Pava

Three streams: what you tell us, what you log, and what your wearable shares.

• Account Email address; authentication is handled by Supabase.
• Profile Voluntary during onboarding: sex, age, height, weight, activity level, goal (lose / maintain / gain), goal weight, dietary preferences, health conditions, goal blockers, cuisine preferences, language preference.
• Meal logs Food names, estimated calories and macronutrients, serving sizes, timestamps, and dates.
• Photos Sent to AI providers for identification and returned as text. Images are not retained beyond the time needed to produce a result.
• Voice Transcribed by an AI provider; only the resulting text is stored with the meal record.
• Ancillary Water intake counts, weight entries, AI request counts (used for per-user daily quota).
• Wearables When you connect Whoop, Apple HealthKit, or Google Health Connect, Pava reads only the data types you authorize — typically active energy burned, resting heart rate, heart-rate variability, sleep duration and stages, and (for Whoop) recovery and strain scores.

Apple requires a specific disclosure about HealthKit data. The clauses below are absolute, apply regardless of anything else in this policy, and are enforced technically by the platform.

Everything we collect powers a feature you interact with. Specifically, we use your data to: operate core logging and tracking; personalize daily targets from your wearable burn and body composition; produce cross-data insights that pair meals with sleep, recovery, and strain; send optional notifications you enable; surface health warnings when the underlying signals warrant them; enforce per-user AI quotas; sync your data across your own devices; and improve the app's own estimates from corrections you make.

We do not use your data to train third-party models.

We do not sell personal information. Service providers who process data on Pava's behalf:

• Supabase Authentication and encrypted database storage.
• Anthropic Claude models — meal photo analysis, coach insights.
• OpenAI Whisper API — voice transcription only.
• Google Gemini API — text parsing for voice-logged meals.
• Whoop Wearable data via OAuth, only when you connect it.

In the event of a business transfer (acquisition, merger, or asset sale), data may pass to the successor entity with prior notification to you.

You can access, correct, delete, and export your data at any time from within the app or by contacting us at the address below. Residents of the European Economic Area and the United Kingdom have additional rights under GDPR; residents of California have additional rights under the CCPA and CPRA, including the right to know, delete, and opt out of the sale of personal information (which we do not do in any case).

Your data persists while your account is active. When you delete your account, cloud-stored data is removed within 30 days except where retention is required by law. Local device data (AsyncStorage caches) is cleared when you sign out.

Data is encrypted in transit (TLS / HTTPS) and encrypted at rest at the database layer. Access to production systems is restricted to authorized personnel. No system is impregnable, and we cannot guarantee absolute security, but we treat your data as if it were our own.

Pava is not intended for use by anyone under 13 years of age. We do not knowingly collect information from children under 13; if we learn we have, we will delete it.

Pava is operated from Toronto, Ontario, Canada. If you use the app from outside Canada, your information will be transferred to and processed in Canada, which may have different data protection standards than your home jurisdiction.

If we materially change this policy we will notify you within the app or by email before the change takes effect. The "Effective" and "Last updated" dates at the top always reflect the current version.

Questions, requests, or concerns: vrajj173@gmail.com