Privacy Policy

1. Who we are

What The Food is operated by AV PRO GROUP LTD, a company registered in England and Wales under company number 14692095.

We are the data controller for personal data processed in connection with the App, except where Apple or another provider acts as an independent controller (for example App Store billing).

2. Scope

This policy covers the What The Food iOS app (bundle ID com.sourdadinc.wtf), our API that powers the App, and support communications to the addresses above. It does not cover third-party websites or apps that we do not control.

3. Data we collect

Depending on how you use the App, we may process:

3.1 Account & identity

• Sign-in via Sign in with Apple or email/password through Firebase Authentication (Firebase user ID, email if provided, display name if you share it).
• App account identifiers we create to sync your data.

3.2 Profile & goals

• Goals (e.g. weight change), body details you enter (such as height, weight, age, sex where you provide them), meal schedule and preferences (language, units, theme).

3.3 Nutrition journal & library

• Meals, calories and macros, history, foods and dishes you save, photos you upload for meal recognition.

3.4 Chat & assistant

• Messages you send, meal recognition results, assistant replies generated for you.

3.5 Subscription & purchases

• Subscription status, product identifiers and purchase/restore events needed to unlock paid features. Purchases are processed by Apple; we receive status via Adapty and our servers, not your full payment card details.

3.6 Device, diagnostics & usage

• Device and app technical data (device model, OS version, app version, language).
• Crash reports (Crashlytics) and product analytics events (PostHog) such as capture, recognition and adding a meal.
• Push notification tokens (OneSignal / APNs) if you allow notifications.

3.7 Apple Health (optional)

• Only if you grant HealthKit permission: types you approve (for example body mass, steps, body fat). We may write weight you log in the App and journal calorie estimates back to Health when you allow write access.

3.8 Support

• Content of emails you send to us, and any diagnostic block you choose to include from the App.

4. Legal bases (UK GDPR)

We process personal data only where a UK GDPR legal basis applies, including:

• Contract — to provide the App you asked for (account, journal, sync, chat, subscription entitlements).
• Legitimate interests — to keep the App secure, fix crashes, understand product usage in aggregate, and improve features, balanced against your rights.
• Consent — where required, for example Apple Health access and push notifications. You can withdraw consent in iOS Settings (or Health / Notifications) without affecting other lawful processing.
• Legal obligation — where we must keep or disclose information to comply with law.

Nutrition and health-related data can be special category data. Where we process it, we do so to provide the App features you request (contract / explicit consent for HealthKit) and we do not use it for third-party advertising.

5. How we use data

• Operate the journal, library, chat assistant and sync across your sessions and devices.
• Personalise estimates and assistant context from the profile and history you provide.
• Process and restore subscriptions and enforce plan limits.
• Send notifications you enabled (meal reminders, recognition ready, and similar).
• Analyse product usage and diagnose crashes to improve reliability.
• Respond to support requests and protect against abuse or fraud.
• Comply with applicable law and App Store / platform requirements.

The App provides nutrition logging and educational assistance. It is not medical advice, diagnosis or treatment.

6. Apple Health

Health access is optional. You choose which HealthKit types to allow. Health data remains under your control on the device; we read or write only what you permit. You can revoke access at any time in iPhone Settings → Health → Data Access & Devices (or the App’s permission prompts). Revoking Health does not delete your journal in What The Food; use account deletion or support for that.

7. Apple Ads and tracking

If you install the App after interacting with an Apple Ads campaign, Apple may attribute that install using the AdServices framework. Our subscription SDK (Adapty) can receive that attribution token. This path does not require the App Tracking Transparency “Allow Tracking” prompt and does not rely on IDFA for Apple Ads attribution.

We do not currently use Meta, AppsFlyer or similar MMP SDKs. If that changes, we will update this policy and any required consent prompts before enabling them.

8. Processors and other recipients

We use service providers who process data on our instructions:

• Google Firebase / Google Cloud — authentication, Firestore documents, cloud infrastructure for our API, Crashlytics crash reports, and Firebase’s basic automatic analytics (we do not add custom Firebase Analytics events). Region for our Cloud Run / Tasks stack: us-central1 (United States).
• OneSignal — push delivery (device and notification tokens). Policy: onesignal.com/privacy_policy.
• PostHog — product analytics. Policy: posthog.com/privacy.
• FatSecret — food search / nutrition reference; we send search queries, we do not host their database. Policy: fatsecret.com/terms.
• Adapty — subscription products, paywall, purchase status, restore, and Apple Ads attribution intake. Device identifiers and Apple receipt/status as needed. Policy: adapty.io/privacy-policy.
• Apple — Sign in with Apple, App Store / In-App Purchase, HealthKit, push (APNs), and Apple Ads attribution where applicable. Apple’s rules and privacy notices apply to those services. Refunds for IAP are handled by Apple.

We may disclose data if required by law, or to protect rights, safety and integrity of the service, users or the public.

9. International transfers

We are established in the United Kingdom. Some processors are located in the United States or other countries. Where UK GDPR requires safeguards for transfers outside the UK, we rely on appropriate mechanisms such as the UK International Data Transfer Agreement / Addendum, Standard Contractual Clauses, or an adequacy decision, as applicable to each provider.

10. Retention

• Account data — while your account is active.
• After deletion — we delete or irreversibly anonymise personal data from production systems within a reasonable period after a verified deletion request, except where we must retain limited records for legal, security, tax or accounting reasons, or backups that rotate out on a fixed schedule.
• Local cache — journal, library and chat copies on your iPhone; cleared when you delete data in-app, uninstall, or as part of account deletion flows.
• Crash / analytics — retained according to the processor’s defaults and our configuration, typically for a limited operational window.

11. Security

We use industry-standard measures appropriate to the risk, including encrypted transport (HTTPS/TLS), access controls on cloud projects, and authenticated API access. No method of transmission or storage is 100% secure; please protect your device passcode and Apple ID.

12. Your rights

Under UK GDPR you may have the right to:

• access your personal data;
• rectify inaccurate data;
• erase data (“right to be forgotten”);
• restrict or object to certain processing;
• data portability (export);
• withdraw consent where processing is based on consent.

To exercise these rights, email support@whatthefood.co.uk from the address associated with your account (or include enough detail for us to verify you). We may need to confirm your identity before acting.

You can also manage Apple Health and notification permissions on the device at any time.

13. Children

The App is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided data, contact us and we will delete it. Where local law sets a higher digital consent age, that higher age applies.

14. Changes

We may update this policy. The “Effective” and “Last updated” dates above will change when we do. Material changes will be reflected on this page. Continued use of the App after the effective date means you acknowledge the updated policy.

15. Contact and complaints

If you are unhappy with how we handle your data, you may complain to the UK Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint.