FoodRay Privacy Policy

Who We Are

FoodRay is a mobile application for nutrition and diet tracking, developed and managed by an independent developer. For any inquiries regarding privacy or personal data, you can visit the Contacts page.

Data We Collect

FoodRay collects and processes the following categories of data, only to the extent necessary to provide the app features:

• Account Data. Email, name, and unique identifier provided through Google Sign-In (Google Auth), used to create and manage your account and sync your data across devices.
• Voice Commands. When you use on-demand voice commands, audio is sent to a third-party artificial intelligence service for processing and instruction recognition. Recognition results are stored in a cache associated with your Firebase account. Phrases learned by the system over time to improve recognition are saved in a personal dictionary linked to your account.
• Food and Receipt Photos. Images taken for nutritional analysis are sent to our processing systems (proprietary backend and a third-party AI service) solely for the purpose of recognizing foods and calculating nutritional values.
• Menstrual Calendar Data. If you choose to enable this optional feature, the app records the cycle information you enter to calculate your calendar and fertility window. This is a sensitive category of health-related data: it is collected only with your explicit consent and can be disabled at any time from Settings, with the permanent deletion of previously recorded data. If you turn on the menstrual calendar, the cycle estimate and the dates of your recent cycles may be included in requests to the AI Coach, which forwards them to Google Gemini. If you turn it off, they are no longer sent.
• Health data (Health Connect). If you turn on “Sync with Health Connect”, the app writes to Health Connect the food (with calories and macronutrients), water and weight you log, and reads weight recorded by other apps. These are the only four permissions, and you can revoke them at any time in Health Connect. FoodRay does not sell this data or use it for advertising. Your weight, like the other data in your profile, may be included in requests from the AI Coach and in the weekly report, which forward them to Google Gemini as described in this policy.
• Database Backup. If you turn on automatic backup, a copy of your local database (recipes, history, nutrition data and, if you use them, weight and the menstrual calendar) is saved in a space reserved for the app in your Google account, not visible among your Drive files and not accessible to us.
• Usage and Billing Data. To manage in-app subscriptions, we process data related to your use of the service and billing via Google Play Billing.
• Information kept to prevent abuse. To prevent the welcome bonus from being obtained more than once and the same purchase from being reused on several accounts, we keep two items of information that remain after an account is deleted, without a fixed expiry: (1) your email address (in lowercase), together with an indicator that the welcome bonus has already been granted; and (2) a technical identifier of each purchase (a code derived from the purchase), with the date on which the account was deleted. The purchase identifier is not linked to your account after deletion.

Why We Process This Data

We process your data to: provide and run the features you actively request (voice recognition, analysis of dishes and receipts, backup, subscription management); maintain your account and sync your data across devices; improve voice recognition accuracy over time; and, if you turn on Health Connect, write what you log to your phone's health data and read your weight.

To protect the welcome bonus and purchases from repeated or fraudulent use, we also process your email address (in lowercase) and a technical identifier of each purchase (see “Information kept to prevent abuse”).

For menstrual calendar data, as a special category of health-related data, processing is based exclusively on your explicit consent, which you can revoke at any time.

Data Sharing

We do not sell your personal data. We share data only with service providers strictly necessary for the app's operation: Google/Firebase (authentication, storage, Drive backup), Google Play Billing (subscription management), and the third-party AI service used for meal and receipt recognition and voice command processing, to which requests are sent without user-identifying metadata. Requests to the AI Coach and the weekly report are processed by Google Gemini through our server: they contain a summary of the data needed to answer (for example diary, goals and weight and, if on, the menstrual calendar), not your name or email, and the server does not store their content.

Data Retention

We retain your data for as long as your account remains active. If you request account deletion (see section below), your data is permanently deleted, except as otherwise required by applicable law. The information described under “Information kept to prevent abuse” is kept after deletion, without a fixed expiry.

Account and Data Deletion

You can request the deletion of your account and all associated data in two ways:

• From the app. Go to Settings → Account & User Profile → "Delete Account and Data". The operation is immediate and permanently deletes: all local data (history, recipes, water, grocery list), Google Drive backups, learned personal voice phrases, and your login account. It also deletes your subscription and usage data stored on our server.
• Without the app installed. If you no longer have the app or cannot access it, you can request deletion by filling out the request directly on the Contacts page, specifying your request for account and data deletion. Requests are processed within 30 days.

Your Rights

You have the right to access your personal data, request rectification or deletion, and object to processing by sending a communication via the Contacts page.

Security

We implement reasonable technical and organizational measures to protect your data against unauthorized access, loss, or improper disclosure.

Changes to This Policy

This privacy policy may be updated periodically to reflect changes in app features or regulatory requirements. The "last updated" date at the top of the page indicates the most recent revision.

Contact Us

For any questions regarding this policy or the processing of your data, please visit the Contacts page.

Who we are

FoodRay is a mobile application for diet and nutrition tracking, developed and operated by an independent developer. For any privacy or personal data request, you can reach us through the form on the Contacts page.

Data we process and how we use it

FoodRay processes the following data, only as far as needed to provide the features you use.

• Account data. You can sign in with Google or with Sign in with Apple, through Firebase Authentication (a Google service). We receive your email address and name (with Apple, the name only the first time and only if you choose to share it, and the email may be Apple's private relay address) and a unique account identifier. We use them to create and manage your account, to link your purchases and usage limits to it, and to protect the free welcome bonus (see "Information kept to prevent abuse").
• Data you enter in the app. Meals and food diary, recipes, water, shopping list, weight history, physical activity log, fasting timer, allergies and intolerances, dietary regimes, calorie and macro goals and, if you enable it, the menstrual calendar. This data is stored in the database on your device, and in your iCloud backup if you enable it. It is not stored on our servers, except for what is described below for the AI features, voice commands and subscriptions. FoodRay does not read data from Apple Health.
• Menstrual calendar. This optional feature records the cycle information you enter, to calculate the calendar and the fertility window. It is health-related data of a sensitive kind: we use it only with your explicit consent. It is stored only on your device and in your iCloud backup; it is not sent to our servers, and the Coach on iOS does not receive it. You can turn the feature off at any time in Settings, and the data already recorded is then deleted. If you type or say something about your cycle in a free-text request (for example to the Coach, or as a voice command), that text is processed like any other request, as described below.
• AI features (Coach, meal and receipt analysis, interpretation of voice commands). When you use these features, the app sends the request to our server, which forwards it to Google's Gemini API for processing. Depending on the feature, the request contains: the text of your question or command; the recent messages of the conversation; the photos you attach or take; and, for the Coach, a summary of the data needed to answer well, such as recent food diary entries with calories and macros, your calorie and macro goals, saved recipes, an active fasting session, allergies and intolerances and dietary regime. The request does not include your name or email address. Our server does not save the content of these requests, the answers or the photos, and does not write them to its logs. The Coach conversation is saved only in the database on your device (and in your iCloud backup). Google processes this data as the provider of the Gemini API, under its own terms. The weekly summary, which you can request with a voice command, also includes your most recent weight; weight is not included in other requests.
• Voice commands. Speech is recognised by Apple's speech recogniser: depending on your device and settings, iOS processes the audio on the device or on Apple's servers, as described in Apple's privacy information. We never receive the audio, only the recognised text, which may be sent to the AI service to interpret the command, as described above. To recognise your commands faster, the app remembers the phrases you use: they are saved in a personal dictionary linked to your account in our database. Phrases about health, the menstrual cycle, weight, allergies and similar topics, and commands that delete data, are never saved. Generic everyday commands that many users repeat may also be added, without any account identifier, to a shared dictionary that helps all users.
• Photos and barcodes. Photos taken for analysis are handled as described under AI features. When you scan a barcode, the code is sent to the public Open Food Facts database to retrieve the product data; Open Food Facts receives the code and your IP address. The app also queries the public food-safety alerts of the European Union (RASFF), without sending data about you beyond what any internet connection reveals, such as the IP address.
• iCloud backup. If you enable automatic backup, a copy of your local database (diary, recipes, history, the data you entered and Coach conversations) is saved in your private iCloud database (Apple CloudKit). It is managed by Apple under your Apple Account, and we cannot read it.
• Purchases and subscriptions (Apple In-App Purchase). Purchases and subscriptions made in the iOS app are processed by Apple through the App Store. We do not receive or store your payment card or Apple Account payment details. To activate and manage your plan, our server receives from Apple technical information about the transaction (such as the transaction identifier, the product purchased, the purchase and expiry dates, and renewal status) and links it to your FoodRay account. We also record how many connections (analyses) you have used in the current period.
• Security and technical data. We use Firebase App Check (Apple App Attest) to verify that requests come from the genuine FoodRay app. Our server, hosted on Google Cloud in Frankfurt (Germany), keeps technical request logs (such as IP address, date and type of request) and, for purchase verification, the account identifier, the product and the transaction identifier. The logs do not contain the text of your questions, the answers or your photos, and are kept for the period configured in Google Cloud.
• Information kept to prevent abuse. To prevent the welcome bonus from being obtained more than once and the same purchase from being reused on several accounts, we keep two items of information that remain after an account is deleted, without a fixed expiry: (1) your email address (in lowercase), together with an indicator that the welcome bonus has already been granted; and (2) a technical identifier of each purchase (a code derived from the purchase), with the date on which the account was deleted. The purchase identifier is not linked to your account after deletion.
• No advertising or tracking. FoodRay does not show advertising, does not use third-party analytics or crash-reporting services, and does not track you across other apps or websites.

Permissions

FoodRay asks for access to the camera (to scan barcodes and take photos of meals and receipts), the microphone and speech recognition (for voice commands, voice food entry and the Coach),. To choose photos it uses the iOS photo picker, which shares with the app only the images you select. You can change these permissions at any time in the iOS Settings.

Why we process this data

We process your data to provide the features you actively request (diary, AI analysis, voice recognition, backup, subscription management), to maintain your account, to verify purchases and activate the plan you bought, and to keep the service secure. The legal bases are the performance of the service you request, your consent where it is required (the menstrual calendar and the device permissions), and our legitimate interest in preventing fraud and misuse of the free welcome bonus and of purchases and in protecting the service.

Data sharing

We do not sell your personal data. We share data only with the providers needed for the app to work: Google (Firebase Authentication, Firestore, Cloud Run hosting, App Check, and the Gemini API), Apple (App Store and In-App Purchase, Sign in with Apple, iCloud/CloudKit and speech recognition), and, for the specific functions described above, Open Food Facts and the European Union's RASFF service.

Data retention

Your data on our servers is kept as long as your account remains active. Data stored on your device and in your iCloud backup stays there until you delete it. When you delete your account, your account data is permanently deleted, except for the information described under "Information kept to prevent abuse", which we keep without a fixed expiry, and except where retention is required by applicable law. Phrases in the shared dictionary contain no account identifier, so they cannot be linked to you and are not deleted with your account.

Account and data deletion

• From the app. Go to Settings → Account and User Profile → "Delete account and data". The operation is immediate and permanently deletes: all local data (history, recipes, water tracking, shopping list), your iCloud backup, the voice phrases learned for your account, your subscription and usage data stored on our server, and your login account. If you signed in with Apple, the link between your Apple Account and FoodRay (Sign in with Apple) is also revoked.
• Important for subscribers. Deleting your account does not cancel your subscription with Apple. To avoid further charges, cancel it in your Apple Account settings (Settings → your name → Subscriptions) before or after deleting your account. The app shows a reminder with any unused credit before you confirm the deletion.
• Without the app installed. If you no longer have the app or cannot access it, you can request deletion by using the form on the Contacts page from the email address associated with your FoodRay account, asking to delete your account and data. Requests are processed within 30 days.

Your rights

You have the right to access your personal data, to request its correction or deletion, to object to its processing and, where applicable, to withdraw your consent, by using the form on the Contacts page. You also have the right to lodge a complaint with your data protection authority (in Italy, the Garante per la protezione dei dati personali).

Security

We adopt reasonable technical and organizational measures to protect your data from unauthorized access, loss, or improper disclosure.

Changes to this policy

This policy may be updated periodically to reflect changes in the app's features or in regulatory requirements. The "last updated" date at the top of the page indicates the most recent revision.

Contact

For any questions about this policy or about the processing of your data: please use the form on the Contacts page.

What this section covers

This section applies to this website, not to the FoodRay app. The data processed by the app is described in the Android and iOS sections above.

Contact form

If you use the form on the Contacts page, we receive the data you enter: your name, email address, the reason for your message, the app version, the message itself, any attachment you choose to add and your confirmation that you have read this policy. We use it only to reply to you and to handle your request, including requests to delete an account and its data. The form is delivered by FormSubmit (formsubmit.co), a third-party service that receives your message and forwards it to us by email. Please do not put passwords or sensitive health information in your message. We keep messages only for as long as needed to handle your request and to meet legal obligations, in line with the storage limitation principle of the GDPR (Regulation (EU) 2016/679, Article 5(1)(e)).

Hosting and technical data

The site is delivered by its hosting provider. As any web server does, the hosting provider processes technical data about each visit, such as the IP address, browser type and the date and time of the request, to deliver the pages, protect the site from abuse and keep it running.

Cookies and third-party content

The site does not use advertising, analytics or tracking cookies, and does not load fonts, scripts or images from third-party servers. To apply your language choice, the page may store a temporary preference in your browser for the duration of your visit; it stays on your device.

Your rights

You can ask to access, correct or delete the data you sent through the form by using the form on the Contacts page. These rights are set out in Articles 15 to 17 of the GDPR.