Privacy policy

The short version

• Without an account, your plan, diary, safety answers and body details stay on your device. We do not receive them. Water and movement stay there even with an account and sync.
• We use no analytics, advertising or tracking services. Cookies exist only for signing in.
• Food data reaches our server only if you explicitly switch on sync. If you end it, we delete the data.
• For the photo estimate, you send a photo to Alibaba. It may also be processed in China. This happens only with your consent and only for photos you send yourself. It's only available if you've also turned on sync.
• During a barcode scan the camera image stays on your device and only the digits reach us. Your device reads nutrition photos itself.

Controller

You can use this address for any question about data protection.

Visiting the site, hosting and Cloudflare

When you open the site, your browser sends technically necessary data: IP address, time, the address requested, browser and operating system. The site cannot be delivered without it. The app itself keeps no access logs with IP addresses. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to provide the site securely and reliably.

netcup

The app, the database (PostgreSQL) and the cache (Redis) run on servers of netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. netcup processes the data as our processor under Art. 28 GDPR.

Cloudflare

In front of our server sits the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare provides DNS and the encrypted connection, delivers the site and protects it from attacks. Cloudflare is our processor under Art. 28 GDPR.

Every request passes through Cloudflare. The encryption of your connection ends there, and Cloudflare encrypts again towards our server. Cloudflare can therefore technically see everything between your browser and us: IP address, approximate location, addresses requested including barcode digits, and the content of requests, such as your email address at sign-in, sync data and photos. The legal basis is Art. 6(1)(f) GDPR; our interest is protection from attacks and fast delivery.

Cloudflare runs a worldwide network and may also process data in the USA. For the USA, the European Commission's adequacy decision on the EU-US Data Privacy Framework applies (Implementing Decision (EU) 2023/1795), under which Cloudflare is certified. For other transfers, the contract provides for the EU Standard Contractual Clauses. See Cloudflare's privacy policy for more.

Cloudflare instructs your browser to send technical error reports to Cloudflare when a connection fails (Network Error Logging). Successful visits are not reported.

Data on your device

The app stores data in your browser's local storage (localStorage). This data stays there and does not reach us unless you use one of the functions described below. For reading nutrition photos, there is also an entry with counters for crashes and slow runs (ocr-device) and the browser cache ocr-v1 with the model files, about 28 MB. Neither contains anything from your photos.

In the settings under “Back up” you can save your data as a file. The file is created in your browser and never reaches us. It is not encrypted, and you decide where it goes. Your answers to the safety questions are not in it. A file you load also stays in your browser. If sync is on, loaded entries go to your account like all others.

What you choose under “Calm and display”, such as hidden numbers or a pause, is also stored only there. Sync does not send it.

If you choose a calorie deficit or a value for a single day, the app stores that only there too. Sync does not send it.

So that the app also starts without a network, a service worker on the app pages keeps the app's pages, program files and images in the browser cache (app-pages, app-static, app-images). They are the same for everyone and contain neither your entries nor our server's answers to your requests. For this, your browser asks our server for new versions when you open the app, as with any page visit. After your first entry, the app also asks the browser not to delete its data by itself (persistent storage). Whether it does so is the browser's own decision.

Storing this needs no consent under Section 25(2) No. 2 of the German TDDDG, because the app you are using cannot work without these entries.

The entries are not encrypted. Anyone using your device and browser can see them. You delete your plan, diary and device ID in the settings under “Back up” with “Delete all data”. Everything else, including the model files and the app's cache, you remove in your browser settings. We hold a copy only if you use sync.

Cookies

We set only two technically necessary cookies, both only when you sign in. That is why we need no cookie banner. The language is part of the address, not a cookie.

The legal basis is Section 25(2) No. 2 TDDDG. If Cloudflare classes a request as a possible attack, it may also set the security cookie __cf_bm, which expires after 30 minutes without activity.

Account and sign-in

An account is optional. You need one only for the photo estimate and sync. The legal basis is Art. 6(1)(b) GDPR, because we need the account to provide these functions.

We store your email address, the time the account was created and your sessions. We store neither an IP address nor a browser with a session.

Sign-in with an email code

You enter your email address and receive a six-digit code that is valid for 10 minutes. The code exists only as a hash in our database. The system removes expired entries, which may contain your email address, at a later sign-in with a code. To send it, we pass your email address and the code to our email service provider, which acts as a processor.

Sign-in with Google

If you choose “Sign in with Google”, your browser takes you to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. You sign in there, and Google learns that you use this service. Google is itself responsible for this, see Google's privacy policy. Google may transfer data to the USA and is certified under the EU-US Data Privacy Framework.

From Google we receive your email address, name, a link to your profile picture and your Google ID. We store these together with the access tokens Google issues at sign-in. We do not use them to fetch further data from Google.

Deleting your account

You delete your account in the settings under “Account and sync” with “Delete account”. This deletes your email address, sessions, Google link and all sync data. The data on your device stays.

Protection against abuse

To stop anyone overloading sign-in, sync or the photo estimate, we count requests. For this we store in Redis a hash calculated with a secret key (HMAC) of your account, IP address, email address or device ID together with a counter. If Redis cannot be reached, the server counts the same way in memory. The entry disappears by itself after its time window, which is between one minute and 24 hours. Such a hash is pseudonymous, not anonymous.

The sign-in system also keeps your IP address briefly in memory to limit attempts. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to prevent attacks, mass sending of codes and costs from abuse.

Optional sync

With sync you back up your data in your account and use it on several devices. It runs only if you switch it on for that device and give your consent. Right after your first sign-in we ask whether your data should live on the server or only on your device. Clicking the server button is your consent. If you decline, everything stays on the device, and you can change this later. The photo estimate is only available with sync. We decided this on purpose. If you decline sync, everything else keeps working, just not the photo estimate.

What reaches the server

• Plan: goal, ways, tracking level, eating window, number of protein portions
• Meals: name, time, origin of the entry, ranges for calories and protein, and for fat, carbohydrates and fibre if entered
• Fasts and ticked protein portions
• Results of your photo estimates, never the photos
• Markers for deleted entries, containing only an ID and a time

What stays on the device

Your answers to the safety questions and your age, sex, height, weight, activity and daily energy need do not go to the server.

Legal basis

Food data and plans can allow conclusions about your health and are then health data under Art. 9 GDPR. We therefore process them only with your explicit consent under Art. 6(1)(a) and Art. 9(2)(a) GDPR. The sole purpose is to back up your data and match it between your devices. The app works just the same without this consent, only without sync.

As proof, we store the version, time and language of your consent (Art. 7(1) GDPR). This record contains no content and stays until you delete your account. The legal basis for this is Art. 6(1)(f) GDPR; our interest is being able to prove that consent was given.

Protection

The transfer is encrypted. The data is not end-to-end encrypted, however, so our server can read it. We do not analyse it and use it for nothing but sync.

Withdrawal, export and deletion

• Withdrawal: In the settings under “Account and sync”, choose “End sync and delete server data”. That is also your withdrawal under Art. 7(3) GDPR. Processing up to that point remains lawful.
• Deletion: This deletes all sync data on the server. Sync switches off on your other devices at the next match. The data on your devices stays.
• Export: Beforehand, you can download everything as a JSON file under “Export server data”.
• Device only: “Delete all data” affects this device only. Server data stays until you delete it under sync.

Without withdrawal, we store sync data until you end sync or delete your account. There is currently no automatic deletion for inactive accounts.

Photo estimate via Alibaba

With an account, an AI model can estimate the calories and protein of a meal from a photo. The model (currently qwen3.8-flash) runs at Alibaba Cloud in the Model Studio service, a provider from the Chinese Alibaba group.

How it works

• Your device shrinks the photo to at most 1024 pixels and removes location and other metadata. Our server removes metadata once more as a precaution.
• You see the photo once more and send it yourself.
• Our server puts it in a queue in Redis. It stays there for at most 15 minutes and is deleted right after the estimate.
• Our server sends the photo and a fixed instruction to Alibaba. The result contains only the estimate and a hash of your account. It is valid in Redis for 10 minutes so that your device can fetch it. The most recent result may stay longer, until the next scan finishes. We do not store the photo permanently.

What we do not send

From us, Alibaba receives neither your name nor your email address, account ID, IP address, location or photo metadata. The photo itself can still reveal something about you. So show only your food, and no faces, addresses, receipts or documents.

Location and retention at Alibaba

We use the Frankfurt access point with the “Global” deployment scope. According to Alibaba, request data stays stored in the Frankfurt region, but the model may run outside the EU, possibly in China. According to its own policy, Alibaba keeps requests and responses for up to 30 days. Content flagged by the automatic safety filter may be kept for up to two years. Alibaba states that it does not use the data to train its models.

Legal basis and third country

Before your first photo, the app tells you about the provider, China and retention. By choosing “Got it, take a photo” and sending each photo, you consent under Art. 6(1)(a) GDPR and, where the photo allows conclusions about your health, under Art. 9(2)(a) GDPR.

There is no European Commission adequacy decision for China. No level of data protection comparable to the EU's applies there: state bodies may have wider access to data, and you may not be able to enforce your rights. Alibaba Cloud's contract terms provide for the EU Standard Contractual Clauses for transfers from the EU. We also base the transfer on your explicit consent under Art. 49(1)(a) GDPR.

You withdraw by no longer sending photos. You do not need photos to use the app: quick selection, barcode and manual entry work without Alibaba. We cannot retrieve a photo already sent to Alibaba.

Result

Your device stores the result. It reaches the server only with sync. The estimate is a suggestion for you to check, not an assessment of you. For the daily limit of 20 photos we count with a hash of your account, which disappears after 24 hours.

AI meal plan

With an account and sync, an AI model can suggest a weekly plan. It's the same Alibaba model as for the photo estimate. Your choices (diet, allergies, what you don't like, meals, cooking time, budget), your notes and your calorie range go to Alibaba without your name, account or IP address. This can also happen in China. By default Alibaba stores requests and answers for up to 30 days.

Allergies can count as health data, and “halal” and “kosher” can suggest your faith. We therefore only send them with your express consent, which you give before each plan (Art. 9(2)(a), Art. 49(1)(a) GDPR). Your answers to the safety questions aren't sent. With some answers the app doesn't offer a plan, your device checks this.

Our server stores neither your choices nor the plan. The plan only lives on your device, and sync doesn't transfer it. It's a suggestion from an AI, not dietary advice.

Barcode, nutrition photo and product data

Scanning a barcode

For a scan, your browser asks for the camera. Your device analyses the camera image itself; it does not reach us. If your browser has no barcode reader of its own, the app loads the necessary file from our server.

To find the product, the app sends the barcode digits to our server. We see your IP address and count the request as described under “Protection against abuse”. We do not link the lookup to your account and do not store who scanned what. The app does not write barcodes to logs. What you scan can reveal something about your diet. The legal basis is Art. 6(1)(b) GDPR, because you trigger the lookup yourself. If you log the product, it goes into your diary on your device without the barcode number. With sync, this entry reaches the server like any other meal.

Searching for food

When you search for a food, the app sends your search term to our server. The search only runs in our own database, none of it goes to Open Food Facts or the Max Rubner-Institut. We see your IP address and count the request as described under “Protection against misuse”. We don't link the search to your account and don't store search terms. They aren't in the address of the request either, and the app doesn't write them to logs. As with barcodes, the legal basis is Art. 6(1)(b) GDPR.

Asking Open Food Facts

Product data is held in our own database. It comes from the open data of Open Food Facts, 21 rue des Iles, 94100 Saint-Maur-des-Fossés, France. If we do not know a code, our server asks there. Open Food Facts receives only the barcode and our app's name, nothing about you. Your device does not talk to Open Food Facts. If a code stays unknown, we remember that for 24 hours as a hash of the barcode, with no link to you.

Nutrition photo

If you photograph a nutrition table, your device reads it itself. The photo goes neither to us nor to Alibaba. The app keeps it only in memory and discards it as soon as you close the form. If you use your device's camera or pick a file, the original stays in your own gallery. The app loads the necessary model files only after you agree, and only from our server; no third-party service is involved. Only what you check in the form and explicitly save for everyone reaches us.

Contributing and reporting products

You can save an unknown product for everyone or report wrong values. You need no account for this. We store the barcode, name, brand and nutrition values. These details are public and fall under the Open Database License. So do not enter personal data in the name or brand.

To detect duplicates and abuse, the app sends a random device ID. With a contribution we store a hash of this ID and a hash of your IP address, or of its /64 network for IPv6. With a report we store only the hash of the IP address. We delete both after 31 days at the latest. After that no link remains between the product and your device or connection. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a reliable product database that cannot be flooded. If you entered something personal by mistake, write to us and we will remove the contribution from the database and future downloads. The download file may be cached for up to 7 days, and we cannot reach copies already downloaded.

If you contact us

If you write or call, we process your details to deal with your request. The legal basis is Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR for questions about your account. We delete the message once it is dealt with and no legal retention duty applies.

Recipients at a glance

We do not sell data or pass it on for advertising. We give data to authorities only if the law requires it.

Retention at a glance

Where we make backups of the database, deleted data stays in them until the backup is overwritten.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). You can use many of these rights directly in the app. For anything else, an email to [email protected] is enough.

We do not know what is stored only on your device. We cannot give information about it, but you can delete it yourself.

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. We then stop processing the data, unless we can show compelling legitimate grounds or the processing serves legal claims.

Complaint to the supervisory authority

You can complain to any data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Duty to provide data and automated decisions

You are not obliged to give us data. Without an email address, however, there is no account and so neither photo estimate nor sync.

We do no profiling and make no automated decisions under Art. 22 GDPR. The safety rules check your answers on the device and hide ways accordingly. The service is for adults aged 18 and over.

Changes

If the app changes, we update this policy. The date at the top shows the current version. If sync changes significantly, we ask for your consent again.