Privacy Policy

1. Information we collect

Account and profile information

We may collect your name, email address, password hash, preferred language, account or guest identifier, profile photo, and session information. We never store your password in plain text.

Nutrition, fitness, and body information

Information you choose to provide may include age, biological sex, height, weight, activity level, nutrition goals, calorie and macro targets, meals, ingredients, custom foods, nutrient values, workouts, and weight history. Depending on applicable law, some of this information may be considered sensitive or health-related data.

Photos and other content

If you use photo-based features, we process the meal, food-label, or profile images you choose to upload. We also process free-text meal and workout descriptions, saved meals, notes, and AI prompts.

Apple Health

If you enable Apple Health workout import and grant permission, Nutrova reads workouts and their active energy. The imported information includes the workout identifier, type, start time, duration, and calories. We sync these entries to your Nutrova account to show them in your journal and, if you choose, adjust your calorie and macro targets. This version does not write data to Apple Health. Health access is optional; you can log workouts manually without granting it.

You can stop new imports in Nutrova’s Apple Health settings and revoke access in Apple’s Health settings. Turning access off does not delete entries already synced to Nutrova; you can delete those entries or your Nutrova account. Deleting an entry in Nutrova does not delete the original workout in Apple Health. We do not use Apple Health data for advertising or marketing.

Sharing information

If you share your journal, we process the invitee’s email address, your sharing choices, the date range, invitation status, and the profile details needed to identify the journal owner and viewer. The invited person can see only the categories and period you choose to share.

Technical and security information

We process device name, user agent, IP address, session and request timestamps, app identifiers, quota usage, and related security signals to operate the Service, prevent abuse, and protect accounts. Our website may also generate ordinary server request logs. We do not currently use advertising cookies or third-party advertising analytics on this website.

2. How we use information

We use personal data to:

• provide, sync, personalize, and maintain the Service;
• calculate nutrition targets and present progress;
• generate AI-assisted meal, label, workout, and goal estimates;
• authenticate accounts and send verification or sharing emails;
• enable the sharing choices you request;
• prevent fraud, enforce limits, troubleshoot, and secure the Service;
• comply with law and protect our users, rights, and systems.

Our legal bases depend on where you live and may include performing our contract with you, your consent or explicit consent, our legitimate interests in operating and securing the Service, and compliance with legal obligations. Where law treats information as sensitive, we process it only to provide features you request and ask for consent when required.

3. AI-assisted features

When you request an AI estimate, we send the information needed for that request to OpenAI. Depending on the feature, this can include meal or workout text, a meal or food-label photo, selected custom foods, language, body measurements, activity level, goal preferences, and journal summaries. These summaries may include workout calories imported from Apple Health. We ask for your explicit permission before sending data to OpenAI. You can withdraw that permission in Nutrova’s Settings; manual logging remains available. Withdrawing permission stops new AI requests and does not erase previously saved entries or processing records. We do not intentionally include your name or email in the AI request.

OpenAI states that API data is not used to train its models by default unless the account owner opts in, and that API content may ordinarily be retained for up to 30 days for abuse monitoring and certain service operations. See OpenAI’s API data controls for current details. AI estimates can be inaccurate. Review and edit them before relying on or saving them.

4. When we share information

We share personal data only as needed with:

• Cloudflare, for application hosting, databases, media storage, networking, and security;
• OpenAI, when you use AI-assisted features;
• Resend, to deliver verification, password, and journal-sharing emails;
• Apple, for App Store distribution, purchases, subscriptions, and related account functions;
• people you choose, when you use journal sharing;
• authorities or other parties when required by law or necessary to protect rights, safety, and the Service.

We do not sell your personal data, share it with data brokers, or use it for targeted advertising. Service providers may process data in countries other than your own. Where required, we use recognized legal safeguards for international transfers.

5. Retention and deletion

We generally keep your account content while your account is active and until you delete the content or your account. When you delete your account in Nutrova, app content and stored photos are removed from Nutrova’s production data systems and active sessions are revoked. Personal account details are removed or anonymized. This applies to guest accounts as well as registered accounts. A request already in progress can finish during deletion. Any remaining data from such a request is removed by our daily cleanup, normally within 24 hours. Limited records may remain when reasonably necessary for security, fraud prevention, legal compliance, or dispute resolution.

Specific operational periods also apply:

• guest data you decline to merge into a registered account is scheduled for deletion after 30 days;
• unattached meal photos are removed after about 24 hours;
• temporary photos used for a background AI analysis are removed when processing finishes; unfinished inputs and temporary results are cleaned up after about 24 hours;
• Nutrova keeps encrypted AI request and response contents for up to 30 days for troubleshooting and service operation. Image pixels are excluded from these audit records;
• AI operation metadata, including feature, model, timing, token usage, result status, and account identifier, is retained for up to 395 days to manage costs, quotas, reliability, and abuse. Scheduled cleanup may take up to one additional day. Deleting your Nutrova account removes its AI audit contents and metadata;
• pending sharing invitations expire after 14 days, and declined invitation records are removed after 7 days;
• content sent to OpenAI may be retained under OpenAI’s then-current API retention controls, described above.

6. Your choices and rights

You can edit much of your profile and journal directly in the app, stop sharing at any time, remove photos, and delete your account from Settings, including when using a guest account. Depending on your location, you may also have rights to access, correct, erase, restrict, object to, or receive a portable copy of your personal data; withdraw consent; and complain to your local data protection authority.

To exercise a right that is not available in the app, email info@kelrova.com. We may need to verify your identity before completing a request.

7. Security

We use technical and organizational measures designed to protect personal data, including encryption in transit, hashed passwords and session tokens, access controls, rate limits, and tenant-aware authorization. No system is completely secure, and we cannot guarantee absolute security.

8. Children

Nutrova is not directed to children under 13. If the law where you live requires a higher minimum age or parental authorization, you may use the Service only after those requirements are met. If we learn that we collected a child’s personal data contrary to law, we will take appropriate steps to delete it.

9. Changes to this policy

We may update this Privacy Policy as the Service or applicable law changes. We will post the updated version here, revise the effective date, and provide additional notice when required.

10. Contact

Questions or privacy requests can be sent to info@kelrova.com.