Privacy Policy

Who is responsible for your data

The data controller for EpiNutri is Epioneum LLP, registered in England and Wales, registered office Stoney Works, 8 Stoney Lane, London, SE19 3BD, United Kingdom.

Write to privacy@epioneum.com to exercise any of the rights described below, or to ask us anything about this policy. If you are in the United Kingdom you also have the right to complain to the Information Commissioner’s Office; if you are in the European Economic Area, to your national supervisory authority.

Your account

Our backend provider, Supabase, authenticates your account and stores an account ID, email address and provider identity information. Apple can supply a Hide My Email private relay address; we do not request your Apple password or the name from your Apple credential. Google sign-in uses Google's authorization screen and Supabase; EpiNutri never receives your Google password. Provider identity information may include the name or profile information the provider shares.

Version 1.0 offers Apple and Google sign-in. Email and password sign-in, account confirmation emails and password reset emails are not available in this version. Sign-in choices with different email addresses may create different accounts; we do not move personal records between them.

Your records and cloud sync

Supabase hosts our authentication and account database in the United States. Cloud sync means reading and saving your account records through an internet connection. The app does not maintain a personal database or an offline queue. Unsaved edits and displayed records can remain in memory while you use the app; an unsuccessful save is not confirmation that data reached your account.

• Meal records include food names, portions, calories, macros and micronutrients, meal times, food sources and edits.
• Water intake, weight history, activity summaries, goals and goal changes, fasting schedules and fasting history are stored in your account.
• Profile and onboarding answers can include your name, city, birth date or age, sex used for nutrition calculations, height, weight, activity level, dietary preferences, nutrition goals, obstacles and optional GLP-1 medication-use preference. We use these answers to calculate and personalize your nutrition plan and displays.
• Favorites, saved barcode product details and nutrition, units, week-start and other app preferences, and your Health cloud-import choice are stored in your account.

The app keeps necessary sign-in credentials, device-integrity identifiers and interrupted-account-deletion recovery credentials in Apple's Keychain. These are not an offline copy of your diary. The bundled food reference database contains public food information, not your personal records. Older installations may contain records from an earlier local-storage version; the app asks before removing them and does not silently upload or assign them to another account.

Meal photo scanning

Before AI analysis, EpiNutri asks for your explicit permission to send your selected meal photo through our recognition service to OpenRouter, which routes it to OpenAI's GPT-5.4 mini hosted on Microsoft Azure, using only endpoints that retain no data and do not train on it. The purpose is to identify foods and estimate portions and calories. You can decline and continue using food search and manual logging.

• EpiNutri remembers your answer on your account, so later scans do not ask again; a new provider or a change in what is shared asks again. Revoke it in Settings → Privacy & data. Revoking stops future uploads and retries, but cannot recall a photo already sent.
• Location and other embedded photo metadata are removed on your phone before upload. Anything visible in the image can still be shared, so avoid including private information in the frame.
• Our gateway processes the image in memory and discards it after the request; it does not store the photo in its database or application logs. Recognized results expire for retry recovery after 24 hours. A cleanup job runs every five minutes to remove expired results; physical removal can take longer if cleanup is delayed. OpenRouter and Microsoft Azure process the photo under zero-data-retention terms and their privacy policies; our deletion controls cannot promise erasure of a provider's records.
• Account-based scan counts, timing, status and an App Attest device integrity key identifier support quota limits, reliability and fraud prevention. They are not used for advertising.
• AI estimates can be wrong. Review and edit the result before saving it to your diary.

Apple Health

Apple Health cloud import is optional and read-only. Before requesting Apple's read access, EpiNutri asks separately whether to import weight history and daily activity summaries into your account stored by Supabase. Summaries include active-energy calories, exercise minutes, stand hours and their goals. The initial weight import can include up to a year of history. We use imported records for your nutrition displays, trends and history across devices, not for medical diagnosis or treatment.

You can stop future imports in Settings. If the change cannot reach the server, the app shows an error and you must retry to apply it across devices. Existing records remain in your account until you delete them; turning off permission does not erase them. You can also revoke read access in iOS Health settings. Deleting EpiNutri data does not delete the original records in Apple Health.

Apple Health records are not sent to the photo AI provider. We do not use Health data for advertising, marketing or unrelated data mining, and do not sell it. Imported records are protected by the same account access controls as your other personal records.

Food search and barcode scans

Food search uses a public reference database bundled inside the app. The app still requires an account and internet connection to access and save your personal records. Barcode lookup sends the barcode number to Open Food Facts. Its servers also receive ordinary network metadata, such as your IP address, under their privacy policy. We attach no account identifier or cookie to that request. Barcode product details you save, favorites, and foods you log are stored in your cloud account.

Subscriptions and service providers

Apple handles App Store purchases. We use subscription identifiers and status to confirm EpiNutri PRO access; we do not receive your payment-card details. Supabase hosts authentication, our database and gateway. Apple and Google authenticate their respective sign-in choices. OpenRouter, with OpenAI's model on Microsoft Azure, provides AI recognition, and Open Food Facts provides barcode lookup. Data sent to these providers may be processed outside your country.

How we use and protect data

We use your information to provide the app, personalize nutrition targets and displays, show totals and trends, maintain account security, make your records available across devices, and verify purchases and scan limits. Network requests use encrypted connections and database access is restricted to the authenticated account. No system is perfectly secure.

• We do not sell or rent your personal information.
• We do not use your food diary or Apple Health data for advertising or marketing.
• We do not show ads, embed advertising trackers, or track you across other apps and websites.

Legal bases and international transfers

Where UK or EU data protection law applies, we rely on these legal bases:

• Contract: to create and run your account, store and sync your records, calculate your nutrition plan and confirm EpiNutri PRO access.
• Consent: to send meal photos for AI analysis and to import Apple Health records. Withdraw either in Settings at any time; withdrawal does not affect processing that already took place.
• Explicit consent for health details: your goal, sex, age, height, weight, goal weight, activity level, eating style, eating obstacles and GLP-1 medication use can reveal information about your health. EpiNutri asks for your explicit consent before you enter them and uses them only to calculate your targets and show your progress. Withdraw it by deleting your data or your account in Settings → Privacy & data; without these details EpiNutri cannot build your plan.
• Legitimate interests: to keep the service secure and reliable and to prevent fraud and abuse, including scan limits, device-integrity checks and billing-recovery records.
• Legal obligation: where the law requires us to keep, disclose or delete information.

Supabase, Apple, Google, OpenRouter, Microsoft Azure (running OpenAI's model) and Open Food Facts process data in the European Union, the United States and other countries. Where UK or EU law restricts a transfer outside the UK or EU, we rely on an adequacy decision or on safeguards such as the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses. Email privacy@epioneum.com for details of the safeguards that apply.

You can complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority where you live or work.

Retention and deletion

Account and personal cloud records remain until you delete the relevant data or your account. Deleting a record can leave an identifier that prevents an old request from restoring it, and short-lived operation receipts support safe retries. Erasing all personal data clears those records. Scan recovery results expire after 24 hours and are removed by a cleanup job scheduled every five minutes. Limited account security events and operation-retry receipts become eligible for deletion after 30 days. Deletion-recovery credentials expire after 30 days. Scheduled minute, hourly or daily cleanup jobs remove these records. Daily account scan-usage totals are removed once their UTC date is more than 30 days old. These are retention and expiry rules, not guaranteed physical-deletion deadlines: removal happens on the next successful cleanup run and can take longer if cleanup is delayed. Completed deletion acknowledgement records do not retain your user ID; the limited subscription-recovery exception below is separate.

If you have a verified App Store purchase, we keep a limited billing ownership record so you can restore it after deleting and recreating your account with the same sign-in identity. It contains the App Store subscription identifier, environment, original purchase-account token (which may be your former EpiNutri account ID), expiry, and keyed digests of the identities linked at deletion. It contains no email address, provider identity text, sign-in credentials, diary or Health records. These pseudonymous records are restricted to our server and used for purchase restoration and protection against fraudulent claims. A record becomes eligible for removal 60 days after the later of account deletion and the last verified subscription expiry, and is removed only after a fresh Apple check confirms the subscription has ended. Verified renewals extend retention; unavailable or inconclusive Apple checks defer removal. An hourly job checks records approaching removal. Restoring a purchase removes the deletion-recovery digests and links billing ownership to the new account.

We also keep restricted-access operator recovery backups until a later verified recovery copy replaces them. Deletion from the active service does not immediately remove information from these backups. Any hosting-provider backup copies follow that provider’s backup cycle.

Delete your account from Settings → Privacy & data → Delete my account. Apple-linked accounts may require Apple confirmation and revocation of the Apple authorization used by EpiNutri. Account deletion removes your authentication account and personal cloud records and clears the app's credentials and in-memory account state, subject to the limited billing-recovery and backup retention described above. If deletion is interrupted, reopen the app and continue the deletion recovery shown there. A network error is not shown as successful deletion.

Deleting your account does not cancel an Apple subscription or prevent you from signing in again to create a fresh account. Deleted personal records do not return. Use the same sign-in identity to restore a verified purchase. Deleting the app alone does not delete your server account or cancel a subscription. Cancel separately in Apple's subscription settings. Photos already sent to the AI provider are covered by that provider's retention policy.

Your data, your controls

• Review or edit the foods you log.
• Use cloud export in Settings → Privacy & data to create a readable JSON file of your personal cloud records. Export needs a working connection. A temporary protected file is created for sharing and removed when sharing finishes or the account changes. Copies you deliberately save or send elsewhere are under your control.
• Delete all my data erases your personal cloud records and preferences but keeps your account and subscription. Delete my account removes the account and personal cloud records, with the limited billing-recovery and backup retention described above. Neither action cancels an Apple subscription.
• Decline or revoke AI photo sharing and Apple Health cloud import independently.

Depending on where you live, privacy laws including the GDPR and CCPA give you rights to access, correct, delete or port your data, object to or restrict processing based on our legitimate interests, withdraw consent, or complain to a supervisory authority. Email privacy@epioneum.com for help, including if you cannot sign in.

Children

EpiNutri is not directed to children under 14 or the minimum age in your country. We do not knowingly collect their information. Contact us if you believe a child has provided personal data so we can remove it.

Changes and contact

Epioneum LLP is responsible for EpiNutri. We will update this policy and its effective date for material changes and request new permission when the data-sharing purpose changes. Questions: privacy@epioneum.com. Website: epioneum.com.