Privacy Policy

1. Who we are

FoodBuddy is provided by NECULAI RAUL - INOCENȚIU PERSOANĂ FIZICĂ AUTORIZATĂ, a Romanian authorised natural person (PFA). We are the controller of the personal data described here.

• Registered office: Strada Principală nr. 465A, Sat Șura Mare, Comuna Șura Mare, Județ Sibiu, 557265, România
• Trade Register number: F32/597/29.07.2021 (EUID ROONRC.F32/597/2021)
• Tax ID (CUI): 44666419, VAT number RO44666419
• Email for everything, including privacy requests: contact@neculairaul.com

We have not appointed a data protection officer, because the law does not require one for us. Write to the address above with any privacy question.

2. What this policy covers

This policy covers the FoodBuddy app for iPhone and this website. It explains what we collect, why, where it goes, how long we keep it, and what you can do about it. It does not cover other services you reach from FoodBuddy, such as Apple Health, Sign in with Apple or Google, or recipe websites you import from; their own policies apply.

3. What we collect

Your account

• Email address, if you sign in with an email code (we send a 6-digit code, there is no password).
• If you use Sign in with Apple or Google: the identifier and email address they give us. For Apple, we also keep a refresh token, only so we can revoke FoodBuddy's access when you delete your account.
• A random user ID.
• Optionally: first name, last name and a display name.

Your profile and targets

What you enter during setup and in Settings: date of birth, sex used for the calculations (or "unspecified"), height, weight and goal weight, optional body fat percentage, activity level, goal and pace, whether you are pregnant or breastfeeding, your calorie and macro targets and how they were calculated, time zone, language, units, meal settings, water goal, and display settings such as "Hide numbers" and Buddy.

Your diary

Foods and amounts you log, meals, notes, water, weigh-ins (with optional notes), favourites, saved meals, recipes, foods you create, and your streak.

Content you share

• Foods you share with the community, and reports or confirmations you make about foods.
• Foods and notes you send to a partner.

AI inputs, only if you agree

Label photos, meal photos (with an optional hint), text you type or say to describe a meal, recipe links and cookbook photos. We keep the structured result of a label scan (the values read, and any corrections you make) and, for every AI request, a usage record (which feature, when, how many tokens, the cost and whether it worked, but not the photo or text itself). Usage records let us apply the daily limits. See How FoodBuddy uses AI.

Consent records

Which consent you gave or withdrew, when, the policy version, the app version and the platform.

Apple Health (iPhone only, only if you connect it)

• FoodBuddy writes nutrition (energy, protein, carbohydrates, fat, saturated fat, fibre, sugar, sodium), water and weigh-ins to Apple Health.
• FoodBuddy reads your weight, and your steps and active energy only if you turn on "Show steps".
• Steps and active energy are read on your phone only and never stored or sent to us.
• Weigh-ins you import from Health are saved to your FoodBuddy diary and synced to our server like the ones you type.
• Health data is never used for ads, never sent to the AI, and never shared.

Technical data

• Crash and performance reports (Sentry): device model, operating system, app version and the error details. We remove email addresses, request contents and any food or diary information before a report is sent. Performance data is collected for 10 % of sessions.
• IP addresses are seen by our providers' servers when your phone connects to them, and kept in their security logs.

Camera, photos and microphone

Used only for the action you start: scanning a barcode, photographing a label, a meal or a cookbook page, picking a profile photo, or scanning a partner's QR code. Photos are not uploaded unless you use an AI feature. Voice input (iPhone only) uses Apple's speech recognition: on your phone when your language supports it, otherwise Apple processes the audio. FoodBuddy does not record or keep audio.

What we do not collect

Location, contacts, advertising identifiers or browsing history. There are no ads, no tracking across apps or websites, no data sales and no analytics SDKs in the app.

4. Why we use your data, and the legal basis

You can withdraw an AI consent at any time in Settings → Privacy, and unpair partners at any time. FoodBuddy cannot keep a diary without the health data consent, so you withdraw it by deleting your account. Withdrawing consent does not affect what was done before.

5. Who processes data for us

These providers process data only on our instructions, under data processing terms.

Other parties you interact with through FoodBuddy act on their own account, not as our processors:

• Open Food Facts: when our server cannot fetch a product, your phone asks Open Food Facts directly using the barcode, so they see your IP address.
• USDA FoodData Central: our server sends search words only, never personal data.
• Recipe websites: when you import a link, our server fetches that page. The website sees our server, not you.
• Apple and Google: Sign in with Apple, Sign in with Google, Apple Health and Apple speech recognition, under their own terms.

We do not send your contributions to Open Food Facts.

6. Transfers outside Europe

OpenAI, Expo and Vercel are in the USA, and Cloudflare operates globally. These transfers are protected by the EU-US Data Privacy Framework where the provider is certified, and by the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards.

7. Guest use

You can start FoodBuddy without an email as a guest. A guest is an anonymous account on our server: your diary syncs there just like a normal account, under a random ID with no name or email.

• Signing out as a guest deletes the guest account and its data from our server and from your phone.
• Guest accounts with no activity for 30 days are deleted automatically.
• Creating a free account keeps your diary and lets you use partners and community sharing.

Guests have lower daily AI limits.

8. Partners

You can pair with another FoodBuddy account (an account is required) by scanning a QR code, which is valid for 10 minutes. You can have up to 10 partners.

• Your partner sees your first name or display name, your meal names, and only the foods and notes you add for them.
• They never see your diary, weight or targets, and you never see theirs.
• An entry only lands in a partner's diary after they accept it.
• Either of you can unpair at any time.

9. Community foods

When you share a food with the community, or report or confirm a food, it becomes part of FoodBuddy's shared food database so other people can use it. If you delete your account, shared foods and reports stay, but they are no longer linked to you.

10. How long we keep data

11. Your rights

You have the right to access, correct, delete, restrict and port your data, to object to processing based on legitimate interests, and to withdraw consent at any time.

• In the app: Settings → Account & data → Download my data gives you a ZIP file with your diary, foods, weigh-ins and recipes as JSON and CSV. Delete account deletes everything (see section 12). AI consents are in Settings → Privacy.
• By email: write to contact@neculairaul.com from the email address on your account. We answer within one month.
• Complaints: you can complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or to the authority where you live or work.

12. Deleting your account

In the app: Settings → Account & data → Delete account. This deletes your account, profile, diary, weigh-ins, targets, private foods, recipes and saved meals, favourites, label scans, consent records, partners and partner entries, and any export files, and revokes FoodBuddy's Sign in with Apple access. The app also wipes its data and reminders on your phone.

What stays:

• Foods you shared with the community, without your name.
• Data FoodBuddy wrote to Apple Health stays in Health. Remove it with "Remove FoodBuddy data from Health" in FoodBuddy's Apple Health settings, or in the Health app.
• Backups, until they expire after 7 days.

No access to the app any more? See Delete your account.

13. Children

FoodBuddy is for people aged 16 and over. Setup blocks anyone younger. People aged 16 and 17 can only use a maintain goal. If we learn that someone under 16 has an account, we delete it.

14. Security

• All connections are encrypted (TLS).
• Every database table is protected by row-level security, so an account can only read its own data.
• Data is hosted in the EU, and providers get only the access they need.
• On iPhone, FoodBuddy's local database is excluded from iCloud backup.
• Sign-in uses one-time codes or Apple and Google, so there is no password to leak.

15. This website

This website sets no cookies, runs no analytics and loads no third-party scripts. Fonts are served from this domain. Our host keeps standard access logs (IP address, time, page, browser) for a short period, at most 30 days, to run and protect the site.

16. Where FoodBuddy is offered

FoodBuddy is offered in the European Union and EEA, the United Kingdom and Switzerland. If you are in the UK or Switzerland, you have the equivalent rights under the UK GDPR or the Swiss Federal Act on Data Protection, and you can complain to the ICO or the FDPIC.

17. Changes to this policy

When we change this policy, we update the version above and show it in the app. If a change is material, for example a new purpose or a new kind of data, we ask for your consent again where the law requires it.

18. Version history

This page is also the official text. Earlier versions are available on request.