Privacy Policy

Nourro AI

Last updated: 12 August 2026 Effective: 12 August 2026

Who we are

Nourro AI ("Nourro", "we", "us") is the business behind this app, based in the United States.

Contact for privacy questions, requests and complaints: contact@nourro.org, or the request form on our support page, which reaches the same place and does not need an email client.

We are the controller of the personal information described in this policy.

If you are in Washington State, Nevada, or Connecticut, there is a separate Consumer Health Data Privacy Policy that governs your health data specifically. It is a standalone document because those states require it to be.

The short version

• Your food diary lives on your device. It only reaches our servers if you create an account.
• We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
• We do not use advertising SDKs, analytics SDKs, or third-party trackers. There are none in the app.
• We collect what the app needs to work, and nothing whose only purpose is to learn about you.
• You can delete your account and everything in it from inside the app, at any time, without contacting us.

What we collect, and why

1. Information you give us

Account information. If you sign up, we store your email address and an authentication record. We never see your password — authentication is handled by Supabase, and passwords are stored only as a salted hash.

Your dietary profile. Allergies, dietary restrictions (including halal, kosher, vegan and vegetarian), and your calorie and macronutrient goals.

Your body profile. Height, weight, age, sex and activity level, if you choose to provide them. These are used to calculate BMR, BMI and daily targets.

Your food diary. Every item you log: the food, the portion, the meal, the date, and a copy of that food's nutrition data.

Your own saved items. Custom foods, saved meals, recipes, favourites and recently viewed products.

Weight entries. Weight, date and any note you attach.

Morning check-ins. Hours slept, sleep quality, how you feel, and alcohol units from the previous day, where you enter them.

Photographs of food, if you use the AI meal scan. See "AI meal scanning" below for exactly what happens to them.

2. Information the app generates

Readiness and health signals. Scores derived from the data above — recovery, sleep, strain, energy — and rolling baselines used to compare a reading to your own normal rather than to a population average.

Subscription status. Which tier you are on and when it expires.

AI usage counts. How many AI requests you have made this month, so we can enforce the quota attached to your plan. We store the count and the feature used. We do not retain the content of the request.

3. Information from your device, only with your permission

Camera — to scan barcodes and photograph meals. Barcode scanning happens entirely on your device; the image is never uploaded.

Photo library — only the specific photo you choose, and only when you choose it.

Location — only when you open the Nearby map, and only your approximate location, to find restaurants near you. We do not store your location.

Apple Health — only if you connect it. Sleep, heart rate, HRV, steps and weight are read on your device.

Notifications — to send the reminders you have switched on.

What we do not collect

To be explicit, because "we may collect" language is usually hiding something:

• We do not collect your contacts, your calendar, your browsing history, your advertising identifier, or any device fingerprint.
• We do not track you across other apps or websites. The app contains no advertising SDK and no analytics SDK.
• We do not build advertising profiles and we run no advertising.
• We do not record your precise location, and we do not store any location.

This website

Everything above is about the app. This is about nourro.org itself, because it now asks you for things and a policy that only covers the app would not cover them.

The site is a set of static pages. It sets no cookies, runs no analytics, and loads nothing from a third party — the stylesheet, the typeface and the images are all served from this domain. There is no tracking pixel and no advertising network.

It has three forms:

Submissions are received and stored by Netlify, who host this site, and are kept until the request has been dealt with. Netlify also keeps ordinary web server logs, including IP addresses, to serve the site and to block abuse. We do not use those logs for anything else and we build no profile from them.

To have a submission deleted, ask on the request form — the same form — or write to contact@nourro.org.

AI meal scanning — exactly what happens

When you photograph a meal for AI identification:

1. The photo is resized on your device and sent over an encrypted connection to our server, which checks your subscription and your remaining monthly quota.
2. Our server forwards the image to Anthropic (api.anthropic.com), which identifies the food and estimates its nutrition.
3. The result comes back to your device. We do not store the photograph, and we do not keep the text of the request or the response. What we record is that one AI request was made, and for which feature.
4. Anthropic processes the image to return the result. Anthropic does not use data submitted through its API to train its models.

Your API requests are never sent directly from your device to Anthropic, and no API key is stored in the app.

Who we share information with

We share only what each service needs to do its job. None of these are advertising companies, and none receive your data for their own marketing.

We will also disclose information if we are legally required to, and we will tell you unless we are legally prohibited from doing so.

We have never sold personal information, and we do not share it for cross-context behavioural advertising.

Where your data lives and how long we keep it

Data is stored on Supabase infrastructure in the United States.

We keep your information for as long as your account exists. When you delete your account, we delete the account and all associated records — diary, weight, preferences, health signals, saved items and AI usage counts. This is immediate and irreversible, and you can do it yourself from Settings → Account → Delete Account.

Anything stored only on your device is removed when you delete the app.

Backups are retained for up to 30 days, after which deleted data is gone from those too.

Security

• All traffic between the app and our servers uses TLS.
• Every table enforces row-level security, so one account's queries cannot return another account's rows. This is tested: our test suite runs 129 assertions that attempt cross-account reads and writes and requires every one to be refused.
• Passwords are never stored in plain text and are never visible to us.
• API keys for third-party services are held server-side and are never shipped in the app.

No system is perfectly secure, and we will not claim otherwise. If we discover a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

Your rights

Wherever you live, you can:

• See what we hold about you
• Correct anything that is wrong
• Delete your account and all its data, from inside the app
• Take your data with you — Settings → Export Diary produces a file you own
• Withdraw consent at any time by deleting your account

Everything in that list you do yourself, in the app, without asking us and without waiting. For anything you cannot — you no longer have the app installed, or you want a decision reviewed — use the request form or write to contact@nourro.org. We will respond within 30 days. We will not charge you, and we will not treat you differently for exercising any of these rights.

If you are in California

Under the CCPA/CPRA you additionally have the right to know the categories of personal information collected, the purposes, and the categories of third parties it is disclosed to — all set out above. You have the right to opt out of sale or sharing; there is nothing to opt out of, because we do neither. You have the right to limit the use of sensitive personal information; we use it only to provide the features you asked for.

If you are in the EU or the UK

We rely on these lawful bases:

• Contract — to provide the app you signed up for.
• Consent — for health data, dietary and religious preferences, and any device permission. You can withdraw it at any time.
• Legitimate interests — to keep the service secure and working.

Health data, and dietary preferences that reveal religious belief such as halal and kosher, are special category data under Article 9. We process them only with your explicit consent, and only to give you the allergen and dietary warnings that are the reason this app exists.

You have the right to lodge a complaint with your local supervisory authority.

Children

Nourro is not intended for anyone under 13, and we do not knowingly collect information from children under 13. If you believe a child has given us information, tell us through the request form and we will delete it.

Changes to this policy

If we change this policy materially, we will update the date at the top and notify you in the app before the change takes effect. We will not retroactively reduce your rights over information we already hold without asking you first.

Contact

Nourro AI United States contact@nourro.org · request form