Draft. This page is being reviewed before Ayme launches. Items in [brackets] are still being filled in.
Ayme Privacy Policy
Last updated: [DATE]
Ayme (“we”, “us”) is a calorie and nutrition tracker for iPhone, made by [LEGAL ENTITY NAME], [ADDRESS]. This policy explains what data Ayme handles, where it goes, and your choices. Ayme is for adults 18 and over.
The short version
- Your food diary, goals, weigh-ins, and body stats are stored on your iPhone. Our servers never hold your diary.
- Ayme backs up your diary to your own iCloud (run by Apple, in your Apple Account), so deleting the app or getting a new iPhone loses nothing. We never receive it, and you can turn it off in Profile › Your data. Progress photos, periods and sleep you log by hand, and Apple Health data are never in it.
- If you back up your iPhone, that backup includes what Ayme keeps on your phone, as it does for your other apps: iCloud Backup (Apple’s, encrypted, in your own Apple Account) or a backup to a computer. We never receive that backup either.
- Raw Apple Health data stays on your iPhone. If you use the AI coach, it gets short summaries with your message (today’s steps, active energy, and workouts, and your recent sleep hours and times), which you can turn off in Profile › Coach. Nothing from Health is stored on our servers.
- Label photos stay on your iPhone.
- We don’t sell your data, show ads, or share health data with advertisers or analytics companies.
- Anonymous counts. The app adds 1 to a few daily totals on our server (finished setup, logged a first food, saw the Premium screen, started a trial or subscription, redeemed a code, came back after a week). Only the event’s name is sent: no account, device ID, or IP address is stored with it.
- Anything that leaves your phone is optional: the AI coach and sharing foods each need your action or consent, and you can turn them off.
1. Data on your iPhone
| Data | Why |
|---|---|
| Foods you log, meals, servings, and times | Your diary and daily totals |
| Goals, calorie and macro targets, activity level, pace | Your targets |
| How you eat (vegetarian, vegan, pescatarian), allergies, and foods you avoid | Keeping Ayme’s food ideas and the coach’s suggestions to what you eat; on your phone |
| Sex, birth year, height, weight entries | Calculating targets and your weight trend |
| Body measurements you enter (waist, hips, etc.) | Showing your progress; on your phone |
| Progress photos, and period dates and sleep you log by hand | Showing your progress, your cycle, and your sleep. Kept in a separate database on your phone, never on our servers. Never sent to us or to the coach |
| Custom foods and foods from label scans | So you can log them again |
| Photos of nutrition labels | Reading the numbers on your phone; never uploaded |
| Apple Health data (steps and movement, active and resting energy, workouts, weight, sleep and its stages, heart rate, resting heart rate, HRV, breathing rate, blood oxygen, wrist temperature, VO₂ max, cycle if you turn it on, blood pressure, ECG results and Apple’s heart and sleep notifications) | Showing activity and calories burned, Your body (readiness, sleep, stress, vitals, heart health, blood pressure, and cycle, each against your own usual), and making a workout lighter after a short night. Read and worked out on your phone, never stored on our servers. Only summaries of steps, energy, workouts, and sleep leave it, to the coach, if you use it and allow it |
| Coach chat history | Showing your conversation; kept on your phone, not on our servers |
| Workouts you log: exercises, sets, reps, weights, routines, training answers | Your training history, progress, and suggestions; on your phone |
We don’t keep a copy of this data on our servers. It stays with you.
Your iPhone’s own backup. Like your other apps’ data, the data above is included in your iPhone’s own backup, if you use one: iCloud Backup (run by Apple, encrypted, and stored in your own Apple Account) or a backup to a computer. You turn that backup on or off in iOS, not in Ayme. Restoring it on a new iPhone brings Ayme’s data with it. We never receive or see it.
Your diary’s backup in your iCloud. While iCloud Drive is on for Ayme, the app saves a compressed copy of your diary database (your foods, goals, weigh-ins, workouts, measurements, and settings) in Ayme’s own folder in your iCloud, when you leave the app and at most once an hour. It keeps the newest few. Apple stores it in your Apple Account; we never receive it and can’t read it. It never includes progress photos, the periods and sleep you log by hand, or anything from Apple Health. When you install Ayme again or on a new iPhone, it offers the backup back. Turn it off in Profile › Your data; delete it in iPhone Settings › your name › iCloud › Manage storage › Ayme.
Deleting the app deletes this data from your phone. The backup in your iCloud stays until you delete it there; with that backup off and no iPhone backup, it’s gone, because we have no copy. You can export your diary at any time, with or without an account (section 5).
2. Data that leaves your iPhone, and only when you choose
Food search and barcode lookups. Search terms and scanned barcodes are sent to our server to find foods. They aren’t linked to your account or stored with your identity. If you’re signed in and log a food from our database, we add one to that food’s popularity count (at most 30 a day per account); we keep only the count of how many times you did this today, not which foods.
Food search and barcodes through FatSecret. Our server passes your search terms and scanned barcodes on to FatSecret (fatsecret.com), whose food database we use for US brands, restaurants, and everyday foods. FatSecret receives only the search text or barcode from our server, not your account, name, or IP address.
Barcode lookups on Open Food Facts. If our database doesn’t know a barcode, your phone may ask Open Food Facts (a public database) for it. They receive the barcode and your IP address.
Sign in with Apple (optional). Needed for the coach and sharing foods. We receive an Apple user ID and, if you choose to share it, an email address (possibly Apple’s private relay address).
AI coach (optional, with separate consent). When you send the coach a message, we send your message and a summary of your numbers (today’s totals and the names of foods you logged, your targets, 7-day averages, weight trend, Reality check estimate, this week’s training: sessions, exercise names, and sets per muscle, and how you eat and the foods you avoid, so it never suggests them, and how you like to cook; while you allow it, also summaries of your recent sleep hours and times from Apple Health (never the sleep you log by hand), and, once Apple Health is connected, today’s steps, active energy, and workouts) to OpenAI (model gpt-4o-mini), which writes the reply.
Logging a meal by typing (optional, same consent). When you describe a meal in words, we send only that text to OpenAI (gpt-4o-mini), which splits it into foods. The app then looks the foods up in our database on your phone, and you confirm before anything is logged. We don’t store the text with your account; we keep token counts for cost control. To answer repeat meals faster, our server keeps the foods found for a typed meal for up to 30 days, filed under a one-way fingerprint of the words and with nothing that identifies you. Your phone keeps its own copy of your results. We don’t send your name, email, Apple Account, photos, or raw Apple Health data. We don’t store your messages on our servers; we keep token counts per reply for cost control. OpenAI processes this data under its API terms: it may keep API data for up to 30 days to check for abuse, then deletes it, and it doesn’t use it to train its models [confirm before publishing]. If we change AI provider, or what we send, the app asks for your consent again.
Sharing foods (optional; signed in only). When you create a food or save one from a label, “Share with everyone” (on unless you turn it off) sends its name, brand, barcode, serving, and numbers, never the photo, and for a label what the app read. Shared foods are shown to everyone in search without your name or account; we keep which account sent each one, only to stop spam and count agreement, and never show it to anyone.
Subscriptions. [From Phase 8:] Apple processes payments. Our subscription provider (RevenueCat) receives your account ID and purchase history to tell us whether your subscription is active. We never receive your payment details.
Crash reports. [From Phase 6:] If the app crashes, a report (device model, iOS version, app version, and what the app was doing) goes to our crash reporting service ([Sentry]). We configure it to exclude health and food data.
3. Where data is stored
Our servers are run by Supabase in the United States (Oregon, us-west-2). The AI provider and our subscription and crash reporting providers may process data in the United States. [For Quebec: we’ve assessed these transfers and apply contractual protections.]
4. How long we keep it
- Your diary: we keep none of it; it stays on your phone (and in your iPhone’s own backup).
- Coach usage records (token counts): [12 months].
- Shared foods: until you delete your account, or [N years].
- Popularity and usage counts: [90 days].
5. Your choices and rights
- See and export: Profile › More › Export diary, weigh-ins, or measurements (CSV) gives you a copy at any time, with or without an account.
- Correct: edit or delete any entry in the app.
- Turn off: sign out; stop sharing with the coach (Profile › Coach); turn off label sharing on the review screen.
- Delete: Profile › Account › Delete account permanently deletes your account, coach consent and usage records, shared foods, and subscription status on our servers. Data on your phone stays until you delete the app; an iPhone backup keeps its copy until that backup is replaced or deleted.
- Depending on where you live (including Washington, California, other US states, and Canada), you may have more rights, such as knowing what we have or withdrawing consent. Contact us to use them; we’ll respond within the time the law requires. You can appeal a decision by replying to our response.
Washington residents: see our Consumer Health Data Privacy Policy.
6. Security
What we hold (your account, shared foods, coach usage records) is encrypted in transit (HTTPS) and at rest on our servers. Your diary is never on our servers.
7. Children
Ayme isn’t meant for anyone under 18, and we don’t knowingly collect data from them.
8. Changes
We’ll update this page and the date above, and tell you in the app about significant changes.
9. Contact
[CONTACT EMAIL]. Privacy officer (including for Quebec): [NAME, TITLE, EMAIL].