Privacy Policy
How we collect, use, keep and protect your information.
What we collect
Account data: your email, a hashed password and your display name — to create your account and sign you in.
Profile data, all of it optional: username, bio, photo, age, weight, height and sex. Used to calculate your targets, and to show your public profile if you publish recipes.
Tracking data: the meals, calories, macronutrients, workouts, supplements, water and weigh-ins you record, to show your history and progress.
Usage counter: the number of AI analyses per day, used solely to enforce the free-plan limit.
Safety data: any report you send about someone else's content, and any user you block. Reports are stored against your account id so we can spot repeat abuse — and the reported person is never told who reported them.
Food photos
When a photo is analysed, it is downscaled on your device and then sent to an AI analysis provider. We do not keep the photo after the analysis returns — only the numbers you accept and save.
Do not photograph anything you would not want processed by a third party.
Payment data
Subscriptions are handled by Apple through a subscription-management provider. We never see, receive or store your card details.
What is public and what is private
Everything you record is private to your account by default. Our database enforces this at the row level, so no account can read another account's data.
Public means only what you explicitly publish: shared recipes and foods, together with the username, display name and photo attached to them.
Who processes your data
We do not sell your data and do not share it with anyone for advertising.
Data passes only through technical providers: Supabase for the database and authentication, an AI provider for food analysis, and Apple with a subscription-management provider.
Deleting your account
You can permanently delete your account from the Profile page; your data is erased from our servers, including anything you published.
Deletion cannot be undone and we cannot restore the account afterwards. If you want a published recipe to outlive your account, it will not — deletion takes it with you.
Security
Data travels over encrypted HTTPS connections. Database access is governed by row-level policies that confine every read and write to the account that owns the data.