Privacy

Privacy architecture

Your journal lives on your iPhone. Meals, check-ins, settings and patterns stay there, and there is no account to create.

Patterns are worked out on your iPhone from the days you record. When you ask for a meal estimate, the description or photo you submit is the one thing that leaves your device. It passes through a Cloudflare Worker, which keeps no application record, to OpenAI; Food & Fit does not save photos.

If you connect Apple Health, Food & Fit asks by category. RevenueCat handles purchases. Product analytics stay on your iPhone. A small per-installation record counts the free daily meal estimates.

Read the full privacy policy below.

Food & Fit is a nutrition journal for women with PCOS. It has no account system, does not show ads, and does not sell personal information. Your journal is stored on your device. The only journal content that leaves your device is a meal description or photo you submit for an AI estimate. This policy explains each flow.

The short version

Meals, daily check-ins, goals, patterns, and app settings are kept in Food & Fit’s on-device database.
When you request an AI meal estimate, your meal text or photo is sent through Cloudflare to OpenAI. That is the only journal content that leaves your device.
Patterns are calculated on your iPhone. Your history is not uploaded for analysis.
Optional Apple Health access is requested by category. Imported Health data stays on your device.
RevenueCat handles paywalls, entitlements, purchase status, Customer Center, and subscription analytics. Apple handles App Store billing.
Product-usage events are recorded on your device only. Food & Fit has no analytics server.
We do not use data for advertising or track you across other companies’ apps or websites.

Information kept on your device

Food & Fit stores the information needed to run the journal locally using Apple’s device storage frameworks:

food items, quantities, meal times, and calories, protein, fiber, carbohydrates, and fat;
your daily hunger, cravings, and energy ratings;
optional symptom tags and period-start/flow context;
current body weight used to calculate an editable general-nutrition protein starting goal;
if you turn on Track weight, the weights you log or import (one per day) and an optional weight reference you set;
optional medicine tags you add to a check-in;
optional height, shown in Personal details;
nutrition references, including an optional calorie reference, and app settings;
optional daily aggregates imported from Apple Health and their source/provenance;
the patterns Food & Fit calculates from those records; and
reminder and privacy preferences.

There is no Food & Fit account and no Food & Fit cloud sync. This information remains on the device until you edit or delete it, choose Delete all data, or delete the app.

AI meal estimates

When you deliberately submit a meal for an AI estimate:

Text estimate: we send the meal description you entered, along with locale, unit, and time-zone context.
Photo estimate: we send the meal photo, any meal context you entered, and locale, unit, and time-zone context.
Response: OpenAI returns estimated food items, quantities, calories, protein, fiber, carbohydrates, and fat. You can edit the estimate before or after saving it.

Your time zone is sent only so the free daily estimate allowance is counted against your own calendar day. It is a zone name such as Europe/Bucharest, not a location.

The request first passes through a Cloudflare Worker operated for Food & Fit, which validates the request and forwards it to OpenAI. The Worker processes the body in memory and does not create an application record of the text, photo, or result. Request-body logging is disabled. Photos are not saved by Food & Fit.

Pseudonymous installation state accompanies protected requests so the Worker can apply the free allowance. The app also sends App Attest headers; verifying them, and so confirming a genuine app installation and preventing replay, is built but not yet switched on. This is not your name, email address, Apple ID, or advertising identifier.

App API and operational metadata

Every app request to the Cloudflare Worker necessarily exposes network and delivery metadata to Cloudflare, including IP address, request time, route, and network/security headers. Food & Fit keeps no per-request log. When a request fails unexpectedly, the Worker logs the error type and message, never the request body, photo, or estimate; Cloudflare keeps these error logs for up to 7 days. Cloudflare may separately process network/security metadata under its service terms to deliver and protect the service.

Patterns are calculated on your iPhone

Food & Fit looks for relationships between what you logged and how you rated your days. All of that calculation happens on your device, using only records already stored there. Your journal history is not uploaded for analysis, and no pattern, question, or experiment result is sent anywhere.

Food & Fit does not offer AI explanations of your patterns. If we build that, we will update this policy, the App Store privacy disclosures, and add a clear in-app consent step before anything can be sent, and it will be off until you turn it on.

OpenAI retention: current default and Zero Data Retention

OpenAI says API data is not used to train its models by default unless the customer opts in. Food & Fit does not opt in to training.

Food & Fit currently uses OpenAI’s default API data controls, not a verified Zero Data Retention configuration. Under those default controls, prompts and responses (your meal description or photo and its estimate) may be included in OpenAI abuse-monitoring logs for up to 30 days. OpenAI says longer retention may occur where required by law or reasonably necessary for safety. Food & Fit requests no application-state storage, but that does not remove the default abuse-monitoring period.

OpenAI offers Zero Data Retention only to eligible customers after approval. We will not claim zero retention unless it has been approved and verified for the exact production project, endpoint, and models Food & Fit uses. If that happens, we will update this policy. Until then, assume the default period above. See OpenAI’s official API data-controls documentation.

Apple Health

Connecting Apple Health is optional and off by default. Food & Fit asks just in time and by category. If you allow it, Food & Fit may:

read your latest weight and height once, during setup, to suggest a protein reference and fill Personal details;
read daily weights for the last 90 days, only if you turn on Track weight and choose to import them;
read daily aggregates for dietary energy, protein, fiber, carbohydrates, total fat, sleep duration, and menstrual flow; and
write confirmed Food & Fit nutrition to HealthKit.

Food & Fit stores daily aggregates and provenance locally rather than keeping a permanent copy of every raw Health sample. It does not request glucose, basal temperature, ovulation, cervical mucus, activity, or unrelated Health types.

Apple provides separate permission controls for each Health type. You can change them in the Health app or iOS Settings. Revoking permission stops future access but does not automatically delete daily aggregates already imported into Food & Fit or nutrition samples already written to HealthKit.

Health data imported into Food & Fit stays on your device. It is not sent to Food & Fit’s Worker, OpenAI, RevenueCat, or any analytics service, and it is never used for advertising or subscription decisions. Apple describes HealthKit’s fine-grained authorization and device encryption in its HealthKit privacy guidance.

Any iCloud synchronization of the Health store is controlled by your Apple/iCloud settings and Apple’s terms, not by Food & Fit.

Subscriptions and purchases

Food & Fit uses RevenueCat as its commercial platform and Apple for App Store billing.

RevenueCat receives a pseudonymous App User ID, app/device technical information, App Store receipt and transaction/purchase history, Offerings and paywall activity, experiment assignment, entitlement status, Customer Center activity, and subscription analytics. Food & Fit does not send RevenueCat your name, email address, advertising identifier, meals, check-ins, symptoms, cycle context, body measurements, nutrient values, insight text, or Health data.

The Cloudflare Worker receives RevenueCat’s signed purchase/entitlement webhooks. It stores only the minimum pseudonymous entitlement snapshot, expiry/product status, and bounded webhook deduplication data needed to enforce Premium access. It does not store a subscriber profile or journal. RevenueCat remains the source of truth.

Apple processes payment and may provide transaction information to RevenueCat and Food & Fit. Neither Food & Fit nor RevenueCat receives your payment-card number from Apple. RevenueCat documents its use of anonymous App User IDs and purchase history in its customer identification and Apple App Privacy guidance.

Apple may also provide Food & Fit with aggregate App Store analytics and crash/diagnostic reports if you have chosen to share diagnostics with developers. These reports are governed by your Apple settings and Apple’s privacy terms; Food & Fit does not join them to journal content.

Public website

The public site is a static site hosted on Cloudflare Pages. When you visit it, Cloudflare necessarily processes standard web-request data such as your IP address, requested URL, time, browser/user-agent headers, and security/network metadata to deliver and protect the site. Food & Fit does not place advertising pixels, session replay, third-party embeds, or browser analytics on the site, and the target site sets no cookies. Do not put meal, symptom, cycle, Health, or other sensitive information in a URL or support link.

Product analytics

Food & Fit records a small set of coarse usage events on your device only: onboarding completed, a meal estimate started or finished, a first meal saved, a check-in saved, a paywall viewed, and a purchase started or completed. They are written to the system log on your iPhone. Food & Fit operates no analytics service and no event-collection endpoint, so none of them are transmitted.

If we ever add one, no event will contain meal text, meal photos, food names, symptoms, cycle dates, body measurements, nutrient values, pattern text, Health data, contact information, or automatic recordings of taps and screens, and this policy will be updated before collection begins. RevenueCat separately provides subscription analytics from the commercial data described above.

Security and minimum server state

Food & Fit uses encrypted HTTPS connections. One small Durable Object per app installation atomically stores only:

last activity time and an expiry alarm, plus the App Attest public key, counter, and replay-protection state once verification is switched on;
the current local-day AI estimate allowance count; and
the pseudonymous RevenueCat entitlement snapshot and webhook state.

This state never contains journal entries, nutrition values, check-ins, symptoms, period context, Health data, photos, pattern text, notes, body measurements, or contact details.

No security method can guarantee absolute protection, but we limit collection and separate journal content from operational state to reduce exposure.

Widgets

Home Screen and Lock Screen widgets read a minimal current-day summary from an Apple App Group on your device. Depending on widget size, it can contain protein/fiber progress, calories, carbohydrates, fat, meal count, update time, and a privacy-mode setting. It contains no meal names, pattern text, symptoms, cycle information, Health samples, or history.

Privacy mode hides numbers. Widget actions open the app’s Log Meal or Check In flow. Widgets do not make network requests or send analytics themselves. Food & Fit does not use a Live Activity.

Contact and support

Choosing Contact Us opens Apple’s mail composer with only our recipient address, your Food & Fit app version, and build number prefilled. It does not attach journal data, logs, identifiers, or Health data. You decide whether to send the message and what to add. Your message is then processed by your chosen email provider and ours under their own terms.

Support messages are used to answer the request and kept only as long as reasonably needed for support, security, or legal obligations. You can ask us to delete a support conversation unless we must keep it by law.

Retention summary

Company/location	Information	Retention
Your device / Food & Fit	Journal, check-ins, settings, imported daily Health aggregates, patterns, usage events	Until you delete records, choose Delete all data, or remove the app
Cloudflare Worker and network edge	Request body in memory; IP/network metadata for delivery/security; content-free error logs	Body has no Food & Fit application record; unexpected-error logs expire after 7 days; Cloudflare service/security retention applies to its network metadata
Cloudflare Pages	Standard web request and security metadata	Under Cloudflare’s service/security retention; no Food & Fit browser profile, cookies, or health-topic reading profile
Cloudflare Durable Object	Pseudonymous integrity, allowance, entitlement, and webhook state only	Automatically 180 days after the last authenticated API activity
OpenAI	Meal estimate prompts/responses and related abuse-monitoring data	Up to 30 days by default, subject to OpenAI’s stated legal/safety exceptions; Zero Data Retention is not currently verified for Food & Fit
RevenueCat	Pseudonymous purchase, entitlement, paywall/experiment, Customer Center, and subscription analytics data	Under RevenueCat’s processor terms and legal obligations; deletable where applicable by privacy request, subject to required purchase/legal records
Apple Health / App Store	Authorized Health samples and App Store purchase records	Controlled by Apple and your settings, under Apple’s policies and legal obligations
Support email	Address/message and any content you choose to add	As long as reasonably needed for the request or legal obligations

Export and deletion

Export. More › Your data › Export journal writes a file on your device that you choose whether to share. Nothing is uploaded.

Appointment prep. More › Appointment prep creates a one-page PDF of your own records for a period you choose. It is made on your iPhone and goes only where you send it.

Sharing a pattern. Share pattern on a pattern's page makes an image of its headline on your iPhone. It contains no numbers or health details beyond that sentence and goes only where you send it.

Delete all data. More › Your data › Delete all data erases the Food & Fit database, your stored patterns, the widget/App Group summary, the local reminder, and your privacy and onboarding settings. It removes everything Food & Fit holds about you on that iPhone.

It does not make a network request. The narrow Durable Object described above holds no journal content and expires automatically 180 days after your last authenticated API activity. To have the RevenueCat customer record deleted sooner, contact us.

Food & Fit cannot selectively remove OpenAI default abuse-monitoring records for estimates you already requested, because they are pseudonymous and time-limited; they age out within the period above.

RevenueCat and purchases. Contact us to request deletion of the RevenueCat customer and associated Food & Fit entitlement snapshot where applicable. Deleting RevenueCat data does not cancel an App Store subscription or erase purchase records Apple must keep. Use Apple’s subscription controls or RevenueCat Customer Center to manage/cancel a subscription first.

Apple Health. Delete nutrition samples in the Health app and change Food & Fit permissions there. Deleting Food & Fit does not automatically remove samples already written to HealthKit.

Your choices and rights

Depending on where you live, you may have rights to access, correct, export, delete, restrict, or object to processing of personal information, and to withdraw consent. You may also complain to your local data-protection authority. We will not discriminate against you for exercising a privacy right.

Health permissions are controlled in Apple Health and iOS Settings. Subscription controls are available through Customer Center and Apple. Your journal can be exported and erased from inside the app. For a request involving information held by a provider, we will coordinate with that provider where the law requires.

Adults only

Food & Fit is designed for adults age 18 or older and is not directed to children or teenagers. Onboarding requires the user to confirm they are at least 18. We do not knowingly collect personal information from anyone under 18. Contact us if you believe this has happened.

International processing and required disclosure

Cloudflare, OpenAI, RevenueCat, Apple, and email providers may process information in countries other than yours under their contracts and applicable transfer safeguards.

We may preserve or disclose the limited information we hold when reasonably necessary to comply with law, protect a person’s safety, investigate abuse, or defend legal rights. We cannot disclose journal history we do not possess, but provider-retained or narrow operational records may be subject to lawful requests.

Changes to this policy

If the product’s remote data flows or processors change, we will update this policy and its date before the changed release is made available, and update App Store privacy disclosures where required. Material new uses that require consent will not be enabled under an old consent.

Contact

Privacy questions and requests: support@alplustech.com

Support: foodandfit.app/support

Food & Fit Privacy Policy