1. Who We Are
Veast X LTD ("Veast," "we," "us," or "our") is a company incorporated in British Columbia, Canada. We operate the Veast app for iPhone and Android, the web app at veast.life/app, and the veast.life website (together, the "Platform"). We decide why and how your personal information is used on the Platform, which makes us responsible for it (the "controller" under the GDPR).
Veast X LTD, Suite 250 - 997 Seymour St, Vancouver, BC V6B 3M1, Canada. Privacy contact: legal@veast.life (Section 16).
This policy explains what we collect, why, who receives it, how long we keep it, and your rights. It applies to everyone who uses the Platform. Washington and Nevada residents: our Consumer Health Data Privacy Policy is at veast.life/wa-health-rights.
2. Information We Collect
What we collect depends on the features you use. Anything marked optional can be left out; the rest is needed for the feature it serves.
2.1 Account and Profile
Your email address and password (stored only in hashed form), or the details your sign-in provider shares if you sign in with Apple, Google or Facebook. If you sign in with Apple, we keep the credential we need to revoke Veast's access when you delete your account. Your username; display name and first and last name (optional); date of birth (required, and can be set only once in the app); gender (Male or Female); the city and country you type in (optional); and your bio, profile photo and banner (optional). If you turn on two-factor authentication: its settings, backup codes and a recovery email. Referral information: the referral code you arrived with or entered, and the code we give you.
2.2 Your Questionnaire
When you join, you answer a questionnaire in sections:
- Body: height, weight and goal weight (required); body-fat percentage and body measurements (optional). From height and weight the app works out your body mass index (BMI), stores it and shows it to you.
- Fitness and training: how often you train, your level and experience (required); training styles, sports and gym access.
- Injuries and health (optional section): injuries, medical conditions, family medical history, surgeries and prescription medications.
- Diet and nutrition: your dietary approach, food allergies and goals (required); supplements.
- Mind and spirit: your practice (the options include prayer and meditation) and what motivates you (the options include spiritual growth). Required, but "none" is an answer.
- Lifestyle (optional section): sleep, stress, energy, working hours, and your use of alcohol, cannabis, tobacco and recreational drugs.
- Goals and coaching preferences.
2.3 Health, Fitness and Activity You Log
- Training: workouts (exercises, sets, weight and repetitions, effort, duration and notes, and your mood and energy before training), meditation and breathwork sessions, discipline check-ins, fasting windows, and your daily Today practice with the private observations you write about it.
- Nutrition and body: meals and foods (with photos if you add them), water, supplements, recipes, and body measurements over time.
- Veast Pulse check-ins: mood, energy, stress, sleep quality, hydration and notes.
- Sleep: sleep you log by hand or with the in-app sleep tracker and, on iPhone with your permission, sleep read from Apple Health. When you save sleep, we also keep a copy with the Apple Health samples behind it as a verification record.
- Steps (iPhone only, with your permission): counted by your phone's motion sensor or read from Apple Health. Veast only reads from Apple Health and never writes to it. The Android app does not collect steps and does not connect to Health Connect.
- Journal: your entries. New entries start private; your connected coach can see only entries you have not marked private.
- Progress and play: Veast Score, plane progress, games you play, challenges, and whether you have opted in to leaderboards.
2.4 Photos, Video and Audio
- What you post or send: profile and banner images, community posts, images in messages, meal and workout photos, and tribe banners.
- Mirror progress photos (front, side and back): the background is removed on your phone, by Apple's Vision framework on iPhone or Google's ML Kit on Android, before the photo is uploaded. Mirror photos are stored privately and are visible only to you and your connected coach.
- Share cards: a transformation card or milestone card is made on your phone and leaves it only through your phone's share sheet, to wherever you choose. A transformation card uses two of your background-removed Mirror photos and is made only after you agree to share that pair; we record that agreement. A milestone card shows the practice, level and streak or fasting target, never your score or notes.
- Photo metadata: photos you choose from your library are uploaded as they are, so they can carry the details your phone stored with them, which may include where a photo was taken. Mirror photos are created by the app and carry no location. To keep location out of your photos, turn off location tagging in your camera settings.
- Coaches: credential documents, intro and exercise videos (with sound), and live sessions. A coach's camera and microphone are broadcast through our live-video server and every session is recorded. Members are never on camera or microphone in a live session; they can take part in its text chat.
Veast uses your microphone only for coach video and live sessions. It does not read your contacts, and it only adds Veast sessions to your calendar; it never reads your other events.
2.5 Messages and Community
- Posts, comments, likes, follows, bookmarks and the tribes you join; reports you make and members you block.
- Messages: direct messages between members and with coaches (including messages to a coach before you become their client), the private coach chat (Premium), live-session chat, questions you send your coach as a Standard member, and notes you add when booking a session. Messages are stored on our servers so they can be delivered and kept in your conversation history. They are protected in transit and at rest but are not end-to-end encrypted, so Veast can access them, for example to act on a report.
- Results tribe: if you agree, Veast may feature what you share in the Results tribe, with your coach named, on veast.life and Veast's social media accounts (Section 6.3).
2.6 The Veast Agent and AI Features
If you use the Veast Agent, we store your conversation history so you can return to it, a short preview of each exchange, and a server log of every message to and from the Agent, kept for up to 2 years for safety and abuse review (Section 7). We also store the routines, diet plans and weekly and monthly reviews our AI features produce for you, and any report you make about an Agent response. Section 5 explains what is sent to our AI provider.
2.7 Purchases
Your membership tier, billing method, renewal and cancellation status, and payment history. Purchases in the iOS and Android apps are handled by Apple or Google; we receive the purchase and its status through RevenueCat, never your card details. Web memberships and Premium coaching are paid by card on Stripe's own checkout page: your card details go to Stripe, never to Veast. We keep the Stripe customer and subscription identifiers, and Stripe receives your email address or customer ID, your Veast account ID, your plan, your country and, for coaching, your coach. Your pricing region comes from your device's region setting in the app and from your profile country on the web.
2.8 Coaches
If you apply to coach: your name, email address, phone number (optional), location, certifications and credential documents, social media and portfolio links, disciplines, rates, and your acceptance of the coach agreement. If you are approved and set up payouts: your legal name, tax residency, tax identification number (which can be entered but is never shown back in the app), date of birth, business number, GST/HST status and postal address, and your payout details: bank account details, a Wise email address, or another payout method you choose. We also keep your earnings and payout records.
2.9 Device, Usage and Diagnostics
- Activity log: the screens you open and actions you take in the app, linked to your account, with an identifier for each app session and some details such as step totals. We use it to run, secure and improve Veast, never for advertising.
- Sessions and notifications: your last-active time, which your connected coach can see; a sign-in record for each device with the device's name; and your device's push notification address and model.
- Crash and performance reports through Sentry: device and app details, the steps leading to an error, performance measurements for about one in five screens, and your account ID. On by default; you can switch it off in Settings > Privacy Settings > Crash Reports.
- App updates through Expo: each time the app starts it checks for updates, sending a random identifier for your installation.
- Device security checks through Talsec's freeRASP: whether the device is jailbroken or rooted, tampered with, running a debugger or emulator, or recording the screen. Talsec receives these signals with an anonymous device identifier and your IP address, from which an approximate location can be derived. Signals the check detects are also recorded in your account's security log.
- Security events: tampering and connection-security warnings, the fact that a screenshot was taken on a protected screen, and the fact that the Agent routed a conversation to crisis resources (recorded without the message).
- Settings: your timezone and language, and your country from your device's region setting.
- IP address: received by our servers and providers whenever your device connects.
2.10 Location
- We do not collect or store your precise location.
- Wellness Map: with your permission, your phone reads your location while you use the map. It stays on the phone: only a point rounded to about 1 km is sent to OpenStreetMap's Overpass service to find places nearby, and nothing is stored. Maps are drawn by Apple Maps on iPhone and the Google Maps SDK on Android, which receives device information and your IP address.
- The app may ask for location permission when you sign up. Granting it collects nothing until you open the Wellness Map.
- Approximate location: the city and country you type in, your device's region setting, and the approximate location Talsec can derive from your IP address.
2.11 Support and Feedback
Messages you send to support@veast.life or through the in-app feedback form, which adds your app version, platform, language and the screen you were on.
2.12 Website Visitors
When you visit veast.life: cookies and page analytics as described in Section 11, and, if you join the waitlist, your email address and the date you joined (Section 12).
2.13 Where It Comes From
Most of this information comes from you. Some comes from your device (its sensors, Apple Health and its settings); from Apple, Google or Facebook when you sign in with them; from Apple, Google, RevenueCat and Stripe about your purchases; from your coach (the routines, notes and reviews they write for you); from other members (messages and reports); and from our AI features (routines, plans and reviews generated from your information).
3. How We Use It and Our Legal Bases
The legal basis column applies to people in the European Economic Area and the United Kingdom. Wherever you live, we use your information only for these purposes.
| Purpose | Information Used | Legal Basis (GDPR) |
|---|---|---|
| Create and run your account and provide the features you use: training, logging, community, messaging, games | Account, profile, logs, content, device | Contract (Art. 6(1)(b)); explicit consent for health information (Art. 9(2)(a)) |
| Personalise your plan, Veast Score and Today practice | Questionnaire, logs | Contract; explicit consent for health and belief information (Art. 9(2)(a)) |
| Connect you with a coach and let them coach you | As listed in Section 6.2 | Contract; explicit consent for health information |
| AI features (Section 5) | As listed in Section 5 | Consent (Art. 6(1)(a) and 9(2)(a)) |
| Take payments, prevent payment fraud and keep tax records | Purchases, payments, coach tax and payout details | Contract; legal obligation (Art. 6(1)(c)) |
| Pay coaches | Coach tax and payout details, earnings | Contract; legal obligation |
| Keep Veast safe: filter objectionable text, screen community images, act on reports, protect accounts and devices | Content, reports, device and security information | Legitimate interests in a safe community and a secure service (Art. 6(1)(f)); legal obligation where content-moderation law applies |
| Fix crashes and improve the app | Activity log, crash and performance reports | Legitimate interests in a working service (Art. 6(1)(f)); you can switch crash reports off |
| Send service messages and the notifications you choose | Email address, push notification address | Contract; legitimate interests |
| Send waitlist and launch email | Email address | Consent (Art. 6(1)(a)) |
| Feature your results on veast.life and Veast's social accounts, if you agree | What you share in the Results tribe, your coach's name | Consent (Art. 6(1)(a), and Art. 9(2)(a) where it reveals health) |
| Comply with the law, answer lawful requests, enforce our Terms | As needed | Legal obligation; legitimate interests |
We do not sell your personal information, use it for targeted advertising, or share it with data brokers. We never use information from Apple Health or your phone's motion sensor for advertising, marketing or data mining, and we never store it in iCloud.
What you must provide. An email address or sign-in provider, a username, your date of birth, your gender and the required questionnaire answers are needed to create an account and build your plan; without them we cannot provide Veast. Everything marked optional can be left out.
Automated decisions. We make no decision based solely on automated processing that has a legal or similarly significant effect on you. Some things are decided automatically: your Veast Score and which planes and practices open (including hiding practices for adults from members under 18), what Today suggests, refusing text that matches our list of objectionable terms, holding a posted image until it passes the safety check, and hiding a post or comment that three members have reported until a person reviews it. You can ask what information and main factors led to such a decision, and ask a person to review it, by emailing legal@veast.life.
4. Health and Other Sensitive Information
4.1 What Is Sensitive
Most of what you log in Veast is health information: your questionnaire answers about your body, injuries, medical conditions, family history, surgeries, medications, diet and allergies; your use of alcohol, cannabis, tobacco and drugs; your workouts, nutrition, body measurements, sleep, steps and Pulse check-ins; your Mirror photos; anything about your health you write in the journal, in messages or to the Agent; and the reviews and plans generated from it. Your Mind and Spirit answers may reveal religious or philosophical beliefs. The GDPR treats both as special categories of personal data, Canadian law treats them as sensitive, and Washington and Nevada law treat the health information as consumer health data.
4.2 Your Consent
Before you use the app, the Consent & Rights step asks you to consent to Veast collecting and using your health information, and you choose whether to answer the optional questionnaire sections. AI features need a separate consent (Section 5), featuring your results needs its own consent (Section 6.3), and reading Apple Health or your phone's motion sensor needs your permission in iOS. We use this information only to provide Veast to you, and we share it only as Section 6 describes.
4.3 Withdrawing Consent
You can withdraw consent at any time, and doing so does not affect what was done before:
- Switch off AI Processing in Settings > Privacy Settings to stop sending your information to Anthropic.
- Turn off Veast's access to Health or to Motion & Fitness in your iPhone's Settings.
- Delete a category of your information (journal, workouts, nutrition, Pulse, Agent conversations, photos, or your Today record) in Settings > Privacy Settings in the iOS or Android app.
- End your coaching relationship to stop sharing with your coach.
- Email legal@veast.life to withdraw your consent to health information altogether. Because Veast is built on this information, we then close and delete your account as described in Section 7.
5. AI Features
Veast's AI features run on Claude, an AI model made by Anthropic PBC in the United States. The Veast Agent is an AI, not a person, and the app labels it as one.
| Feature | What Is Sent to Anthropic | When |
|---|---|---|
| Veast Agent chat | Your messages and the Agent's recent replies, with your display name, plane, Veast Score, membership tier, fitness level, goal, diet, injury areas and current routines | When you chat |
| AI routines and diet plans | Your full questionnaire (including health conditions, medications and substances), date of birth, gender, recent Pulse check-ins, body measurements, workouts and your last 20 Agent messages | When a routine is generated for you, including when your coach asks for one |
| Meal-photo and food analysis, nutrition targets and summaries, workout review | The photo, text or log involved | When you use that tool |
| Weekly and monthly reviews | Totals from your logging for the period | Each week and month, for paid members |
| Coach digest | Your Pulse check-ins, the mood and date of journal entries you have not marked private, and your workout logs including notes, with your account ID | When your connected coach's summary of your week is prepared |
| Community image safety check | Every image you post to the community | Always, before other members see it |
| Security summary | A weekly summary of serious security events, without your name or account ID | Always |
Your choice. Every feature in the table except the last two runs only after you agree to use the Veast Agent and while AI Processing is on. You can give or withdraw that consent in Settings > Privacy Settings at any time. Without it, the Agent and AI routines stay off, your reviews show your numbers without a written summary, your coach cannot have an AI routine generated for you, and the rest of Veast works as normal. The image safety check and the security summary keep running because they protect the community and the service.
How Anthropic handles it. Anthropic processes this information to provide its service to us. Under Anthropic's commercial terms it does not use it to train its models, and it deletes what we send, and what it returns, within 30 days, unless it must keep it longer to enforce its usage policy (up to 2 years for flagged content) or to comply with the law. We never send Anthropic your email address.
Crisis. If you tell the Agent you are in crisis, it replies with crisis resources without sending that message to Anthropic, and we record that this happened, without the message. The Agent is not an emergency service.
The filter that refuses objectionable text in posts, comments, messages and profiles is a list of terms on our servers, not AI.
6. Who Receives Your Information
6.1 Other Members
Your username, display name, profile photo, banner, bio, posts, comments and tribes are visible to other members. Your Veast Score and plane are private unless you choose to show them, and you appear on a leaderboard only if you opt in. Messages go to the people you send them to, and a live-session chat is visible to the session's audience. Push notifications for a message show the sender's name and the first 140 characters on the recipient's device.
6.2 Your Coach
While you have an active connection with a coach, they can see your profile and full questionnaire (including health, injuries, medications and substances); your Pulse check-ins, workouts, nutrition, water, body measurements, sleep, steps and mindfulness minutes; your Veast Score and routines; your Mirror photos; journal entries you have not marked private; and your last-active time. A coach you message before becoming their client sees your messages and public profile. Coaches are independent professionals, not Veast employees. They are bound by our coach agreement and Data Processing Agreement and may use your information only to coach you. Ending the coaching relationship ends their access.
6.3 Featuring Your Results
When you join the Results tribe, you may agree that Veast can feature what you share there, with your coach named, on veast.life and Veast's social media accounts. It is optional and joining never requires it. You can withdraw in Settings > Privacy Settings or by leaving the tribe; nothing new is featured after that, but what has already been published stays published. Your coach gives their own consent to be named.
6.4 Service Providers
These providers process information for us to run the Platform, under contracts or terms that limit them to providing their service and require them to protect it as this policy does. Overpass, Open Food Facts, YouTube and jsDelivr receive no account information.
| Provider | Role | Location | Information |
|---|---|---|---|
| Supabase (on Amazon Web Services) | Database, sign-in, file storage and server functions | United States (AWS us-east-1) | Everything stored in your account, including photos and files |
| Anthropic | AI features (Section 5) | United States | As listed in Section 5 |
| Apple | Sign in with Apple; App Store billing; push delivery, Apple Maps and on-device background removal on iPhone | United States | Sign-in details; purchase and subscription status; your device's push notification address |
| Apple Health | With your permission, the source of the steps and sleep Veast reads on iPhone; Veast writes nothing to it | On your iPhone | Nothing is sent to Apple Health |
| Google Sign-In; Google Play billing; push delivery on Android; the Google Maps SDK and ML Kit on Android; YouTube | United States | Sign-in details; purchase and subscription status; your device's push notification address; device information, identifiers, IP address and usage of the map and ML Kit (ML Kit receives no images) | |
| Facebook (Meta Platforms, Inc.) | Sign in with Facebook, if you choose it | United States | Sign-in details |
| RevenueCat | Membership status across the App Store, Google Play and Stripe | United States | Your Veast account ID and purchase and subscription status |
| Stripe | Card payments for web memberships and Premium coaching | United States | Card and billing details you give Stripe; your email address or customer ID, account ID, plan, country and coach |
| Sentry | Crash and performance reports, while Crash Reports is on | United States | Device and app diagnostics and your account ID |
| Expo (650 Industries) | Push notification delivery and app updates | United States | Your device's push notification address and the notification text; a random installation identifier |
| Resend | Email delivery | United States | Your email address and the email's content |
| Talsec (freeRASP) | Device-integrity checks | Czech Republic; its data is stored in the United States | Device security signals, an anonymous device identifier and IP address. Under freeRASP's terms Talsec may also use this data, without your account, to improve its products and publish security statistics |
| Oracle Cloud | Hosts our live-video server, which relays coaches' live sessions and records them | Canada | Coaches' live video and audio |
| Cloudflare | Storage for recordings of live sessions | United States and its global network | Coaches' session recordings |
| OpenStreetMap Overpass (FOSSGIS e.V.) | Finds places to train for the Wellness Map | Germany | A point rounded to about 1 km; never your account |
| Open Food Facts | Food search and barcode lookups | France | What you search for or scan; never your account |
| YouTube (Google) | Plays live group Q&A sessions in the app | United States | What you watch, under Google's privacy policy |
| jsDelivr | Delivers the 3D anatomy models the app displays | Global network | Your IP address |
| Netlify | Hosts the veast.life website and web app | United States and its global network | Your IP address and the pages you request |
| Wise | Coach payouts, if a coach chooses it | United Kingdom and United States | The coach's payout details and the payment |
Apple and Google also act on their own account, under their own privacy policies, for the purchases you make through their stores.
6.5 Legal, Safety and Business Transfers
We may disclose information when the law requires it or to respond to a valid legal request; to protect someone's life or safety, including telling the police about a threat to someone's life or safety; to investigate fraud or abuse; and, if Veast X LTD is merged, acquired or sells its assets, to the new owner, who must honour this policy. Otherwise we share your information only with your consent.
7. How Long We Keep It
| Information | How Long |
|---|---|
| Your account, profile, questionnaire, logs, photos and videos, journal, Agent conversations, the messages you sent, your posts and your activity log | Until you delete them or your account. When you ask to delete your account, it is closed at once and permanently deleted after a 30-day grace period; stored files are removed within hours after that. Your posts become a "deleted" placeholder so other members' replies stay readable. |
| Agent server log (Section 2.6) | Up to 2 years after each message, then deleted automatically, or earlier when your account is deleted. Deleting your Agent conversations in Privacy Settings does not remove it. |
| Live-session chat | 90 days after the session ends |
| Live-session recordings (coaches) | Until the coach deletes the recording. Recordings are not removed automatically when a coach deletes their account; a coach can delete them first or ask us to. |
| A data export you request | The download link works for 24 hours; the file is deleted with your account |
| Subscription and payment records | Kept after your account is deleted, for as long as tax and accounting law requires (in Canada, generally six years after the end of the tax year they relate to) |
| Coach tax, payout and earnings records | Kept after the coach's account is deleted, for as long as tax law requires (in Canada, generally six years after the end of the tax year they relate to) |
| Security event records | 2 years, then deleted automatically. When your account is deleted, they no longer name you and keep only the internal identifier your account had. |
| Reports and moderation decisions | Kept for the community's safety, including after the accounts involved are deleted |
| Consent records (AI, Results tribe, share cards, coach agreement) | Kept as proof of what was agreed and when, including after your account is deleted |
| Your sign-in record | After deletion we keep an empty sign-in record, with your email address, phone number and password removed, so the records above stay consistent |
| Waitlist email | Until you unsubscribe; we then keep your address marked as unsubscribed so we do not email you again |
Copies in our database provider's automatic backups expire as those backups are replaced. Anthropic keeps what we send it as described in Section 5. Apple, Google, RevenueCat, Stripe and Sentry keep their own records under their own retention schedules; deleting your Veast account does not delete your customer record at Stripe. The data deletion page lists what is deleted and what is kept.
8. Your Rights
Wherever you live, you can ask us to:
- Access your information and learn how we use it and who has received it.
- Correct it. Most of it you can edit in the app. Your date of birth can be set only once, so a mistake in it is corrected by contacting us.
- Delete it, in part (Settings > Privacy Settings) or by deleting your account (Settings > Delete Account), subject to the records we must keep (Section 7).
- Export it. Settings > Privacy Settings > Export My Data in the iOS or Android app gives you a file of your profile, questionnaire, workouts, nutrition, journal, Veast Score history, posts and Today record, through a download link that works for 24 hours. Your messages, photos, Agent conversations, Pulse check-ins, sleep, steps, body measurements, routines and reviews are not yet in that file; email us and we will send them.
- Withdraw consent (Section 4.3), and object to or ask us to restrict how we use your information.
To make a request, email legal@veast.life with the subject "Privacy Rights Request" from the address on your account. We may ask for information to confirm it is you. Requests are free. We reply within 30 days; where the law allows more time, such as 45 days under several US state laws, we will tell you if we need it and why. If we refuse a request, we explain why. You can appeal by replying with the subject "Appeal", and we answer an appeal within 45 days. You can also complain to a regulator (Section 9).
9. Rights by Region
Canada
You have the rights in Section 8 under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, in British Columbia, the Personal Information Protection Act. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, for British Columbia, the Office of the Information and Privacy Commissioner (oipc.bc.ca).
Quebec: you can also ask us to give you the information you provided in a structured, commonly used technological format; to stop disseminating your information or de-index a link to it where the law allows; and to explain an automated decision about you and let a person review it. You can complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).
European Economic Area and United Kingdom
Under the GDPR and UK GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), to object to processing based on legitimate interests (Art. 21), and to withdraw consent at any time without affecting earlier processing (Art. 7(3)). You can complain to us, and we acknowledge a complaint within 30 days. You may also complain to the data protection authority where you live or work, or where you believe the law was broken. In the UK, that is the Information Commissioner's Office (ico.org.uk).
United States
Washington and Nevada: your rights over consumer health data, and how to use them, are in our Consumer Health Data Privacy Policy.
California and other states: state consumer privacy laws such as California's CCPA apply to businesses above certain sizes, and Veast is below them today. We still give every US resident the rights in Section 8, including an appeal, and if we deny your appeal you can contact your state Attorney General. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you.
Do Not Track: our website does not change its behaviour in response to Do Not Track signals; it does not track you across other sites in any case. Other companies do not collect information about your activity across sites through Veast, except that YouTube does so when you play a video, under Google's privacy policy.
10. Where Your Data Is Stored and International Transfers
Veast X LTD is in Canada. Your information is stored by Supabase in Amazon Web Services' us-east-1 region (Northern Virginia, United States), and backups stay in the same region. Our other providers process it in the countries listed in Section 6.4, mostly the United States; our live-video server is in Canada. Information processed in another country is subject to that country's laws and can be accessed by its courts, law enforcement and national security authorities.
From the EEA and the UK: transfers to the United States rely on the EU-U.S. Data Privacy Framework and its UK Extension where the recipient is certified (as Amazon Web Services, Google, Stripe, Sentry, Expo, Resend and Cloudflare are), and otherwise on the European Commission's Standard Contractual Clauses, with the UK Addendum, in the provider's data processing terms (Supabase, Anthropic and RevenueCat). Canada has an EU adequacy decision for organisations subject to PIPEDA. To ask for a copy of these safeguards, email legal@veast.life.
11. Cookies and Website Analytics
The veast.life website uses cookies. We obtain your consent before loading non-essential cookies via our cookie consent banner. Categories:
- Strictly Necessary: Session management, security, CSRF protection. Always active.
- Functional: Language preference, consent preferences. Active only with consent.
- Analytics: Veast's own first-party page analytics, which set no cookie and store nothing on your device. For each page view we record the page, the referring site, any campaign tags in the link you followed, and your screen width, together with a visitor key derived one-way from your IP address, a server-held secret and the date, so it cannot be traced back to you and changes every day. If you switch Analytics off in your cookie preferences, no page view of yours is recorded. No third-party analytics service is used.
- Marketing: Advertising attribution (not currently used). Active only with consent.
Your preference is stored in cookie veast_consent_v1 for 365 days. Change your preferences at any time via the link.
The website loads its fonts from Google Fonts, which receives your IP address. The iOS and Android apps do not use cookies. The web app at veast.life/app keeps your sign-in session and settings in your browser's storage, which it needs to work. Activity in the apps is recorded in our activity log (Section 2.9).
12. Email
We send service email, such as sign-in, security, account and subscription messages and the notifications you choose, through Resend. The app sends no marketing email.
If you join the waitlist on veast.life, we send you a welcome email, a short series of emails about Veast and its launch, and occasional announcements. Every email carries our name and address and an unsubscribe link that works in one click; unsubscribing takes effect at once and, in any case, within 10 business days.
13. Age Requirements and Members Under 18
Veast is for people aged 16 and over. We ask for your date of birth at sign-up, our servers refuse anyone under 16, and a date of birth can be set only once. We do not knowingly collect personal information from children under 13 or from anyone under 16. If we learn that we have, we delete it. Contact legal@veast.life if you believe someone under 16 has an account.
For members aged 16 and 17: practices that need supervision (such as long breath-holds, cold immersion and fasting) and Plane 13 stay hidden until 18, and our servers refuse them. In some countries 16- and 17-year-olds are children under the law, and Veast's defaults reflect that: your Veast Score and plane are private, leaderboards are opt-in, and location is never collected in the background.
14. Security and Breaches
We protect your information with technical and organisational measures, including:
- Encryption in transit (TLS) and at rest
- Row-level security in our database, so each account can reach only its own records and what others have chosen to share with it
- Two-factor authentication available to every member
- Device-integrity checks and connection-security checks in the app
- A security event log
No system is perfectly secure. We keep a record of every security breach involving personal information. If a breach creates a real risk of significant harm, or a risk to your rights and freedoms, we notify you and the regulators as the law requires, including, where the GDPR requires it, the supervisory authority within 72 hours of becoming aware of it.
15. Changes to This Policy
We will post any change here with a new "Last updated" date. We tell you about material changes in the app or by email before they take effect, and where the law requires your consent to a change, such as a new use of your health information, we will ask for it first.
16. Contact and Privacy Officer
Veast X LTD
Suite 250 - 997 Seymour St
Vancouver, BC V6B 3M1, Canada
Website: veast.life
Privacy Officer (the person in charge of the protection of personal information at Veast X LTD): legal@veast.life, subject "Privacy Rights Request". Security issues: security@veast.life. Account deletion: support@veast.life.