Your information, explained.
Effective 22 September 2026 · Movlet for iOS · AuraByte Studios
This policy describes how AuraByte Studios handles information when you use Movlet (Food, Fitness & Habits), including optional online features. Contact: support@aurabytestudios.online.
1. Your journal and health information
Meals, saved photos, mood, water, caffeine, movement, supplements, weight, measurements, goals, care notes and preferences are stored in the app’s local journal. The journal and its recovery copies are excluded from automatic cloud backup. An optional account does not currently synchronize this journal to our servers. We use this information on your device to provide tracking, summaries and pattern views.
Widgets use a local shared snapshot of selected progress information. Widgets may make that information visible on your Home or Lock Screen. Remove a widget if you do not want it visible there.
2. Apple Health
If you grant permission, Movlet reads workouts and step counts to display movement totals. This integration is read-only: it does not write workouts to Apple Health. Health records are not sent to food analysis, included in journal exports, or used for advertising. You can disconnect in Movlet and manage read permissions in Apple Health. Disconnecting does not delete the original records in Apple Health.
3. Optional food, menu and pantry analysis
Before the first AI request, Movlet asks for explicit permission to share the photo or text you submit. Only choosing Allow AI analysis grants permission; choosing Not now or dismissing the permission screen sends nothing for analysis. This permission covers meal photos, food-text estimates, menu analysis and pantry ideas and is remembered on this device. Manual logging and offline recipes remain available without it.
With permission, your selected photo, food description or pantry ingredients are sent through our service hosted on Vercel to OpenRouter. For the current app, OpenRouter forwards requests only to Novita running inclusionAI’s Ling 3.0 Flash VL model. Updated AI permission is required for this provider change; old permission cannot authorize forwarding to Novita. See the model provider details. We resize photos and remove location metadata before transmission. The request does not include your journal, mood history, account profile, care notes or Apple Health records. Avoid including faces, documents or other private information in what you submit.
You can review or withdraw AI permission in For you → Account & settings → Privacy → AI analysis (the settings screen is titled Your space). Withdrawal stops future requests; it cannot recall information already sent or stop processing already underway. Your saved journal is not erased. AI-sharing permission is separate from Apple tracking permission and regional advertising choices.
Our analysis endpoint processes the request without storing a photo or food-text database and does not intentionally log its content. Movlet enforces OpenRouter’s no-training and zero-data-retention routing controls for Novita inference, with no fallback to another host or paid model. This is not a promise that all service metadata is erased: hosting providers and OpenRouter may retain operational records, and applicable policies include legal and security exceptions. See Novita’s privacy policy. Free model availability may change; if this permitted route is unavailable, analysis fails rather than silently selecting another recipient. See OpenRouter’s privacy policy and its provider data-handling guidance. Review any AI estimate before saving it.
4. Optional accounts
Where account services are available, signing in by email, Apple or Google provides an email address (which may be Apple’s relay address), account identifier and authentication information to our account service and Supabase. Apple sign-in uses Apple-issued credentials. Google sign-in shares basic profile information (such as name and profile picture), email and an account identifier with Supabase to authenticate you. Movlet requests no access to Gmail, contacts, calendars or Google Fit. See Google’s privacy policy. Google sign-in may require provider setup before it is available. Email delivery providers process the address and verification message to deliver a sign-in code. Session credentials are stored in this device’s Keychain. Account information is used to authenticate you and manage or delete the account; it is not used to target health-based advertising. See Supabase’s policy and Apple’s policy. Availability of sign-in can vary while the service is being rolled out.
5. Advertising and purchases
Before advertising starts, Movlet requests Apple’s App Tracking Transparency permission when a decision is needed. If you authorize tracking, Google may use your device’s advertising identifier and, when your regional advertising choices also permit it, serve personalized ads and measure advertising across apps and websites. If tracking permission is denied or restricted, Movlet explicitly requests non-personalized ads and Google Mobile Ads does not receive the advertising identifier. If no tracking decision has been made, Movlet waits and does not request an ad. Denying tracking does not block journal or food features. Manage tracking permission in iOS Settings → Privacy & Security → Tracking.
Movlet uses Google AdMob for in-flow native ads and full-screen interstitial or rewarded ads, which can include video. Non-personalized does not mean no data collection: Google may process IP-derived general location, device identifiers permitted by your choices, ad views and interactions, diagnostics and performance data to deliver, measure and protect its advertising service. Movlet does not pass your journal, food, mood, profile or Apple Health records in ad requests. Read Google’s SDK disclosure and Google’s advertising privacy information.
Applicable Ad privacy choices are accessible from For you → Lifetime Ad-Free. The same purchase screen is also available through Account & settings → Lifetime Ad-Free. A lifetime ad-free purchase, when available from the App Store, removes in-flow and full-screen ads with one payment, without a subscription. Restore purchases is on the same screen. Apple processes payment; we do not receive your card details. StoreKit verifies purchase entitlement and restoration. The app stores local ad-frequency and offer-dismissal preferences.
6. Service operation and support
Our hosting and authentication services process technical information such as IP addresses, request times, security events and response status to operate the service, prevent abuse and diagnose failures. If you email support, we receive the address, message and any attachments you choose to send. Do not send a full health journal unless it is necessary for your request. We use correspondence to respond and resolve issues.
7. Retention, deletion and sharing
Your local journal remains until you erase it or remove the app. Exported files remain wherever you save or share them, under that destination’s controls. Account records remain until deletion, subject to provider backups and records required for security or legal obligations. Provider retention periods differ; deleting a local entry does not recall an earlier AI request, support email or exported file. We do not sell your journal or HealthKit data. Service providers receive only information involved in the features described above; information may also be disclosed where legally required.
8. Your choices and rights
You can edit entries, export a backup, erase the local journal, revoke permissions, stop using online analysis, change available advertising choices or request account deletion. Depending on your location, you may have rights to access, correct, delete or obtain a copy of information we hold, restrict or object to processing, withdraw consent, or complain to your data protection authority. Email support to exercise these rights. We may need to verify ownership and cannot remotely access your device-only journal.
9. International processing and security
Our providers may process information outside your country. Applicable provider terms describe their transfer protections. We use encrypted network connections, device storage protections and restricted server credentials. No storage or transmission method is guaranteed completely secure.
10. Children and policy changes
Movlet is intended for adults managing their own lifestyle and is not designed for children under 13. Contact us if a child has provided personal information to our online services. We will update this page when practices change and provide additional notice where required. Movlet supports daily organization; it does not diagnose, treat or replace professional medical care.