‹ Nutrition Tracker

Privacy policy

Last updated 1 November 2026

Nutrition Tracker is a food, activity and sleep diary with an AI assistant that estimates what you describe. It is run by Beyond Simplicity LLC (“we”, “us”). This page says, in plain words, what the app keeps about you, why, who can see it, and how to see, export or delete it.

What we keep

Your account

Your email address, which is how you sign in — there are no passwords. Sign-in codes and links are single-use, expire within minutes, and are stored scrambled (hashed). We record when you last signed in.

What you log

• Food — names, amounts, calories, protein, carbohydrate, fat, sugar and vitamins and minerals, with the meal and time, and the notes the assistant wrote about its assumptions.
• Activity — what you did, the calories it burned, and how it should be eaten back.
• Sleep — bed and wake times, and how you slept and felt if you say so.
• How the day was — the states you mark, such as rest, sick, sore, stressed or travelling.
• Body and plan — height, weight and weight history, age, sex, everyday activity level, sleep target, your goals, plans and daily targets, and your two answers from the welcome steps — how you want the app to treat you and your main goal — which decide how your Today page is laid out.
• Body measurements — the weigh-ins and body scans you give the assistant: weight, body fat and muscle mass, with the date and time of each. The assistant reads them from your words or from a photo of a scale or a scan printout; it never estimates them.
• About me — the free text you choose to write for the assistant.
• Saved meals, and the analyses you run on Analytics (where a week’s food or activity came from).
• Meal photos you send the assistant, with the date each was last sent — see Photos and voice.
• Progress photos you add to a plan’s weeks, with the date and the slot (front, left, right, back) of each — see Progress photos.
• If you apply to become a coach: your letter, the messages between you and us about it, and our decision.
• Your time zone, so that “today” is your day and not the server’s. We never record where you are.

Much of this is information about your health. We keep it only because you enter it, and only to show it back to you — and to a coach you choose.

From Apple Health (iPhone only, only if you choose)

The iPhone app can import workouts, sleep and body weight from Apple Health. It shows them to you first; only what you accept is added to your log. The app also reads Health on the phone to time its reminders — that stays on the phone. The app never writes anything to Apple Health.

Running the service

To keep the service working and fair we keep: the IP address and account behind requests, in counters that stop abuse (for example, too many sign-in attempts) and in a list of refused requests; for each assistant request, its time, the model used, how many tokens it took and what it cost — not what you wrote; errors, with the page and account involved; and a record of changes made in the administrator’s dashboard. These records keep only a fixed number of recent entries and older ones are deleted automatically.

Error reports from the app. When something goes wrong inside the web app or the iPhone app, it tells us: what failed and where in the app, your device type and system version (for example “iPhone · iOS 18.2 · Safari”), the app version, your language setting, and the last few screens you opened and requests the app made — their addresses only, never what they carried. Never what you logged, typed or photographed. Reports are tied to your account so we can help you, and are kept like the other records above.

What we do not collect

No payment details, contacts, location, advertising identifiers or analytics trackers.

Photos and voice

Photos of a meal — or of a scale or a body-scan printout — are made smaller on your device — which also leaves out where the photo was taken and the camera’s details — sent to our server, and passed to Google’s Gemini for the estimate. We keep each photo you send, and a small preview of it, in your account’s Photos (beside Saved meals in the assistant), so you can send it again for a new estimate instead of searching your phone for it. The same photo sent twice is kept once. Each account keeps photos up to a fixed amount of space (25 MB today, about 150 photos); past it, the photos you have used least recently and least often are deleted automatically to make room — we count, per photo, when and how you used it (sent it, attached it again, saved a meal from it), and nothing else. Delete any photo there at any time; it is gone from the app at once. We also count, per account and per day, how many photos were kept, used and removed, and how much space they take, to run the service — never what is in them. Photos are never shown to anyone else — a coach included — and are not part of your log. A meal you save from a photo keeps its own small copy of the preview, so you recognise it in Saved meals; deleting the saved meal deletes that copy. The web app also keeps a small thumbnail in your browser’s own storage so the conversation still shows what you sent.

Progress photos

On a plan’s own page you can add photos of yourself to each week — up to four, front, left side, right side and back. Your device makes two smaller copies first (which also leaves out where the photo was taken and the camera’s details): a full one and a small preview, both kept in your account on our server, with the day each was taken and its slot. They are never sent to the assistant or to Google, never shown to anyone else unless you share them with a coach (see Coaching), and never deleted automatically: each account has a fixed amount of space for them (25 MB today, about 60 photos), and past it a new one is refused until you delete some. Replacing a photo deletes the one it replaces; delete any photo at any time and it is gone from the app at once, and all of them go when you delete your account. So that they open quickly, and on the iPhone without a connection, the app also keeps a copy of the photos you have looked at on your device — on the iPhone where it cannot be read while the phone is locked — and removes it when you log out or delete your account. A photo you add with no connection waits on your device and is uploaded when the connection returns; until then it exists only there, and logging out discards it. As with meal photos, we count how many are added, replaced and deleted and how much space they take — never what is in them.

Voice is turned into text on your iPhone, or by your browser’s speech recognition on the web — which, depending on the browser, may be done by its maker (for example Apple or Google). No audio ever reaches our servers, and the words go into the text box for you to check before anything is sent.

Sharing a meal

On the iPhone app you can share a proposal, a saved meal or a meal you logged with someone else — over AirDrop, Messages or anything else your phone offers. The app makes a small file holding that meal only: its name, its foods with their amounts, calories, macros, micronutrients and notes, the time it was eaten if it has one, and its small picture if it has one. Nothing about you or your account is in it — no name, email address or log. It goes only where you send it, and we keep no copy. When someone opens a meal shared with them, our server reads the file to show it as a proposal, keeps nothing of it, and adds nothing to their log until they accept it. We count, per account and per day, how many meals were shared and opened — never which.

The AI assistant and analyses

When you send the assistant a message or a photo, we send Google’s Gemini API what it needs for that answer: your message or photo; the entries, targets, sleep and day states of the day you are looking at; your “About me” text; the names of foods you logged recently in your current plan; and the names and totals of your saved meals. When you run an analysis on Analytics, we send the names, amounts and nutrition or burn of the entries in the weeks you picked. We never send your email address.

Google processes this to produce the answer, under the Gemini API terms. What comes back is a suggestion: nothing is added to your log until you accept it.

Coaching

A coach is an account we have given the coach role — one we chose, or one that applied and we approved. A coach can see your log only if you give them a one-time code (or its QR code) from Account → Coaching. Each code works once, for 24 hours, and making a new one cancels the old.

• What a linked coach sees: your Today, Plans and Analytics pages, as you see them, on any day — your food, activity, sleep and day states, your body measurements (weight, body fat, muscle mass), your plans and targets, and the body details they are worked out from (height, weight, age, sex, activity level). They also see your email address, and you see theirs.
• What they do not see: your Account page, including your “About me” text; your assistant conversations; your saved meals; your meal photos; and your progress photos, unless you share them with that coach. They cannot export your data.
• Progress photos, only if you choose: Account → Coaching has a switch for each coach, off until you turn it on — and off again on every new link. With it on, that coach can look at your progress photos on your plans’ pages; they cannot add, change, date or delete any. Their device holds them only while they look and never stores a copy. Turning the switch off takes effect on their very next step.
• They cannot change anything. The one thing a coach can do is run an analysis on Analytics; its answer is kept in your account, where you see it too, and its cost counts against the coach.
• You stay in control: Account → Coaching lists every coach who can see your log and when they last looked. Unlinking takes effect immediately. Both of you see a short history of linking and unlinking.
• We can see who coaches whom and when, but not your log through coaching. We can suspend or remove a coach at any time.

Applying to be a coach

Anyone can ask to become a coach from Account → Coaching, with a short letter. We read the letter and the messages you send us about it, and write back in the same place; you see our replies as coming from “the team”. We keep the application, the messages and our decision — with the reason, which we show you only if we choose to — so there is a record of who became a coach and why. They are deleted with your account. Until you send it, a letter you are writing is kept only on your device.

Who can see your data

• You.
• Coaches you link, as described above.
• Anyone you share a meal with — that meal only, as described in Sharing a meal.
• Us, to run the service: we have technical access to the stored data to keep it working, make backups and fix problems. We do not look through anyone’s log. Our dashboard shows accounts, usage, errors (including the app’s error reports) and coach applications — not what you logged.
• Our service providers, only for what they do for us: Railway hosts the app and stores its databases; Google (Gemini API) produces the assistant’s estimates and analyses; Resend delivers sign-in emails.

We do not sell your data, share it for advertising, or use it for anything but running the app for you.

Where it is kept, and how it is protected

Each account’s log is kept in its own database on our hosting provider’s servers, which may be outside your country, including in the United States. The app is only served over an encrypted connection (HTTPS). Sign-in and coaching codes are stored scrambled, and sessions are signed so they cannot be forged.

How long we keep it

Your log and account are kept until you delete them. Deleted entries are gone from the app at once; copies in our backups disappear as those backups are replaced, and if we ever restore one, we delete again every account that was deleted after it was made.

When you delete your account (Account → Delete account, or by asking us), it happens at once: your account, your log, your photos, your plans and saved meals, your coaching links (on both sides) and any coach application are deleted, and every device you were signed in on is signed out. A few service records are kept because they are our own books — what the assistant cost, which limits were reached, how many photos were kept or shared each day, errors and the dashboard’s audit log — but your email address is removed from them and replaced with a number (“deleted #12”), and any IP address is cleared. We also keep a note that an account with that number was deleted, and when — not who it was. The service records keep only a limited number of recent entries.

Your choices and rights

• See and export everything — Account → Export data gives you your log, your weigh-ins and body scans, and your saved meals as a file. Your photos — and the pictures on saved meals — are not in that file; you see each of them in the app.
• Correct it — tap any entry to change it.
• Delete it — entries from their edit screen; a photo from Photos; your whole account from Account → Delete account (you can download your data first), or by writing to us at the address below.
• Leave things out — the photo, voice, Apple Health and coaching features are all optional.
• Take access back — unlink any coach at any time.

Depending on where you live, you may also have the right to ask us what we hold about you, to object to or limit how we use it, and to complain to your data protection authority. Write to us and we will answer within 30 days.

On your device

The web app sets a cookie to keep you signed in, one with your time zone, and — for coaches only — one that remembers which client they are viewing. Your browser’s own storage keeps your display preferences, the day’s assistant conversation and a coach letter you have not sent yet. The iPhone app keeps your sign-in in the iPhone’s Keychain, schedules its reminders on the phone, and keeps the day’s conversation and an unsent coach letter there too. The web app also remembers, for as long as the tab is open, the last few pages and requests it made, so that an error report can say how it got there. None of these is used for tracking. When you log out, the conversation, an unsent letter and the plans and weeks you had picked are cleared from that device, so the next person to sign in on it never sees them; display preferences and the iPhone’s reminder settings stay.

Children

Nutrition Tracker is not meant for anyone under 16, and we do not knowingly keep data about them. If you believe a child has an account, write to us and we will delete it.

Changes to this policy

If what the app collects or shares changes, this page changes with it, with a new date at the top. For a change that matters, we will also tell you in the app.

Contact

Write to srbakivo@gmail.com for anything about your data or this policy.

Beyond Simplicity LLC · Nutrition Tracker