FatRadar Privacy Policy

Version of 20 October 2026. Test version of the app.

Who we are

FatRadar is an app for tracking food, calories and macronutrients on iPhone and Android. It is currently a test version developed and operated by one private individual, the app's developer ("we"). A company will be set up before the public launch; this policy will be updated then.

Contact for any question about your data: david.aaarh.com@gmail.com.

What data we collect

• Account. Sign-in is only via Apple or Google (through Google's Firebase Authentication service). We receive the account identifier and the email address if the sign-in service provides it (Apple may provide a hidden relay address). We never see or store a password. We also store the interface language, time zone and the time of the last request to the server.
• Profile, if you fill it in: sex, year of birth, height, weight, goal and activity level. It is used to calculate your daily calorie target.
• Diary: what and how much you ate, the meal, the date, your notes, water intake, planned and completed workouts.
• Health data — only with your permission in Apple Health (iPhone) or Health Connect (Android). Only daily totals reach our server: steps, active calories, resting calories, workout minutes, weight, and the names of the apps that wrote this data to Apple Health or Health Connect. We do not receive individual samples. You can withdraw the permission in your phone's system settings.
• Food photos, if you recognise a meal from a photo. The server downsizes the photo, removes its metadata (including location), sends it to DeepSeek for recognition and does not store the original. We may keep a reduced copy without metadata for up to 30 days solely to check recognition quality: if the app asked you "Maybe also …?" or you gave separate consent to the test comparison of models (see "A third-party cloud speech-recognition provider" below). The copy is then deleted automatically, or immediately when you delete your account.
• Voice. Speech can be recognised in two ways. By default it is recognised by the phone's system service (Apple or Google), and only the text reaches our server. If you have given one-time consent to server-side voice recognition (one consent per account, for the phone and the watch; you can withdraw it in the app), and for a voice recording from the watch (up to 60 seconds), the audio reaches our server and is passed to a third-party cloud speech-recognition provider solely to be converted into text. Processing may take place outside Ukraine, including in the USA. The recording is not stored on our servers: we delete it immediately after the response, even if recognition fails, an unfinished recording is deleted automatically, and the audio never gets into server logs; only the recognised text is kept. The provider may temporarily keep data under its own security rules for up to 30 days. A list of providers is available on request.
• Text describing a meal (typed or recognised from voice) — for meal recognition.
• Barcodes are read on the device; only the digits of the code reach our server.
• Technical data. A log of recognitions: time, input type, number of processed text units (tokens), cost and result. For voice, also the length of the recording in seconds. These records are kept to count our AI spending and to apply the daily and monthly limits that apply to each user separately; they contain no text, audio or photo itself (a protected fingerprint is stored instead). Server logs contain no request bodies, no diary content and no search queries. The IP address is used in memory to limit request rates; the address itself is never written anywhere.
• Recognition ratings. From time to time (once every 5 photo cards) the app asks "👍 / 👎" about recognition quality; with 👎 you can pick a reason from a fixed list ("wrong dish", "wrong weight", "something is missing", "other") — there is no free text. We store your rating, the reason, which recognition was rated (the model and the version of its instructions) and a counter of photo recognitions to know when to ask. The service owner sees only totals (how many 👍/👎 and for which reasons, by day and model), without your data. (Draft wording, pending owner approval.)
• Security log. When the server rejects a suspicious request (access guessing, attempts to inject code, probing for service files, exceeding limits), we record the kind of rejection, the time, the service path of the request (without the request text) and protected fingerprints of the IP address and the account — an irreversible transformation with a secret key from which the address or account cannot be recovered. These fingerprints are still personal data (pseudonymised), so we process them only to protect the service against abuse and attacks (temporarily blocking the source, alerting the developer).
• A recipe you shared. If you tap "Share" on one of your recipes, we create a link https://fatradar.com/r/…. Anyone who receives it sees only the recipe: its name, the dish photo (if you added one), ingredients, calories and macronutrients, yield and cooking steps. Your name, email, profile photo, body weight, goals, diary, entry dates, label photos and chat texts are not on that page. The page is not indexed by search engines. The link works until you tap "Turn off link" or delete the recipe or your account — then it stops working immediately. A preview that a messenger has already shown may remain in that messenger. Our database does not store the link in clear form — only a protected fingerprint of it and an encrypted copy for you.
• "Coming soon" waiting list. On https://fatradar.com/soon you can leave your email to receive one email when FatRadar is available on the App Store or Google Play. We accept the address only with the consent box ticked and store it encrypted, together with the time and version of the consent text, the page language, the platform you asked about and where you came from (a shared recipe page or directly). We use the address only for that single email: no newsletters, no advertising, no sharing with third parties. Your IP address is used only in memory to protect the form from mass submissions and is never written down. The page has no counters, pixels or third-party fonts.

Why

• to keep your diary and calculate calories, macronutrients, your daily target and the "eaten vs burned" balance;
• to recognise meals from text, voice, photos and barcodes;
• to protect the service from abuse and failures (rate limits, security).

We do not sell data, show ads, use health data for advertising or profiling, or share it with third parties other than the processors listed below and only to the extent described.

Who we share data with

• DeepSeek (an AI service of DeepSeek, China) — meal description text and food photos for recognition. Your name, email or account identifier are not sent with them. DeepSeek processes this data under its own terms.
• Apple and Google — account sign-in (Sign in with Apple, Google sign-in, Firebase Authentication).
• Open Food Facts — an open product database: only barcode digits, to find the product.
• Hetzner Online GmbH — rented servers in data centres in the European Union, where the data is stored.
• Cloudflare — the network intermediary that protects and delivers traffic to our server; it also delivers the fatradar.com pages, and caching of these pages is disabled.
• The launch email for the waiting list will be sent through an email service that will be named here before the email is sent.
• Anthropic (the Claude AI model, USA) — recognition quality checks: the text of what you said about a meal (from voice or text) and a reduced photo of a meal for which the app asked a clarifying question ("Maybe also …?"), together with the item name and your "yes/no" answer. Your name, email, account identifier or photo metadata are not sent with them; phone numbers, addresses and names in the text are replaced with "[…]" before sending. The only purpose is to find where recognition goes wrong and improve it; on our side these materials and the check results are kept for up to 30 days. (Draft wording, pending owner approval.) Anthropic does not use this data to train its models. (Pending owner approval.)
• A third-party cloud speech-recognition provider — converting voice to text for users who gave consent to server-side recognition, and for voice from the watch: the server sends the audio and recognition language, and deletes the audio on our side immediately after the response, even on failure. The provider may temporarily keep data under its own security rules for up to 30 days and, by default, does not use it to train models. Separately, only for participants of the test comparison of models who gave separate consent: the same meal text and food photo that go to DeepSeek are sent in parallel to a second model to compare which one recognises more accurately. You are shown only the main model's answer; the request text, both models' answers and a reduced copy of the photo without metadata are kept on our side for up to 30 days solely for this comparison. Your name, email or account identifier are not sent with the data. A list of providers is available on request. (Draft wording about model comparison, owner's open decision #1, pending approval.)

How long we keep data

• Diary, profile, daily health totals, water and workouts — while your account exists or until you delete them.
• Unconfirmed recognition drafts (you did not tap "Add") — deleted automatically after 7 days without changes.
• The recognised meal content in the recognition log — erased after 30 days; only the accounting (time, tokens, cost) remains.
• Deleted planned workouts — permanently erased after 30 days.
• Recognition ratings and the photo recognition counter — with no separate time limit, while your account exists (they are a model quality signal); you can remove a rating in the app, and they are erased immediately when you delete your account. (Draft wording, pending owner approval.)
• Security log (protected fingerprints of the IP address and account, kind and time of the rejection) — up to 90 days, to protect against abuse; then erased automatically. Records of temporary blocks — up to 90 days after they end.
• Food photos — the original is not stored; a reduced copy without metadata may be kept only in the cases described in "Food photos" above, for up to 30 days to check recognition quality. It is then deleted automatically, or immediately when you delete your account. (Draft wording, pending owner approval.)
• Participants of the test comparison of models (separate consent, see "A third-party cloud speech-recognition provider" above): the request text, both models' answers and a reduced copy of the photo (without metadata) — up to 30 days, solely for the quality comparison; then deleted automatically, or immediately when you delete your account. (Draft wording, pending owner approval.)
• Waiting list: the address is deleted 30 days after the launch email and in any case no later than 12 months after you left it. You can delete it earlier at https://fatradar.com/soon/forget or by writing to the contact address.
• Recipe links: valid until "Turn off link" or deletion of the recipe or account; deleting the account erases all your links.
• Deleting your account in the app deletes all your data immediately and completely. Afterwards a service record of the deletion itself (the date and a technical sign-in identifier — no email or other data) remains for 30 days, and a hashed identifier with a recognition counter remains for 2 days so that re-registering does not bypass the daily limit. Then these are erased too.

Your rights

• Delete your account and all data in the app: Profile → "Delete account".
• Get a copy of your data, correct it or ask a question — write to david.aaarh.com@gmail.com. We reply within 30 days.
• Withdraw access to Apple Health or Health Connect in your phone's system settings.
• Lodge a complaint with the data protection authority of your country (in Ukraine, the Ukrainian Parliament Commissioner for Human Rights).

Security

Data is transferred only over encrypted connections (HTTPS). Each user's data is separated in the database at row level, and only the developer has access to the servers. No storage method is absolutely secure; if a breach affects your data, we will notify you.

Children

The app is intended for people aged 18 and over; younger people only with the permission of a parent or guardian. We do not knowingly collect data from children under 13.

Changes

This is a test version: features and this policy may change. The date of the current version is shown at the top of the page.