Draft for review. Effective date, company name and contact address to be filled in before release. Lines marked "For the lawyer" are open questions and come out before release.
Celorbix privacy policy
Celorbix helps you log what you eat by speaking, typing, scanning a barcode or taking a photo, estimates its nutrition, tracks your health numbers next to it, and offers a coach, groups and professionals. This policy says what we collect, why, who else handles it, where it is kept, and the choices you have.
The short version
- Your diary is on your phone and on our servers. Your blood sugar, blood pressure, HbA1c, the answers about your conditions and what Apple Health holds stay on your phone unless you choose to send them: by turning on Celorbix AI, or by sharing with a professional.
- Reading a photo, turning speech into text when your phone can't, and Celorbix AI use outside AI companies. We name them below.
- We do not sell your data, use it for advertising, or use your diary to train models.
- You can download what the server holds and delete your account from the app.
What we collect
What you log and set
- What you log. The foods, amounts, times, meal types and places (home, street, restaurant) you record, and any changes you make to them.
- What you say or type to log. Speech is turned into text on your phone when your phone can do that for your language. Where Apple's recogniser has your language but your phone can't run it alone, your speech goes through Apple's speech service, and the app shows "via Apple". Where your phone has no recogniser for your language (Apple lists none for Marathi today), or what it heard is no food we know, the app asks you first, once. If you agree, the recording is sent to our server and to Groq to be turned into text, and the app shows "sent to Celorbix" while you speak; you can change your answer in Settings → Logging. The text of what you typed or said is sent to our server so it can match foods.
- Photos you choose to send. A photo of a plate, a label, a menu or a receipt, only when you take or pick one in the app. A meal's photo is read by Google's Gemini, and may be retouched by it to look its best.
- A food we don't know. If what you type or say is in none of our food lists, those words alone, with nothing about you, go to Google's Gemini for an estimate.
- A swap for a dish. With Celorbix AI on, when our own lists have no swap for a dish, its name alone and your country, with nothing about you, go to our server and on to Google's Gemini once; the answer is kept for everyone who logs that dish. Your allergies, how you eat and your goal are applied on your phone and aren't sent for this.
- Foods you add. Their name, serving and nutrition are kept with your account so every phone of yours knows them. If you turn "Share with Celorbix" on (it starts off), a copy (not your name or account) is reviewed by our team and may be added to the food list for everyone.
- Numbers you enter yourself. Weight, waist, body fat, water, steps, exercise, distance, sleep, heart rate, blood oxygen, temperature, finished fasts and your daily energy check are kept with your account so your phones agree.
- Settings. Your languages, region and country of food, cooking profile, when your day starts, your goals and daily targets and your preferred input method.
- Feedback you send. What you write in "Help and feedback" or "Report a problem", a screenshot if you add one, your app's version and build, your phone's model and system version, your language and country, and our replies. A report also carries the foods in the meal you were logging. Our team reads it, shown without your name or email. An AI assistant sorts it and drafts a reply, seeing only your words with any email address or phone number taken out, and the app's build. It never sees your name, your account, your screenshot or the meal, and words about your health or about hurting yourself are not sent to it at all.
About you
- Notifications. If you allow them, your phone gets a token from Apple or Google, and we keep it with your account so we can tell you that we've answered your feedback or that something is new in Community. All Apple or Google receive from us is that token, a fixed sentence and a random id: no words of yours, no name, and no group. The id means something only to your signed-in app. The token goes when you sign out or delete your account.
- Account. If you sign in with Apple, Google, Facebook or Microsoft, the name and email the provider shares and a one-way hash of your provider identifier. If you sign up with an email, that address, a one-way hash of it and a salted one-way hash of your password; we can't read the password. Test builds can also use a random key kept on the phone instead of an account.
- Date of birth. Kept with your account, to confirm you are 18 or over and to set goals. If you agreed to marketing, it is also used for birthday offers; you can withdraw that at any time.
- Sex, height, your goal in your own words, your aims and what you track. Kept on your phone. Your date of birth also comes back to a new phone from your account.
- Allergies and how you eat. They stay on this phone, where they warn you about a food before you save it, unless you turn the AI coach on.
- Conditions you tick (such as diabetes, heart, pregnancy or an eating disorder) and your answers to their questions. These are health data. They are kept on your phone, and leave it only as described under "Celorbix AI".
- Blood sugar, blood pressure and HbA1c. These are health data. They are kept on your phone, and our server refuses to store them with your account. They leave your phone only through Celorbix AI or a professional you share with.
- Your phone's own backup. If you back up your phone to iCloud or Google, that backup includes what Celorbix keeps on your phone, health data too, under your own account with Apple or Google. Your sign-in stays out of it, so after restoring to a new phone you sign in again.
Apple Health, Oura and WHOOP
Apple Health. If you connect it, Celorbix reads your steps, energy burned, exercise, sleep, heart rate, heart rate variability, blood oxygen, breathing rate and weight to show them next to what you eat. It reads them on your phone. They do not leave it unless you choose: Celorbix AI sends steps, sleep, resting heart rate and weight, and a professional you share with receives the kinds you pick. If you allow it, Celorbix also saves what you log (meals, water, weight and readings) to Apple Health. You can turn access off at any time in the Health app → Sharing → Apps → Celorbix.
Oura and WHOOP. If you link one of these accounts, you sign in on its own page and Celorbix never sees your password. Your phone then reads your readiness or recovery score, sleep score, overnight heart rate variability and, for WHOOP, strain, directly from that service, and keeps them and the access tokens on your phone only. Our server helps with the sign-in and passes the tokens to your phone without keeping them. All we store is that you linked the account, what it allows, which wording you agreed to, and when you linked and disconnected it. You can disconnect at any time in Settings → Connected apps, and choose to delete what came in. Oura and WHOOP handle your data under their own privacy policies.
The rest
- Plans. If you subscribe: the App Store's transaction id, the product, when it renews or ends, and whether it was refunded. Apple tells our server when any of these change. We count how many photos and AI answers your plan has used. Payment is through Apple; we never see your card.
- Device and app data. A random device identifier, the app version, and crash and hang reports from Apple's MetricKit (the code location and versions; not what you logged).
- Location. We do not collect your precise location. When you tap "Use my location" to find a professional, it is rounded to about a kilometre, used for that search and never kept. A group you start has the place you give it, rounded the same way.
We do not collect your contacts, advertising identifiers or anything from other apps.
Celorbix AI: the coach
Without Celorbix AI, the coach's answers come from your phone and nothing is sent. Celorbix AI is off until you turn it on, in the coach or on the coach's terms; signing those terms does not turn it on. You can turn it off at any time. We record each choice.
Each question. With it on, each question and the last few messages go to our server and on to Groq, the company that runs the model, with a summary of you: your birth year and sex; the conditions you ticked and your diabetes type; your allergies and how you eat; your goal in your own words, your aims, targets and what you track; the country you eat in; today's meals; the past week's calories; your blood sugar and how it rose after meals; today's water and steps; last night's sleep; your resting heart rate; your weight; and your streak.
Your plan. Making a plan from your month sends the same way: a month of your days, with each meal's foods, time and calories; carbs, protein, sugar, fibre and glycemic load; your eating windows and fasts; steps, sleep, resting heart rate and weight, including from Apple Health if you connected it; blood sugar readings with their times; your daily energy check; your goal, aims and targets; the conditions you ticked with your answers to their questions; your allergies and how you eat; whether fasting is safe for you and why not; your birth year, sex and height.
Your name, email and photos are not sent. Our server does not store or log what it passes on, though it does check that your yes is on record. A question suggesting you may harm yourself is never sent to the AI: you get a line to call instead. Groq's terms say it does not train on this data.
The coach's terms, if you sign them, are kept with your account: the version, the name you typed, a hash of the text and when you signed.
For the lawyer: Groq's data retention. Whether our account has zero data retention on, and a data processing agreement, is not confirmed (D146). Is what is said here about Groq enough for GDPR Art. 13 and Art. 9(2)(a), and for App Store guideline 5.1.2(i) on third-party AI? Is the coach's plan "profiling" under Art. 22?
Professionals
In India, the United States and Mexico you can connect with a dietitian, doctor or trainer whose credentials we have checked. Not in France yet. If you connect with one:
- You choose what they see: meals, blood sugar, weight, sleep, activity, fasting and your goal. Your phone sends those days to our server for them to read, for the last 90 days at most. Our server stores them encrypted. Stop sharing a kind, or the connection, and its days are deleted at once.
- You can see each time they opened your data and what they saw.
- Messages, notes and plans between you are kept and seen by both of you, including meal and exercise plans they send you. A plan stays readable after the connection ends, until you delete your account.
- When you use "Use my location" or a code to find them, see "Location" above. If you report a professional, we keep your report.
If you join as a professional, we keep your profile, your library of plans, the credentials you give and the documents proving them, and show checked ones to people looking for you (never the number). A professional's own care of you is their responsibility and subject to the rules of their profession.
For the lawyer: who is the controller of what a professional reads (we, or they, or jointly), and whether a data processing agreement with each professional is needed. India's DPDP Act, HIPAA's reach in the US, and Mexico's LFPDPPP as they apply to this. France stays closed until this review is done (D147).
Community groups
- Groups use a handle and a name you choose. They never read your food or health data. What you post is seen by the group's members.
- A share card shows only what you chose to show; it needs your yes each time and you can take it back.
- Automatic rules check each post and comment before it appears, and may hold or refuse it. An AI model (Groq, as above) may take a second look at the text. Words suggesting someone may harm themself are held, shown to our staff, and answered at once with where to get help.
- Members can report posts. Moderators and our staff act on reports, and the record of what they did is kept.
- A group you start has the place you give it, rounded to about a kilometre.
For the lawyer: moderation records and EU DSA Art. 17; India's IT Rules 2021 (grievance deadlines); whether holding self-harm posts and showing them to staff needs anything further said here.
The website
- Reading the public pages sets no cookie and runs no analytics or advertising. Like any web server, ours logs your address and what was asked for, to keep the service running.
- Signing in on the website sets one cookie, which scripts can't read, that keeps you signed in for at most 7 days, and for a few minutes a second one that proves a sign-in with Apple or Google came from your browser. We don't use cookies for anything else.
- Logging is in the apps. The website shows your reports and lets you download your data and manage your account. It sends nothing you log to an AI. A professional's own tools are there too.
- What the website shows is only what our server holds. Blood sugar, blood pressure, HbA1c and the answers about your conditions aren't there, because they stay on your phone.
For the lawyer: the website's sign-in doesn't take a separate yes to these terms beyond a line on the first screen. Is that enough? Is a notice about these two strictly necessary cookies enough under the ePrivacy rules if the EU opens?
Why we use it
- To recognise the foods you log and estimate their nutrition, and to keep your diary across your devices.
- To make logging faster: your usual foods and portions, and the food lists kept on your phone.
- To give you the coach, your groups and your connection with a professional, when you use them.
- To keep your plan's limits and to know what you have paid for.
- To keep the community safe, and to confirm you are 18 or over.
- To fix problems and improve recognition, using crash reports and the problems you report.
We do not sell your data, we do not use it for advertising, and we do not use your diary to train models.
Who else handles it
| Who | What for | What they get |
|---|---|---|
| Google Cloud (Mumbai, India) | Runs our server and database | What our server holds |
| Groq | Celorbix AI; speech your phone can't recognise; a second look at group posts if that is on | The summary and the month described above, your question and its messages; the recording; the post's text |
| Google (Gemini, on a paid plan) | Reading photos and nutrition labels; retouching a meal's photo; estimating a food in none of our lists; finding a swap for a dish; sorting feedback and drafting a reply for our team | The photo; the words of that food; the dish's name and your country; the words of your feedback, as described above. On this plan Google does not use prompts and responses to improve its products, and logs them for a limited time for policy and legal reasons. |
| Apple | Sign-in, purchases, Apple Health on your phone, crash reports, speech where your phone can't recognise it alone | What each of those needs; Apple's own policy applies |
| Google, Facebook, Microsoft | Sign-in, if you choose them | What signing in needs; their own policies apply |
| Our email delivery service | Sign-up and password codes, if you sign up with an email | Your email address and that message |
| Oura, WHOOP | Linked accounts, if you link one | Your sign-in on their own page; your phone reads from them |
| A professional you connect with | Your care | The kinds of data you chose, and your messages |
For the lawyer: feedback (D198). Someone can write anything in it, health details included, though a word list keeps the obvious ones from the AI. Is telling them on the screen they send it from, and here, enough, with no separate yes?
For the lawyer: a data processing agreement with each processor above, in particular Groq and Google. Confirm the Gemini wording against Google's current terms, and whether photos count as health data.
Where it is kept and for how long
- Your diary is kept on your phone and on our servers in Mumbai, India, whichever country you are in.
- A recording, when it is sent to our server, is deleted within 24 hours.
- A photo of a meal you did not save is deleted within 24 hours. The photo you sent for a saved meal is kept for 30 days for processing, then deleted.
- The retouched copy of a saved meal's photo stays with the meal, so another phone or a reinstall can show it, until you delete the meal or your account.
- Your diary, settings, numbers and account details are kept until you delete them or your account.
- A screenshot you add to feedback is deleted after 90 days. The words and our replies are kept until you delete your account.
- A day you shared with a professional is deleted when you stop sharing that kind or the connection ends.
- We keep encrypted backups in a second place in India, Delhi, so a failure can't lose your diary. The database is copied every 10 minutes and your photos once a day. Most copies are deleted within 8 days, and every copy within 35 days. So something you delete, or your whole account, can stay in a backup for up to 35 days. Backups are used only to recover from a failure, and the key that opens them isn't kept on our servers.
- When your account is deleted we keep only its bare id, so that if a backup is ever restored the account is removed again. If a subscription was refunded, we also keep a one-way hash of its App Store transaction id and the refund's dates, so that a copy of the purchase can't buy Pro on a new account. Neither says anything else about you.
For the lawyer: people in France and the EU have their data held in India. Transfers under GDPR Chapter V need a basis (standard contractual clauses and a transfer assessment); France's rules on hosting health data (HDS) may apply; an EU representative under Art. 27 may be needed.
For the lawyer: backups (D181). Is 35 days acceptable for data someone has erased (GDPR Art. 17, India's DPDP Act), and is this wording enough? Older dumps taken by hand are on a laptop in the US, and two old disk copies are in Mumbai: this sentence isn't true of them until they are deleted. Restoring a backup doesn't yet remove deleted accounts again by itself, as the last line of this list says it does (CLOUDSECOPS G13).
Your choices and rights
- Download your data: Settings → Your data → Download my data, or Reports on the website, gives you one file with everything our server holds about you: your account and date of birth, diary, numbers, consents, coach's terms, plan and its counters, what you shared with professionals and your conversations with them, your groups and what you wrote in them, and links that work for a day to each photo we still hold. What stays only on your phone (such as blood sugar and your conditions) is not in that file because we do not have it; you can see it in the app.
- Correct it: edit or delete any meal in the diary, and change any setting or number.
- Delete your account: Settings → Your data → Delete my account, or Account on the website, removes your account and its data from our servers and from the phone, including your community name, posts, comments and reactions, and comments others left under your posts. A group you own passes to its next moderator or member, or closes if nobody is left. Reports you made stay for the moderators without your name or note. It cannot be undone. Cancel any subscription with Apple as well; deleting your account does not end it.
- Withdraw a choice: Celorbix AI, sharing with a professional, marketing, reminders and linked accounts can each be turned off in the app at any time.
- Permissions for the microphone, camera, photos and location are asked only when you first use them and can be changed in iOS Settings.
If you are in India
You have the rights given by the Digital Personal Data Protection Act, 2023, including access, correction, erasure and grievance redressal. Contact our grievance officer at the address below.
If you are in the European Union (including France) or the United Kingdom
Under the GDPR you may access your data, have it corrected or erased, restrict or object to its use, receive it in a portable form, and withdraw any consent at any time without affecting what was done before. You may also complain to your data protection authority (in France, the CNIL).
We use your data to provide the service you asked for (contract), to keep the service safe and working (legitimate interests), and to meet legal duties. We use your health data, including what you log where it reveals your health, only with your explicit consent, which you can withdraw in the app.
For the lawyer: confirm these legal bases, and whether a food diary as a whole is Art. 9 health data, in which case consent must be taken at sign-up (today it is taken for Celorbix AI, reminders, marketing, linked accounts and sharing, not for the diary itself). A data protection impact assessment, and a DPO, are likely needed for health data at scale. Age of consent is not at issue while the app is 18+.
If you are in the United States or Mexico
For the lawyer: US state consumer-health laws (Washington's My Health My Data Act and others) may require their own notice and consent; California's CCPA/CPRA rights. Mexico's LFPDPPP (aviso de privacidad, ARCO rights). A Spanish and a French version of this policy may be required.
Health information
Celorbix gives nutrition estimates and general guidance, not medical advice. The numbers are estimates from recipes, labels and published values and can be wrong. Talk to a doctor or dietitian about your diet and health. In an emergency, call your local emergency number.
Children
Celorbix is for adults 18 and over, and we do not knowingly collect children's data.
Contact
[Company name], [postal address]. Grievance officer: [name], [email]. Data protection contact: [name], [email].
We will post changes to this policy here and tell you in the app if they are significant.