Privacy Policy

What we collect

What we collect depends entirely on how you use Vitals:

• Using Vitals without an account (Guest): nothing at all. Your numbers stay in your browser's memory for that session only — nothing is sent to or stored on our servers, not even locally on your device.
• Creating an account (Free or Pro): your email and password, or your name/email/profile photo if you sign in with Google. Anything you enter into the app — income, expenses, debt, savings, budget cards, goals, and the questions you ask in chat.
• Optional profile details: date of birth, gender, and country, if you choose to provide them on the Profile screen. All of these are skippable and can be left blank or updated anytime.

How we use it

Solely to calculate your financial health score, generate your AI narrative and chat responses, and make the app work as described. We don't use your data for advertising, and we don't sell it to anyone.

Who we share it with

• Supabase, which hosts our database and handles authentication.
• The AI provider that powers chat and your narrative (currently Anthropic, OpenAI, Groq, or Google, depending on configuration) — your financial figures and questions are sent there to generate a response. If you provide your own API key, it's used only for that request and is never stored on our servers.
• Google, only if you choose to sign in with Google — this is standard OAuth sign-in; we never see or store your Google password.

We do not connect to your bank, and we never ask for banking credentials.

How long we keep it

Guest sessions: never stored anywhere — gone the moment you close the tab. Free and Pro accounts: kept until you delete it yourself.

Your controls

From Settings, you can clear all your financial data while keeping your account, or permanently delete your account entirely — both take effect immediately, with no request or waiting period.

Security

Every account's data is protected by row-level security, meaning our own database rules enforce that a user can only ever access their own records. Passwords are never stored in plain text, and all traffic is encrypted in transit.

Children's privacy

Vitals is not intended for use by anyone under the age of 18, and we do not knowingly collect information from children.

Changes to this policy

If this policy changes, we'll update the date at the top of this page.

Contact

Questions about this policy or your data? Reach out at pavanhebli@gmail.com.