Privacy Policy

Baseline · effective 20 October 2026

Baseline is a personal health and training tracker for iPhone, with a backend service at vr009tracker.store. It is developed and operated by Viacheslav Rianov, an independent developer ("we", "us"). This policy explains what data Baseline collects, why, where it is kept, and how you control it. We do not sell your data, we do not show ads, and the app contains no third-party analytics or advertising SDKs.

1. Data we collect

• Account. When you sign in with Apple we receive a stable Apple user identifier and, if you choose to share them, your name and email (which may be an Apple private relay address). We store a hash of your session token, never the token itself.
• Apple Health data, only with your permission and read-only (Baseline never writes to Health): steps, distance, active and basal energy, body mass, heart rate, resting heart rate, heart-rate variability, blood oxygen, blood pressure, respiratory rate, VO₂ max, walking heart rate, exercise and stand time, sleep and its stages, wrist temperature, breathing disturbances, time in daylight and workouts.
• Oura data, only if you connect your Oura account (see section 3).
• What you enter. Meals and their estimated nutrition, meal photos you take or pick, workouts and activity notes, weight entries, body metrics (height, age, sex, goal), daily ratings and tags, habits, your training plan and experiments, and messages you send to the in-app assistant, together with its replies.
• Voice recordings, only when you tap the microphone in the assistant to dictate a message (this needs your microphone permission). The recording is sent from the app to our server, which forwards it to OpenAI for transcription and does not store the audio. The resulting text is placed in your message box; only the text you choose to send becomes a chat message. If our transcription is unavailable, the app may instead transcribe the recording on your device with Apple's speech recognition, without sending it anywhere.
• Derived data. Daily summaries, scores, trends, correlations, hypotheses and daily reports computed from the data above.
• Technical data. Server request logs (time, path, status, your IP address as seen by the server) kept for operation and security, and per-day counters of AI usage used to enforce limits.

2. How we use it

Only to provide the app's features to you: computing your energy balance, sleep and recovery scores, trends and reports; estimating the nutrition of meals; answering your questions in the assistant; and transcribing messages you dictate. Health data, including data from Apple Health and Oura, is never used for advertising or marketing, is not sold, and is not shared with data brokers or other third parties except the service providers listed in section 4 that process it on our behalf to run these features.

3. Oura data

If you choose to connect Oura, you authorize Baseline through Oura's own sign-in page, and you can see the requested permissions there. With your authorization we read, through the Oura API, your sleep (including stages, heart rate and HRV during sleep), readiness and its contributors, body-temperature deviation, activity, heart rate, blood oxygen and breathing disturbance index, stress and resilience, cardiovascular age, VO₂ max, workouts, sessions, tags, rest-mode periods, recommended bedtime, ring configuration and the basic profile Oura provides (such as age, weight, height, sex and email).

• We use Oura data only to show it to you and to compute your scores, trends, insights and reports inside Baseline.
• Oura access and refresh tokens are stored encrypted on our server and are used only to fetch your own data.
• You can disconnect Oura at any time in the app. Disconnecting revokes our access with Oura and deletes the stored tokens; the data already imported stays in your history until you delete it or your account. You can also revoke access from your Oura account.
• We do not sell Oura data, do not use it for advertising, and do not share it except with the service providers in section 4.

4. Service providers

• DigitalOcean hosts our server and database in Frankfurt, Germany.
• Anthropic (Claude API) processes the content needed for the AI features: a meal photo or description you submit for estimation, and, for planning, daily reports and the assistant, the relevant parts of your data and your messages. Under Anthropic's commercial terms, data sent through the API is not used to train their models.
• OpenAI (transcription API) converts the voice recordings you dictate in the assistant into text. We send it only the recording, plus a fixed vocabulary hint that contains no data about you, never your account details or other data. Under OpenAI's API terms, data sent through the API is not used to train their models.
• Apple provides Sign in with Apple and HealthKit on your device.
• Oura provides your Oura data if you connect it.

Meal photos and voice recordings are sent for estimation or transcription and are not stored on our server.

5. Storage, retention and security

Your data is stored on our server in Frankfurt, Germany, for as long as you keep your account. Connections to the server are encrypted with TLS, third-party tokens are encrypted at rest, and access to the server is restricted to the operator. Request logs are kept for a limited period for security and troubleshooting.

6. Your choices and rights

• Delete your account in the app (Profile → Delete account). This revokes Sign in with Apple, disconnects Oura and permanently deletes your account and all associated data from our database.
• Withdraw Apple Health access at any time in iOS Settings → Health → Data Access & Devices, and Oura access as described in section 3.
• Withdraw microphone access (which turns dictation off) or speech-recognition access (which turns off only the offline transcription fallback) at any time in iOS Settings → Baseline.
• Depending on where you live (for example under the EU/UK GDPR), you may have the right to access, correct, export, restrict or delete your personal data and to object to its processing, and to complain to your data-protection authority. We process your data to provide the service you asked for and, for health data, on the basis of your explicit consent, which you can withdraw at any time. To exercise any right, email us.

7. Not medical advice

Baseline is a wellness tool. Its scores, estimates and suggestions are not medical advice and are not intended to diagnose, treat or prevent any condition.

8. Children

Baseline is not intended for anyone under 16, and we do not knowingly collect data from children.

9. Changes

If this policy changes, we will update the date above and, for material changes, tell you in the app.

10. Contact

Questions or requests: privacy@vr009tracker.store.