Privacy Policy
Last updated
VitalStep (vitalstep.pro) is operated by MyGPT Software Joint Stock Company (MyGPT Jsc), Vietnam (tax ID 0110643733), "we" or "us". This policy explains what information the app uses, why, who else processes it and the choices you have. We wrote it to match what the app actually does today.
The short version
- You can use VitalStep without an account, a name or an email address.
- Most of your data (plans, workout history) stays in your own browser. It is copied to our server only if you use Premium cloud backup.
- Most plans come from our library of ready-made plans, matched to the answers you give. Your answers are not stored with your device or identity. Only when no ready-made plan fits are they sent to OpenAI to write one (without your name, email or device ID).
- Your messages to the AI coach are sent to OpenAI to generate the reply.
- Payments are handled by PayPal. We never see your card or bank details.
- Analytics (Google Analytics) runs only if you accept it.
- We do not sell your data and we do not use it for advertising.
Information we use
| What | Why | Where it is kept |
|---|---|---|
| Device identifier: a random ID and a random token created in your browser and stored there | To recognise your device without an account, keep your free or Premium status, link a second device, and prevent abuse | Your browser and our server |
| Health and fitness details you enter: health conditions, goals, age range, gender, activity level, and your BMI (calculated in your browser; your height and weight stay in your browser) | To find a matching ready-made plan or, if none fits, generate one | Your browser. Sent to our server to look up a ready-made plan; not saved with your device or identity. Sent to OpenAI only when no ready-made plan fits. A newly written plan is added to the library together with the profile it was written for (age range, gender, BMI, activity level, conditions, goals), never with who asked |
| Messages to the AI coach and workout feedback | To answer you and adjust your plan | Your browser. Sent to our server and to OpenAI to produce the reply |
| Plans and workout history | To run your workouts and show progress | Your browser. On our server only if you use Premium cloud backup |
| Plans you choose to share with the community | To publish them on the Community Plans page | Our server; visible to everyone |
| Subscription details: PayPal subscription ID, PayPal payer ID, the email address of your PayPal account, plan, status and dates | To activate Premium, keep it in sync with PayPal and help you restore a purchase | Our server |
| Email address, only if you enter one to link devices | To link or move your account between devices | Our server |
| Workout reminders: your browser's push-notification address and reminder schedule | To send the reminders you asked for | Our server, until you turn reminders off |
| Technical data: time zone, last visit, and server logs (IP address, browser type, pages requested). With your device identifier we also keep how you first arrived (referring site, campaign source, and the kind of first page), your browser type and language, and simple counts of visits and of key actions (plans created, workouts finished, shares). These counts never include your health conditions or plan contents. | To run the service securely, apply fair-use limits, fix problems, and understand which channels bring people who find VitalStep useful | Our server; logs are kept for a short period |
Health information is sensitive. Where the law requires a legal basis for processing it (for example the EU/UK GDPR), we rely on your explicit consent, which you give by entering it to build a plan. You can withdraw it at any time by deleting your plans and asking us to delete any server copy (see "Your rights"). For other data we rely on performing the service you requested, our legitimate interest in keeping the service secure, and, for analytics, your consent.
Who else processes your data
- OpenAI (USA): generates workout plans and AI coach replies from the details you send. OpenAI states that data sent through its API is not used to train its models by default.
- PayPal: processes payments and subscriptions under its own privacy statement.
- Google Analytics (Google): usage statistics, only after you accept analytics.
- YouTube (Google): workout videos are played from YouTube, which may set its own cookies when a video loads.
- WeatherAPI.com: your browser asks it for local weather using your approximate location from your IP address, or the city you choose.
- Browser push services (such as Google or Apple) deliver reminders if you turn them on.
- Internet radio stations: if you play workout music, the stream is loaded directly from the station.
Some of these providers are outside your country, including in the United States. Where required, transfers rely on the providers' standard contractual safeguards. We share data with authorities only when the law requires it.
Cookies and similar storage
VitalStep stores your plans, history, settings and device token in your browser's local storage. This is needed for the app to work. Google Analytics cookies are set only if you click "Accept" on the analytics notice. You can change your choice at any time:
How long we keep data
- Data in your browser stays until you delete it or clear your browser data.
- Account, subscription and backup data on our server is kept while you use VitalStep, and deleted on request. Records needed for accounting or legal obligations (such as payment records) may be kept for as long as the law requires.
- Server logs are kept only as long as needed for security and troubleshooting.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict processing, and to withdraw consent. To make a request, email thaitq@mygpt.vn. Because we do not use accounts, we may ask for details that let us find your data (for example your PayPal email or the email you used to link devices). You can also complain to your local data protection authority.
California residents: we do not sell or share personal information for cross-context behavioral advertising.
Security
Data is sent over HTTPS, and access to our server is restricted. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security, but we work to protect your information and will notify you where the law requires.
Children
VitalStep is intended for adults aged 18 and over. We do not knowingly collect data from children.
Not medical advice
VitalStep provides general exercise guidance and is not a medical service. See our Terms of Use.
Changes
We will update this page when our practices change and adjust the date above. Significant changes will be highlighted in the app.
Contact
MyGPT Software Joint Stock Company (MyGPT Jsc)
Room 501, 5th Floor, No. 4, Lane 38 Yen Lang Street, Dong Da Ward, Hanoi, Vietnam
Email: thaitq@mygpt.vn