Prova — GLP-1 tracker. Last updated 29 September 2026. This version applies from Prova 1.0.3.
Prova has no servers and no accounts. Everything you write stays on your iPhone. Two things leave it, and neither is about your health: anonymous usage information — which screens and buttons get used — and the fact that the app was installed, so we know which advertisement brought you here. You can switch the first off in one tap, and iOS asks your permission before the second reads any identifier. This policy explains all of it in detail.
Prova is published by Nikola Posarac, an individual established in the European Union, acting as the data controller within the meaning of the General Data Protection Regulation (EU) 2016/679.
Contact: nikola@pareto-labs.com
Prova has no account. It never asks for your name, your email address, your phone number, or a password. There is nothing to sign in to, because there is nothing on the other side.
Everything you enter is written to a database inside the app's own storage on your iPhone:
This database and these photos live in the app's container on your device. A small part of it — your next dose date, whether today's pill has been taken, the sentence of the day, and whether a subscription is active — is also copied into a storage area shared with Prova's own widgets, so that a widget can draw without opening the app. That area is on your device too, it is reachable by nothing but Prova, and nothing is copied into it that a widget does not display. They are covered by your iPhone's own encryption, and they are included in your device backups if you have backups turned on — that backup is between you and Apple, and Prova plays no part in it.
Prova does not use iCloud. Nothing you record is synchronised to any cloud service by the app, and your data does not move from one device to another.
Required disclosure of the specific health data read from the device: if you allow it, Prova reads your body weight from Apple Health, so that weights recorded elsewhere can appear alongside the ones you enter here.
If you take a progress photo, the image is saved on your iPhone, in the app's own storage. It is never uploaded.
Prova looks for a face in the photo so it can cover it. That detection runs entirely on your iPhone, using Apple's on-device Vision framework. The image is not sent anywhere to be analysed, and no face data is stored or transmitted.
If you allow notifications, Prova schedules them locally on your iPhone. No server sends them. These are the only ones:
No notification ever names your medication or your dose. Dose and trial reminders always go out; the others are held back so that no more than two notifications arrive in a day, three with Prova+.
If you press and hold a dose reminder, iOS shows two buttons. “Mark as taken” records the dose on your iPhone without opening the app, and iOS asks for Face ID or your passcode first. “Remind me in 1 hour” schedules the same reminder again, on your iPhone.
Subscriptions are purchased through Apple's In-App Purchase. Apple handles the payment. Prova never sees and never stores your card, your Apple Account, your name or your billing address.
What the app receives from Apple is whether a subscription is currently active and whether a free trial is running. That answer is read from Apple each time the app opens; it is not stored as a profile and is not linked to anything about you.
Apple's own handling of your purchase is governed by Apple's Privacy Policy.
Prova can compose a milestone image, a before/after image, and a one-page PDF report for your doctor. In every case the file is built on your iPhone and handed to the standard iOS share sheet. Prova does not publish or upload anything. Where the file goes next is your choice, made in Apple's sheet, and what happens to it afterwards is governed by whatever app or service you chose.
On any shareable image, your face is covered by default and your absolute weight is switched off by default. You have to turn them on yourself.
The support button prepares an email addressed to nikola@pareto-labs.com, with the subject you chose from a short list. The message carries the app version and your iPhone model, and nothing else — no health data of any kind. The email is not sent by the app: it opens in your mail app, and you send it. Whatever you then write in it, you have written yourself.
Starting with version 1.0.1, Prova uses PostHog, an analytics service run by PostHog, Inc., to understand how the app is used — for example, how many people finish the setup, open the subscription screen, or use a reminder button. This is what helps a one-person app decide what to fix next.
What is sent:
What is never sent: your weight, your doses, your medication, whether you take a shot or a pill, your side effects, your measurements, your photos, your notes, or anything read from Apple Health. PostHog is set up to discard your IP address, and no location is derived from it.
When this is on, the app also asks PostHog for its own settings each time it starts. That request carries nothing about you — no identifier, no health data — and is only how the service tells the app how to behave.
You can switch this off at any time in Settings, under “Share anonymous usage data”. Once it is off, no usage information is sent at all. The install attribution described in the next section is separate, happens once, and carries nothing you have recorded.
This information is used only to improve Prova. It is not sold, not used for advertising, and not combined with data from other companies. PostHog processes it on our behalf, under its own privacy policy.
Prova is advertised on the App Store and on social platforms. To know which advertisement led to an install — and nothing more than that — the app uses two mechanisms.
1. Apple's SKAdNetwork. When you first open Prova, the app tells Apple that an install happened. Apple, not Prova, forwards a signed and anonymised notice to the advertising network that showed you the ad. No identifier of yours is sent, and Prova receives nothing back. This happens whatever you answer to the question below.
2. The Meta SDK. Prova includes Meta's software development kit, used for one purpose: attributing installs to the advertisements we run on Facebook and Instagram. It sends Meta two system events — that the app was installed, and that it was opened. It sends nothing from inside the app.
Before any of this begins, iOS asks you: “Allow Prova to track your activity across other companies' apps and websites?” Prova shows you a short screen explaining why, then iOS asks. Nothing is initialised until you have answered.
You can change your answer whenever you want, in Settings › Privacy & Security › Tracking. The app keeps working exactly the same either way — nothing is locked, nothing is degraded.
None of this carries anything you record in Prova. Not a weight, not a dose, not a medication, not a side effect, not a measurement, not a photo, not a note, and nothing read from Apple Health. Those stay in the app's own storage on your iPhone, as described above. Meta receives that an install happened; it never learns that you take a GLP-1.
Your health data is never shared, never sold, never used for profiling, and there is no automated decision-making.
You have the right of access, rectification, erasure, restriction, portability, and objection. In practice, you exercise them directly on your device: your health data is in your hands, we hold no copy, and there is nothing for us to look up, correct, export or delete on your behalf. Anonymous usage information is processed on the basis of our legitimate interest in improving the app; you can object at any time by switching it off in Settings. Everything else relies on your consent, which you give through iOS permission prompts and withdraw in iOS Settings at any time.
You may nevertheless write to nikola@pareto-labs.com with any question, and you have the right to lodge a complaint with your national data protection authority.
Prova is not intended for children under 13, and is not directed at them. It knowingly collects nothing from children.
If Prova ever gains a feature that changes any of this — cloud synchronisation, for instance — this page will be updated before that feature ships, and the date at the top will change.