Privacy Policy

1. The information we handle

Food records: food and meal names, serving amounts, eating times and time zones, nutrition values and their sources, daily nutrient goals and limits with their change history, a goal weight and starting weight if you set one, notes and assumptions, saved foods and meals, drafts, edits, and deletion history. For a meal logged in a SayPlate chat, we also keep the calorie total, number of foods, and kinds of nutrition sources it had when first saved. These records may reveal health information or eating habits.

If you turn on SayPlate AI, we also keep the sent text and replies from SayPlate chats, their dates, food preferences you state, and search data made from those chats. We keep a record of chat deletion so an older device cannot bring a cleared chat back. We do not sync unfinished drafts.

Account and connection details: your account identifier, email address, display name, optional profile photo, sign-in provider details, session records, and approvals for connected services. Apple may supply a private relay email address. We do not receive your Apple account password. If you start without Apple sign-in, we create a guest account with an identifier and no email address. Adding Apple sign-in later keeps the same account.

Billing records for Pro: your account identifier, Stripe customer and subscription identifiers, chosen plan, payment status, and paid-through date. Stripe handles payment details on its hosted checkout and billing pages. SayPlate does not receive full card numbers and does not send food logs or health data to Stripe. Stripe may keep transaction records to meet financial and legal duties after a SayPlate account is deleted.

Device and service records: an app device identifier and device name, your chosen sync device, request identifiers, usage limits, Health sync status, nutrient types written or skipped, and error categories. Our hosting and sign-in providers also process network and security data, such as IP addresses, request times, browser or device details, and access logs.

Groups: if you start or join a group, we keep the group name and icon, its shared goals, your display name in that group, your sharing choices, when you joined, which goals you completed on which days, and cheers or nudges you send or receive. If you connect Apple Health in Groups, we also keep your workouts (activity type, start and end times, length, active calories, and distance) and your daily calories burned and steps. If you allow group alerts, we keep a push notification token for your device.

Messages you send us: your email address, support messages, attachments you choose to include, and feedback. Please leave out passwords, sign-in codes, and health details we do not need.

Optional restaurant area: you can enter a hometown or ask the iPhone app to find your current town. The app keeps the town and region on your iPhone, not your coordinates. It sends the chosen area with chat requests to help find the right restaurant. Apple handles the location lookup when you ask for it. You can turn area use off, sign out, or erase this iPhone’s SayPlate data to remove the saved area.

We receive information from you, your device, your sign-in provider, and services you connect. SayPlate does not request your contacts or advertising identifier. From Apple Health it can read your height, weight, age, sex, and active and resting calories only when you turn on a feature that uses them, and your workouts, calories burned, and steps only if you connect Apple Health in Groups.

2. How we use it

We use this information to keep your food log, calculate and display nutrition from its sources, save your regular foods, track progress against your chosen goals, sync records you choose to connect, carry out requests, manage sign-in and permissions, answer support requests, and keep the service secure. We use request and sync records to avoid duplicate changes, resolve sync failures, enforce usage limits, and investigate abuse.

To make SayPlate’s food estimates more accurate, we measure in summary form how often meals logged in chat are later changed or deleted, and how much their calories change. These measurements count meals across accounts, report no group smaller than 20 meals, and do not include food names, chat text, or your identity. We do not use them to study or make decisions about any one person.

We also keep service diagnostics for 30 days to find and fix problems: which features ran, whether they worked, error categories, counts, and how long they took. If the iPhone app crashes, it sends a crash summary: the app and iOS version, the error type, and where in SayPlate’s code it stopped. They do not include your identity, food names, chat text, or nutrition values. The app and website add a random ID for each launch or visit so we can see the steps of one visit in order. We do not store that ID with your account.

We do not sell personal data, share it for cross-context behavioral advertising, or use food or health data to target ads. We do not use your private food log to train our own AI models. We do not use your records to decide insurance, employment, credit, or medical eligibility.

3. Your iPhone, voice, and label scans

You can keep a food log locally on your iPhone. Connected features send the records needed for account sync or for your request to SayPlate’s service. The app keeps a local copy for use on your device. If you give clear consent for SayPlate AI, the app uploads old sent SayPlate chats and syncs new sent text and replies to your account. Unfinished drafts stay on your iPhone. You can clear one chat or all chats and saved food preferences without deleting logged meals.

Live AI voice sends microphone audio to OpenAI while you talk. SayPlate stores completed text turns in your account chat, not raw voice recordings. Other voice entry uses on-device speech recognition when available. Label scanning reads text on your device; Unfinished chat photos and their notes stay in protected files on your iPhone so you can return to a draft or retry a failed request. These temporary photos are removed when you finish or discard the draft, clear its chat, sign out, or erase local data. Premium meal photo analysis sends a smaller copy of your photo to OpenAI. SayPlate’s server does not save that photo. If you turn on Keep meal photos, SayPlate keeps the photo you used to log a meal on your iPhone only and never uploads it. Text and nutrition values you choose to save become part of your food log and may sync with your account.

You can change camera, microphone, speech, and location permissions in iPhone Settings. Turning off a permission may stop the feature that needs it. You can still set a hometown if you do not share your location.

4. Apple Health and health-related data

You choose whether SayPlate may write approved nutrition to Apple Health. The iPhone app requests write access to supported nutrition types, not read access to your wider Health history. It manages the Health records it creates. Connected AI apps and the SayPlate server have no direct access to HealthKit on your iPhone.

If you turn on the weight chart or the calorie estimate, the iPhone app asks to read your weight from Apple Health. It uses your weight from the past year to draw your weight trend, and your weight from the last 4 weeks, with the calories you logged, to estimate how many calories you burn. These Health readings stay on your iPhone. SayPlate does not send them to its server, to AI providers, or to connected apps. If you set a goal weight, SayPlate saves that goal and the starting weight you confirm to your account, so they show on your other devices. You can change or clear them at any time. You can turn off Weight access in the Health app at any time.

If you turn on Calories burned, the iPhone app asks to read the active and resting calories that your watch, fitness band, or iPhone saves to Apple Health. It uses them to show calories burned today and an estimate for the full day, on the Today screen and in a widget. If you also allow weight, it compares the last 4 weeks of these numbers with your weight trend and adjusts them to match. These calories stay on your iPhone. SayPlate does not send them to its server, to AI providers, or to connected apps. You can turn off Calories burned in Preferences, or Active Energy and Resting Energy access in the Health app, at any time.

If you connect Apple Health in Groups, the iPhone app reads your workouts, calories burned, and steps and sends them to SayPlate’s server while you are in at least one group, so shared goals can be checked off. Members of your groups see whether you completed each shared goal. They see your calories eaten and protein, your meals, or your workouts, steps, and calories burned only for the kinds you choose to share with that group, and you can change those choices or leave a group at any time. SayPlate does not send workout or step data to AI providers or connected apps.

Your synced SayPlate food log includes the nutrition you record. Separately, your iPhone can send sync results to SayPlate, including the meal version, nutrient types written or skipped, timestamps, and an error category. These results help show whether a Health update succeeded; they do not include a copy of your broader Health history.

We use health-related data only to provide the features you request, support them, measure their accuracy in summary form as described above, protect them, or meet legal duties. We share it with the service providers and connections described in this policy only for those purposes. We do not sell it or use it for ads. Device permission or acceptance of our terms does not replace a separate consent that the law requires.

You can revoke Health access in Apple Health. Revoking access does not erase existing Health records. Deleting a meal asks your iPhone to remove the Health records SayPlate wrote for it, but that step needs the device and permission to run. You can also manage those records directly in Apple Health.

5. Connecting ChatGPT or Claude

Connecting an AI app, such as ChatGPT from OpenAI or Claude from Anthropic, requires sign-in and your approval. The app can then send SayPlate requests and receive the records needed for the tools you use, such as saved foods, meal details, nutrition totals, goals and limits, draft results, and Health sync status. A request may include text or other details from your chat. SayPlate receives the requests sent to its tools, not automatic access to your full chat history in that app.

The company behind the app you connect receives SayPlate’s replies so the app can answer you and carry out your requests. OpenAI handles ChatGPT conversations and tool results under its privacy policy and your ChatGPT settings. Anthropic handles Claude conversations and tool results under its privacy policy and your Claude settings. Those settings may include separate retention and model-improvement choices.

You can disconnect SayPlate in the AI app’s connection controls or from your SayPlate account page. This ends that connection but does not erase your SayPlate account, previous chats, or data already held by OpenAI or Anthropic. Use each service’s controls to manage its copies.

6. Optional SayPlate AI

SayPlate uses AI to help log food and answer food questions. It can make mistakes. It is not medical advice. Check food labels and ask a health professional about health choices. After you turn it on, we send OpenAI your request and the food details needed to answer it. For restaurant searches, this can include the town you chose in Settings. We do not send your coordinates to OpenAI. For a question about past chats, we send only relevant saved text and food preferences, not your full chat history. Live voice sends microphone audio to OpenAI while you talk. Premium meal photo analysis sends a smaller copy of the photo to OpenAI. SayPlate does not save that copy. We do not send label photos or your broader Apple Health history through this feature.

We ask OpenAI not to store the API response as saved application state. That is not a promise of zero retention: OpenAI’s standard API abuse-monitoring logs may contain request and response content and may remain for up to 30 days, or longer when legally required. OpenAI states that it does not use API data to train its models by default. ChatGPT conversation settings are separate from these API controls.

7. Who receives information

We use USDA FoodData Central and Open Food Facts for public food and barcode records. Food lookup sends a food query or product barcode to USDA, and sends a barcode USDA cannot match to Open Food Facts, without your account ID or conversation history. We cache public source records and show their source links. We use Supabase for accounts and synced records, Vercel for website and server hosting, and Google Workspace for support email. These providers process the information needed to perform those tasks. Apple handles the sign-in and device services you choose to use. OpenAI receives information when you use a ChatGPT connection or the optional AI feature described above.

Members of a group you join receive your display name in that group, your goal check marks, cheers and nudges, and the food or activity details you choose to share with that group. Group alerts go through Apple’s push notification service, which receives the alert text and your device’s push token.

We may disclose limited information when the law requires it, to respond to a valid legal request, or when reasonably needed to protect people, accounts, and legal rights. We assess the request and limit the information we disclose.

If ownership of SayPlate changes, relevant records may transfer as part of that change, subject to this policy and applicable law. We will give notice of a material change in who controls your data and obtain any consent the law requires. A transfer does not grant a right to sell health data or use it for ads.

8. Browser storage and tracking

The account-connection page uses browser session storage to complete sign-in and remember a pending connection request. Sign-in providers may use their own cookies and security checks on their pages. Blocking required storage may prevent sign-in.

SayPlate does not use advertising cookies, tracking pixels, or third-party behavioral analytics. We do not change that practice based on a Do Not Track or Global Privacy Control signal because we do not sell data or share it for targeted advertising.

9. How long we keep information

Local records remain on your device until you remove them or the app’s stored data. Synced account records remain while you use the account, unless you request account deletion or we no longer need them. We do not automatically erase cloud records just because you stop opening the app.

Synced SayPlate chats and food preferences stay with your account until you delete them or close the account. Clearing a chat also removes the search data and saved preferences drawn only from that chat. We keep deletion marks to stop an old device from restoring cleared chats. Provider logs and backups may follow their own retention cycles.

Deleting a meal removes it from your active log. The synced meal record and deletion history may remain with your account so connected devices can apply the change and remove related Health entries. Deleting a meal is not the same as permanently erasing all copies or closing your account.

We keep support and security records only as needed to handle the issue, protect the service, meet legal duties, and resolve disputes. The period depends on the type of record, the risk or issue involved, and any legal requirement. Provider logs and backups can have separate retention cycles. OpenAI’s standard API log period is described in section 6; ChatGPT has separate controls.

When you request account deletion, we verify the request and remove your account and associated active records, except information we must or may lawfully retain for a specific purpose. We explain any exception and the expected timing when handling your request. Copies in backups may remain until their retention cycle ends. We do not promise that deletion from every provider’s backup is immediate.

10. Your choices and privacy requests

You can review and correct meals in the app, export your food log from Settings, and delete meals from their detail screen. In SayPlate chat you can view and forget saved food preferences, clear one chat, or clear all chats and preferences. On our website, account settings let you export your cloud records, disconnect AI apps, and permanently delete your SayPlate cloud account after a recent sign-in and confirmation. You can also revoke device permissions. Removing the app or signing out does not delete your cloud account.

For account deletion, access, correction, a copy of your data, or another privacy request, email support@sayplate.com. Use the address linked to your account if you can. If you use Apple’s private relay or cannot access that address, tell us so we can arrange another way to verify you. Do not email a password, sign-in code, or identity document unless we have agreed on a suitable secure process.

Depending on the law where you live, you may also have rights to restrict or object to processing, withdraw consent, use an authorized agent, appeal a decision, or complain to your local privacy regulator. To appeal, reply to our decision with “Privacy appeal” and explain your concern. We handle requests within the deadlines that apply to them and do not discriminate against you for exercising a privacy right.

Withdrawing consent does not undo processing that was lawful before withdrawal. A feature may stop working if it needs the information or permission you withdraw. SayPlate cannot erase records held separately by Apple Health, OpenAI, or Anthropic on your behalf through an account-deletion request; use those services’ controls too.

11. Security and processing locations

We use encrypted network connections, account access controls, and database rules that limit access to the owner of a record. The iPhone app stores sign-in tokens in Keychain and uses iOS file protection for its local archive. No service or device can guarantee complete security. Protect your device and tell support@sayplate.com if you suspect unauthorized access.

SayPlate and its providers may process information in the United States and other countries where they operate. Those countries may have different privacy laws. Where the law requires a safeguard for a cross-border transfer, we must use an approved basis, such as applicable contractual protections, before making that transfer. Contact us for information about a transfer that affects your records.

Where data-protection law requires a legal basis, we process data to provide the service you request, meet legal duties, and pursue legitimate interests in securing and supporting the service where your rights do not override them. We rely on consent where required, including for health-related data or optional permissions. This policy is a notice, not a substitute for that consent.

12. Adults only

SayPlate is for people aged 18 and older. We do not knowingly collect personal data from children. If you believe a child has provided information, contact support@sayplate.com so we can review and remove it as required.

13. Changes and contact

We will post updates here with a new effective date. If a change materially affects how we use personal data, we will give a clear notice through the service or another suitable channel before it takes effect where required. We will obtain fresh consent when the law requires it.

For privacy questions or requests, contact Joshua King, operator of SayPlate, at support@sayplate.com.

Provider privacy information

• Stripe privacy policy
• Supabase privacy policy
• Vercel privacy notice
• Google privacy policy
• Apple privacy policy
• OpenAI privacy policy
• OpenAI API data controls
• Anthropic privacy policy