Privacy Policy
In short
- Your food log, Apple Health data, pantry, plans, cycle days and Sober trackers stay on your iPhone.
- Our server keeps only your account, a daily count of AI requests and, if you subscribe, your UMEVA+ subscription.
- Coach, photo estimates and AI Chef are optional. Each asks for your consent first and shows what it sends.
- You can export or delete everything in the app, at any time.
- You can use logging, recipes, the pantry and Apple Health without an account.
What we don't do
- We don't sell or rent your personal data.
- We don't show ads, and we don't share data with advertisers or data brokers.
- We don't use analytics or tracking SDKs, and we don't track you across other apps and websites.
- We don't use Apple Health data for marketing, advertising or profiling.
- We don't keep your meal photos, Coach conversations or AI requests on our server.
- We don't let our AI provider train its models on your data.
- We never use your location or GPS.
1. Who is responsible
The controller of your personal data is Mark Gerasimov, Bratislava, Slovak Republic ("UMEVA", "we", "us"). Contact for all privacy matters: support@umeva.app. We have not appointed a data protection officer, as we are not required to; the address above reaches the person responsible.
This policy covers the UMEVA iPhone app and the website umeva.app. It is written under the EU General Data Protection Regulation (GDPR) and Slovak Act No. 18/2018 Coll. on the protection of personal data.
2. Data that stays on your iPhone
UMEVA is built so that most of your data never leaves your device. The following is stored only in the app on your iPhone and is not collected by us: your profile and targets, food and drink log, workouts, pantry, meal plans and grocery list, supplements, habits, cycle days, the Pregnant setting, Sober trackers with their notes, the Coach conversation, saved recipes and the country you shop in. You can export it (You › Export my data) and erase it (You › Delete all data). Because we don't receive this data, we cannot restore it if you delete the app.
iCloud copy of your profile. If iCloud is on for UMEVA, your profile answers and targets (name, goal, sex, birth year, height, weight, goal weight, activity, diet, allergies, avoided ingredients and daily targets) are also kept in your own iCloud key-value storage so a new iPhone can restore them. This storage belongs to your Apple Account and is provided by Apple; we cannot access it. Your log, cycle days and the Pregnant setting are never stored there. Delete all data removes this copy.
3. Apple Health
With your permission, UMEVA reads (never writes) these Apple Health types: steps, workouts, active energy, weight, body fat, waist circumference, sleep, heart rate, resting heart rate, walking heart rate average, heart rate variability, State of Mind and mindful minutes. They are processed on your iPhone and not kept by us. Nothing from Apple Health is sent anywhere, except the following values inside Coach's summary when you ask Coach a question: steps, active energy, recorded workouts, sleep, resting heart rate, heart rate variability, the stress estimate and weight. Health data is never used for advertising, marketing or data mining, and is never sold. You can change permissions at any time in iPhone Settings › Health › Data Access & Devices.
4. Data we process
| Data | When | Purpose | Legal basis |
|---|---|---|---|
| Email address (or Apple's private relay address), account ID | Only if you create an account | Sign-in, account, applying daily limits | Contract, Art. 6(1)(b) GDPR |
| Daily count of AI requests per feature | With an account | Applying free and UMEVA+ limits | Contract, Art. 6(1)(b) |
| Subscription record: original transaction ID, product, expiry, refunds or revocations | Only with UMEVA+ | Granting UMEVA+ | Contract, Art. 6(1)(b); legal obligations, Art. 6(1)(c) |
| Coach request: your question, the conversation and an on-device summary that includes health data (section 5) | Only when you ask Coach, after consent | Answering your question | Explicit consent, Art. 6(1)(a) and 9(2)(a) |
| Meal or menu photo | Only when you request an estimate, after consent | Estimating the food | Explicit consent, Art. 6(1)(a) and 9(2)(a) |
| AI Chef request: pantry items, recipe choices, diet, allergies, avoided ingredients, remaining protein | Only when you create a recipe, after consent | Writing one recipe | Explicit consent, Art. 6(1)(a) and 9(2)(a) |
| Country code and foods to price | With an account, when prices are shown | Approximate prices | Contract, Art. 6(1)(b) |
| Technical data: IP address, device and request metadata in server logs; a one-way hash of your account ID for 2 minutes | When the app or website contacts our servers | Security, preventing abuse, keeping the service running | Legitimate interests, Art. 6(1)(f) |
| Messages you send to support | When you write to us | Answering you | Contract or legitimate interests, Art. 6(1)(b) and (f) |
You don't have to give us any personal data to use UMEVA's core features (logging, recipes, pantry, plans, Apple Health). Without an account, the AI features and prices are not available.
5. AI features and your consent
Coach, photo and menu estimates and AI Chef are optional. Before the first use of each, UMEVA shows what will be sent and to whom, and asks for your consent. You can withdraw consent at any time in You › Privacy and data; this does not affect processing that already happened.
- Coach receives your question, the conversation so far and a summary made on your iPhone: first name, date and time, your targets, today's totals, meals and planned meals, energy, protein, water, carbs, fat, fibre and sugar over the last 7 and 30 days, today's vitamins and minerals, drinks and caffeine, steps, active energy and workouts, sleep, resting heart rate, heart rate variability and the stress estimate, weight, goal weight and BMI, habits and supplements, pantry items to use soon, your diet, preferences, allergies and avoided ingredients. Your cycle day is added only if you turn on Share cycle with Coach, Sober streaks only if you turn on Share Sober with Coach, and pregnancy only if you switched on Pregnant. Coach › What Coach sees shows exactly what is sent.
- Photo and menu estimates. The photo is reduced in size and stripped of location and camera details on your iPhone, then sent once. It is not stored by us, on the server or on your iPhone. Nothing is logged until you confirm.
- AI Chef receives the inputs listed in section 4. Nutrition is calculated on your iPhone, and recipes are checked against your allergies before they are shown.
Requests pass through our server to Anthropic's Claude API, which returns the answer. We don't store the requests or answers on our server. Anthropic may keep them for a limited time under its own retention rules, normally no more than 30 days, and longer only where needed to enforce its usage policies or required by law. Anthropic acts as our processor under its commercial terms and a data processing agreement, which do not allow your inputs to be used to train its models. AI answers are generated automatically and are labelled as such in the app. They are not decisions that have legal or similarly significant effects on you (Art. 22 GDPR).
6. Open Food Facts
When you search for a food, scan a barcode or check a product, UMEVA sends the search words, the barcode or a product category directly to Open Food Facts (openfoodfacts.org), a non-profit database, to find products. No account, name, location, country or health data is sent. Open Food Facts receives your IP address as part of the request and is responsible for it under its own privacy policy.
7. Prices
To show approximate prices, UMEVA sends your country code (for example SK) and the foods to price to our server with your signed-in request. We never use your iPhone's location or GPS and never ask for a city. Prices are stored per country and food, never per person; foods without a known price may be estimated by Anthropic's Claude from the food name and country only. You can hide prices in You › Where you shop.
8. Who we share data with
| Recipient | Role | Purpose | Location |
|---|---|---|---|
| Supabase, Inc. | Processor | Server, database, authentication, website images | EU (Frankfurt, Germany) |
| Anthropic, PBC | Processor | AI requests (Coach, estimates, AI Chef, price estimates) | United States |
| Resend, Inc. | Processor | Sending sign-in codes | EU (Ireland) |
| Cloudflare, Inc. | Processor | DNS, website script delivery and forwarding of emails sent to support@umeva.app | Global network |
| Vercel, Inc. | Processor | Hosting the umeva.app website | Global network |
| Independent controller | Delivering the website fonts (Google Fonts) | Google's privacy policy applies | |
| Apple | Independent controller | App distribution, payments, Sign in with Apple, iCloud, Apple Health | Apple's privacy policy applies |
| Open Food Facts | Independent controller | Product database requests | France (its privacy policy) |
Some providers are based in, or may access data from, the United States. Such transfers rely on an adequacy decision (the EU–US Data Privacy Framework, where the provider is certified) or on the European Commission's Standard Contractual Clauses, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards. We never sell personal data and never share it for advertising.
9. How long we keep data
- Account (email, account ID): until you delete your account.
- Daily AI usage counts: while your account exists; deleted with it.
- Subscription record: while your account exists, and afterwards only where accounting or tax law requires it.
- AI requests, photos and Coach summaries: not stored by us. Anthropic, our AI processor, normally deletes them within 30 days (section 5).
- Account hash for rate limiting: 2 minutes.
- Server and website logs: kept by our hosting providers for a short period, normally up to 30 days.
- Support emails: up to 2 years after the conversation ends.
10. Your rights
Under the GDPR you have the right to access your data, to correct it, to have it erased, to restrict or object to its processing, to data portability and to withdraw consent at any time. Most of these are built into the app: Export my data, Delete all data, Delete account and You › Privacy and data. For anything else, write to support@umeva.app. We answer within one month and may ask you to confirm your identity.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. In Slovakia this is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR), Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk.
11. How we protect data
Connections use TLS encryption. On your iPhone, your session is kept in the Keychain and app data uses iOS data protection. On the server, access is restricted per user and by role, and AI requests are not stored. If a personal data breach is likely to put your rights at risk, we will notify the supervisory authority and, where required, you.
12. Website
umeva.app has no cookies, analytics or trackers. Our hosting provider processes your IP address and request details to deliver the pages and protect them from abuse (legitimate interests, Art. 6(1)(f)). To show the pages, your browser also loads the Geist fonts from Google Fonts and an animation library from Cloudflare's cdnjs, which receive your IP address as part of those requests.
13. Children
UMEVA is not intended for anyone under 16 and we don't knowingly create accounts for them. If you believe a child has created an account, write to us and we will delete it.
14. Changes
We may update this policy when the app or the law changes. The date at the top shows the current version. If a change materially affects how we use your data, we will tell you in the app before it applies and, where the law requires, ask for your consent again.