Privacy Policy
Last updated: September 15, 2026
1. Who is responsible
Oskar Vanhove, an independent developer based in Belgium, operates the Sweet Off iOS app and sweet-off.app and is responsible for the personal data described here. Contact oskar@prikkl.app for privacy questions and requests.
2. Data stored on your device
Food and weight logs, goals, preferences, progress photos, custom recipes and chat history are stored in the app on your device. Saved images remain in app storage until deleted or the app is removed. Device backups are managed by Apple and your device settings. Sweet Off does not provide CloudKit synchronization.
Local storage does not mean all processing stays on your phone. The connected features and service providers below receive the data described for their functions. Sweet Off does not sell your personal data.
3. Camera, food analysis and AI chat
- Barcodes: The camera detects barcode numbers on your device. The number is sent to nutrition providers to find a product; barcode lookup does not require uploading the camera feed. Providers include Open Food Facts, USDA FoodData Central and, when enabled, fatsecret or Nutritionix.
- Food and label analysis: Selected food photos and meal descriptions are sent to Google Gemini to estimate nutrition. Derived food names may also be checked against USDA and Open Food Facts. Do not include faces, private documents or unrelated personal information in a food photo.
- Chat: Google Gemini receives your message, recent conversation, saved goals, motivation, craving triggers and coaching preferences. Version 1.0.7 excludes your name, weight logs and progress photos from the automatic chat context. Information you type yourself is still part of the message sent.
- Permission and control: Version 1.0.7 introduces separate permission prompts for food analysis and chat before cloud AI sharing. You can decline and enter sugar manually, or change permission in Profile → AI & privacy. Revoking permission stops future sharing but cannot recall requests already sent. Earlier app versions do not include these controls; update to use them.
- Cloud processing: Version 1.0.7 routes private API requests through the Sweet Off server. Our API does not save photo or chat request bodies. Google processes requests under the Gemini API terms; its retention and use of submitted content depend on the service terms and project configuration. We do not promise that provider-side processing or retention ends immediately after a response.
- Device permissions: Camera, photo library, microphone and speech-recognition access follow system permissions. Dictation uses the system speech service and may involve Apple’s processing, depending on the device and recognition settings. You can revoke these permissions in iOS Settings.
4. Service identity and security
Cloudflare hosts the Sweet Off API and processes request data and network information to provide this service. The API issues a random session token without requiring a name or email. The token is stored on your device; Cloudflare D1 stores only its hash with a 30-day expiry. Request counters use hashed session and IP identifiers to limit abuse and expire within a day. Hourly cleanup removes expired sessions and counters. The API also caches public USDA nutrition reference records for up to 24 hours, indexed by a hashed lookup key, to improve reliability. It does not cache your meal descriptions or photos. Supabase cloud features are disabled in this version.
In version 1.0.7, “Remove cloud session” under AI & privacy deletes this anonymous identity and turns off AI sharing. It does not delete logs stored on your device or erase information already processed by other providers. Using connected features again can create a new service identity.
5. Purchases, analytics and attribution
- Apple and RevenueCat: Apple processes App Store payments. RevenueCat processes purchase records, subscription entitlements and customer identifiers to manage access and restore purchases. It also receives your name and selected onboarding preferences, goals and motivations to personalize offers. We do not receive your payment card details.
- PostHog: We use the EU PostHog service to understand app usage and onboarding. It receives usage events, device information, installation identifiers and onboarding answers, including height and weight. Earlier versions may also have sent a name when edited in the profile. This information is not described as anonymous: activity can be linked to an installation or profile.
- AppsFlyer: We measure installations, campaigns, subscription and purchase events. AppsFlyer processes installation, device and attribution identifiers and network information. Access to Apple’s advertising identifier follows your iOS tracking permission.
- Website: sweet-off.app uses Vercel Analytics to measure page visits and technical usage information under Vercel’s policy.
6. Retention, transfers and your choices
Local data remains until you delete it or remove the app; copies in device backups follow your backup settings. Removing the app does not automatically delete provider records. Subscription, analytics, authentication and AI providers apply their own retention rules and may process data internationally, as described in their linked policies.
You can correct or delete individual logs and photos in the app and control AI sharing and system permissions. Contact us for access, correction, deletion, portability, restriction, objection, or questions about data held by us or our providers. We will handle requests under applicable data protection law. Where processing depends on consent, you can withdraw it without affecting earlier processing. You may also complain to your data protection authority, including Belgium’s Data Protection Authority.
7. Age and updates
Sweet Off is intended for people aged 16 and older. If you believe a child has provided personal data, contact us so we can investigate and address it. We update this policy as the app changes and show the revision date above.