Privacy Policy

NutriAI Privacy Policy

This policy explains which data may be processed when you use the NutriAI app, what it is used for, and your rights over your data.

Last updated: 28 October 2026

1. Controller

The controller responsible for processing your personal data is:

Muhittin Dayan
E-mail: mhtndyn363@gmail.com

2. Data we collect

Depending on the features you use, NutriAI may process the following data:

  • Account and profile information
  • Nutrition and training preferences: diet type, allergies, foods you dislike, meal preparation time, training experience and session length (all optional and editable in your profile)
  • Meal logs, water tracking, exercise and weight tracking data
  • Health and activity data such as step counts, only if you allow it
  • Notification preferences and technical information about your device
  • Prompts, text and, if you choose, meal photos that you send to AI features
  • Limited verification data about your subscription and purchases
  • If you use the contact form in the imprint: your name (optional), e-mail address, message and a keyed hash of your IP address to prevent abuse (the IP address itself is not stored). We use this only to answer your request (Art. 6(1)(b) and (f) GDPR).

Weight, body measurements, allergies, diet and activity data can reveal information about your health. They are special categories of personal data under Article 9 GDPR and are processed only with your explicit consent.

3. Why we use data and on which legal basis

  • Providing the app, your account, logs, plans and premium access (Art. 6(1)(b) GDPR, performance of a contract)
  • Processing health-related data and sharing data with the AI service to create analyses, recipes and plans (Art. 6(1)(a) and Art. 9(2)(a) GDPR, your explicit consent)
  • Reading health and activity data from Apple Health or Health Connect (Art. 6(1)(a) and Art. 9(2)(a) GDPR, your consent, given in the system permission)
  • Reminders and notifications (Art. 6(1)(a) GDPR, your consent)
  • Basic technical logs for security, abuse prevention and fixing errors (Art. 6(1)(f) GDPR, our legitimate interest in a secure and working service)

You can withdraw a consent at any time with effect for the future, for example in your profile, in the system settings or by e-mail. Withdrawal does not affect processing that took place before it.

4. Third-party services

NutriAI uses the following processors and services to provide the service:

  • Supabase: authentication, database and storage
  • RevenueCat: subscription and entitlement verification
  • Google Gemini: creating analyses and suggestions from the meal photo or text you choose and, depending on the feature, your age, height, weight, goal, nutrition preferences, allergies, disliked foods, training preferences and related activity data. Meal photos are resized before they are sent.
  • USDA FoodData Central and Google Translate: food search text and translation of food names; requests are sent through Supabase and contain no account data

The app asks for your explicit consent before data is first shared with Google Gemini. You can withdraw this consent in your profile. These services are used only as far as needed to run the related feature.

5. Where data is stored and international transfers

  • Our database and storage (Supabase) are hosted in Tokyo, Japan. The European Commission has recognised Japan as providing an adequate level of data protection (Art. 45 GDPR).
  • Google (Gemini, Translate) and RevenueCat may process data in the United States. These transfers rely on the following safeguards: for Google, the EU-US Data Privacy Framework (Google LLC is certified) and the European Commission's Standard Contractual Clauses; for RevenueCat, the Standard Contractual Clauses (Commission Decision (EU) 2021/914) in its Data Processing Addendum.
  • Apple and Google process purchase data under their own terms as independent controllers.

6. How long we keep data

  • Account, profile, logs and plans: until you delete your account
  • Cached AI results: deleted automatically after 24 hours
  • Technical logs: until you delete your account
  • Contact form messages: deleted automatically after 12 months
  • Purchase records: kept by Apple or Google under their retention rules

7. Your rights

If the GDPR applies to you, you have the right to:

  • access the personal data we hold about you (Art. 15)
  • have incorrect data corrected (Art. 16)
  • have your data deleted (Art. 17); you can do this yourself in Profile → Delete my account
  • restrict processing (Art. 18)
  • receive your data in a structured, machine-readable format (Art. 20)
  • object to processing based on legitimate interests (Art. 21)
  • withdraw any consent at any time (Art. 7(3))

To use these rights, write to mhtndyn363@gmail.com. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.

8. Deleting your account

In Profile → Delete my account you can permanently delete your account, your profile and the related app records. Deleting your account does not cancel your App Store subscription automatically; manage your subscription in your Apple account settings.

9. Automated decisions

AI-created plans, analyses and suggestions are recommendations. They are not decisions with legal or similarly significant effects on you within the meaning of Article 22 GDPR.

10. Children

NutriAI is not intended for children under 16. We do not knowingly collect data from them.

11. Security and important note

NutriAI applies reasonable technical and organisational measures to protect your data; however, no system is completely free of risk. NutriAI is a health and nutrition support app; it does not replace medical diagnosis, treatment or professional healthcare.