Privacy Policy

1. Scope

This policy explains how the developer of Foodle (“we,” “us,” or “our”) handles information when you use the Foodle iOS app. Foodle is a local-first meal journal and nutrition recognition tool. You can use photo capture, recognition, and local history without an account. Signing in with Apple enables optional cross-device cloud sync.

2. Information we process

• Meal photos and text records: photos you capture or select, an on-device subject cutout, meal names, portions, nutrition results, life notes, timestamps, and notes you edit. Foodle only sends images you choose or text you actively submit for analysis and does not scan your entire photo library. After text analysis succeeds, the original input is not saved as record content; only the generated title and response are retained.
• Optional account and profile: an Apple-provided account identifier, a real or relay email address if Apple provides one, and profile fields you choose to enter, including display name, birth date, calculation sex, height, weight, activity level, and avatar. We do not receive your Apple password.
• Cloud-sync content: after sign-in, structured meal records, meal image assets, cutouts, stickers, avatar, and user-entered profile fields are stored in a private cloud space associated with your account.
• Usage and diagnostics: app and feature interactions, recognition outcomes, coarse duration buckets, random installation/session/request identifiers, app version and build, device model, OS version, locale, and time zone. Server logs include request path, status, and duration, but not meal photos or the body of text records.
• Subscription and free allowance: Apple product, transaction, and original transaction identifiers, an anonymous appAccountToken, purchase and expiration dates, subscription status, daily successful-recognition count, and request identifiers used to prevent duplicate counting. Apple processes payment; we do not receive your card or other payment-method details.

3. Apple Health data

With your permission, Foodle reads body mass, basal energy, and active energy from HealthKit to calculate a daily energy target on your device. Raw HealthKit samples and specific values derived from them are not uploaded to Foodle, Supabase, or AI services and are not used for advertising, marketing, or tracking.

Profile values you manually enter in Foodle are separate from HealthKit data. If you sign in and use cloud sync, manually entered height, weight, birth date, calculation sex, and activity level are uploaded as profile data.

4. How we use information

• Recognize meals, estimate portions, generate nutrition data, and organize life notes;
• Save, edit, display, restore, and sync your records and settings;
• Authenticate accounts, maintain sessions, secure data, and delete accounts;
• Verify Foodle Plus access, restore purchases, and enforce the free recognition allowance;
• Measure feature operation and improve reliability, performance, and usability;
• Comply with law and prevent abuse or security incidents.

5. Service providers and sharing

We transmit information to Apple, Supabase, Render, OpenRouter, and selected model providers only as needed to provide these functions. Meal photos and text you actively submit for analysis are sent through the Foodle API to OpenRouter and then to a selected model provider. OpenRouter says prompt and response content is not stored by default, while request metadata is retained. Individual model providers may have different retention and training practices. Do not upload photos containing other people, identity documents, medical records, or other sensitive information.

We do not sell personal data, show ads, or combine Foodle data with third-party data for targeted advertising or advertising measurement.

6. Retention and security

• Without sign-in, meal records and images remain primarily on your device until you delete them, clear data, or uninstall the app.
• Cloud-sync content is generally retained until you delete the related meal or delete your account in the app. Signing out clears account data from the current device but does not delete the cloud account.
• Product analytics remain in the device queue for up to 7 days and raw server analytics for up to 90 days. Account-linked analytics are also removed through the account-deletion flow.
• Subscription status and transaction identifiers are retained as needed to provide access, process refunds, prevent fraud, and meet legal obligations. Account deletion removes the Foodle account link, but does not delete transaction records Apple is required to retain.
• Recognition content, including text submitted for analysis, is processed for the time needed to fulfill the request. Third-party retention for security, abuse prevention, billing, or legal compliance is governed by their policies.

We use reasonable safeguards including encryption in transit, access tokens, private storage, row-level access controls, and server-side encryption. No network or storage system can be guaranteed absolutely secure.

7. Your choices and rights

You may deny or change camera, photo, and Health permissions; use Foodle without signing in; sign out; edit or delete individual meals; and delete your account from Foodle Settings. Account deletion initiates Apple authorization revocation and deletion of the cloud account, meals, images, profile, avatar, and linkable analytics.

8. Children, international processing, and updates

Foodle is not designed specifically for children. Service providers may process data outside your country or region. We may update this policy when features, providers, or laws change. We will revise the effective date and provide notice through this page, the app, or App Store release notes when appropriate.

9. Contact

For privacy questions, data requests, general support, or feature suggestions, email foodle_support@163.com. Do not email passwords, verification codes, Apple sign-in tokens, complete identity documents, or medical records.