

We do not share your health data — heart rate, body weight, height, body fat percentage, or lean body mass — with any third party for that party's own purposes, and we never share it with advertisers or data brokers.

6. International Data Transfers

Your account and training data are stored on servers we operate in Amazon Web Services in the United States, and your information may also be processed in other countries by us and by our service providers. Coaching audio and static assets are delivered through a content delivery network.

Where personal information is transferred from the EEA, the UK, or Switzerland to a country not deemed to provide an adequate level of protection, we take steps to ensure that the transfer is carried out subject to appropriate safeguards required by applicable law, such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Agreement. You may contact us for further information about, or a copy of, the safeguards in place.

7. Data Retention

We retain personal information for as long as necessary to provide the Service, fulfill the purposes described in this policy, and comply with our legal obligations. The retention period depends on the nature of the information and the purpose for which it is processed. Your account, training profile, training records, and any heart-rate values recorded with a session are retained while your account is active, so that we can keep showing your history and progression. Server logs and usage events are kept only for as long as necessary for security, troubleshooting, and product analysis. Aggregated or de-identified information that can no longer be associated with you may be retained for statistical purposes. You may request deletion of your personal information in accordance with Section 9.

8. Data Security

We implement reasonable administrative, technical, and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. Communication between the app and our servers is encrypted in transit with HTTPS/TLS, your sign-in session credential is stored securely on your device and is not readable by other apps, and database access requires authentication and follows least-privilege authorization. No security measure is perfect, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us promptly of any suspected unauthorized access. If a personal-data breach occurs, we will notify you and the competent supervisory authorities as required by applicable law.

9. Your Rights and Choices

Depending on your location, you may have the right to access, correct, update, port, or delete your personal information; to object to or restrict certain processing; to withdraw consent; and to lodge a complaint with your local data-protection authority.

You can view and correct your training profile and delete individual training records directly in the app, and you can revoke Health access at any time in the iOS Health app, which stops any further reading or writing immediately. To request a copy of your data, deletion of specific server-side data, or deletion of your account, use the in-app settings or contact us at 3rd@silverdragonltd.com. We will respond within the time period required by applicable law (generally within 30 days) and may need to verify your identity before acting on a request.

Deleting your vitalbay account does not by itself revoke your Sign in with Apple or Sign in with Google authorization: to remove it, open iOS Settings, tap your name, then Sign in with Apple, or revoke vitalbay's access in your Google account security settings.

10. U.S. State Privacy Rights

If you are a resident of California, Colorado, Connecticut, Virginia, or another U.S. state with comprehensive privacy legislation, you have the rights described in Section 9, as well as the right not to be discriminated against for exercising those rights. The health data we process — heart rate recorded during a workout, and the body weight, height, body fat percentage, and lean body mass you provide or authorize us to read from Apple Health — is sensitive personal information, and we use it only to provide the Service (showing your training summary, body metrics, and progression).

We do not sell personal information and we do not "share" it for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act, so we do not provide a "Do Not Sell or Share My Personal Information" link; and we use sensitive personal information only for purposes permitted under applicable law, so we do not offer a separate "Limit the Use of My Sensitive Personal Information" link. To exercise any right, write to 3rd@silverdragonltd.com.

11. Children's Privacy

vitalbay is a strength-training coach intended for adults. It is not directed to children, and we do not knowingly collect personal information from children. We do not operate an automated age check at sign-up, but if we learn that an account belongs to a minor, we delete that account and the information collected during sign-up. If you are a parent or guardian and believe a child has provided us with personal information, contact us at 3rd@silverdragonltd.com and we will delete it. We do not profile minors for advertising or marketing.

12. Cookies, Local Storage & Device Identifiers

vitalbay is a native application with no embedded web-browsing surface, so there are no third-party web cookies and no web-tracking pixels. On your device the Service stores your sign-in session credential (so that you stay signed in between launches), a cache of your training plan, exercise catalog, and coaching audio, and your app preferences such as units, sound, and language.

We do not request or use the advertising identifier (IDFA), and we present no App Tracking Transparency prompt because we do not track you across other companies' apps and websites. Because the app integrates no analytics SDK, no analytics vendor collects a device identifier from your device. You can sign out to clear the session credential, delete the app to remove its local cache and preferences, and revoke Health access in the iOS Health app at any time.

13. Third-Party Links and Services

The Service connects to Apple and Google for sign-in and delivers content through a content delivery network. The coaching voice you hear during a workout is pre-generated audio we produced in advance and deliver through that network — the app only plays it back and sends nothing about you to any large language model, speech-synthesis service, or other AI vendor.

The Service may otherwise reference third-party services that are not operated by us. This policy does not apply to those third parties, and we encourage you to review their privacy policies before providing any personal information.

14. Automated Decision-Making

We use automated systems to generate your training plan and to recommend loads and progression from your profile and training history. These systems do not make decisions that produce legal or similarly significant effects on you, and we do not use your health data for automated decisions that affect your rights. You may contact us to request human review of any training assessment you believe is inaccurate.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes — to the purpose, method, or scope of processing, to who receives your information or where it is transferred, or to your rights or how you exercise them — we will notify you through prominent means such as an in-app notice or email before the change takes effect, and we will update the effective date. Your continued use of the Service after the effective date constitutes your acceptance of the updated policy.

Version history

V1.0.0 (2026-07-15): first version, for the Global release.

16. Contact Us

If you have questions, comments, or complaints about this Privacy Policy or about how we process your personal information, contact us:

Operator: SILVERDRAGON TECH PTE. LTD., a company registered in Singapore.

Support and privacy requests: 3rd@silverdragonltd.com

We will respond within 30 days of receiving your request, or within the shorter period your law requires. If you are in the EEA or the UK and are not satisfied with our response, you have the right to lodge a complaint with your local data-protection supervisory authority. This policy is governed by the laws of the jurisdiction in which the Operator is established.

Back to download