Privacy Policy — NutriCitadel
Last updated: 31 October 2026
The short version. NutriCitadel has no accounts. Your food diary, your body details and your searches stay on your phone and are never sent to us or to anyone we work with. Nothing leaves your phone except a meal photo you choose to send, with a random device identifier that counts the day's photos (the app asks you before the first one), and, on Android, a photo result you choose to report. The photo goes to Google's Gemini model, a third-party AI, for the estimate: our server does not store it, and Google keeps it only for a limited time, to detect misuse and for legally required disclosures. There are no ads, no analytics and no tracking. If you email us, we receive what you write, and we use it only to answer you.
Washington and Nevada residents: read our Consumer Health Data Privacy Policy.
No account, ever
We never ask for your name, email address or phone number, and there is nothing to sign up for. We keep no accounts or profiles. The only way we learn anything about who you are is if you choose to email us (see Emailing us).
What stays on your phone
- Your food diary — what you ate, when, and the nutrition figures saved with each entry.
- Your body details and daily calorie target, if you choose to enter them.
- Barcodes you scanned that we could not find, kept only so we know which foods to add in a future data update. These are never sent anywhere.
- The nutrition database itself — 441,373 packaged foods and 12,568 prepared dishes from USDA FoodData Central, copied onto your phone the first time you open the app.
Barcode scanning and text search never leave your device. They work with no internet connection at all.
What leaves your phone
On iPhone, one thing, and only when you press the button: a meal photo you take. On Android, two: that photo, and a photo result you choose to report, described at the end of this section.
- Before the first photo is sent, the app tells you where it goes and asks you to agree. Saying no changes nothing else. You can turn photo analysis off again at any time in About; barcode scanning, search and everything else keep working.
- The photo is resized to 512 pixels and sent to our server, which forwards it to Google's Gemini model to estimate the food and its nutrition.
- Our server checks that each request has the shape of a single photo request — one image, our own fixed instructions, nothing extra — before forwarding it unchanged. It does not view or store the photo itself, and nothing is written to any log or database.
- We use Google's paid API tier for this. Under it, Google states it does not use your photo to train or improve its products. It logs the photo for a limited time, only to detect misuse of its service and for legally required disclosures. We do not use the free tier, where those protections do not apply.
- A random device identifier is sent with it. It is a meaningless string generated on your phone the first time you use the feature. It is not an advertising identifier and it is not linked to you or to anything else you do. Its only purpose is counting how many photos that phone sent today, so the daily limit works.
- If you subscribe, the request also carries the App Store's signed record of your subscription. Our server only checks Apple's signature and that the subscription is active, so that subscribers get their own daily allowance. It does not keep this record.
On Android, a photo result you choose to report. Under a photo estimate there is a Report this result button. If you tap it and pick a reason, the app sends our server the reason you picked and the estimate the AI model returned: the food names, grams and calories. It carries no photo, device identifier, subscription record or anything you type, and our server does not pass it on to Google or anyone else. The iPhone app does not have this button.
We do not send your food diary, your body details, your barcode scans or your searches anywhere.
What we do keep
To make the daily photo limit work, our server keeps a counter row containing three things: that random device identifier, the date, and how many photos were sent that day. For subscribers, the row holds a one-way code made from the subscription's App Store transaction number instead of the device identifier; the code cannot be turned back into that number. The row holds nothing else — no photo, no food, no nutrition figures. No IP address is logged.
Cloudflare, which runs that server, has to see your IP address to deliver the request. We have turned request logging off, so it is not kept.
These rows contain no name, email address or IP address. They are deleted automatically 7 days after the day they refer to.
Reports, on Android. If you report a photo result, our server keeps the date, the reason you picked and the estimate you reported. A report holds no photo, device identifier, subscription record, name, email address or IP address, so we cannot tell who sent it, and we do not try to find out. We read reports only to find and fix wrong or inappropriate estimates. They are deleted automatically 90 days after the day they arrive.
Cloudflare's database keeps an automatic recovery history for up to 30 days, so a counter row or report we have deleted can still exist in that history until it expires. We use that history only to repair the database if something breaks.
What we do not do
- No advertising, and no advertising identifiers.
- No analytics tools, tracking, profiling or crash reporting.
- We do not sell your data. Apart from the service providers listed under Third parties below, we share nothing with anyone.
- We do not use location or contacts, and we do not use Apple HealthKit or Google Fit. The step count comes from the sensor your phone already keeps, and how it gets there differs by platform — both are described below.
- Health Connect, on Android, read-only. Android keeps your step count in Health Connect, and that is the only place a daily total exists. We ask for permission to read steps and nothing else — no weight, no heart rate, no sleep — and we never write anything back. What we read stays on this phone. Declining it only turns the Steps screen off.
- Motion & Fitness, on iPhone, read-only. iOS counts steps in the phone's own motion sensor (CoreMotion), so we ask for the Motion & Fitness permission and read the step count for the day you are looking at. Nothing else is read — no workouts, no heart rate, no health records — nothing is written back, and the number stays on this phone. This is separate from Apple Health: we do not open HealthKit and nothing appears in the Health app. Declining it only turns the Steps screen off.
- We do not record or store audio. Voice logging turns speech into text on your phone; if your phone cannot do that on-device, the feature stays off rather than sending your voice to a server.
Permissions
On Android, the app requests exactly five permissions, and nothing else:
| Permission | Why |
|---|---|
CAMERA |
To scan barcodes and take meal photos. The camera is active only while you have the scanner or the photo screen open. |
INTERNET |
To send a meal photo for analysis and, on Android, a photo result you choose to report. Nothing else in the app uses the network. |
RECORD_AUDIO(microphone) |
To let you log a meal by speaking instead of typing. Your phone turns the speech into text on the device — we receive only the text, the recording is not saved, and the audio is not sent anywhere. On phones that cannot do this on-device, the feature stays off rather than sending audio away. Declining it only turns voice logging off. |
health.READ_STEPS(Health Connect) |
To read the daily step total your phone already keeps. On Android, step data lives in Health Connect; we ask only for read access to steps and never write anything back. The number is stored on this phone and never sent anywhere. Declining it only turns the Steps screen off — everything else keeps working. |
com.android.vending.BILLING(Google Play, Android only) |
To let you subscribe through Google Play. It shows no prompt and gives the app no access to anything on your phone: Google Play shows the price and handles the payment, and your card details stay with Google. On iPhone, subscriptions go through the App Store and need no permission. |
We explicitly block location, contacts and external storage permissions, and the activity-recognition permission (on Android, steps come from Health Connect instead), so they cannot be requested even by a library that would otherwise ask for them. On iPhone, steps use the Motion & Fitness permission described above.
Steps and the microphone are asked for when you first use that screen, not when the app opens, and saying no leaves the rest of the app untouched. The water counter and weight tracking need no permission at all — you type those in, and they never leave the phone.
Backups — you keep the copy
On iPhone, the app's data is part of your own iPhone backup — to iCloud or to a computer — if you have backups turned on, the same as your other apps. That backup belongs to you and your Apple ID; we never receive it and have no way to read it. When you restore that backup onto a new iPhone, the app's data moves with it.
On Android, the system normally copies an app's private files, including its databases, into
the user's Google Drive automatically. We turn that off. This app
ships a data-extraction rule whose <cloud-backup> section excludes
everything, so nothing about your food reaches Google Drive — not
your diary, not your body details, not your searches.
We deliberately left one path open: the phone-to-phone transfer Android offers when you set up a new device. That transfer is something you start, it goes straight from your old phone to your new one, and it does not pass through us or through Google's servers. We left it on because the alternative is losing years of logging the day you change phones. If you would rather it did not move at all, decline the transfer when the new phone offers it — the app does not depend on it.
Technically: android:allowBackup="true" with
android:dataExtractionRules excluding cloud-backup
(Android 12+), and android:fullBackupContent including data only
under requireFlags="deviceToDeviceTransfer" (Android 11 and
lower). Setting allowBackup="false" would disable the phone-to-phone
transfer as well, which is why it is not used.
Because of that, the copy is yours to keep: About → Export a backup file writes a plain JSON file and hands it to the share sheet, so you choose where it goes. Restore from a backup file reads such a file back. Restoring only adds entries — it never deletes what is already on the phone, and entries that are already there are skipped rather than duplicated.
The backup file contains your food entries, your body details and your fasting target. It does not contain the device identifier or your photo allowance, so a backup file cannot be edited to unlock paid features.
Deleting your data
Your diary is on your phone, so deleting the app deletes it. You can also remove individual entries inside the app at any time.
On our side there is the counter row described above, which deletes itself 7 days after the day it refers to, and, on Android, any report you sent, which deletes itself 90 days after the day it arrives. Neither carries a name, email address or IP address, so we cannot tell which one is yours. If you have emailed us, we delete that conversation when you ask.
Emailing us
Writing to us is the one way we receive something that could identify you: your email address and whatever you write. We use it only to answer you. We do not add you to any list, and we do not share it. We never ask for health details, and you do not need to include any to get help. We delete the conversation within 90 days of our last reply, or sooner if you ask. Our mailbox is hosted by Google (Gmail).
If there is a security incident
If we learn that someone got unauthorised access to data we hold — the counter rows and reports described above, or emails you sent us — we will tell those affected in plain language and without unreasonable delay, within the time the law allows. We will email anyone affected whose address we have, and post a notice on this page and on our support page. The notice will say what data was involved, when it happened and when we found out, and how to reach us. Where the law requires it, we will also notify the authorities.
Your diary, body details and history are kept on your phone, not on our server, so an incident on our side cannot reach them.
Children
This app uses general adult nutrient reference values and is not intended for children. It is not directed at children under 13, and we knowingly collect nothing from them.
Age range. Where the law requires it (for example, Texas), your app store can share your age range with an app: Apple when you agree, Google Play once your age has been verified in Google Play. When you open Photo, NutriCitadel asks iOS or Google Play for it. If the answer is under 13, photo analysis stays off. If you decline to share it where it is required, or Google Play says your age still has to be verified, photo analysis stays off until you do. We use the answer only for this check. It is held in memory while the app runs, is not saved on your phone or sent to us or anyone else, and is asked for again next time. Barcode scanning, search and your food log work either way.
Third parties
- Google Gemini — receives the meal photos you choose to send, in order to produce the estimate. policies.google.com/privacy
- Cloudflare — operates the server that forwards those photos and stores the counter rows and reports. cloudflare.com/privacypolicy
- Google (Gmail) — hosts our mailbox, so it holds the emails you choose to send us.
Google, for the paid Gemini API, and Cloudflare handle this data as our service providers ("processors"), under data processing terms that we have accepted with them. Those terms let them use it only to provide their service to us, not for their own purposes, and require them to protect it with appropriate security. That gives your data the same protection this policy describes; the one exception is the limited misuse log described above, which Google keeps under the same terms. Our mailbox is different: it is a regular Gmail account, so emails you send us are covered by Google's own privacy policy, linked above.
No other third party receives anything from us. If you subscribe, Apple or Google processes the purchase under their own terms; we never see your card. On Android, the Google Play billing library that handles the purchase inside the app also sends Google a technical record of its own calls (for example, whether a purchase call succeeded or failed, and connection problems) under Google's terms; we never receive that record.
Where the nutrition figures come from
Packaged foods and prepared dishes come from USDA FoodData Central, a public database published by the U.S. Department of Agriculture. Photo estimates are produced by an AI model and are estimates, not measurements. NutriCitadel is not a medical device and does not diagnose, treat, cure or prevent any disease.
Independent app
NutriCitadel is an independent app. It is not affiliated with, endorsed by, sponsored by or reviewed by the U.S. Department of Agriculture (USDA), the U.S. Food and Drug Administration (FDA), or any other government agency. Naming a source is attribution, not approval.
Changes
If this policy changes, the date at the top changes and the new version appears in the app.