Privacy & your data

Your data, in your own database.

What VITAL holds, what it will not do, and what remains when you leave — limits included.

The data-ownership model

Two places, kept apart.

Your database

Everything you add

Each member has a separate database. It holds what you imported, connected or typed in: activities and routes, daily health measures, weight and blood pressure, manual readings, check-ins, journeys, goals and notes, and your settings. Other accounts cannot read it, and automated tests check that.

The accounts registry

No health values

The registry holds only what running accounts needs: your username and email, sign-in identities, hashed recovery codes and invites, sessions, your consent history and an audit trail of actions, times and counts — no health values, file names or note text.

What VITAL does not do

Not for sale. Not for ads.

VITAL is free.

No sale of health data, and no advertising.
No analytics or telemetry. This website sets no cookies and loads nothing from third parties.
No research use, and no pooling or reuse of your data across accounts.
No AI training on your records, and VITAL never sends your health data to an AI service by itself. Connected AI is not offered on the public service at present. If it is offered later it will be optional, will need your separate consent in Settings, and this policy will be updated first: a provider such as Claude could then read only the selections you send, read-only, until you revoke it. It processes what it receives under its own terms, and VITAL cannot recall or delete that after you revoke.

The limits

What we do not claim.

VITAL is not end-to-end encrypted. The person who operates the server, and anyone with administrative access to it, can technically read stored data and backups.
Controls that exist: per-member databases with restrictive file permissions, consent required before data routes work, hashed session tokens, hashed invite and recovery codes, rate limits and an audit log. They reduce risk; they do not remove it.
No system is free of risk. VITAL does not claim any security certification.
VITAL may be unavailable or lose data. Do not use it as your only copy of important records.
VITAL does not claim any certification or regulatory compliance.

Export

Take it with you.

Export gives you a zip with one JSON file for every table of your database — activities, readings, journeys, notes, settings, import records and more — plus your account, consent and audit records, and a README.

It never includes other people’s data, your sign-in subject id, session tokens, or invite and recovery-code hashes. The format is raw JSON, not a curated portable format.

Deletion

What is removed, and what remains.

Deleting your account (type DELETE MY DATA in Settings) removes your database and its files at once — an ordinary delete, not a secure wipe — along with your sign-in identities, recovery codes and group memberships. Consents are marked withdrawn. The account cannot sign in again.

What remains afterwards

A deletion tombstone: Opaque identifiers only: user id, an opaque sign-in subject (or its hash), invite reference and deletion time. Your username and email are erased. This stops a deleted identity being silently re-created and keeps the audit trail attributable.
Consent history: When you agreed, and when you withdrew.
Audit rows: Actions, timestamps, counts and ids. No health values, file names or note text.
A deletion record: User id, event, time and database file name (no name or address), kept in three places so a deletion can be re-applied if an old backup is ever restored. No health data.
Backups: Long-term off-site backups are encrypted; short-term copies on the server itself may not be, and are owner-only. Copies of your data can remain in backups until they expire — on the private instance up to about six months; public-service periods are to be confirmed. They are never restored as an active account. There is no guaranteed erasure within 30 days.

If you later create an account again, it starts fresh and empty.

Also worth knowing

Imports, logs and groups.

Import uploads

Uploaded files are staged in a private folder next to your database and deleted when the import finishes, is cancelled or fails permanently. A retriable failure keeps the file for at most 24 hours.

Server logs

The web server logs the address, time, request, status, size, referer and user agent of each request. Request bodies and cookies are not logged. Logs are bounded by size rather than by time, and deletions do not rewrite them.

Groups

Private, and opt-in per group and per category. Your journeys, notes, symptoms, medication, weight, blood pressure, HRV, sleep, heart rate and routes are never exposed through groups.

Who is responsible

One person, not a company.

VITAL REBUILD is an independent hobby project developed by one individual under the hobby name ABSTRACT & BORED, which is not a company or organisation. That individual is the operator responsible for your data.

The in-app rights above — view, export, correct, delete, withdraw consent — are available to every user wherever you live. Depending on where you live, the law may give you additional rights; VITAL does not claim to meet any particular country’s requirements. VITAL is for adults only (18 or older). If we become aware of a security incident affecting your data, we will notify affected users and authorities where applicable law requires it.