Privacy policy

Last updated 20 October 2026

Life OS is a health, fitness and wellbeing app for iPhone. It handles some of the most sensitive information a phone holds, and this document is written to describe what the app actually does rather than to reserve every right a policy could reserve.

The short version. Almost everything stays on your iPhone. Nothing goes to an AI model until you allow it: the app shows exactly what is sent and to whom before the first request, and Settings, Privacy, turns it off again. With your permission, what your ELO needs to answer you goes to our server on Cloudflare and to one AI model: an open model run by Cloudflare Workers AI, or Google's Gemini on Google's paid terms. Neither is allowed to use it to train models. A backup of your day-to-day records is sealed on your iPhone before it leaves, with a key kept in your iCloud Keychain, so we cannot read it. You can delete your account, and everything we hold for it, in the app. There is no advertising or tracking, and the only usage measurement is an anonymous count of which features are opened, which you can switch off.

Who this is from

Life OS is an independent app published on the Apple App Store by its developer. Questions about this policy, requests about your data, or anything else, go to hello@eloai.io and are answered by the person who wrote the app.

1. What stays on your iPhone

The app's records live in an on-device database. That includes everything you log and everything it computes: meals and their nutrients, water, workouts and lifts, sleep records and scores, recovery and strain figures, journal entries, your wardrobe and outfits, laundry state, checklist and streak state, targets, settings and layout.

That database is not synced to iCloud. Health information stays on the phone, as Apple requires; the encrypted backup described below is how it moves to a new iPhone.

Measured entirely on device, never transmitted

• Rep counting during a session, from body pose, on the phone.
• Garment colour, read from your clothing photo on the phone before anything else happens.
• The first-pass food classifier, which runs locally and offline. The cloud service is only a fallback.
• Speech for the wake phrase and for calls with your ELO on an iPhone with Apple Intelligence, turned into text on the phone. Dictation and journal recordings are different, see section 3.
• Calendar events are read on the phone to work out your day. They are not stored by us. If you allow your ELO to use AI models, today's events it needs to answer you are sent with that request, as described in section 3.

2. Apple Health

With your permission, Life OS reads a wide set of HealthKit data so that it can compare today against your own normal rather than a population average: body measurements; active, resting and dietary energy; steps, distance, exercise and stand time; heart rate, resting heart rate, heart rate variability and heart-rate recovery; VO₂ max, respiratory rate and blood oxygen; body and wrist temperature; walking and running form metrics; time in daylight and audio exposure; sleep analysis and mindful sessions; workouts and Apple's own activity-ring goals; and the nutrients other apps have written.

With your permission it writes back workouts, active energy, bodyweight, water and the nutrients from meals you log, each behind its own switch in Settings, so you can let it read without letting it write.

HealthKit data is read into the app on your device. The only part of it that leaves the phone is the summary the coach reads to answer you, listed in section 3, and that is behind a switch you control. Apple requires, and this app observes, that health data is never used for advertising or sold to anyone. You can withdraw any individual permission at any time in the iPhone Health app, under Sharing then Apps.

3. What leaves your device, and why

Life OS uses a small backend we operate on Cloudflare for the features that need a model too large to sit on a phone, and to hold the few records listed here. Every AI request below is sent only after you have allowed your ELO to use AI models; until then nothing is sent to one, and Settings, Privacy, “Share with AI models” turns it off at any time.

Who receives what you send to an AI model

• Cloudflare, Inc. runs our backend and, through Workers AI, the open models that answer by default (from Meta, Mistral, Qwen, OpenAI's Whisper for speech, and Deepgram for voice). Cloudflare states that it does not use this content to train any AI model or to improve any Cloudflare or third-party service.
• Google LLC, through the Gemini API, only on Google's paid terms, under which Google does not use what is sent to improve its products.

We send personal data to no other AI company. If that ever changes, the app will say so and ask again before anything is sent, and this policy will name the company first.

These requests are made over HTTPS. Nothing here is sold, shared for advertising, or used to profile you. Health data is used only to provide the app's own features to you, as Apple requires.

On our websites

When you chat with or call the ELO on eloai.io, lifeos.eloai.io or chat.eloai.io, what you type or say (as text, after your browser turns speech into words) and the ELO's replies are kept for 90 days, with the page you were on and an id made for that visit only. We read them to see what people ask and to improve the ELO. We do not keep your voice, your IP address or anything else that identifies you, and they are deleted automatically after 90 days. Do not share private details in that chat. To limit misuse, each visitor has a daily allowance, counted with a code made from the IP address and the day that cannot be turned back into either.

If you allow analytics in the cookie settings, each page you open is counted (the page and, if you came from another site, that site's name), with no id and no cookie. If you do not, nothing is counted. See the cookie policy.

4. What is not collected

• No third-party analytics kit. The only measurement is the anonymous feature count described in section 3, which you can switch off.
• No advertising kit, ad identifier, or advertising network.
• No third-party tracker, session recorder, crash-reporting network or attribution kit.
• No selling, renting or sharing of personal data with data brokers. Health data in particular is never used for advertising, and never will be.
• No cross-app or cross-site tracking of you.

Apple separately provides the developer with aggregate, anonymised App Store figures such as downloads, crashes and subscription counts, which are not linked to you and cannot be traced back to an individual.

5. Permissions the app asks for

Every one of these can be refused, and changed later in iPhone Settings. Refusing one disables the feature that needs it and nothing else.

6. Search, widgets and the Watch

The app indexes some records into Spotlight so you can find them from the home screen: lifts, meals and journal entries. It deliberately does not index your weight, body measurements or recovery scores. The test applied was whether you would be unhappy to see it on a borrowed phone. The index is wiped when you erase your data.

Widgets and the Apple Watch app read a small shared summary written into a private app group on your device: today's calories, protein, water, ring values and checklist progress. It does not leave the device either.

7. Subscriptions

Pro is offered as an auto-renewing subscription sold through Apple. Apple processes the payment, and the app never sees your card, billing address or Apple ID password. Subscription status is verified with Apple rather than stored as a local flag. Refunds and cancellations are handled in your Apple account.

8. Children

Life OS is for people 13 or older, and the app asks your age when you set it up. We do not knowingly collect personal information from a child under 13. If you are a parent and believe your child under 13 gave us personal information, write to hello@eloai.io and we will delete it. For teenagers, the app never sets weight-loss or calorie-cutting targets.

9. Your control over your data

• See it. Everything the app holds about you is visible in the app itself. There is no hidden profile.
• Delete your account. Settings, Account, Delete account. After you confirm with Apple or Google, we delete your account and everything stored for it on our server: the account record and sign-in links, the sealed backup, the web dashboard snapshot, push tokens, connected-service tokens and anything your ELO keeps on our server. What is on your iPhone stays until you delete the app. If you joined the Earn program, records of commissions and payouts are kept as long as the law requires.
• Delete what is on the phone. Settings has an erase option that clears the on-device database and the Spotlight index. Deleting the app removes the local store.
• Stop the sending. Turn off “Share with AI models” in Settings, Privacy, and nothing goes to an AI model. Turn off Health sharing and the app stops reading Health immediately.
• Ask. Email the address above for anything else, including a copy of what we hold.

Depending on where you live you may have statutory rights of access, correction, deletion, portability and objection. Most are exercised directly in the app; for anything held in the backend, use the deletion above or email the address above.

10. Retention

On-device records are kept until you delete them or delete the app. The account identifier and referral code described above are kept while the account exists. The sealed backup is kept until you delete your account. The web-dashboard snapshot and pairing token expire on their own after thirty days regardless of use. Photos, recordings and messages sent for processing in the app are not retained by us after the request is answered. Conversations with the ELO on our websites are kept as text for 90 days, as described in section 3. Cloudflare and Google may keep a request briefly for abuse monitoring under their own terms, and do not use it to train models.

11. Security

Requests to the backend are made over HTTPS. On-device data sits inside the app's own sandbox and is covered by iOS file protection and your device passcode. The backup is sealed on your iPhone before it is sent, so what we hold is ciphertext we cannot read. The web-dashboard snapshot lives in our Cloudflare account, keyed to your account identifier rather than your name; it is not end-to-end encrypted, but it is not analysed, browsed routinely, or shared with anyone. The web dashboard itself is reachable only with a pairing code generated by your own phone and a token that expires after thirty days. No system is perfect, and nothing here is a guarantee against every possible failure, but the design decision that matters most is that most of your history is not held centrally at all; only the parts described in section 3 are, and each is there for a stated reason.

12. Changes to this policy

If what the app does with data changes, this page changes with it and the date at the top is updated. A change that materially expands what leaves your device will be described in the app's release notes as well.

13. Contact

hello@eloai.io for privacy questions, data requests, and corrections to anything on this page.

One account across ELO AI

Life OS and our websites (eloai.io and chat.eloai.io) share one account. You sign in with Apple or with Google; the identifier that provider gives us for you is your account. Your profile, your ELO's name and look, and your settings are held against it. Life OS is the source of truth: what you change there is what the websites show.

ELO Connect

ELO Connect is not open yet. When it opens, this section applies. ELO Connect is the part of the service where people post, comment, like, message and follow. What you post there is public by design: your profile (name, handle, bio, picture and your ELO's picture), your posts, the pictures and videos in them and your comments can be seen by other people in the apps and on the web at https://connect.eloai.io. Direct messages are seen only by you and the people in the conversation; like posts, their words and pictures pass an automated safety check before they are delivered, and a reported message can be reviewed. You choose whether to join, and you can make your comments private in Settings.

Before anything is shown to other people, its words are checked by a safety model and its pictures by a vision model, both run by Cloudflare Workers AI, to keep out abuse and content that does not belong. Reports and blocks are stored so they can be acted on. Archiving a post hides it from everyone but you. Deleting a post, your ELO Connect profile or your account removes what it covers: profile, posts, pictures, videos, comments, likes and follows.

The Life OS API

The API is off until you turn it on in Settings, Your data, Developer API, and choose what it may read (days, sleep, meals, workouts, today's list). While it is on, your iPhone sends a copy of only what you chose, for the last 90 days, to our servers on Cloudflare, where anyone holding one of your API keys can read it. Your journal, your chats and your photos are never part of it. Turning the API off, or deleting your account, deletes that copy and every key. Keys are stored only as a one-way hash.

Data read through the API goes wherever you send it. Anything you connect to it is yours to choose and outside this policy.

Routines, your crew and calls

Routines you set and ELOs your ELO hires for you (your crew) run on our servers on Cloudflare, so they keep working while your phone is closed. For each one we keep its job in your words, how often it runs and its last 20 reports. To do a job it uses Cloudflare Workers AI with the job, its last report, and the short summary of your day your phone last sent (sleep, readiness, plan, food and water); a job about the world also searches the web with the words of the job. Reports reach you as notifications only if you allowed notifications. Pausing or letting an ELO go stops it; letting it go, or deleting your account, deletes its job and every report.

When your ELO calls you (a wake-up call, a reminder you asked for, a practice call), our server places the call to your iPhone through Apple's calling system. A call's subject and transcript are kept on your iPhone in your call history; what you say during a call is sent to answer you in the same way as a message, as section 3 describes.

Web searches

Web searches for a question about the world are sent from your iPhone to DuckDuckGo with the words of the question only.

Who we share data with

We do not sell your personal information, we do not share it for advertising, and we do not use it to train AI models. We use these service providers, each only to run the service and bound to use the data only for us:

We may disclose information when the law requires it, to protect someone's safety, or as part of a sale or merger of the business, in which case this policy keeps applying to what was collected under it.

Why we may use your data (legal bases)

Where the law asks for a legal basis (for example the GDPR in the European Union and the United Kingdom): we use your data to provide the service you asked for (contract); health data and anything sent to an AI model only with your explicit consent, which you can withdraw in Settings at any time; anonymous feature counts and keeping the service secure on our legitimate interest in running and improving it; and records the law requires us to keep (such as payments) on legal obligation.

Where your data is processed

Our providers are based in the United States and process data in the US and elsewhere. When data from the EU, the UK or Switzerland is transferred, it is covered by the providers' Standard Contractual Clauses or the EU-US Data Privacy Framework, where they participate in it.

Your rights

Wherever you live, you can see what the app holds about you in the app itself, export it, correct it, delete your account and everything we hold for it (Settings, Account, Delete account), and withdraw consent to AI models and to Apple Health at any time. You can also email privacy@eloai.io for a copy of what we hold, a correction or a deletion. We answer within 30 days, or sooner where the law says so, and never charge for it.

EU, UK and Switzerland. You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your data protection authority.

California and other US states with privacy laws. You have the right to know what we collect, to delete it, to correct it, and to opt out of its sale or sharing for advertising. We do not sell or share personal information, so there is nothing to opt out of; we treat a Global Privacy Control signal as that opt-out all the same. Health data, precise location and account sign-in are sensitive personal information, and we use them only to provide the service you asked for. We will not treat you differently for using any of these rights. You can use an authorized agent; we may ask it to show your permission.

Washington, Nevada and other states with consumer health data laws. See our consumer health data privacy policy.

Israel. You have the right to review the information held about you and to ask for it to be corrected or deleted, under the Protection of Privacy Law.

If we turn down a request, you can appeal by replying to our answer; we will reply within 45 days and tell you how to contact your attorney general or regulator if you still disagree.

Decisions made by software

Your ELO and the app's scores make suggestions, never decisions with legal or similarly significant effects on you, such as credit, employment or insurance.

If something goes wrong

If a breach of our systems affects your personal data, we will tell you and the authorities the law requires us to tell, without undue delay.

Cookies

Our websites set no advertising cookies, and ask before keeping preferences or counting visits. See the cookie policy.