Privacy Policy

SmartCrunch is a calorie tracker for iPhone. You give it a goal weight, you log what you eat, and it works out how much energy you have left for the day and whether your weight is actually moving the way the plan says it should.

It has no account. There is nothing to register, nothing to log in to, and no server anywhere holding a profile with your name on it. Everything the app knows about you is a file on your phone.

That shape is what makes this document readable. Most of it is not “here is what we collect” — it is “here is the short list of moments when something does leave your phone, and what you have to do first for that to happen”.

1. The short version#

• Your food diary, your weights, your goal and your targets live in a database on your iPhone. We have no copy of any of it.
• There is no account, no sign-up, no login, no friends list, no feed and no leaderboard.
• There are no ads, no advertising SDKs, no attribution kits and no third-party trackers. The app does not ask for tracking permission because it does not track you.
• Apple Health is read on your device, with your permission, and the app writes back exactly four numbers a day: energy, protein, carbohydrates and fat.
• The AI features are the one place data about your body leaves the phone. They are off until you switch them on: they need an active SmartCrunch Pro subscription and a separate, explicit “yes” to AI processing. Without both, no request is ever built.
• Product analytics are off until you say yes as well, as a separate question. Say no and the analytics library is never even started.
• Barcode scanning and food search query Open Food Facts, a public food database. What travels is a barcode or your search words — nothing else about you.
• Purchases are handled by Apple. We never see your card, your Apple ID or your billing address.

2. Who is accountable, and how to reach them#

Everything described below is controlled by:

Aleksandr Kolesnikov Dimitri Nikolaou 7, Limassol, Cyprus, 4006 the Republic of Cyprus

Privacy questions, requests and complaints: [email protected].

This is a one-person operation, not a company with a privacy department. There is no separate Data Protection Officer, because the scale of processing does not require one — write to the address above and it reaches the person who wrote the code.

This policy covers the SmartCrunch iOS app and the website at smartcrunch.org. The website’s own storage is dealt with separately in the Cookie Notice, which is short because the site stores nothing.

3. What stays on your iPhone#

Unless a later section names an exception, everything below is written to your device and read back from it, and never sent anywhere:

There is no cloud sync built into this app. The database is a plain local store; it is not configured against iCloud, CloudKit or any server of ours. If you have iCloud Backup switched on in iOS, your device backup may include the app’s files — that is Apple’s backup of your phone, governed by Apple’s terms and controlled entirely from your iOS settings, and we have no access to it.

Deleting the app deletes the database, the photos and the preferences with it. The one thing that survives, by design, is the Keychain identifier described in §7.1 — §12 and §13 explain how to get rid of it.

4. Apple Health#

Apple Health is an on-device framework. Nothing you allow here is transmitted to us by allowing it — permission grants the app read access on your phone, and what happens afterwards is described in §6.

4.1 What SmartCrunch reads#

The app asks iOS for the following, and only the following. You can grant them individually, refuse any of them, and change your mind later in Health → Data Access & Devices.

Six further channels are requested and read but not used, and this policy is not going to pretend otherwise. They are VO₂ max, sleeping wrist temperature, blood-oxygen saturation, breathing rate, heart-rate variability and heart rate at rest. They are inherited from the codebase SmartCrunch was built out of; the app reads them into its local database on each sync and no screen in this version displays them and no calculation consumes them. They stay on your device like everything else in this section, they are never part of an AI request (see §6.2), and they are queued for removal. Until that ships, the honest statement is that they are read, and you can decline them individually in Health with no effect whatsoever on how the app works.

Sleep is a seventh case, and a narrower one. The app asks for sleep permission and issues exactly one kind of sleep query: “what is the date of the oldest sleep record you hold?”, used together with the same question about weight and energy to know how far back to look when you ask it to load your history. No sleep data is read, stored or shown. It is queued for removal with the six above.

4.2 What SmartCrunch writes — exactly four things#

If you grant write access, the app mirrors your diary back into Health as four daily totals:

1. Dietary energy (kcal)
2. Protein (g)
3. Carbohydrates (g)
4. Fat (g)

That is the entire write surface. Nothing else is ever written — not your weight, not water, not a note, not a photo. The numbers are the ones the app’s own calculation produced for that day, written unchanged; when a day is edited the previous entry the app itself wrote is replaced rather than added to.

Write access is a separate permission from read access. Decline it and every other part of the app behaves identically — your diary simply stays inside SmartCrunch.

When the app reads the four nutrition channels back, it deliberately ignores its own samples. Otherwise the totals it wrote in the morning would come back in the afternoon as somebody else’s food and be counted twice.

5. Open Food Facts — the database behind the scanner#

Scanning a barcode, or searching for a product by name, sends a request to Open Food Facts, a public, openly licensed food database run by a French non-profit.

• What is sent: the barcode digits, or the words you typed into the search field. Plus, because their API requires a client to identify itself, a header naming the app and its version.
• What is not sent: anything about you. There is no key, no account and no identifier of any kind in these requests. Open Food Facts sees an anonymous request from an IP address, exactly as a browser visiting their website would.
• Why the request goes straight from your phone rather than through infrastructure of ours: their rate limit is per IP address. Routing everyone through one server would make every user share one small quota and jam each other.
• Results are cached on your device, so scanning the same packet twice makes one request, not two.

Barcode scanning uses the camera on your device. Frames are processed by iOS on the phone to find the code; no image from the scanner is transmitted anywhere and none is stored.

Open Food Facts data is used under the Open Database Licence, which the app credits in Settings → About.

6. Google Gemini — the part where data about you leaves your iPhone#

This is the section worth reading slowly. Everything above happens on your device. The AI features do not.

When you ask the app to identify a meal from a photo, estimate a meal from a description, or build you a day’s meal plan, the request goes to Google’s Gemini API. It travels through a small Cloudflare Worker that we operate, whose only job is to hold the Google API key so that the key is not shipped inside the app where anyone could extract it. The relay forwards the request to Google and hands the reply straight back; it does not read, buffer, store or log the contents of either. What it does write down is a single structured line per call: a timestamp, the name of the route, whether it succeeded, the status code returned, the elapsed milliseconds, and a truncated one-way hash standing in for your install identifier. Separately it keeps a running count of calls made by your install, which is what makes the ceilings in §6.3 enforceable. That is the complete list.

None of this happens unless you have made it happen. Every AI request passes three gates, in this order, before a request body exists at all:

1. An active SmartCrunch Pro subscription. The AI features are the paid part of the app.
2. Your explicit consent to AI processing. Asked as its own question, on the first screen of the app, before anything is read. Not pre-ticked, not bundled with anything else, refusable, and reversible in Settings → Privacy.
3. A remote switch we can use to disable the AI entirely — for a provider outage or a cost emergency.

Silence is not consent. An install that has never answered is treated exactly like an install that answered “no”: nothing is sent.

6.1 What is sent#

It depends on which feature you used. There is no single “everything” payload.

Estimating a meal from a photo sends the photo, downscaled to at most 1024 pixels on its longest side and JPEG-compressed, plus the caption you typed if you typed one, plus an instruction telling the model to identify the dishes and estimate portions. That is all. No numbers about you ride along with it — not your weight, not your targets, not what you have already eaten.

Estimating a meal from text sends the words you typed (or dictated into the text field) and nothing else. Dictation itself is the iOS keyboard’s, handled by Apple under Apple’s terms; the app only receives the finished text.

Building a meal plan is the request that carries context, because a plan for a 55 kg person is not a plan for a 100 kg person. It sends:

• the date and day of week, and the eating window you configured;
• your nutrient targets for the day and their physiological floors;
• your energy figures: estimated expenditure, what you have eaten so far, the resulting balance, the gap to your goal, and your goal weight;
• your body facts: age, sex, height, mass, body-fat percentage and fat-free mass where known, and whether the mass is measured or estimated;
• your dietary preferences and your free-text dietary note — this is where an allergy usually gets written down, and where a halal or kosher preference, if you set one, would be included. Of everything the app stores, this is the only entry capable of hinting at a religious belief. Leave it blank and it is absent from the request; nothing else about the app changes;
• your frequent and recent foods, by name, with typical portions — these are names you typed, so treat them as your own words;
• your interface language, so the plan comes back in it.

Wording a notification. Three of the app’s notifications are operational — “a sync looks stuck”, “some data seems missing”, “the AI is unavailable” — and their sentence can be written by the model. These carry no information about you at all: telling a model your body mass in order to phrase a sync warning would only invite it to make plumbing personal. This is also the only AI call that can happen while the app is in the background, and only if you have granted AI consent.

6.2 What is not sent#

• Your diary as a whole. No AI request contains your history of meals, your weight series, or any day other than the one in question.
• The six unused Apple Health channels listed in §4.1, and nothing about sleep. None of them appears in any payload the app assembles.
• Your name, your e-mail, your Apple ID, your device identifiers, your IP as an identifier we attach, your purchase details or your payment method. The app does not hold most of these in the first place.
• Photos other than the one you attached to that estimate. The app never asks for access to your photo library as a whole; iOS’s own picker runs outside the app and hands over the single image you chose, and nothing else.
• Your location. The app never requests it, at any precision.

The request does carry one identifier: a random UUID minted on your device, sent so the relay can enforce a per-install budget and refuse a runaway loop. It is the same random UUID described in §7.1, it is not derived from you or your hardware, and Google does not receive it — the relay strips it and forwards only the model request.

6.3 Your controls, and the limits that apply#

• Withdraw at any time in Settings → Privacy. It applies to the very next request; there is nothing queued to drain and no grace period.
• Withdrawal is not retroactive at Google. Anything already sent has been processed under Google’s terms. §13 explains what you can ask for.
• Nothing about the AI is required to use the app. Manual entry, barcode scanning, the diary, weight tracking, targets, the trend, notifications and Apple Health all work with the AI switched off, permanently.
• Rate limits exist to protect the bill and to stop a retry loop from running away. Every AI feature — photo estimate, text estimate and meal plan alike — draws on one shared allowance of 30 successful calls per device per day, which resets at your local midnight. A call that fails costs you nothing, so an error is always retryable. The relay adds its own ceilings on top: a short-window burst limit and a daily maximum per install.
• Photos are stored on your device for the diary entry. Deleting the entry removes the photo. Nothing keeps a copy on our side.

If you are not comfortable with a photo of your dinner and your body facts being processed on Google’s infrastructure, say no to the AI question. The rest of the app is built to work without it.

7. Product analytics and crash reports (PostHog)#

The app can report which features are used and when it crashes, through PostHog, on their EU-hosted service.

The AI question and this one are two independent questions, put to you together but answered apart. Saying no to either leaves the other untouched, and saying no to both is a perfectly ordinary way to run the app.

Until you say yes, the analytics library is not started at all. This is deliberate and stronger than an opt-out flag: an initialised-but-opted-out SDK still contacts its server for configuration. Skipping the initialisation entirely means the count of network requests before your consent is zero.

7.1 What stands in for your name#

A randomly generated UUID, minted on your phone the first time one is called for and held in the iOS Keychain. It is neither your Apple ID nor a device identifier, it is not computed from anything about you or your hardware, and there is nothing in it to reverse back into a person.

Because the Keychain outlives an app deletion, that UUID survives deleting and reinstalling the app. That is genuinely useful for counting people rather than installs, and it is also exactly the kind of persistent identifier you should be able to get rid of — so withdrawing analytics consent destroys it, not merely stops using it. Turning analytics back on later mints a brand-new one; the old identity is not resurrected.

The same UUID is what the AI relay receives as an install token (§6.2). Purging it therefore changes both.

7.2 What is collected#

A short list of named events, each with a fixed vocabulary of properties:

• app opened, data refreshed, a tab viewed, settings opened, onboarding completed;
• a food entry logged — the fact of it, not what you ate;
• a paid feature was tapped while not subscribed, and the daily AI limit blocked a call;
• the subscription funnel: paywall shown, purchase, restore, expiry — with the plan tier and where the paywall was opened from, never a price, a transaction id or a receipt.

Attached to every event is a small set of properties: your interface language, the app version and build, whether you are subscribed, how many days since you installed, and the goal type you chose.

Crash and error reporting rides on the same answer. A crash is written to disk when it happens and uploaded the next time you open the app; errors the app caught itself are reported with their message and a stack trace, because a report that cannot name what went wrong is not worth collecting.

7.3 What is not collected#

• No session replay. No screen recording. Ever. That collector is explicitly switched off, as are automatic screen views, automatic lifecycle events and automatic tap capture. The only events sent are the ones listed above.
• No health or body data. No weight, no calories, no macros, no targets, no goal weight, no Apple Health value. Events say a food entry happened; they do not say what it was or how big.
• No content you typed. No food names, no notes, no dietary text, no captions.
• No identity or payment data. No name, e-mail, Apple ID, transaction id, price or receipt.
• No advertising identifier, no cross-app or cross-site tracking, no data shared with a data broker.

Error reports are the one place with unbounded text — an error’s own description and its stack trace. Every error type in the app that can reach that path is written to interpolate developer-authored text or a fixed status token only, precisely so that a server’s error message cannot smuggle a copy of your request into a crash report.

8. Subscriptions and payments#

SmartCrunch Pro is sold through Apple’s In-App Purchase system. Apple is the merchant.

• We never see and never receive your card number, your billing address, your Apple ID or your name. Apple processes the payment under Apple’s own privacy policy.
• What the app receives from iOS is a signed entitlement: whether a subscription is active, which product, and when it expires. That is what unlocks the AI features.
• Managing, pausing or cancelling a subscription happens in your Apple ID settings, not here. The Terms of Use cover the commercial side.
• There is no free trial and no introductory offer. No product in the app defines one. If you ever see the app imply otherwise, that is a bug worth reporting.

9. Why each category is processed, and on what legal basis#

Health data is a special category under Article 9 of the GDPR and needs its own explicit basis, so it is listed separately rather than folded into a general line.

10. Who receives data about you, and in what role#

Nobody else is on this list. The app contains no ad network, no broker, no attribution kit, and no other third-party code that puts anything on the wire.

11. Transfers outside the EEA#

• PostHog receives analytics on its EU infrastructure. No third-country transfer is intended for this purpose.
• Google (Gemini) answers from Google’s own infrastructure, which includes servers in the United States. That is an export out of the EEA. It rests on the Standard Contractual Clauses and the additional safeguards written into Google’s Gemini API data-processing terms, and on your specific, explicit consent under Article 49(1)(a). That consent is an actual deliberate act, not something inferred from your having tapped a button: the app puts the question first, says who receives the data, and will not assemble a request at all while the answer is anything but yes.
• Cloudflare runs the relay. It is a US-headquartered company with points of presence worldwide, and your call is served by whichever one sits closest to you — possibly outside the EEA — so this is an export too. It is covered by Cloudflare’s own Standard Contractual Clauses and data-processing addendum, and by the very same consent: the relay exists only to carry an AI call, so if you never grant that consent, nothing of yours reaches it in the first place.
• Open Food Facts is operated from France. Their servers answer an anonymous lookup; there is no personal data in the request to transfer.

If processing in the United States is not acceptable to you, decline the AI consent. Every non-AI feature stays fully functional.

12. How long things are kept#

13. Your rights when there is nobody to ask#

You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw a consent at any time without that affecting what was lawful before.

Exercising them here is unusual, because for most of the data there is nobody to ask — the data is on your phone and we cannot see it. So:

For everything on your device (§3), you already have every right, directly.

• Access and portability: it is on your phone. Apple Health holds the four daily totals in §4.2 in an exportable form.
• Rectification: edit or re-log the entry.
• Erasure: delete the entry; or delete the app, which removes the database, the photos and the preferences together. We hold no copy that could survive it. Note the Keychain identifier below, which does survive.
• Restriction and objection: turn off the feature, or revoke the Health permission in iOS. Nothing depends on your having granted it.

For what left the device, write to [email protected].

• AI requests (§6): tell us roughly when you used the feature. Because there is no account, we cannot look you up — but we can raise a deletion request with Google for the relevant processing, and we will tell you what came back rather than claim more than we can do.
• Analytics (§7): here is the uncomfortable consequence of building it this way. Analytics records are keyed to a random UUID that the app does not display anywhere, and we hold nothing that maps that UUID to you. So we cannot look you up, and we are not going to start collecting something that would let us — under Art. 11 GDPR a controller is not required to acquire additional identifying information purely to satisfy a request, and acquiring it would make your data less private, not more. What you can do instead is withdraw analytics consent, which destroys the identifier on your device so that nothing further can ever be attached to it, and write to us to have the whole project’s records for a date range deleted if you would rather they were gone. We would rather state that plainly than promise a lookup we cannot perform.

Withdrawing a consent takes two taps in Settings → Privacy, separately for AI and for analytics. AI withdrawal applies to the next request. Analytics withdrawal stops capture, stops the queued events on disk from being uploaded, and destroys the identifier.

We answer requests within one month. If a request needs no lookup — most of them do not — it is usually the same day.

14. Automated decision-making#

The app calculates a lot: your daily budget, your macro targets, your weight trend, how far you are from your goal. All of it runs on your device, and none of it is a decision with a legal or similarly significant effect on you within the meaning of Article 22. Nothing here decides on credit, employment, insurance, eligibility or access to a service. It is arithmetic about food, shown to you, which you are free to ignore, override or edit.

The AI features identify food and propose a plan. They do not diagnose, treat or decide anything, their output is always editable before you accept it, and every number the app finally uses is recomputed by its own calculation rather than trusted from the model. See the Health Disclaimer for what the app is and is not.

15. Children#

SmartCrunch is not intended for anyone under 16, which is also the minimum age in the Terms of Use. Calorie targets and weight goals are the wrong instrument for a body that is still growing, and nothing in the app can make them the right one. The Health Disclaimer sets out who else should not be using it.

We do not ask your age and we collect nothing that would verify it, so this is a condition of use rather than something the app enforces — collecting identity documents to police it would be a far worse trade for everyone’s privacy than stating the rule plainly.

If you believe a child has been using the app, deleting it removes the local data straight away. Write to [email protected] if you also want the analytics identifier dealt with, and see §13 for what that involves.

16. Security#

• The smallest attack surface is no server. There is no account database to breach, no password to leak and no user table to exfiltrate, because none of them exists.
• The Google API key is not in the app. It lives as an encrypted secret on the relay, which is exactly why the relay exists — a key shipped inside an iOS binary can be extracted, and a stolen key is billed to us.
• The relay is a narrow allowlist, forwarding exactly one model endpoint. A stolen install token buys someone this app’s own features and nothing else, and it is rate-limited per install.
• All network traffic is HTTPS. There is no plaintext path.
• Nothing sensitive is logged. Bodies are never read or logged by the relay; error messages from a provider are reduced to a status code and a fixed token before they can reach a crash report.
• Device security is iOS’s, and it is the main thing protecting your diary: your data is inside the app’s sandbox, protected by your device passcode and Apple’s file encryption. Use a passcode.

No system is perfect, and this one is maintained by one person. If you find a security problem, please write to [email protected] before publishing it.

17. What SmartCrunch never does#

• No selling of data. There is no arrangement, at any price, with anyone.
• No advertising, no ad SDK, no ad identifier, no App Tracking Transparency prompt — because nothing is tracked across apps or websites.
• No data brokers, no attribution SDKs, no fingerprinting.
• No session replay or screen recording.
• No permission request for your contacts, calendar, microphone, location or photo library. The camera is the only device permission the app asks for beyond Health and notifications, and only when you tap to photograph a meal or scan a barcode.
• No background upload of your diary. There is nowhere for it to go.
• No account, so no password to lose and no e-mail list to be added to.
• No dark patterns in the consent screen: two plain questions, neither pre-ticked, both answerable “no”, and the app works if you answer “no” to both.

18. Changes to this policy#

When something substantive shifts — another recipient, another category of data, another country at the far end — this document shifts with it, the date moves, and, where the change affects what you consented to, the app asks you again rather than inheriting an answer you gave to different words. The consent record on your device stores which version of the wording you were shown, precisely so that “you already agreed” cannot be claimed about text you never read.

Small corrections — a typo, a clearer sentence, a translation fix — update the date and nothing else.

19. Complaints#

If something here is wrong, or a request was handled badly, write to [email protected] first. It reaches the person who can actually fix it, and that is usually the fastest route.

You also have the right to complain to a data protection supervisory authority — either in the Republic of Cyprus, where the controller is established, or in the EU or EEA country where you live or work. Using that right does not require asking us first.

Related documents: the Terms of Use, the Health Disclaimer and the Cookie Notice for what the website at smartcrunch.org stores.