Privacy Policy

Toro keeps the sensitive things on your iPhone and sends only what a feature actually needs to work. This policy explains, plainly, what never leaves your device, what does leave it and why, and what we never do.

1. Data that never leaves your device

The following stays on your iPhone. We do not upload it, and we do not store it in iCloud:

• Body-diary photos and the silhouette measurements taken from them — stored behind Face ID, with file protection, excluded from backups and from the cloud. You can erase them all in one action.
• Calendar events shown in the app.
• Sign-in tokens for a connected calendar (Google or Yandex), kept in the device Keychain.
• The audio of your voice on iPhone: speech recognition runs on your device, and the recording is not uploaded. Dictation on Apple Watch is a separate case — see section 4.

If you delete the app, this data is removed with it.

2. Apple Health (HealthKit)

With your permission, Toro reads your steps and active energy to show them in your day and week summary, and can write your weight, height and water back to Apple Health. HealthKit data is never used for advertising, never sold and never shared with third parties. Your step count and weight for a day are part of the day snapshot described in section 3, which is stored on our server for backup only.

3. What leaves your device (and why)

• Backup of your daily log. Toro sends a snapshot of your recent days to our server so that your history survives a reinstall: the date, meals with their items and macros, water, steps, weight, the workout you did and the blocks of your day. The snapshot is stored under a random installation identifier — there is no account, no name and no email attached to it. You can turn the backup off in Settings → Privacy, and the same screen erases the backed-up daily log we hold for your installation; leaderboard data is deleted separately, the moment you leave the leaderboard.
• AI features. When you chat with the coach, ask for a meal or workout suggestion, or have Toro estimate what you typed, we send only what the request needs to our server, which forwards it to an AI provider (currently DeepSeek for both text and image features): remaining calories and macros, your diet preference, favorite food names, training goal, level, duration and equipment, and the text you wrote. The coach answers about you, so a coach request additionally carries your sex, age, height, current and target weight, activity level, the injuries you entered, your recent chat messages, your calorie and macro targets, and your training stats — estimated one-rep maxes and level, how often you trained recently, and your recent weight change. We do not send your name, email or any identifier that points to you.
• Photos you send to a feature. A photo of a meal is sent to our server and on to the AI provider to name the dishes and estimate their weight; the calories and macros are then taken from our own database. A photo of a nutrition label travels the same way, so the values printed on the pack can be read off it. If you set a profile photo for the rating, it is checked automatically before it is published. These photos are processed to return a result and are not used to build a profile of you. Photos in the body diary are never part of this — see section 1.
• Rating and leaderboard (optional). The global leaderboard is off until you turn it on, and the app shows you the exact list of what will be published before you do: your display name, your profile photo, your score, tier, achievements and how long you have used Toro. Your profile photo is stored on our server while participation is on. Your weight, meals and goals are never published. Offensive names and photos are prohibited: every photo passes moderation before it is published, and profiles that break the rules are removed from the leaderboard. You can report or block any member from their profile. Turning participation off deletes your row from the leaderboard.
• Reports. If you report a leaderboard profile, we send to our server the reported entry, the reason you select, and your installation's random identifier. Reports are used only to review the content, hide or remove it, and ban repeat offenders, and are deleted once resolved. Blocking a member is stored only on your device.
• Subscriptions. Purchases are handled by Apple. To confirm your subscription, the app may send Apple's signed receipt to our server for verification. We never receive your Apple ID, name, or payment details.
• Calendar (optional). If you connect Google or Yandex Calendar, Toro reads your events to display them. Your calendar data is not sent to our servers.
• Exercise illustrations. Exercise illustrations are loaded from the jsDelivr CDN, which sees your IP address and which illustration was requested. They are cached on your device after the first load.

All requests to our server carry a random installation identifier used to prevent abuse and rate-limit traffic. It is not linked to your identity. The identifier is stored in the device keychain and normally survives a reinstall on the same device — that is what lets Toro offer to restore your backed-up daily log after you reinstall the app.

4. Permissions

• Camera — to photograph a meal, your profile photo, or a body-diary shot. Nothing is captured in the background.
• Microphone & Speech — to log by voice. On iPhone, speech recognition runs on your device and the audio is not sent to the cloud. On Apple Watch, dictation is handled by watchOS and may be processed by Apple.
• Face ID — to unlock the body diary on your device.
• Notifications — local reminders (e.g. to drink water). Scheduled on-device; no push server.
• Calendar — read-only, to show your events.

5. What we never do

• No advertising and no ad identifiers (no IDFA).
• No third-party analytics, attribution or crash-reporting SDKs.
• No cross-app or cross-site tracking. We do not ask for App Tracking Transparency because we do not track you.
• No selling or sharing of your personal data.

6. Data retention

On-device data persists until you delete it or remove the app. The backup of your daily log is kept until you erase it in Settings → Privacy or ask us to erase it. A leaderboard row exists only while participation is on and is deleted the moment you turn it off. Reports about leaderboard profiles are deleted after they are resolved. AI requests and photos sent to a feature are not stored by our server; they are forwarded to the AI provider to generate the response and are then handled under the provider's own policy — nothing we forward carries your name, email or any identifier that points to you, and we never use them to build a profile of you. Server-side request logs are minimal and kept only briefly for reliability and abuse prevention.

7. Children

Toro is a general-audience health tool and is not directed at children. We do not knowingly collect personal data from children.

8. Your rights

You are in direct control: edit or delete any entry in the app, erase the body diary in one action, turn leaderboard participation off to delete your public row, revoke Health, Camera, Calendar or other permissions in iOS Settings, and disconnect any linked calendar at any time. To have the backup of your daily log erased from our server, open Settings → Privacy in the app: the same screen turns the backup off and deletes the copy we hold for your installation. You can also write to us at the address below, for that or for anything else about your data.

9. Changes

If this policy changes, we will update this page and the date above. Material changes will be reflected before they take effect.

10. Contact

Questions about privacy? Email support@rvmzvz.tech.