Privacy Policy

1. Who We Are

NutriText AI is developed and operated by APPCODE S.R.L., a company registered in Romania. Throughout this policy, "NutriText", "we", "us", or "our" refer to APPCODE S.R.L. We are the data controller for the personal data you provide to us.

If you have any questions about this policy, you can contact us at privacy@nutritextai.com.

2. What Data We Collect

We collect only the data necessary to provide and improve our service. This includes:

2.1 Information You Provide via OAuth

When you sign in using Google or Apple, we receive:

• Name — your display name from the provider
• Email address — used for your account identifier and communications
• Avatar image — a profile picture URL from the provider (you may replace this)

We do not offer email/password registration. Authentication is exclusively through Google and Apple OAuth.

2.2 Information You Provide Directly

• Recipes and food text — the recipe descriptions you type or paste for nutrition analysis
• Daily food logs — what you eat and when
• Workout logs — exercise descriptions and dates you record
• Weight history — body weight entries you log
• Body metrics — age, sex, height, weight, activity level, dietary preferences, and goals
• Nutri conversations — messages and completed replies in the Nutri assistant
• Ingredient corrections — if you correct AI-matched nutrition data, those corrections are stored
• Profile photo — optionally uploaded to our storage

2.3 Information Collected Automatically

• IP address and user agent — captured at session creation for security and analytics-free operations
• Session token — stored on your device via your OS-level encrypted storage (Keychain on iOS, EncryptedSharedPreferences on Android) to keep you signed in
• Unit preferences — weight unit, height unit, and nutrition display mode stored locally on your device

2.4 AI-Processed Data

When you submit a recipe, photo, or Nutri message, our AI services process the content to provide the feature you requested. For personalized Nutri questions, this may include relevant goals, food logs, weight progress, workout logs, preferences, saved recipes, and recent conversation context. We do not send your name, email address, or account identifier to the AI model as part of the prompt.

Before the first Nutri conversation, the app displays a feature-specific privacy notice and records the policy version and acceptance time. Nutri cannot process a new message without current consent.

3. How We Use Your Data

We use your data for the following purposes:

• To provide the service — analyze recipes, generate nutrition breakdowns, track food diaries, organize custom meal plans, suggest ingredient swaps, and answer Nutri conversations
• To personalize your experience — tailor goals and Nutri replies based on the relevant preferences, recipes, logs, and metrics you choose to provide
• To improve AI accuracy — crowd-sourced ingredient corrections help improve nutrition matching for all users (anonymized)
• To communicate with you — send service-related emails (e.g., account changes, subscription status) if needed
• To enforce rate limits — prevent abuse of the API

3.1 Legal Bases (GDPR)

If you are in the European Economic Area (EEA) or the United Kingdom, our legal bases for processing your data are:

• Consent — when you sign in and choose to use the app
• Contract performance — processing is necessary to perform the nutrition analysis and tracking services you request
• Legitimate interests — improving our AI models through anonymized corrections, and ensuring the security and integrity of our service

4. How We Share Your Data

We share your data only with the third-party services necessary to operate the app. We never sell your personal data.

4.1 Payment Processing

All payments are processed through Apple's App Store and Google Play. NutriText never receives or stores your payment card details. RevenueCat receives only your app-level user identifier and subscription status — not your financial information.

5. Cookies and Local Storage

We use a minimal set of cookies and local storage:

• Better Auth session cookie — a single HTTP cookie that is secure (HTTPS-only), httpOnly (inaccessible to JavaScript), and uses SameSite=Lax (CSRF protection). This cookie expires after 30 days of inactivity.
• expo-secure-store — on your mobile device, we store a session token and unit preferences using the OS-level encrypted storage (Apple Keychain / Android EncryptedSharedPreferences). This data never leaves your device except when the session token is used to authenticate API requests.

We do not use tracking cookies, analytics cookies, advertising cookies, or third-party tracking scripts of any kind.

6. Data Retention

We retain your data for as long as your account is active. Specifically:

• Account data (name, email, avatar) — retained until you delete your account
• Recipes, logs, goals, weight history — retained until you delete them or your account
• Completed Nutri conversations — retained for up to 30 days unless you clear the conversation or withdraw Nutri consent sooner; requests blocked by the safety guard and failed responses are not retained
• Nutri consent record — retained until you withdraw Nutri consent or delete your account
• Session data — retained for the life of the session (30 days) or until you sign out
• Ingredient corrections — retained in anonymized form even after account deletion to maintain nutrition reference accuracy
• LLM usage logs — retained for up to 90 days for operational monitoring and abuse prevention

When you delete your account, all personally identifiable data is permanently deleted from our database via cascading deletion. Anonymized, aggregated data (such as ingredient corrections without user identifiers) may be retained.

7. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

7.1 For All Users

• Access — you can view your profile, recipes, logs, goals, weight history, and retained Nutri conversation through the app
• Rectification — you can update your name, avatar, goals, and body metrics in the app settings
• Erasure (Deletion) — you can delete your account and all associated data through the app's Settings screen. This immediately and permanently removes your data from our database

7.2 Additional Rights for EEA/UK Users (GDPR)

• Data portability — you can request a copy of your data in a structured, machine-readable format by contacting us
• Restriction of processing — you can request that we limit how we use your data
• Objection — you can object to our processing of your data for legitimate interests
• Withdraw consent — you can withdraw Nutri consent from Settings → Nutri Privacy & AI; this clears the retained Nutri conversation and prevents new Nutri processing until you consent again. You can also withdraw all app consent by deleting your account

7.3 Additional Rights for California Users (CCPA)

• Right to know — you can request the categories and specific pieces of personal information we have collected about you
• Right to delete — you can request deletion of your personal information (handled through account deletion)
• Right to non-discrimination — we will not discriminate against you for exercising any of your CCPA rights
• Notice — we do not sell your personal information, nor do we share it for cross-context behavioral advertising

To exercise any of these rights, contact us at privacy@nutritextai.com or use the account deletion option in the app Settings.

8. International Data Transfers

Your data is processed and stored on servers located in the European Union (Hetzner, Finland/Germany). Our AI service providers (Google, OpenAI) may process submitted content and the feature-specific context described above in the United States and other jurisdictions where they operate. We omit direct account identifiers from AI prompts. When data is transferred outside the EEA, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• The provider's adherence to applicable data protection frameworks

9. Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit via TLS 1.2+ (HTTPS) for all communications
• Encryption at rest for database storage
• OS-level encrypted storage for session tokens on mobile devices (Keychain / EncryptedSharedPreferences)
• HTTP-only, Secure, SameSite cookies for session management
• Rate limiting on API endpoints to prevent abuse
• No storage of raw payment card information

10. Children's Privacy

NutriText is not directed at children below the applicable digital-consent age (13 in many jurisdictions and 16 in parts of the EEA). A parent or legal guardian must review and accept the Terms and the Nutri privacy notice where local law requires it. If you believe a child has provided personal data without the required authorization, contact us at privacy@nutritextai.com and we will delete it.

11. Changes to This Policy

We may update this privacy policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. If we make material changes, we will notify you through the app or by email.

12. Contact

If you have any questions, concerns, or requests regarding this privacy policy or your data, please contact us:

• Email: privacy@nutritextai.com
• Account deletion: available in the NutriText app under Settings → Delete Account

APPCODE S.R.L.
Romania
Email: privacy@nutritextai.com