Nutrio is built to help you pay attention to what you eat without feeling watched. I collect as little as I can, I never sell your data, and everything below is written to be read — not to be survived.
You own your journal. I store the foods and meals you log so I can show them back to you and sync them across your devices. Analytics are off until you turn them on, and even then they count screens and the shape of a visit, never what you have written. Crash reports from the iOS app run without a switch, and they never carry anything you've written either. You can use the app without an account, and your journal is stored the same way. You can have a copy of the lot by email, and you can delete it all. That's the whole shape of it — the detail follows.
Nutrio is built and run by one independent developer. There's no company behind it — no registered entity, no team, no investor — so the data controller for everything described here is me, personally, and privacy@nutrioapp.com reaches nobody else. Nutrio is far too small to need a data protection officer, so there isn't one; you're writing to me either way. If you need my name and a postal address — for a formal request, or to take a complaint to a regulator — ask at that address and I'll give you both.
Nutrio isn't for children. You need to be at least 16 to use it, with or without an account, and separately Nutrio won't run its calorie formula for anyone under 18 — it was never validated for a growing body, so the calculation is refused outright. If you skip the calculation, the app still offers a general population average to start from; that's a rough figure for adults, not a target worked out for you. You can log whatever you like either way.
Your account basics — the email address you sign in with, and, if you sign in with Google, the name on that Google account. With Apple I ask for your email address and nothing else, and if you choose Hide My Email, the address I hold is the private relay one Apple made for you. If you use Nutrio without an account, there are no account basics at all, only a random ID.
Your journal — the foods, meals, portions and notes you add, the activity you log to earn calories back, any day you record as a balance on its own, and the daily and weekly totals I calculate from all of it.
Your calorie-baseline details, if you choose to calculate one — sex, birth year, height, weight, activity level, and the goal you pick (lose, maintain or gain weight, with a pace for losing). These are used only to compute your daily calorie and macro targets. The baseline is kept as a dated history rather than a single value: each day you change it adds a row — including the day a new weight arrives from Apple Health, if you calculated your baseline rather than skipping — so a target can still be explained months later. Change it twice in one day and the second replaces the first; it's a record per day, not per edit.
And a little technical context from the iOS app — the app version, device model and language that travel with the crash reports and, if you allow them, the analytics described below. Those go to Google, not to me: the app itself sends my server nothing but your journal and the date it's asking about.
I don't collect your contacts, your location, or anything from other apps.
In the iOS app you can start without signing in. Nutrio then creates a guest account for you: a random ID with no email address, name or phone number attached. Your journal is stored exactly like any other account's, on the same servers, under that ID, and everything in this policy applies to it.
Only the iPhone that created a guest journal can open it. There's no way to sign out of one, because there would be no way back in, and if you delete the app, move to a new phone or reset this one, the journal can't be reached any more. It stays stored all the same, and I can't tell which guest journal is yours without the phone it lives on, so deleting it from Settings before you change phones is the way to be sure it's gone.
From Settings you can turn a guest journal into a full account by adding Apple, Google or an email address, and everything you've logged stays. If that sign-in already belongs to a Nutrio account, you choose what happens: merge the guest journal into that account, after a preview of what moves and where the two journals overlap, or delete the guest journal and carry on with the account. Either way the guest account is deleted afterwards. Connecting an assistant needs a full account, because the assistant signs in to Nutrio on the web.
If you connect Apple Health on iOS, Nutrio reads your daily Active Energy total (to top up your budget on active days) and your body weight (so a weight change updates your calculated baseline). When you set a baseline up, and only if you allow that separate prompt, it also reads your height, your biological sex and your date of birth — to prefill the form so you don't have to type them. Nothing else is read.
It also writes back. The meals you log are mirrored into Health as energy, protein, carbohydrate and fat, so your Health data stays whole; Nutrio only ever replaces samples it wrote itself. The mirroring is done by the app rather than the server, so a day only reaches Health once the app has opened that day — meals you logged through an assistant show up when you next look at them. Because Nutrio doesn't ask what time you ate, it stamps each meal at a conventional hour — breakfast 08:00, lunch 13:00, snack 16:00, dinner 19:00. Those times keep the day tidy; they aren't a record of when you actually ate.
You can turn any of it off in Apple Health at any time — Sharing → Apps → Nutrio — and Nutrio carries on without it.
The law asks me to name a lawful basis for each thing I do with your data. In plain terms:
Nutrio uses Google Analytics to count visits and see which pages and screens people actually reach — enough to tell what's confusing or slow. Alongside that it records the ordinary shape of a visit: when the app was opened or updated, your device model, your operating system version, your language, and the country your connection resolves to. It never sees your journal, your baseline details, or anything you have typed.
It runs only if you say yes. On the website a banner asks before the script loads at all; in the app the switch sits in Settings under Privacy and starts off. You can take it back whenever you like — on the website that forgets your answer and clears the cookies it set, and in the app it clears the identifier that was being counted. Withdrawing stops what happens next rather than undoing what already happened, though the data is deleted on the schedule below regardless. Nutrio behaves exactly the same either way.
Google handles this as my processor, under terms that require it to protect the data as this policy promises. On the website I have switched its advertising signals off in the page's own code, so nothing from the site feeds ad profiles. In the iOS app those signals sit at Google's default rather than being switched off, though the app never asks for the tracking permission Apple requires, so there is no advertising identifier for them to work with. Either way I don't sell any of it and I only ever look at the totals. Google deletes it on the retention schedule set for my property — the event data after two months, which is the shortest window it offers, and the user-level records after 14.
When the iOS app crashes, Firebase Crashlytics sends me a report: the stack traces of every thread, the app and iOS version, the device model and its language, and the memory and processor figures from the moment it fell over — along with a random identifier for that installation, so I can tell how many people hit the same crash. It carries nothing you have written — not your journal, not your baseline details, not your email — and it isn't tied to your account.
It isn't anonymous, and I'd rather not use a word that suggests otherwise: that identifier lasts as long as the app stays installed, which is exactly what makes the counting work.
Unlike analytics, this one has no switch in the app — that's the legitimate interest set out above, and the objection route with it. An app that crashes is no use to anyone, and a crash I can't see is a crash I can't fix. Google handles crash reports as my processor, doesn't use them for advertising, and deletes each one ninety days after it arrives. There is no crash reporting on the website or on the server.
Nutrio is not a medical service, and I am not a doctor, a dietitian or a certified nutrition professional. Calorie baselines, goal adjustments and macro targets are computed with well-known published formulas and mainstream health-authority guidance — they are general estimates, not advice for your personal situation. If you feel unwell, have a medical condition or an eating-disorder history, are pregnant, or are planning a significant change to your diet, please talk to a doctor or a registered dietitian first. I strongly recommend it.
Nutrio can be connected to an AI assistant — ChatGPT, Claude, or any other client that speaks the Model Context Protocol. It only happens when you approve it on the consent screen, and that screen names the assistant asking. Once connected, it can read your saved foods, meals and daily balance, which includes the active calories synced from Apple Health, and it can add, change and delete entries and set your body parameters. It can't read back the sex, height or weight you've saved. That is the whole set: the permission isn't split into smaller pieces yet, so approving is all-or-nothing and worth doing deliberately.
Nutrio has no passwords at all — you sign in with a one-time code, or your Apple or Google account, and an assistant never sees any of them. To end a connection, open Settings in the iOS app, tap through to the connector screen and use Disconnect: that withdraws the assistant's access here, which is the part that actually stops it. Removing Nutrio in the assistant's own settings only makes that app forget its key — the permission on my side would still be standing. Deleting your Nutrio account ends every connection at once.
Left alone, a connection stays live as long as the assistant keeps using it — it renews itself in the background, so there's no date I can promise it will lapse on. One that goes quiet expires about a year after it was last used. If you want a connection ended, end it deliberately rather than waiting it out.
The assistant itself belongs to whoever makes it, not to me, and it isn't one of the services I run Nutrio on. I never send it anything on my own: it gets only what it asks for after you've approved it, over an encrypted connection, and Disconnect stops that straight away. From there your data sits in a conversation with that company, under its privacy policy rather than this one: OpenAI's for ChatGPT, Anthropic's for Claude. Those policies can allow things this one doesn't. Depending on your settings there, for instance, conversations may be used to improve their models. Read theirs before you connect, and connect only an assistant you'd trust with your journal.
I run Nutrio on other people's infrastructure, because one person cannot run a database at three in the morning. Each of these holds or moves your data to do one specific job for me, and none of them may use it for anything else:
Each of them is held, by its agreement with me or by its own published terms, to protecting your data at least as well as this policy does.
I don't sell your data, I don't give it to advertisers, and nothing here trains a model on your journal.
Most of these companies are American, so your data reaches the United States. Where it does, I rely on the transfer terms in each provider's own data-processing agreement — standard contractual clauses, and for several of them the EU–US Data Privacy Framework.
Everything you can do with your data lives in Settings in the iOS app for now — a copy of it, a correction, or deleting the lot. The website is here to connect an assistant and to carry these documents; it isn't where you manage your account.
What you can ask for. You can ask me for a copy of your data, in a portable form if you like, and to correct it, delete it, or restrict or object to what I'm doing with it. You can also withdraw any consent you've given. The copy you can get yourself: ask from Settings in the iOS app and I'll email your food library and your whole journal to the address on your account as CSV files, usually within a minute. That covers your foods, your meals, your logged activity, your recorded balances and your baseline history. It's capped at five requests a day. If your account has no email address, as a guest journal doesn't, you type one in: I email a one-time code there first and send the export only once you've entered it, so your journal can only reach an inbox you can open. That address is used for that code and that export, and isn't saved to your account. For anything else, a copy in another form, or if you only use the website, write to privacy@nutrioapp.com and I'll do it by hand. It's free, and I'll answer within a month. Nutrio makes no automated decision that has a legal effect on you: it calculates a target and sometimes declines to, and you're free to ignore both.
Correcting and deleting. You can delete any meal you have logged and edit any food you have saved, from the iOS app; some corrections still mean deleting an entry and adding it again, because the editing tools are thinner than I'd like. You can delete your account and everything in it from Settings in the iOS app, and I honour erasure requests in line with the GDPR.
Withdrawing consent. For analytics: the cookies notice for the website, Settings for the app. For your body details: turn Nutrio off in Apple Health, or stop updating your baseline — and to withdraw the consent for what's already stored, delete your account, which is the only thing that clears your baseline history. Withdrawal applies from the moment you do it — it can't undo processing that already happened, though deleting your account covers everything still held.
If I get it wrong. Tell me first if you're willing, but you don't have to: you can complain to a data protection authority directly — the one where you live, where you work, or where you think the problem happened. Any EU or EEA authority on that list can take your complaint.
When you delete your account I remove your personal data from the live database straight away, and the removal cascades through every table holding anything of yours. Every device you were signed in on is signed out: no session can be renewed, and any key already handed to a device stops working within the hour. If you signed in with Apple, the app asks Apple to confirm it's you once more, so I can have Nutrio taken off your Sign in with Apple list as the account goes.
The database is also copied daily into a private backup, so a mistake or an outage doesn't take your journal with it. Each copy is deleted 30 days after it was made, so that's the outside limit on how long a deleted account survives in the database and its backups. It isn't the outside limit everywhere — the crash reports, analytics and mail described above run on their own clocks, and the one-line record that I acted on your request is meant to outlast the account.
When this changes, the date at the top changes with it. There's no announcement channel in the app yet, so this page is the record — worth a glance if you've been away a while. I won't quietly widen what I collect and leave the date where it was.
Questions, requests, or just want to understand something here better? Write to privacy@nutrioapp.com and a real person will reply.