Privacy policy
1. Who is responsible
[COMPANY], at [POSTAL ADDRESS], operates Nibbles and decides how the app uses your personal information. You can contact us at [PRIVACY EMAIL] about this policy or your rights. Our support address is hello@lit.dog. Where required, our EU representative is [EU REPRESENTATIVE], our UK representative is [UK REPRESENTATIVE], and our data protection contact is [DPO OR PRIVACY CONTACT].
2. What Nibbles collects
Nibbles helps adults record meals, follow nutrition and weight trends, and use an AI food coach. It is not a healthcare provider or an emergency service.
We collect the information needed for the features you use:
- Account and security information. A generated account identifier, app-installation attestation information (Apple App Attest), authentication records, and an Apple account identifier if you choose Sign in with Apple. Nibbles does not ask Apple for your name or email address, so we do not receive them. You do not need to provide your real name or email to use Nibbles. Support correspondence may include your email address and any information you send us.
- Profile and health information. Your birth year, sex, height, weight, weight goal, activity level, dietary preferences, obstacles, and answer about GLP-1 medication use. We also keep nutrition targets, meal records, portions, nutrient estimates, water records, and progress information.
- Apple Health information, if connected. Weight samples and daily step and active-energy totals. Nibbles can write meal energy, protein, carbohydrate and fat records to Apple Health.
- Photos and other content. Meal photos you select or take, food descriptions, clarification answers, notes, coach messages and replies. We store conversation history, relevant remembered facts, safety indicators, suggestions, and records of decisions you make. We can keep an AI draft and your correction to it.
- Preferences and pet activity. Your pet's name and appearance, progress, rewards, time zone, language, units and reminder choices.
- Purchase information. The product, purchase dates, trial and subscription status needed to provide paid features. We use RevenueCat to manage subscriptions (see section 5). Apple handles payment details; neither Nibbles nor RevenueCat receives your card number.
- Usage and technical information. Service calls, quotas, model cost and timing measurements, crash and error reports (see section 6), and anonymous product-use events (event names only, see section 6). Service providers also receive the network information needed to handle a connection.
Voice input is converted to text on your device. This version requires an on-device recognizer and does not upload the voice recording. When you pick a photo from your library, the app reads the time it was taken on your device to file the meal under the right meal of the day; the uploaded copy contains no location or other photo metadata. If you submit the transcript, we process it like typed food text. We do not request access to your contacts or device location. A photo or message can still contain identifying information, so include only what is needed.
3. Why we use information and the EU/UK legal bases
We use information to keep your account secure, synchronize your records, calculate and display your plan, provide requested features, process support requests, manage subscriptions, and keep the service working. The coach uses your context to make its responses relevant. It can generate remembered facts, reminders and recaps. These features can involve automated analysis of health information. They do not make insurance, employment, credit or clinical decisions for you.
The following is the proposed basis for EU/UK processing. It must be confirmed before launch:
| Purpose | Proposed basis |
|---|---|
| Provide account, sync, preferences and subscription features that you request | Performance of our contract, where the processing is necessary for that service. |
| Use health information for your plan and optional AI features | Consent under Article 6(1)(a), with explicit consent under Article 9(2)(a) for special-category data. |
| Prevent abuse, protect accounts, diagnose failures, and control service costs | Legitimate interests in running a secure, reliable service, subject to a documented balancing assessment. This does not itself authorize use of health data. |
| Crash and error reports (section 6) | Legitimate interests in finding and fixing failures, subject to a documented balancing assessment. The reports contain no health data. |
| Anonymous product analytics (section 6) | Legitimate interests in understanding which features are used and improving the app, subject to a documented balancing assessment. The events are anonymous, contain no health data, and you can switch them off in Settings. |
| Meet a specific legal recordkeeping or disclosure duty | Legal obligation, only where an identified law requires it. |
Where we rely on consent, you can withdraw it. Withdrawal does not make earlier lawful processing unlawful. Some requested features cannot work without the information they need. We explain those consequences when you choose a feature.
4. AI features and Apple Health
Before we send personal information to third-party AI services, we ask for your permission. If you agree, we send the content needed for the task: your meal photo or description, clarification answer, or coach message. For coaching, this can also include your profile, nutrition targets, recent meals, weight and activity records, conversation history, remembered preferences, and your pet's name. Weight, steps and active-energy data imported from Apple Health can be part of that context.
Different requests can use Anthropic, OpenAI or Google. Requests pass through Cloudflare AI Gateway, with gateway logging and caching turned off. If the first service fails or is slow, a backup request can go to another of these providers, so a single task can reach more than one of them. Safety checks, memory updates, reminders and recaps can also use AI, including while you are not actively chatting. We do not send the raw voice recording through this feature.
You can refuse AI processing and use available non-AI features. You can withdraw AI permission in [VERIFIED SETTINGS PATH]. Withdrawal stops new AI processing; it does not automatically delete your stored records. You can separately request deletion as described below. A request already delivered to a provider cannot be recalled by stopping a connection.
Apple Health permission is separate from AI permission. You choose which Health data the app can read or write. You can change Apple's permission in the Health app. Imported copies already in Nibbles do not disappear merely because permission is revoked. When you delete your Nibbles account, the app also attempts to remove the meal records that Nibbles wrote to Apple Health. It does not delete records written by other apps. If this device cleanup fails, the app tells you how to remove Nibbles data in Health.
We do not sell Apple Health data or use it for advertising, advertising measurement, or product analytics. We do not use it to build advertising profiles. We do not supply health content for a provider's general model training. Processor terms and configurations must support these commitments before we enable a service.
5. Who receives information
We use the following services, subject to the final release configuration and contracts. We do not sell your personal information or share it for cross-context behavioral advertising under the proposed business model.
| Service | What it does and what it can receive |
|---|---|
| Cloudflare | Hosts the API, account databases and meal-photo storage, and our short-lived error logs (section 6). It relays AI requests through AI Gateway with request logging and caching turned off. It handles the personal information needed for those services and operational network data. |
| Anthropic | Processes task-selected photos, food text, coach messages and health context through its API. Prompt caching can apply. |
| OpenAI | Processes task-selected photos, food text, coach messages and health context through its API. The app requests store:false; separate provider retention can still apply. |
| Google Gemini API | Processes task-selected photos, food text, coach messages and health context. We use it only under Google's paid-service terms, which do not allow Google to use the content to improve its products. |
| PostHog (PostHog Inc.; EU cloud, data stored in Frankfurt, Germany) | Receives anonymous product-analytics events from the app: the event name, a few non-sensitive properties from a fixed list, and a random analytics installation identifier that is not linked to your Nibbles account. It never receives meal content, photos, health values, chat text or the Nibbles account ID. The app asks PostHog to discard IP addresses and not to create person profiles, and uses no SDK autocapture, session replay or advertising identifiers. |
| Sentry (Functional Software, Inc.; data stored in Sentry's EU region) | Receives crash and error reports from the app and our server: error type, a filtered error message, code locations, app version, operating-system version, device model, crash-free session counts and our internal account identifier (in the app's reports only). Our filters remove meal content, chat text, health values, request and response bodies, headers, screenshots and screen recordings before sending. |
| Apple | Processes App Store purchases and optional Apple identity services under Apple's terms. Apple also provides HealthKit, App Attest and operating-system diagnostics. Its role differs from that of our contracted hosting processors. |
| Open Food Facts | Receives the product barcode from our server when needed for a lookup. We do not send the Nibbles account ID or health profile with that lookup. USDA nutrition records are imported into our food database. |
| RevenueCat (RevenueCat, Inc.) | Manages subscriptions. Receives your App Store purchase and subscription records and your Nibbles account identifier, and tells our server whether Pro is active. It does not receive your health data, meals or chats. |
| [SUPPORT PROVIDER] | [SUPPORT DATA, PURPOSE, CONTRACT AND LOCATION]. Remove this row if not used. |
We may disclose information when a valid legal requirement applies, or when necessary to establish or defend legal claims, subject to applicable health-data restrictions. If our business changes ownership, any proposed transfer must respect applicable law and the commitments in this policy. We do not give a buyer unrestricted permission to reuse health data.
6. Crash reports, error logs and analytics
Crash and error reports. When the app crashes or an operation fails, the app sends a report so we can find and fix the problem. Reports go to Sentry (section 5) and, for failures such as a sign-in or network error, to our own server. A report contains the type of error, a filtered error message, where in the code it happened, the app and operating-system versions and the device model. Sentry reports from the app also carry your internal Nibbles account identifier, so we can tell whether one person is affected repeatedly. Our own error logs carry a random installation identifier instead, not your account identifier, and we delete them after 30 days. Neither kind of report contains meal content, photos, chat text, health values, request bodies, screenshots or screen recordings. We do not use crash reports for advertising or to build a profile of you.
Product analytics. Nibbles sends anonymous product-analytics events to PostHog (EU cloud, Frankfurt) to show us which features are used and where people get stuck. An event is a name from a fixed list in the app, for example that a screen was opened, with at most a few non-sensitive properties. Events carry a random analytics installation identifier generated on your device. It is separate from your Nibbles account identifier and from the installation identifier of our error logs, and we never join it to your account. We ask PostHog to discard IP addresses and not to create person profiles, and the app uses no autocapture, session replay or advertising identifier. Events never contain meal content, photos, health values (weight, calories, steps), chat messages or your name. We do not use analytics for advertising or to track you across other apps and websites. You can turn analytics off at any time in Settings › Privacy › App usage analytics. Nothing is sent after you opt out, and turning it back on creates a new, unrelated identifier. Retention at PostHog: [POSTHOG RETENTION] (set from the PostHog project settings).
7. How long we keep information
We keep information for the purposes above, subject to the limits and decisions below. We do not promise that all records disappear when you delete one meal.
| Information | Current behavior and required retention decision |
|---|---|
| Account profile, saved records, coach conversations, memory and safety state | Remain until account deletion; no general inactivity expiry is implemented. Set [INACTIVE ACCOUNT PERIOD] and any shorter category limits before launch. |
| Meal photos and correction history | Can remain until account deletion, including after an individual meal is removed. Corrections include the original draft and edited record. Set [PHOTO/CORRECTION LIMIT] and approve their purpose. |
| Food drafts | Follow-up access expires after 30 days. Old rows are pruned when another draft is saved. This is not guaranteed deletion on day 30, and it does not delete the photo. |
| Deleted record metadata | The server keeps sync deletion records. Some indexed nutrition/weight fields can remain in those rows until account deletion. |
| Account-linked AI cost measurements | Daily maintenance prunes older samples on a roughly 90-day schedule. Account deletion removes the account's samples. |
| PostHog analytics events | Kept by PostHog (EU cloud) for [POSTHOG RETENTION]. They carry only the random analytics identifier, so the Nibbles account deletion does not erase them and we cannot find them by account. |
| Aggregate operational measurements | Cloudflare Analytics Engine has a separate retention period; verify the configured service limit. No account identifier is included in the current stream. |
| Deletion marker | A retained flag and deletion time prevent late operations from recreating an account. No automatic expiry is implemented. See section 8. |
| Our client error logs | Deleted automatically after 30 days. They carry a random installation identifier, not the account identifier. |
| Sentry crash and error reports | [SENTRY RETENTION] (plan default). Not erased by the Nibbles account endpoint. |
| RevenueCat subscription records | Kept by RevenueCat under its terms while needed for the subscription; [VENDOR DELETION PROCESS]. |
| AI-provider caches and safety records | [APPROVED PERIODS BY PROVIDER]. These are not erased by the Nibbles account endpoint. |
| Backups, legal records and support correspondence | [BACKUP EXPIRY], [LEGAL BASIS AND PERIOD], [SUPPORT PERIOD]. Verify the restore and vendor-deletion procedures. |
8. Export and deletion
You can request an account export through [VERIFIED SETTINGS PATH] or [PRIVACY EMAIL]. The current export contains structured account records, conversations, remembered facts, subscription records held by us, and related metadata. It lists photo keys and upload details. Photo files are obtained separately through authenticated download; they are not embedded in the JSON export.
You can request account deletion through [VERIFIED SETTINGS PATH]. Our account deletion process removes the account's active application tables, stored meal photos, authentication records, linked Apple subject, subscription webhook records, and account-linked cost samples. The app clears its local records and session and attempts Apple Health cleanup. If a server cleanup step fails, the process reports failure and can be retried.
We retain a minimal deletion marker in the former account's storage location: a deleted flag and deletion time. It blocks delayed work from recreating deleted data. The marker contains no profile, meals or conversation, but its association with the former storage location means we do not call it anonymous. [APPROVED NECESSITY, BASIS, RETENTION AND REVIEW PERIOD].
Deleting an account does not cancel an Apple subscription, erase Apple's transaction records, immediately erase all vendor records, or erase backups before their approved expiry. Cancel the subscription separately through Apple. We must process any required provider or backup deletion under the applicable schedule. If you exported files or kept photos outside Nibbles, you control those copies.
9. Your rights
Depending on where you live and the applicable conditions, you can ask to access, correct, delete or obtain a portable copy of your information. You can ask us to restrict use, object to processing based on legitimate interests, and withdraw consent. You may also have rights relating to solely automated decisions with significant effects. We will explain any lawful reason that prevents us from fulfilling all of a request.
Contact [PRIVACY EMAIL]. We may need proportionate information to confirm that a request concerns your account. We do not require you to send health records simply to verify identity. We respond within the period required by applicable law and explain any permitted extension. You can complain to your local EU supervisory authority or the UK Information Commissioner's Office. You do not have to contact us first to exercise that right. See EDPB rights guidance.
US state laws may provide additional access, correction, deletion, appeal and authorized-agent rights, including rights for consumer health data. [ADD THE APPLICABLE STATE NOTICE, REQUEST METHODS, APPEAL PROCESS AND REQUIRED HEALTH-DATA DISCLOSURES]. We do not discriminate against you for exercising applicable privacy rights.
10. International processing and security
Our providers may process information outside your country, including in the United States. PostHog analytics data is stored in the EU (Frankfurt), but PostHog Inc. is a US company, so transfer safeguards apply to it as well. A database region alone does not determine where all AI or support processing occurs. Where EU/UK transfer rules apply, we use [APPLICABLE ADEQUACY DECISION, STANDARD CONTRACTUAL CLAUSES, UK ADDENDUM/IDTA, AND OTHER SAFEGUARDS]. Contact [PRIVACY EMAIL] for information about the safeguards and how to obtain relevant copies.
We use access controls and authenticated requests to protect account information. No system can guarantee complete security. We review incidents and provide notifications when required by law.
11. Adults only
Nibbles is intended for people aged 18 or older. It is not intended to provide weight-loss coaching to children. The app asks for age information and restricts underage coaching. These checks are not identity verification. If you believe a person under 18 has provided information, contact [PRIVACY EMAIL] so we can review and handle it appropriately.
12. Changes to this policy
We will update the effective date when this policy changes. We will explain material changes through [NOTICE METHOD]. Where a new use needs fresh consent, a policy update alone does not supply that consent.