Privacy Policy

Last updated 16 October 2026

This English text is the authoritative version of this policy.

This app photographs your meals and estimates what is in them. That means a picture of your food leaves your phone. This page explains exactly what leaves, where it goes, how long it stays, and what never leaves at all.

The app is published by Soufiane Chalouh and Ali Chalouh (“we”), individual developers, who are the joint controllers of the data described below. You can reach us at soufianechalouh@gmail.com.

There is no account

We never ask for your name, your email address, or a password, and there is nothing to sign in to. We do not know who you are.

What identifies your phone to us is the identifier iOS gives us for it (Apple calls it the identifier for vendor). It is specific to this app on this device, it is not your advertising identifier, and it is regenerated if you delete the app and install it again — which is to say, deleting the app severs the link between you and everything below.

What never leaves your phone

All of this is stored only on the device, and is deleted with the app:

• Your onboarding answers — age, sex, height, weight, activity level and goal — and the daily calorie target calculated from them.
• Your food diary: every meal you log, its calories and macronutrients.
• Your weight log and your goal weight.
• The small thumbnail kept beside each logged meal.
• Your unit and numeral preferences.

We have no copy of any of it. There is no cloud backup and no sync. If your phone's own iCloud backup is on, Apple backs this data up under Apple's privacy policy, not ours.

What leaves your phone

The photograph of your meal

When you scan a meal, the photograph is uploaded to our storage — a private bucket, not readable by anyone else — and sent to Anthropic, whose model identifies the food in it. Anthropic processes it to answer that one request and does not use it to train models. See Anthropic's privacy policy.

We delete the photograph within 30 days. It is kept that long for one reason: when you correct a wrong estimate, someone reviews the correction, and that review is meaningless without being able to see what the camera saw. Past a month it has no further use, and it is removed automatically.

The result of the scan

We keep the outcome — the dishes identified, the estimated portion sizes and calories, and any correction you made — attached to the device identifier. This is what makes the app get better: every correction points at either a wrong entry in our dish database or a weakness in the prompt, and both get fixed for everyone. It contains no photograph and nothing that identifies you.

Abuse prevention

To stop the scanner being flooded with requests, each scan attempt is logged with the device identifier and a scrambled form of the IP address it came from. We never store the IP address itself: it is passed through a one-way function keyed with a secret only our server holds, so the stored value cannot be turned back into an address. This log is used only to limit how many scans can be made in a short time, and is deleted after at most 2 days.

Analytics

We record a small, fixed list of product events through PostHog, hosted in the European Union. The complete list is: which onboarding step you reached, that onboarding finished, that the paywall was shown, that a trial or purchase started or failed and which product and price, that your first scan completed, that you corrected a scan, and that you came back on a given day. These events are recorded against the device identifier described above.

That is all of it. We do not send your meals, your photographs, your weight, your onboarding answers, the calorie target calculated from them, or your diary to any analytics service.

Advertising attribution

We buy ads, and we need to know which ones work. So AppsFlyer and TikTok always receive the fact that you installed the app, how far you got through onboarding and the paywall, whether you started a trial or subscribed and at what price, and that you came back on a given day — together with the device identifier described above and the technical details any internet connection carries, such as your IP address, device model and iOS version.

Your device's advertising identifier (IDFA) is added if — and only if — you allow tracking when iOS asks. If you decline, no advertising identifier is collected. Either way, neither company receives anything about your meals, your photographs, your weight or your onboarding answers. Apple's own SKAdNetwork also reports ad results to us, in aggregate and in a form that cannot identify you.

If TikTok's software component inside the app itself fails, it may send TikTok a report about that failure.

Purchases

Subscriptions are processed by Apple. We never see your payment details. RevenueCat handles the receipt on our behalf and tells us that a subscription started, renewed or lapsed, and at what price. Because renewals happen on Apple's servers rather than in the app, RevenueCat also passes those same events to AppsFlyer and TikTok, with the identifiers described above (the advertising identifier only if you allowed tracking), so that a renewal can be credited to the ad that led to the install.

Apple Health

If you grant permission, the app reads your body mass from Health so your calorie target stays accurate, and writes the meals you log — energy, protein, carbohydrate, fat and fibre — plus any weight you enter, so your nutrition data lives in one place.

Health data is read and written on your device only. It is never uploaded to us, never shared with any third party, and never used for advertising or marketing. You can revoke either permission at any time in the Health app, and the rest of the app carries on working without it.

How long we keep things

Where your data is processed

Our storage and database are hosted in Ireland, in the European Union, and so are analytics. Anthropic, RevenueCat, AppsFlyer and TikTok process data in the regions described in their own policies, which may include the United States.

If you are in the European Economic Area, this means the data described above that reaches those providers may leave it. We rely on the European Commission's standard contractual clauses for those transfers, and on the fact that what is transferred carries no name, no email address and no account — only a device identifier that is regenerated when you delete the app.

Your rights

Depending on where you live — including under the GDPR in the European Union and the Personal Data Protection Law in Saudi Arabia — you have the right to ask what we hold about you, to have it corrected, and to have it deleted.

Two things make this simpler than usual. Deleting the app stops all collection and breaks the link to everything above. And your photographs are already on a 30-day timer whether you ask or not.

To delete everything from inside the app: Settings → “Delete my data”. Once you confirm, we erase from our servers the meal photographs, scan results, corrections and dish suggestions tied to your device identifier, and unlink the identifier from the scan attempt log (which is deleted within 2 days regardless). The app then erases your diary, weight, water and fasting logs and targets from the phone, and starts using a new identifier. No email is needed. Anything already saved to Apple Health stays there for you to manage in the Health app, and subscription records are kept by RevenueCat and Apple for as long as our tax obligations require.

For anything else, email us at soufianechalouh@gmail.com and include the device identifier shown in Settings — without it we cannot tell your rows from anyone else's, because we hold no name or email address.

Children

This app is not intended for children. It is rated for users aged 17 and over, and we do not knowingly collect anything from anyone younger.

Changes

If this policy changes we will update the date at the top of this page. If a change is significant, we will say so in the app before it takes effect.