Privacy policy

• We do not sell your personal information or use your diary, photos, voice notes or measurements for advertising.
• We do not make your meals, photos or profile public.
• We only send data outside Cifrx Track when a feature needs it - such as sending a photo to the AI after you ask for an analysis.
• An AI estimate is never saved to your diary until you have reviewed it.
• You can export your data or permanently delete your account from Settings.

• You can enter meals without uploading a photo or voice note. If you ask for AI analysis or transcription, Groq or OpenAI receives the photo, meal details or voice note needed for that request. Check what you include before sending it, especially if a photo shows you or someone else.
• Optional analytics and notifications are off unless you turn them on. Reminders may be visible to someone who can see your device. You can turn them off in Settings.
• You can edit or delete entries, choose how long saved meal photos remain, export your information or delete your account in Settings. You can also email us yourself about your privacy rights.

• While signing up: we ask you to check the date. If you confirm it, we delete your new account and what you entered straight away, and show you how to contact us if the date was wrong.
• If you already have an account and save that date in Settings: we don’t save the date. We lock the account for 14 days and keep the date you entered with that lock. During that time you can download your data or correct the date. If it isn’t corrected, we delete the account and its data. Accounts with coaching records are reviewed by our staff instead.

So that the same email address can’t sign up again, we keep a scrambled code made from it, using a secret key, along with an expiry date: your 16th birthday. We delete it after that. We don’t keep your name, date of birth or email address with it, but the expiry date does show roughly how old you are. If a mistake stopped you signing up, email support@cifrx.com from the same address. A person will review it and can remove the code.

• Your account: your email address and display name, so you can sign in and we can keep your diary separate from everyone else’s, and your country and language, so we can show the right terms, prices and text.
• Your setup details: your date of birth, sex at birth, gender identity if you give it, height, weight, activity level and time zone. We use these to check your age and calculate your targets. If you tell us during setup that a medical condition applies, we don’t store that answer, but we do switch off automatic targets, which is recorded on your account.
• Your agreements: which version of the terms, privacy policy and health-data consent you accepted, and when.
• Your tracker: the profile details, goals, meals, portions, notes, hydration, weights, recipes, favourites and plans you choose to save. These make your diary and targets work.
• Photos and voice notes: only when you choose to upload them for meal analysis or transcription.
• AI history: what you submitted for analysis, your answers to follow-up questions, the AI’s results and which model produced them. You can review this in Settings.
• Usage and plan records: your AI credits, feature allowances and any Pro plan, so we can apply the right limits.
• Reminders: the schedule you set and, only if you turn notifications on, the browser subscription needed to deliver them.
• Support requests: your messages and any meal or photo you choose to share with support.
• Plato chats: if you use Plato, we save your conversations with him to your account so you can return to them, unless you turn saving off. You can delete them at any time.
• Bug reports: what you choose to write, your account identifier, and - only when you leave the technical-details option on - the current app screen, browser, language, time zone, screen size and app release.
• Small amounts of service data: timestamps, error and performance information, and a salted hash of an IP address to prevent analysis abuse. We do not store the plain IP address in that record.

• Supabase keeps your account, tracker data and private media.
• Resend sends support notifications containing references and sign-in links, without meal contents or private messages.
• Cloudflare Turnstile checks sign-in and signup forms for automated abuse.
• Vercel runs the website and its secure server functions.
• Live voice input sends microphone audio directly to OpenAI while you record, with a pseudonymous safety identifier. Cifrx does not store this live audio.
• Groq or OpenAI processes a meal photo, written context or voice note only when you ask for AI analysis or transcription. For photo analysis, it receives short-lived links to the selected image and the meal context - not your email, profile identity, body measurements or saved diary history. An AI model can make mistakes, which is why you review each estimate before saving it.
• Groq also receives ingredient names and amounts when you ask it to fill in a recipe’s nutrition.
• If you use Plato, OpenAI receives your message, your recent messages in that chat and any diary details Plato looks up to answer you, without your name or email. Groq receives the same if OpenAI is unavailable.
• USDA FoodData Central and Open Food Facts receive a food name, preparation or barcode when we look up nutrition reference data. We do not send your account identity to them. Some generic foods may instead be matched against our own copies of the USDA, CoFID (UK) and CIQUAL (France) datasets, which sends nothing to those organisations.
• Barcode photos and on-device checks: barcode photos are read on your device and are not uploaded, although the barcode number is sent for the lookup above. Where the feature is on, your device can also check whether a meal photo shows a nutrition label, and only that yes or no answer is sent to us.
• Cifrx staff: authorised staff can access the account information needed to handle support, security, billing or legal requests. These actions are recorded in an audit log.
• Your browser’s push service receives a reminder only if you enable notifications.

• change your profile and targets;
• correct or delete meals and their photos;
• turn reminders on or off;
• download your diary as CSV or your account data as JSON; and
• permanently delete your account, diary and private media, unless a review or legal hold described in this policy applies. If it does, we’ll tell you and support will handle the request.

Where we rely on your consent, you can withdraw it at any time. You can switch off optional analytics and notifications in Settings. To withdraw consent for health-related information, email us or delete your account in Settings; we cannot provide the tracker without using this information. Withdrawal does not affect processing that was lawful before you withdrew consent.

• Sign-in: Supabase authentication cookies keep you signed in and support secure account access. They can persist for up to 400 days and be renewed during use; signing out removes the authentication session from this browser. A cookie’s lifetime does not guarantee that your account session remains valid for that long.
• Language and preferences: the Cifrx language cookie remembers your language for one year and may be renewed when you browse. Local storage remembers your theme, shared-device choice and install-prompt history. These local entries have no automatic expiry; a dismissed install prompt is suppressed for 30 days. You can change language and theme in the app.
• Country: the Cifrx market cookie remembers your country for one year, so we can show the right terms and prices.
• Demo and short-lived confirmations: if you try the demo, a cookie marks that for 12 hours and your demo data stays in this browser. A short-lived cookie carries the result of an email address change back to the app.
• Drafts and recovery: local storage holds an unfinished onboarding draft, including your name and date of birth, until setup completes, your signup closes, or you clear the site’s data. Session storage holds temporary meal and planning drafts, navigation position and markers that prevent duplicate reminders; it normally lasts for the browser tab’s session, although your browser may restore it. Where recovery features are available, the browser’s IndexedDB database holds account-specific drafts and queued changes with a 24-hour expiry. Expired records are removed when that storage is next accessed. Settings provides shared-device mode and a control to clear private drafts and queued changes where these features are available.
• Offline files: the app’s service worker caches the offline screen, icons, scripts, styles and fonts. It does not cache your diary pages, API responses or uploaded photos. Cached files have no fixed time expiry; they are replaced or removed as the app updates, reaches its cache limit, or you clear the site’s data.
• Notifications: only after you enable browser notifications, a Cifrx device cookie identifies the registered browser for reminders. It lasts up to 400 days and may be renewed on registration. You can turn off reminders or remove registered devices in Settings and revoke notification permission in your browser; the device cookie can be removed by clearing the site’s cookies.
• Security checks: Cloudflare Turnstile accesses browser and device information on authentication forms to help prevent automated abuse. This check supports account security rather than advertising.

Optional product analytics remain off unless you enable them in Settings, where you can also switch them off. They use a monthly pseudonymous identifier and are not used for advertising. Raw analytics events are retained for 30 days; non-identifying daily aggregates may remain longer.

You can delete cookies, local storage, session storage, IndexedDB records and cached files through your browser’s controls for this site. Clearing site data can sign you out and remove preferences, unsaved drafts and queued changes; it does not delete diary entries already saved to your account. Blocking essential storage can prevent sign-in or recovery features from working. For help with a storage choice or objection, email support@cifrx.com.

• Contract (Article 6(1)(b)): we use account and tracker information to provide the Service you request.
• Legitimate interests (Article 6(1)(f)): we use limited security, fraud-prevention, error and fair-use information to protect accounts, prevent abuse and keep the Service reliable. We also rely on this to apply our age limit and keep the scrambled email code that stops the same address signing up again before age 16.
• Consent (Article 6(1)(a)): we use optional product analytics and browser notifications only if you enable them.

Providers may process information outside the UK. Where a UK adequacy regulation applies, it can provide the transfer basis. Otherwise, a restricted transfer needs an appropriate safeguard, such as the UK International Data Transfer Agreement or UK Addendum. Email us to ask which mechanism applies to your information and for a copy of the relevant safeguard.