1. Who this policy covers
This policy applies to the SeeMeEat iOS and Android apps, SeeMeEat.app, and the SeeMeEat API. “SeeMeEat,” “we,” and “us” refer to SeeMeEat and the developer identified in the applicable app-store listing.
2. Information we process
| Information | Why we use it |
|---|---|
| Account information, including name, email address, Apple or Google provider identifier, Firebase user ID, and authentication state when supplied by your chosen provider. | Create and secure your account, sign you in with Apple or Google, and associate access with the same suite account. SeeMeEat does not collect or store an app-specific password. |
| Meal photos you choose to submit. | Estimate visible foods, portions, calories, macronutrients, and confidence. Camera and photo-library access happen only when you choose them. |
| Purchase and entitlement information, such as product, store, purchase identifier, status, and expiration. | Verify subscriptions, restore access, process renewals or revocations, prevent duplicate claims, and provide support. We do not receive your full payment-card number. |
| Usage records, including photo-scan and natural-language-analysis counts, allowance period, request identifier, provider token counts, and estimated processing cost. | Enforce the separate monthly allowances, prevent duplicate charges for retried requests, monitor reliability, and control cost. |
| Content-free launch and reliability events, including app opens, onboarding and paywall steps, purchase or restore outcomes, first-log and journal-sync outcomes, app version/build, platform, and prior-run crash or hang counts. | Understand whether version 2.0 launches reliably and where users encounter setup, purchase, or sync failures. These events use a one-way account pseudonym and do not include names, email addresses, meal or health content, photos, descriptions, receipts, tokens, stack traces, or device identifiers. |
| Meal descriptions and food-name searches you choose to submit. | Turn an editable description into a nutrition draft or retrieve source-labeled food records. A typed or dictated meal description is sent as text for analysis; SeeMeEat does not send microphone audio to its API or OpenAI. |
| Support communications you send us. | Answer your question, investigate a problem, or carry out a privacy request. |
| Structured journal data, including analysis results, manual/search/barcode/label entries, corrections, editable meal categories, calendar history, Meal Memory, food favorites, AutoLog schedules, calorie/macro/water/weight goals, and hydration and weight histories. | Provide your offline journal, cross-device continuity after sign-in, trends, saved meals, goals, and complete export. The app keeps an offline cache and synchronizes these structured records to SeeMeEat’s isolated Google Cloud database. The journal retains at most 2,000 structured meal entries and does not retain their original meal photos. AutoLog is optional, uses an exact reviewed saved meal, runs when the app is active after the selected time, and uses a shared daily identifier to prevent duplicate entries across devices. |
| Historical export files you deliberately select for migration from another nutrition service. | Parse the selected archive or file into a bounded, source-labeled review preview before you commit it to your journal. Original upload bytes exist only during the request and are not saved. Uncommitted normalized previews expire after 24 hours. Import attempts and bytes are rate limited to protect the service. |
| Community, progress, and profile content you deliberately post, including photos, text, comments, reactions, group membership, reports, and professional-sharing permissions. | Provide public or invite-only groups and private professional sharing. Selected photos are retained in private SeeMeEat storage until you delete them, a moderator removes them, or you delete your account. Access follows the group and connection permissions you choose. |
| Device-only app data, including temporary goal-planner inputs, coaching suggestions, export files, widget snapshots, reminder preferences, meal-photo previews, label photos, and speech audio handled by your platform speech service. | Provide local planning, guidance, sharing, widgets, capture, and notifications. Temporary planner inputs such as age, height, weight, formula setting, activity, and direction are processed in memory and are not saved; only a goal you apply enters the structured journal. These device-only items are not uploaded through journal sync. |
| Apple Health or Health Connect data, only if you opt in. | Write calories, protein, carbohydrates, fat, known supported micronutrients, water, and weight from entries you choose to log. When you explicitly start a history import, SeeMeEat reads nutrition, hydration, and weight records on device and turns the records you choose to import into ordinary editable journal entries; those normalized entries synchronize to your private SeeMeEat account after sign-in. Requested steps, active energy, and recent-workout context stay on device. SeeMeEat does not request heart rate, run automatic background history imports, or upload raw platform-health samples or device identifiers. |
3. How meal-photo analysis works
The app resizes a selected image and sends it over encrypted HTTPS to the SeeMeEat API. Cloudflare terminates TLS at our API edge and streams the request to our Google Cloud backend; our edge code does not cache the image or make product decisions. The backend validates the image and passes it to OpenAI’s API to produce a structured nutrition estimate. The SeeMeEat backend does not save the original photo to its database or object storage after the request finishes.
On supported phones, you can choose a depth-assisted capture. ARKit or ARCore processes the depth map on the device. The raw depth map does not leave the phone; only bounded volume, coverage, distance, and confidence signals can accompany the session-only meal photo to help judge portion size. Unsupported or uncertain captures use the ordinary camera path, and every estimate remains editable.
OpenAI processes the image and prompt on our behalf. We set Responses API requests to not store application state and do not opt in to model-training data sharing. Under OpenAI’s default API controls, content may still appear in abuse-monitoring logs for up to 30 days, and images are automatically checked for child-safety abuse. OpenAI may retain flagged material as described in its API data-controls documentation.
4. How barcode and nutrition-label entry work
Nutrition-label photos are read on your device using Apple Vision on iOS or Google ML Kit on Android. SeeMeEat does not upload the label photo for OCR. You must name the food and confirm or edit the extracted serving, calories, and macronutrients before logging it.
For a packaged-food barcode, the app sends the numeric barcode to the authenticated SeeMeEat API. Our backend requests a narrow product record from Open Food Facts and does not send your Firebase user ID, email address, journal, or authentication token to Open Food Facts. Open Food Facts is a community-contributed database, so a record may be missing, incomplete, outdated, or wrong. SeeMeEat displays the source and serving basis and lets you edit or use manual entry before logging.
5. How text logging, food search, migration, and private export work
If you use dictation, iOS requires on-device recognition; on Android, the device’s selected speech service returns text under that provider’s settings. SeeMeEat sends only the editable transcript—not microphone audio—to the SeeMeEat API. The API sends that text to OpenAI to create a structured estimate, and nothing is logged until you review and confirm it. SeeMeEat does not intentionally write the description to its database or application logs; a structured idempotency result can remain for about 24 hours to make safe retries possible.
Food-name search sends your query through the authenticated SeeMeEat API to USDA FoodData Central. We do not send USDA your Firebase user ID, email, journal, or authentication token. The app distinguishes USDA reference foods from manufacturer-label records, shows the 100 gram basis and source link, and leaves unavailable nutrient fields unknown.
After Apple or Google sign-in, goals, meals, Meal Memory, favorites, hydration, weight, editable meal categories, and AutoLog schedules synchronize through SeeMeEat’s authenticated journal service. The sync schema rejects original images, image Base64, raw audio, passwords, authentication credentials, store receipts and tokens, signed transactions, raw Health samples, and activity context. Normalized entries you explicitly import from Apple Health or Health Connect become ordinary journal entries and can synchronize. Offline edits remain on the device and merge when connectivity returns.
Historical migration supports selected exports from several nutrition services and generic ZIP, CSV, TSV, XLSX, JSON, XML, and PDF files. The authenticated service admits and parses each file within strict account, byte, time, memory, expansion, and record limits; original filenames, file bytes, and food content are excluded from routine logs. You review source, date range, counts, samples, and fidelity warnings before committing. Stable imported IDs make retries safe.
When signed in, CSV, JSON, and seven-day PDF export first requests the latest merged journal, then generates the file on your device. Exports contain no original meal images, Firebase user ID, cloud cursor, or pending-sync metadata. The system share sheet lets you choose whether and where to send a file, including to a professional. SeeMeEat does not receive a copy; the recipient and selected sharing service apply their own privacy and retention practices.
6. Service providers and data sources
We disclose information only as needed to operate the service, comply with law, or protect users and the service. Current processors include:
- Apple and Google Firebase and Google Cloud for provider sign-in, authentication, backend hosting, databases, secrets, and operational security.
- OpenAI for photo-to-nutrition and text-to-nutrition inference.
- Open Food Facts for community-contributed packaged-food records requested by barcode.
- USDA FoodData Central for source-labeled food records requested by name.
- Apple App Store and Google Play for app distribution, subscription billing, purchase status, refunds, and store notifications.
- Apple Health and Health Connect, only when you enable the integration, as device/platform stores for the narrow health categories described above.
- Cloudflare for the public website, DNS, TLS, the streaming API edge, and related network security.
We require service providers to protect data consistently with their contracts and applicable law. Their processing is also governed by their privacy terms.
7. No ads, sale, or cross-app tracking
We do not sell personal information, run behavioral advertising, or track you across other companies’ apps and websites. The app sends the narrow first-party launch and reliability events described above; it contains no advertising or third-party behavioral-analytics SDK. The SeeMeEat website does not use analytics cookies. We may disclose information in a business transfer or when legally required, with appropriate safeguards.
8. Retention
- Original meal photos are streamed through the Cloudflare edge without application caching and held in request memory only by SeeMeEat; provider retention is described above.
- Completed idempotency records, which contain the structured nutrition result but not the photo, raw audio, or natural-language description, expire after about 24 hours.
- Account, entitlement, and quota records remain while your account is active and for the minimum additional period needed for billing, fraud prevention, disputes, or legal obligations.
- Routine operational logs are configured for short retention and do not intentionally contain raw photos, authentication tokens, purchase receipts, or meal descriptions.
- Content-free launch and reliability events expire after at most 90 days. Their per-account quota records expire after about two days. Account deletion also removes both through the same one-way account pseudonym.
- Original historical-migration uploads are not saved. Uncommitted normalized migration previews expire after about 24 hours; committed entries follow ordinary journal retention.
- Structured cloud journal data—including goals, meals, Meal Memory, favorites, hydration, weight, meal categories, and AutoLog schedules—remains while your account is active and is deleted through the in-app account-deletion flow, subject only to narrow periods required for legal, security, fraud, or dispute handling. The journal contains no original meal photos or raw speech audio.
- The offline journal cache, exports, reminders, and widget snapshots remain on a device until you delete them, delete the account through the app, clear app data, remove an exported file, or uninstall. The app retains at most 2,000 structured meal entries in its cache.
- Entries written to Apple Health or Health Connect remain under your platform account and retention settings until you delete them there. Pausing, disconnecting, uninstalling SeeMeEat, or deleting a SeeMeEat account does not automatically delete those platform health records.
- Support messages remain as long as reasonably needed to resolve the request and document the outcome.
9. Your controls and deletion rights
You can sign out, manually sync, edit or remove journal information, configure, pause, or remove each AutoLog schedule, export a portable copy, disable local reminders, decline camera, photo, or depth access, pause health sync, revoke individual health permissions, disconnect the app, delete or report community content, leave groups, revoke professional sharing, and delete SeeMeEat-written health entries through Apple Health or Health Connect. Your offline journal remains usable without health access or a current network connection.
To delete your account and associated SeeMeEat cloud data, open Account → Delete account & data. You may also use our web deletion instructions. Deleting an account does not automatically cancel an Apple or Google subscription; cancel it separately in your store account to prevent future billing.
Depending on where you live, you may also have rights to access, correct, port, restrict, object to, or delete personal information, and to appeal a decision. Email privacy@seemeeat.app. We may need to verify that you control the account.
10. Security and international processing
We use encrypted transport, server-side secrets, authenticated requests, bounded inputs, redacted logs, and store-side purchase verification. No system is perfectly secure. Service providers may process information in the United States and other countries where they operate, using the legal safeguards applicable to them.
11. Children
SeeMeEat is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 created an account, contact us so we can delete it. A higher minimum age may apply where local law requires it.
12. Nutrition and health information
Meal-photo estimates, label OCR, and community-contributed packaged-food records may be wrong. SeeMeEat is not medical advice, diagnosis, or treatment. Do not rely on the app for allergies, medication or insulin decisions, eating-disorder care, or any situation requiring precise nutrition information. Verify product labels and consult a qualified professional when needed.
Syncing an estimate to Apple Health or Health Connect does not make it clinically accurate. Health integrations are optional, are not used for advertising or eligibility decisions, and can be paused or revoked through the app and platform controls.
13. Changes and contact
We may update this policy as the service changes. We will post the new effective date here and provide additional notice when required. Questions or complaints can be sent to privacy@seemeeat.app or through SeeMeEat Support.