Privacy Policy

Last updated: September 15, 2026

At NutriAI, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application.

1. Information We Collect

1.1 Personal Information

When you create an account, we collect:

  • Email address
  • Name (if provided through social login)
  • Profile picture (if provided through social login)

1.2 Health and Nutrition Data

We collect information you provide about:

  • Meal photos and descriptions
  • Dietary goals and preferences
  • Health objectives (weight loss, muscle gain, etc.)
  • Chat conversations with AI nutritionist
  • Nutrition tracking data (calories, macros)

1.3 Usage Information

Operational logs are needed to run and protect the service, whether or not you allow optional tracking. They can include request time, status, network address and technical browser information. If you separately allow product analytics or marketing tracking, those providers may also collect:

We also keep daily aggregate counts, separate from optional Google analytics: ordinary website HTML document loads, and how many meals, chat messages and weight entries the whole service recorded that day. A stored count is a single number per day and contains no page address, query string, network address, cookie, device identifier, account or any part of what you wrote, photographed or ate — nothing in it can be traced back to a person. Loads are not a count of unique visitors; in-app page transitions and known crawlers are excluded. The server-to-server counter does not ask your browser to make another tracking request.

  • Device information (browser type, operating system)
  • Pages viewed and interaction times
  • Analytics data (feature usage, engagement metrics)

2. How We Use Your Information

We use the collected information to:

  • Provide and maintain our nutrition tracking services
  • Analyze meal photos and provide nutritional information
  • Generate personalized nutrition advice and recommendations
  • Create in-app reports and statistics
  • Improve service reliability and fix technical failures
  • Send push notifications you have enabled
  • Respond to your questions and provide customer support
  • Detect and prevent fraud or abuse

Automated email reports, onboarding messages and marketing campaigns are currently disabled. Push notifications are the current opt-in notification channel. A password-reset email is sent only when you explicitly request it. The email-report code is retained but inactive.

Legal bases and sensitive information

We process information needed for the features you request to perform our service agreement. We use legitimate interests for limited operational logs, security, abuse prevention and the non-identifying daily aggregates of website loads and recorded actions. Separate consent is the basis for optional product analytics and marketing tracking. Billing records may be retained to meet applicable legal obligations.

Meals, goals and chat content can say something about your health. Anything of that kind — an allergy, an intolerance, a diagnosis, a medication, a pregnancy — is kept only if you say it may be: the assistant asks you in the conversation before remembering it, and you can change that answer, or delete what was remembered, on the Memory page at any time. Saying no removes it everywhere, including the archive. Whatever you write in a message is sent to the AI providers that answer it.

3. Data Sharing and Disclosure

We do NOT sell your personal information to third parties.

We may share your information only in the following circumstances:

  • Service Providers: Firebase handles sign-in and a requested password reset; MongoDB stores account and nutrition data; OpenRouter routes text and image AI requests; Groq processes voice transcription; Stripe handles checkout and subscription billing; Vercel hosts the website and Hetzner hosts the API. A browser push provider delivers notifications to devices that opt in.
  • Optional analytics and marketing: Google Analytics measures product use only if you allow product analytics. Google Ads and Meta Pixel measure advertising and conversions only if you separately allow marketing tracking.
  • Legal Requirements: We may disclose information if required by law or in response to valid legal requests.
  • Business Transfers: If NutriAI is acquired or merged, your information may be transferred to the new entity.
  • With Your Consent: We may share information for any other purpose with your explicit consent.

4. Cookies and Tracking Choices

Essential browser storage keeps your language, session and privacy choice. Product analytics and marketing tracking have separate, initially off choices. Rejecting either does not limit the application. An older combined approval does not silently become permission for the two separate purposes.

You can change or withdraw either choice at any time. Our app then stops events for the withdrawn purpose, updates provider consent signals and removes accessible first-party cookies for that purpose. Google Analytics page-location query strings are excluded; custom analytics events do not include a meal, chat, profile or Stripe checkout reference. Marketing providers may process the page address and technical data when you allow them.

5. Data Security

We implement appropriate technical and organizational security measures:

  • Data encryption in transit (HTTPS/TLS)
  • Secure authentication via Firebase
  • Regular security audits and updates
  • Access controls and monitoring

However, no method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Your Rights

You have the right to:

  • Access: Request a copy of your personal data
  • Correction: Update or correct your information
  • Deletion: Request deletion of your account and data
  • Data portability: Download the account JSON export where available
  • Objection: Object to certain data processing activities
  • Withdrawal: Withdraw consent at any time

You may complain to a supervisory authority in your country. AI nutrition estimates are not intended to be a solely automated decision with legal or similarly significant effect.

To exercise these rights, contact us at support@nutriai.one

7. Data Retention

We retain your account information while the account is active. Account deletion starts live-data erasure immediately, cancels billing where possible and queues a retry if a provider or operation temporarily prevents completion. Limited billing records may remain where law requires them; infrastructure backups and provider records follow separate retention schedules. We cannot promise that every external copy is erased instantly.

8. Children's Privacy

NutriAI is not intended for children under 13. We do not knowingly collect information from children under 13. If you believe we have collected such information, please contact us immediately.

9. International Data Transfers

Some providers may process information in countries other than your own. The countries and transfer safeguards depend on their current contracts; ask support for details. This notice does not replace verification of those contracts.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated through an in-app notice or push notification.

11. Contact Us

If you have questions about this Privacy Policy, please contact us:

NutriAI Support

Email: support@nutriai.one

Website: https://nutriai.one