Privacy Policy

1. Information we collect

Account and profile information

We may collect your name, email address, password hash, preferred language, account or guest identifier, profile photo, and session information. We never store your password in plain text.

Nutrition, fitness, and body information

Information you choose to provide may include age, biological sex, height, weight, activity level, nutrition goals, calorie and macro targets, meals, ingredients, custom foods, nutrient values, workouts, and weight history. Depending on applicable law, some of this information may be considered sensitive or health-related data.

Photos and other content

If you use photo-based features, we process the meal, food-label, or profile images you choose to upload. We also process free-text meal and workout descriptions, saved meals, notes, and AI prompts.

Sharing information

If you share your journal, we process the invitee’s email address, your sharing choices, the date range, invitation status, and the profile details needed to identify the journal owner and viewer. The invited person can see only the categories and period you choose to share.

Technical and security information

We process device name, user agent, IP address, session and request timestamps, app identifiers, quota usage, and related security signals to operate the Service, prevent abuse, and protect accounts. Our website may also generate ordinary server request logs. We do not currently use advertising cookies or third-party advertising analytics on this website.

2. How we use information

We use personal data to:

• provide, sync, personalize, and maintain the Service;
• calculate nutrition targets and present progress;
• generate AI-assisted meal, label, workout, and goal estimates;
• authenticate accounts and send verification or sharing emails;
• enable the sharing choices you request;
• prevent fraud, enforce limits, troubleshoot, and secure the Service;
• comply with law and protect our users, rights, and systems.

Our legal bases depend on where you live and may include performing our contract with you, your consent or explicit consent, our legitimate interests in operating and securing the Service, and compliance with legal obligations. Where law treats information as sensitive, we process it only to provide features you request and ask for consent when required.

3. AI-assisted features

When you request an AI estimate, we send the information needed for that request to OpenAI. Depending on the feature, this can include meal or workout text, a meal or food-label photo, selected custom foods, language, body measurements, activity level, and goal preferences. We do not intentionally include your name or email in the AI request.

OpenAI states that API data is not used to train its models by default unless the account owner opts in, and that API content may ordinarily be retained for up to 30 days for abuse monitoring and certain service operations. See OpenAI’s API data controls for current details. AI estimates can be inaccurate. Review and edit them before relying on or saving them.

4. When we share information

We share personal data only as needed with:

• Cloudflare, for application hosting, databases, media storage, networking, and security;
• OpenAI, when you use AI-assisted features;
• Resend, to deliver verification, password, and journal-sharing emails;
• Apple, for App Store distribution, purchases, subscriptions, and related account functions;
• people you choose, when you use journal sharing;
• authorities or other parties when required by law or necessary to protect rights, safety, and the Service.

We do not sell your personal data, share it with data brokers, or use it for targeted advertising. Service providers may process data in countries other than your own. Where required, we use recognized legal safeguards for international transfers.

5. Retention and deletion

We generally keep your account content while your account is active and until you delete the content or your account. When you delete your account in Nutrova, app content and stored photos are removed from Nutrova’s production data systems, active sessions are revoked, and the authentication account is deactivated. Limited records may remain when reasonably necessary for security, fraud prevention, legal compliance, or dispute resolution.

Some shorter operational periods apply:

• guest data you decline to merge into a registered account is scheduled for deletion after 30 days;
• unattached meal photos are removed after about 24 hours;
• pending sharing invitations expire after 14 days, and declined invitation records are removed after 7 days;
• content sent to OpenAI may be retained under OpenAI’s then-current API retention controls, described above.

6. Your choices and rights

You can edit much of your profile and journal directly in the app, stop sharing at any time, remove photos, and delete your account from account settings. Depending on your location, you may also have rights to access, correct, erase, restrict, object to, or receive a portable copy of your personal data; withdraw consent; and complain to your local data protection authority.

To exercise a right that is not available in the app, email info@kelrova.com. We may need to verify your identity before completing a request.

7. Security

We use technical and organizational measures designed to protect personal data, including encryption in transit, hashed passwords and session tokens, access controls, rate limits, and tenant-aware authorization. No system is completely secure, and we cannot guarantee absolute security.

8. Children

Nutrova is not directed to children under 13. If the law where you live requires a higher minimum age or parental authorization, you may use the Service only after those requirements are met. If we learn that we collected a child’s personal data contrary to law, we will take appropriate steps to delete it.

9. Changes to this policy

We may update this Privacy Policy as the Service or applicable law changes. We will post the updated version here, revise the effective date, and provide additional notice when required.

10. Contact

Questions or privacy requests can be sent to info@kelrova.com.