Privacy policy

The short version

• Without an account, your plan, diary, safety answers and body details stay on your device. We do not receive them.
• The app runs at app.kostenlos-abnehmen.de. There are no ads there, and no script from kostenlos-abnehmen.de can read what the app stores in your browser.
• Ads from Google may appear on the knowledge and recipe pages at kostenlos-abnehmen.de. We measure how the pages are used with Google Analytics, but only if you agree in the banner. Ad cookies also exist only with your consent.
• Your entries reach our server only if you explicitly switch on sync. They are encrypted there. If you end it, we delete them.
• For the photo estimate, you send a photo to Alibaba Cloud. It may also be processed in China. Everything about our AI is under AI in the app. This happens only with your consent and only for photos you send yourself. It's only available if you've also turned on sync.
• Reminders are off unless you switch them on. The server then stores your browser’s subscription and the times you chose, but no meals or other entries.
• Sharing as an image happens only in your browser. A link puts only the values you choose on our server as a public page, until you delete it or it expires.
• When you scan a barcode, the camera image stays on the device and only the digits reach us. Your device reads nutrition photos itself.

Controller

You can use this address for any question about data protection.

Visiting the site, hosting and Cloudflare

When you open the site, your browser sends technically necessary data: IP address, time, the address requested, browser and operating system. The site cannot be delivered without it. The app itself keeps no access logs with IP addresses. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to provide the site securely and reliably.

The site has two addresses: the home page, knowledge, recipes and legal texts are at kostenlos-abnehmen.de, the app is at app.kostenlos-abnehmen.de. Your browser keeps the data of the two addresses apart, so a script on kostenlos-abnehmen.de cannot read what the app stores.

netcup

The app, the database (PostgreSQL) and the cache (Redis) run on servers of netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. netcup processes the data as our processor under Art. 28 GDPR.

Cloudflare

In front of our server sits the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare provides DNS and the encrypted connection, delivers the site and protects it from attacks. Cloudflare is our processor under Art. 28 GDPR.

Every request passes through Cloudflare. The encryption of your connection ends there, and Cloudflare encrypts again towards our server. Cloudflare can therefore technically see everything between your browser and us: IP address, approximate location, addresses requested including barcode digits, and the content of requests, such as your email address at sign-in, sync data and photos. The legal basis is Art. 6(1)(f) GDPR; our interest is protection from attacks and fast delivery.

Cloudflare runs a worldwide network and may also process data in the USA. For the USA, the European Commission's adequacy decision on the EU-US Data Privacy Framework applies (Implementing Decision (EU) 2023/1795), under which Cloudflare is certified. For other transfers, the contract provides for the EU Standard Contractual Clauses. See Cloudflare's privacy policy for more.

Cloudflare instructs your browser to send technical error reports to Cloudflare when a connection fails (Network Error Logging). Successful visits are not reported.

Data on your device

The app stores data in your browser's local storage (localStorage), only for the address app.kostenlos-abnehmen.de. This data stays there and does not reach us unless you use one of the functions described below. For reading nutrition photos, there is also an entry with counters for crashes and slow runs (ocr-device) and the browser cache ocr-v1 with the model files, about 28 MB. Neither contains anything from your photos.

Notes and feelings in the diary stay on your device. Sync does not send them, only a backup file contains them. Eating times of their own for single weekdays stay on your device too. The same goes for details of protein portions. Your way of eating stays there too, it only goes to our AI provider with sync for AI tips, see below. What you plan under supplements, medication and sport also stays on your device. Sync does not send it and the AI does not get it. A backup file contains it. For a reminder the server only gets the kind and the time, never the name or the amount. For medication the kind only says “planned”.

In the settings under “Back up” you can save your data as a file. The file is created in your browser and never reaches us. It is not encrypted, and you decide where it goes. Your answers to the safety questions are not in it. A file you load also stays in your browser. The same goes for exports of other services from which you take over your weight history under “Weight”: the file is only read in your browser, and only the day and the weight are taken over. If sync is on, loaded entries go to your account like all others.

What you choose under “Calm and display”, such as hidden numbers or a pause, is also stored there. It reaches the server only with sync. The app also works out the week review and its notes there, from your entries. Nothing goes to us.

If you choose a calorie deficit or a value for a single day, the app stores that there too. It reaches the server only with sync.

So that the app also starts without a network, a service worker on the app pages keeps the app's pages, program files and images in the browser cache (app-pages, app-static, app-images). They are the same for everyone and contain neither your entries nor our server's answers to your requests. For this, your browser asks our server for new versions when you open the app, as with any page visit. After your first entry, the app also asks the browser not to delete its data by itself (persistent storage). Whether it does so is the browser's own decision.

Storing this needs no consent under Section 25(2) No. 2 of the German TDDDG, because the app you are using cannot work without these entries.

The entries are not encrypted. Anyone using your device and browser can see them. You delete your plan, diary and device ID in the settings under “Back up” with “Delete all data”. Everything else, including the model files and the app's cache, you remove in your browser settings. We hold a copy only if you use sync.

Cookies

For signing in we set two technically necessary cookies, both only when you sign in. On the knowledge and recipe pages, Google cookies for ads and measurement are added with your consent, see below. The language is part of the address, not a cookie.

The legal basis is Section 25(2) No. 2 TDDDG. If Cloudflare classes a request as a possible attack, it may also set the security cookie __cf_bm, which expires after 30 minutes without activity.

Consent banner

On the knowledge and recipe pages at kostenlos-abnehmen.de, a banner asks whether you agree to ads and measurement. The home page and the app show no banner, because no ads run there and no measurement runs without your consent.

The banner is the consent management platform of Google Ireland Limited under the Transparency and Consent Framework (TCF) of IAB Europe. It stores your choice in cookies in your browser and passes it to Google and to the advertising partners it lists. The legal basis is Art. 6(1)(c) in conjunction with Art. 7(1) GDPR, because we must be able to prove consent.

Saying no is as easy as saying yes. You change or withdraw your choice at any time under “Privacy settings” at the bottom of every page. Withdrawal applies from then on.

Ads from Google

On the knowledge and recipe pages at kostenlos-abnehmen.de, Google AdSense shows ads. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

With your consent, Google sets cookies or similar identifiers, measures whether ads are seen and may choose ads based on your interests. For this Google processes, among other things, your IP address, the page you open, your browser and device. The banner's settings show exactly which purposes and partners are involved. If you say no, Google may still show ads that are not tailored to you.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Google may also process data in the USA. For the USA, the adequacy decision on the EU-US Data Privacy Framework applies, under which Google LLC is certified. More is in Google's privacy policy and under How Google uses information from sites.

There are no ads in the app at app.kostenlos-abnehmen.de, and we do not pass details from the app on for advertising. If your browser still holds data from the time the app ran at kostenlos-abnehmen.de, we show no ads there.

Measurement with Google Analytics

With your consent, we use Google Analytics 4 to measure how often which pages are opened, at kostenlos-abnehmen.de and in the app. This shows us which articles are read and where people stop during setup.

Google Analytics runs through Cloudflare Zaraz. Your browser loads no script from Google. A Cloudflare script at our address reports the page view to Cloudflare, and Cloudflare passes it on to Google. Google receives the page address, the previous page, language, screen size, browser and device, and a random identifier stored in a cookie. Entries from the app such as meals, weight or answers do not go to Google.

Without your consent, Zaraz measures nothing. You give it in the banner on the knowledge and recipe pages. The cookie ka_messung carries it into the app.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Google Ireland Limited processes the data for us as a processor, and so does Cloudflare. Google may also process data in the USA; Google LLC is certified under the EU-US Data Privacy Framework. Google keeps the measurement data for at most 14 months.

Account and sign-in

An account is optional. You need one only for the AI estimates, sync and reminders. The legal basis is Art. 6(1)(b) GDPR, because we need the account to provide these functions.

We store your email address, the time the account was created and your sessions. We store neither an IP address nor a browser with a session.

To run the service we see, in a protected admin area, your email address, when your account was created and last active, whether sync is on, the number of your entries and the number of your AI requests. This area does not open content such as meals, weight, allergies or plans. For AI use we also count per day and task how many calls finished or failed, with no link to an account. If we block an account, we record that with the time and the admin account. The legal basis is Art. 6(1)(f) GDPR, our interest in running the service securely.

Sign-in with an email code

You enter your email address and receive a six-digit code that is valid for 10 minutes. The code exists only as a hash in our database. The system removes expired entries, which may contain your email address, at a later sign-in with a code. To send it, we pass your email address and the code to our email service provider, which acts as a processor.

Sign-in with Google

If you choose “Sign in with Google”, your browser takes you to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. You sign in there, and Google learns that you use this service. Google is itself responsible for this, see Google's privacy policy. Google may transfer data to the USA and is certified under the EU-US Data Privacy Framework.

From Google we receive your email address, name, a link to your profile picture and your Google ID. We store these together with the access tokens Google issues at sign-in. We do not use them to fetch further data from Google.

Deleting your account

You delete your account in the settings under “Account and sync” with “Delete account”. This deletes your email address, sessions, Google link and all sync data. The data on your device stays.

Protection against abuse

To stop anyone overloading sign-in, sync or the photo estimate, we count requests. For this we store in Redis a hash calculated with a secret key (HMAC) of your account, IP address, email address or device ID together with a counter. If Redis cannot be reached, the server counts the same way in memory. The entry disappears by itself after its time window, which is between one minute and 24 hours. Such a hash is pseudonymous, not anonymous.

The sign-in system also keeps your IP address briefly in memory to limit attempts. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to prevent attacks, mass sending of codes and costs from abuse.

Optional sync

With sync you back up your data in your account and use it on several devices. It runs only if you switch it on for that device and give your consent. Right after your first sign-in we ask whether your data should live on the server or only on your device. Clicking the server button is your consent. If you decline, everything stays on the device, and you can change this later. The photo estimate is only available with sync. We decided this on purpose. If you decline sync, everything else keeps working, just not the photo estimate.

What reaches the server

• Plan: goal, ways, tracking level, eating window, number and size of protein portions
• Meals: name, time, origin of the entry, ranges for calories and protein, and for fat, carbohydrates and fibre if entered, ingredients with amounts and values
• Fasts and ticked protein portions
• Results of your photo estimates, never the photos
• Weight entries, water, movement and habits
• Favorites, your own meals, recipes, week plan and shopping list
• Your deficit choice and your settings under “Calm and display”
• Your saved AI meal plan with your choices for it: diet, allergies, what you dislike, notes
• Markers for deleted entries, containing only an ID and a time

If you agreed to a shorter version earlier, you stay with plan, meals, fasting periods, portions and photo estimates. More only reaches the server once you agree again in the settings.

What stays on the device

Your answers to the safety questions and the body details in your plan (age, sex, height, weight, activity, daily need) do not go to the server. On a new device you answer them again.

Legal basis

Food data, weight and plans can allow conclusions about your health and are then health data under Art. 9 GDPR. So are allergies, and “halal” and “kosher” can point to your faith. We therefore process them only with your explicit consent under Art. 6(1)(a) and Art. 9(2)(a) GDPR. The sole purpose is to back up your data and match it between your devices. The app works just the same without this consent, only without sync.

As proof, we store the version, time and language of your consent (Art. 7(1) GDPR). This record contains no content and stays until you delete your account. The legal basis for this is Art. 6(1)(f) GDPR; our interest is being able to prove that consent was given.

Protection

The transfer is encrypted. In the database your sync data, email address, name and profile picture are encrypted too (AES-256-GCM, a separate key for each account), also in backups. The master key is kept apart from them. The data is not end-to-end encrypted, though, so our server can read it. We do not analyse it and use it for nothing but sync.

Withdrawal, export and deletion

• Withdrawal: In the settings under “Account and sync”, choose “End sync and delete server data”. That is also your withdrawal under Art. 7(3) GDPR. Processing up to that point remains lawful.
• Deletion: This deletes all sync data on the server. Sync switches off on your other devices at the next match. The data on your devices stays.
• Export: Beforehand, you can download everything as a JSON file under “Export server data”.
• Device only: “Delete all data” affects this device only. Server data stays until you delete it under sync.

Without withdrawal, we store sync data until you end sync or delete your account. There is currently no automatic deletion for inactive accounts.

Keys for AI assistants

In your account you can create keys with which ChatGPT, Claude or other assistants log meals in your diary. This needs sync. The legal basis is your consent to sync under Art. 9(2)(a) GDPR, because meals can be health data, and for the key Art. 6(1)(b) GDPR.

For each key we store its name, its first characters, a hash, its rights per area, and when it was created and last used. We do not store the key itself. What an assistant logs is encrypted in sync like your other entries, with the name of the key. When you revoke a key, we delete it at once. The entries stay until you delete them. If you turn sync off or delete your account, we delete all keys as well.

Instead of a key you can also connect an assistant directly: it sends you to us, you sign in and see who asks, where you go back to and which rights it wants. You can take rights away before you agree. For each connection we store the name of the assistant, its return address, the allowed rights and hashes of the access tokens. An access token lasts an hour, a refresh token 30 days and works once. When you disconnect, we delete all of it at once.

Rights exist per area for reading and writing: meals, daily totals, water, activity, weight, goal and plan, fasting and recipes. An assistant can only read goal, plan and fasting. Notes, mood and safety answers are not on the server, no assistant gets to them.

What an assistant logs for water, weight or activity shows with its name in the app. A typed daily value for activity always comes first. The newest weight decides whether the app blocks for underweight: a weight from an assistant can start a block at once, it only lifts one once you confirm it in the app.

We send nothing to ChatGPT, Claude or other providers on our own, the assistant calls us. Data still ends up with its provider: everything you give the assistant, such as photos and texts, and with reading rights also the data of the allowed areas, such as meals, daily totals or weight, that it asks us for. That can be health data. The provider processes it on its own responsibility under its own terms, often outside the EU as well. We have no influence on that. You grant reading only with a tick of its own and your explicit consent. You take it back by changing the rights or removing the key or connection.

Photo estimate

With an account, an AI model can estimate the calories and protein of a meal from a photo. The model runs at Alibaba Cloud in the Model Studio service, a provider from the Alibaba group in China. Which feature uses which model is under AI in the app.

How it works

• Your device shrinks the photo to at most 1024 pixels and removes location and other metadata. Our server removes metadata once more as a precaution.
• You see the photo once more and send it yourself.
• Our server puts it in a queue in Redis. It stays there for at most 15 minutes and is deleted right after the estimate.
• Our server sends the photo and a fixed instruction to the provider. The result contains only the estimate and a hash of your account. It is valid in Redis for 10 minutes so that your device can fetch it. The most recent result may stay longer, until the next scan finishes. We do not store the photo permanently.

What we do not send

From us, the provider receives neither your name nor your email address, account ID, IP address, location or photo metadata. The photo itself can still reveal something about you. So show only your food, and no faces, addresses, receipts or documents.

Location and retention at the provider

We use the Frankfurt access point with the “Global” deployment scope. According to the provider, request data stays stored in the Frankfurt region, but the model may run outside the EU, possibly in China. According to its own policy, the provider keeps requests and responses for up to 30 days. Content flagged by the automatic safety filter may be kept for up to 2 years. The provider states that it does not use the data to train its models.

Legal basis and third country

Before your first photo, the app tells you about possible processing outside the EU and about retention, and links to AI in the app, which names the provider and the country. By choosing “Got it, take a photo” and sending each photo, you consent under Art. 6(1)(a) GDPR and, where the photo allows conclusions about your health, under Art. 9(2)(a) GDPR.

There is no European Commission adequacy decision for China. No level of data protection comparable to the EU's applies there: state bodies may have wider access to data, and you may not be able to enforce your rights. The provider's contract terms provide for the EU Standard Contractual Clauses for transfers from the EU. We also base the transfer on your explicit consent under Art. 49(1)(a) GDPR.

You withdraw by no longer sending photos. You do not need photos to use the app: quick selection, barcode and manual entry work without AI. We cannot retrieve a photo already sent to the provider.

Result

Your device stores the result. It reaches the server only with sync. The estimate is a suggestion for you to check, not an assessment of you. For the daily limit of 20 photos we count with a hash of your account, which disappears after 24 hours.

Estimate from text

With an account and sync you can describe a meal in a few words. An AI model estimates calories and protein from that. Like the photo estimate it runs at the same AI provider, and what we say there about the provider, location, storage time and third countries applies here too.

• Your text has at most 300 characters. Our server puts it in a queue in Redis, where it stays for at most 15 minutes and is deleted right after the estimate.
• The provider only gets the text, not your name, email address, account ID or IP address. So only write what you ate, without names or illnesses.
• We do not store the text and do not write it to logs. If you log the result, the name of the meal and the estimates stay in your diary.

Before the first text, the app shows the full notice and asks for your express consent. Your device remembers that, and after that a short line with a link stands above the button. By sending each text you give your consent under Art. 6(1)(a) GDPR and, as far as the text allows conclusions about your health, under Art. 9(2)(a) GDPR. You withdraw by no longer sending texts. We cannot get back a text already sent to the provider.

The same applies to recipes you paste to have them read. This text has at most 2,000 characters. Only what you then save in the recipe is stored: name, portions and ingredients with estimates.

The estimate is a suggestion that you check, not a judgement of you. For the daily limit we count with a hash of your account, which disappears after 24 hours.

AI tips for the day

The app can show you one short, general note a day from a fixed list that we wrote ourselves. A rule on your device decides which notes fit. If several fit and you use sync, an AI model picks one of them. It only answers with its ID and writes no text. For this the app sends your way of eating, the time, the number of meals, ticked protein portions, water, whether your eating window is open and the IDs of the fitting notes to our AI provider from 11 am.

Calories, your goal, names of meals, notes, weight, safety answers and anything that says who you are are not included. The numbers stay in Redis for at most 15 minutes, and what we say about location, storage time and third countries for the photo estimate applies here too. The note stays on your device. Without sync nothing goes out, the rule then picks on its own.

The legal basis is your explicit consent under Art. 6(1)(a) and Art. 9(2)(a) GDPR, which you give when switching on sync. You withdraw it by switching AI tips off under Calm. During a break, with hidden hints, a block, an illness or pregnancy the app shows no tips.

AI meal plan

With an account and sync, an AI model can suggest a weekly plan. It runs at the same AI provider as the photo estimate. Your choices (diet, allergies, what you don't like, meals, cooking time, budget), your notes and your calorie range go to the provider without your name, account or IP address. This can also happen in China. By default the provider stores requests and answers for up to 30 days.

Allergies can count as health data, and “halal” and “kosher” can suggest your faith. We therefore only send them with your express consent, which you give before each plan (Art. 9(2)(a), Art. 49(1)(a) GDPR). Your answers to the safety questions aren't sent. With some answers the app doesn't offer a plan, your device checks this.

Until a plan gets its turn, your choices stay in our queue in Redis for 15 minutes at most and are deleted right after it is created. The finished plan stays there for 10 minutes so your device can fetch it. Only your account can fetch it. The plan lives on your device. If you agreed to full sync, it goes to your account encrypted, together with your choices. It's a suggestion from an AI, not dietary advice.

Questions to the knowledge articles

With an account and sync you can ask questions about our articles. For this, your question and matching sentences from our articles go to the model of our AI provider that the photo estimate also uses, without name, account or IP address. The model only picks sentences, the answer consists of passages from our articles word for word. This may also happen in China. By default, the provider stores requests and answers for up to 30 days.

A question can reveal something about your health. So do not write anything about yourself or your health. Before the first question, the app shows the full notice and asks for your explicit consent, and after that a short line with a link stands there. You consent by sending each question (Art. 9(2)(a), Art. 49(1)(a) GDPR). Before that, our server tries to recognise questions on illnesses, medication, pregnancy, on you personally or on eating disorders, and answers them itself without the provider. This works with a word list that does not catch every wording. What it does not catch goes to the provider. Questions for which we find no section do not go there either.

Your answers to the safety questions are not sent. If you stated during setup that you are under 18 or have an eating disorder, your device remembers this and offers you no questions. The server cannot check this. Until it is its turn, the question stays in our queue in Redis for at most 15 minutes and is deleted right after the answer. The answer stays there for 10 minutes so that your device can fetch it. Only your account can fetch it. We do not store questions permanently and write them to no log. We only count how many questions an account asks. The answer is an AI selection from our articles and not advice.

Reminders

With an account, the app can remind you by web push, even while it is closed. This is off by default. You switch it on yourself for each device, and only then does your browser ask for permission.

What we store

• Your browser’s subscription: an address at the push service and the keys to send there encrypted
• The kinds and times you chose. For reminders about the eating window, the times follow from your window, for supplements and sport from what you planned
• Quiet hours, the daily limit, time zone, language and whether you want detailed texts
• When the next reminder is due and how many went out today
• Version and time of your consent

The server does not get meals, weight, water or other entries for this. So it does not know whether you have already eaten or had a drink. The subscription and times are stored encrypted in the database.

Who sees a reminder

Each reminder reaches your device through your browser’s push service, for example Google (Chrome, Android), Apple (Safari, iPhone), Mozilla (Firefox) or Microsoft (Edge). The content is encrypted on this way. The service does see when a message goes to your device and that it comes from this site. This can also happen in the USA.

The default is a neutral text with no reference to food or weight. Only if you choose detailed texts does a reminder name its topic. It can then appear on your lock screen. Your device shows the address of the site either way.

Legal basis and deletion

Kinds and times can allow conclusions about your health. So we only process them with your explicit consent under Art. 6(1)(a) and Art. 9(2)(a) GDPR. You give it with the button “Switch on reminders”. You can withdraw it at any time by switching reminders off.

We delete the subscription on the server when you switch reminders off, sign out on the device, your session expires after 30 days without use, you delete the server data or your account, a safety question ends the plan (then for all devices), or the push service reports that the subscription no longer exists. This happens, for example, when you take back the permission in the browser.

Sharing as an image or a link

You can share a summary of your day, week or month. You choose what is on it. Weight and calories are off until you switch them on.

As an image

The image is made in your browser. We receive neither the image nor the values on it. Where you send it is up to you. The platform is responsible for what it does with it.

As a link

A link needs an account. With “Create link” you put a snapshot of the chosen values on our server as a public page. Anyone who knows the link can view it. If you share the link in a chat or social network, you also pass it to that service's preview, which fetches the page and the preview image.

What we store

• The chosen values, the span, the design and the language, encrypted
• When it was created and the expiry date, if you chose one
• Which account it belongs to, so only you see and delete your links

The server receives no other entries from your diary for this. The page names neither your name nor your email address. The address of the link is random and says nothing about you. We explicitly ask search engines not to list the page. Our server draws the preview image with fonts stored on the server itself. No request goes to Google or any other service for it.

Legal basis and deletion

The values can be health data. We only publish them with your explicit consent under Art. 6(1)(a) and Art. 9(2)(a) GDPR, which you give with “Create link”. You can withdraw it at any time by deleting the link.

We delete a link when you delete it, when you delete the server data or when you delete your account. The page is then gone at once, the preview image can still come from caches for up to a minute. When a link expires, the page is gone from that moment, and we delete the database entry within an hour. Copies others have already kept, such as a screenshot or the preview in a chat, we cannot take back.

Barcode, nutrition photo and product data

Scanning a barcode

For a scan, your browser asks for the camera. Your device analyses the camera image itself; it does not reach us. If your browser has no barcode reader of its own, the app loads the necessary file from our server.

To find the product, the app sends the barcode digits to our server. We see your IP address and count the request as described under “Protection against abuse”. We do not link the lookup to your account and do not store who scanned what. The app does not write barcodes to logs. What you scan can reveal something about your diet. The legal basis is Art. 6(1)(b) GDPR, because you trigger the lookup yourself. If you log the product, it goes into your diary on your device without the barcode number. With sync, this entry reaches the server like any other meal.

Searching for food

When you search for a food, the app sends your search term to our server. The search only runs in our own database, none of it goes to Open Food Facts or the Max Rubner-Institut. We see your IP address and count the request as described under “Protection against misuse”. We don't link the search to your account and don't store search terms. They aren't in the address of the request either, and the app doesn't write them to logs. As with barcodes, the legal basis is Art. 6(1)(b) GDPR.

Asking Open Food Facts

Product data is held in our own database. It comes from the open data of Open Food Facts, 21 rue des Iles, 94100 Saint-Maur-des-Fossés, France. If we do not know a code, our server asks there. Open Food Facts receives only the barcode and our app's name, nothing about you. Your device does not talk to Open Food Facts. If a code stays unknown, we remember that for 24 hours as a hash of the barcode, with no link to you.

Nutrition photo

If you photograph a nutrition table, your device reads it itself. The photo goes neither to us nor to our AI provider. The app keeps it only in memory and discards it as soon as you close the form. If you use your device's camera or pick a file, the original stays in your own gallery. The app loads the necessary model files only after you agree, and only from our server; no third-party service is involved. Only what you check in the form and explicitly save for everyone reaches us.

Contributing and reporting products

You can save an unknown product for everyone or report wrong values. You need no account for this. We store the barcode, name, brand and nutrition values. These details are public and fall under the Open Database License. So do not enter personal data in the name or brand.

To detect duplicates and abuse, the app sends a random device ID. With a contribution we store a hash of this ID and a hash of your IP address, or of its /64 network for IPv6. With a report we store only the hash of the IP address. We delete both after 31 days at the latest. After that no link remains between the product and your device or connection. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a reliable product database that cannot be flooded. If you entered something personal by mistake, write to us and we will remove the contribution from the database and future downloads. The download file may be cached for up to 7 days, and we cannot reach copies already downloaded.

Social media

Our “Social media” page and the footer only contain plain links and preview images from our own server. We do not embed posts from TikTok, Instagram or other platforms. So as long as you click nothing, nothing goes to these providers. If you click a link, you leave our site. The privacy policy of the platform then applies.

If you contact us

If you write or call, we process your details to deal with your request. The legal basis is Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR for questions about your account. We delete the message once it is dealt with and no legal retention duty applies.

Recipients at a glance

We do not sell data, and we do not pass details from the app on for advertising. We give data to authorities only if the law requires it.

Retention at a glance

Where we make backups of the database, deleted data stays in them until the backup is overwritten.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). You can use many of these rights directly in the app. For anything else, an email to [email protected] is enough.

We do not know what is stored only on your device. We cannot give information about it, but you can delete it yourself.

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. We then stop processing the data, unless we can show compelling legitimate grounds or the processing serves legal claims.

Complaint to the supervisory authority

You can complain to any data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Duty to provide data and automated decisions

You are not obliged to give us data. Without an email address, however, there is no account and so neither photo estimate nor sync.

We do no profiling and make no automated decisions under Art. 22 GDPR. The safety rules check your answers on the device and hide ways accordingly. The service is for adults aged 18 and over.

Changes

If the app changes, we update this policy. The date at the top shows the current version. If sync changes significantly, we ask for your consent again.