Privacy Policy for Nourish Nutrition Tracker

Effective Date: January 1, 2025
Last Updated: September 5, 2026

Introduction

Nourish Nutrition Tracker ("we," "our," or "us") is committed to protecting your privacy through a privacy-by-design approach. This Privacy Policy explains our data practices when you use our mobile application ("App"). Simply put: we do not run accounts or servers that hold your health data. Your food logs, recipes, weight, and nutrition data are stored on your device and, when iCloud sync is on (the default), in your personal iCloud account. We collect minimal technical data (anonymous device tokens for API security) as described below. Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access the App.

Information We Collect

Personal Health Data - Stored Locally

Important: We do not collect or have access to your personal health information. All nutrition data you enter into the app (food logs, recipes, weight, goals) remains on your device and, when iCloud sync is enabled, syncs privately to your personal iCloud account.

Data You Store Locally

The following information is stored locally on your device and optionally synced to your personal iCloud account:

• Profile Information: Username, age, gender, height, weight, and activity level
• Health Goals: Daily calorie targets, macronutrient goals (protein, carbohydrates, fat)
• Nutrition Data: Food items logged, meal information, serving sizes, and nutritional intake
• Health Metrics: Water intake logs, weight tracking data, and progress measurements
• App Preferences: Theme settings, notification preferences, and sync settings

Anonymous Usage Analytics

We use TelemetryDeck, a privacy-focused analytics service, to collect anonymous usage data. This helps us understand how features are used and improve the app. This data:

• Contains no personal information, user IDs, or device identifiers
• Cannot be traced back to individual users
• Does not include any of your food logs, nutrition data, or health information
• Is aggregated and used only for product improvement
• Is GDPR compliant and does not require consent

Examples of anonymous data collected: feature usage counts (e.g., "barcode scan used"), app launch counts, and general performance metrics. We never collect what you eat, your goals, or any personal health data.

Camera Access

Our App may request access to:

• Camera: For barcode scanning, AI-powered food recognition, and taking profile photos

Note on Photo Selection: When selecting photos from your library (for AI food analysis or profile photos), we use Apple's modern photo picker which does not require access to your full photo library. You select specific photos to share, and we never see your other photos.

HealthKit Integration

If you enable HealthKit sync, the App can read and write health data:

• Read: Weight, body fat percentage, active energy burned, and water intake from Apple Health
• Write: Nutrition data (calories, protein, carbs, fat), weight, and water intake to Apple Health

HealthKit data stays within Apple's secure health ecosystem. We do not transmit HealthKit data to our servers. You can enable or disable specific sync options in the app settings.

Device Authentication

To secure our API and prevent abuse, we use Apple's App Attest to verify your device. This creates an anonymous device token that:

• Is not linked to your name, email, or Apple ID
• Cannot identify you personally
• Automatically expires after 90 days of inactivity
• Is stored securely on our servers (Upstash Redis)

This protects all users by ensuring only legitimate app installations can access our services.

AI Food Recognition

When you use the AI food recognition feature, your food photos are:

• Analyzed on-device when possible: When your device and app version support Apple Intelligence with image understanding (iOS 27 or later), photo analysis runs entirely on your device using Apple's on-device models and the photo is not sent anywhere
• Otherwise processed securely in the cloud: If on-device analysis isn't available, your photo is sent to our secure API server, which forwards it through Cloudflare AI Gateway to a third-party AI model (currently OpenAI) for food identification. We disable request logging at the gateway so photo content is not retained in those logs
• Not stored on our servers: Cloud-processed photos are handled transiently and are not retained by us after analysis
• Stored locally: Food photos you log are saved only on your device (and your iCloud if sync is enabled)
• Never shared: Your food photos are never sold, used for advertising, or shared with anyone other than the AI provider described above

Note: Voice and text meal descriptions are parsed entirely on your device (using Apple Intelligence, or Apple's NaturalLanguage framework as a fallback) and are never sent to a server. When a photo is processed in the cloud, the AI provider handles it according to its own API privacy policy, which does not use API data to train its models.

How Your Data is Used

Since we don't collect your data, we cannot and do not use your personal information. Your data is used only by the app on your device for:

Local App Functionality

• Calculate personalized calorie and macronutrient goals on your device
• Track and analyze your nutrition intake and progress locally
• Provide personalized health insights using local calculations
• Sync your data to your personal iCloud account (if you enable this feature)

What We Don't Do

• We do not analyze your personal health or nutrition data
• We do not send personalized communications based on your data
• We do not profile users or create analytics from personal information
• We do not sell or share your data with advertisers
• App updates and support are provided without accessing your personal data

Data Storage and Sync

Local Storage

• All your nutrition and health data is primarily stored locally on your device
• Data is encrypted and secured using industry-standard methods
• No personal data is transmitted to external servers for storage

iCloud Sync (Optional)

• iCloud sync is on automatically when you're signed in to iCloud with iCloud Drive enabled for Nourish; your nutrition data (food logs, recipes, goals, and progress) syncs to your personal iCloud account so it is available across your own devices
• We use Apple's CloudKit framework for secure, encrypted synchronization
• Only you can access your synced data through your Apple ID
• We cannot access your iCloud data - it remains under your control

Information Sharing and Disclosure

We do not and cannot share your personal information because we do not have access to it.

No Data Sharing

• We do not collect, store, or have access to your personal data
• We cannot share what we do not possess
• Your data remains exclusively under your control

Apple iCloud (Optional)

• iCloud sync is on when you're signed in to iCloud with iCloud Drive enabled for Nourish, and your data is stored in your personal Apple iCloud account
• This is governed by Apple's privacy policy, not ours
• We have no access to your iCloud data - it belongs entirely to you
• You can turn off iCloud sync at any time in iOS Settings → [your name] → iCloud → Saved to iCloud → Nourish

Third-Party AI Providers

• When your device supports on-device analysis (iOS 27 or later with Apple Intelligence, including image understanding), analysis happens on-device and never reaches a third party
• Otherwise, food photos are sent through Cloudflare AI Gateway to a third-party AI model (currently OpenAI) for analysis
• Food photos sent to the cloud are processed transiently and are not stored by us
• We disable request logging in Cloudflare AI Gateway so photo content is not retained in gateway logs
• The AI provider processes images according to its own API privacy policy and does not use API data to train its models

Food Database Providers

• Food search and barcode lookups are sent from your device to our server, which queries USDA FoodData Central and Open Food Facts on your behalf
• We cache search results (food names and nutrition data, not personal data) for up to 7 days in Upstash Redis to speed up repeated lookups

Analytics Provider

• We use TelemetryDeck, a privacy-focused analytics service based in the EU
• TelemetryDeck is GDPR compliant and collects no personal data
• No cookies, no user tracking, no personal identifiers are used

Your Privacy Rights and Choices

Access and Control

• View Data: Access all your personal data through the app's profile and settings sections
• Edit Information: Update your profile, goals, and preferences at any time
• Delete Data: Remove individual entries or clear all app data. See our data deletion guide for complete instructions.
• Export Data: View and export your nutrition logs and progress data

Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: nourish@navbytes.io
Subject Line: "Privacy Policy Inquiry - Nourish App"

Response Time: We will respond to privacy inquiries within 30 days of receipt.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of any material changes by posting the updated Privacy Policy within the App and updating the "Last Updated" date at the top of this policy.