What this document covers
This document explains which of your data Trophic AI processes, for which purposes and on which legal bases. It is written to fulfil the information duties under the EU General Data Protection Regulation (GDPR) and the disclosure duty (aydınlatma yükümlülüğü) under Turkish Law No. 6698 on the Protection of Personal Data (KVKK).
At a glance
- Your food photos are not stored on our servers; they are processed transiently for analysis only and stay on your device.
- There are no ads and no advertising or analytics SDKs in the app. We never sell your data or share it for marketing.
- You do not have to create an account; the app can be used as a guest.
- Health-related data such as height, weight and goals is processed only with your explicit consent.
- You can permanently delete your account and server data from inside the app.
Data controller and contact
The data controller is the developer of the Trophic AI app. (This section will be updated with the company name and address once incorporation is complete.)
Contact: (an e-mail address will be added before release)
You can send any requests about your personal data to this address. Requests are answered within one month under the GDPR and within 30 days under the KVKK.
Data we process
- Account data (only if you sign in): your name, e-mail address and profile picture from your Google or Apple account.
- Body and goal data (optional): height, weight, age, sex, activity level, your goal, and the daily calorie and macro targets calculated from them. This is treated as health-related data and processed only with your explicit consent.
- Food diary entries: food name, calorie and macro values, portion information, meal type, and date and time.
- Food and label photos: processed for analysis only (see the next section).
- Device identifier: a random number (UUID) generated by the app on first launch. It is not your device’s hardware identifier; it is used to track the free scan allowance and to match your records to your device. It resets if you delete and reinstall the app.
- Barcode numbers: the barcode of a product you scan is used to search product databases.
- Purchase data (once paid subscriptions launch): your subscription status. Your payment details (card number etc.) never reach us; payments are handled by the App Store / Google Play.
Your language preference and app settings are stored on your device only.
Your photos and AI
When you take or pick a photo of a meal or a nutrition label:
- The photo is sent through our server to our AI service provider, Google (Gemini API), for analysis.
- The photo is not saved on our servers; it is processed transiently during the analysis only. Only the analysis result (food name, calorie and macro estimates, portion information) is stored on the server.
- A copy of the photo is kept on your device only, to show a thumbnail in your diary; you can change or remove it at any time. Photos are not transferred if you switch devices.
- No identifying information such as your name or e-mail is sent along with the photo.
- Google’s processing of the photo is subject to Google’s Gemini API terms of service.
- No image is ever captured unless you initiate taking or picking a photo; the camera runs only while you are using it.
AI estimates are approximations and can be wrong; see the health and accuracy notices in the Terms of Use.
Purposes and legal bases
- Providing the core features of the app (scanning, diary, goal tracking): performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c).
- Processing health-related data such as height, weight and goals: your explicit consent (GDPR Art. 9(2)(a); KVKK Art. 6). If you do not consent, you cannot use the goal calculation feature; the rest of the app is unaffected.
- Keeping the free scan counter and preventing abuse: legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5/2-f).
- Complying with legal obligations: applicable law (GDPR Art. 6(1)(c); KVKK Art. 5/2-ç).
Your data is collected electronically and by automated means through the mobile app, based on the legal grounds above. Your data is never processed for advertising or marketing; no automated decision-making or profiling with legal effects is carried out. Photo analysis is an automated process, but its results are only shown to you and you can edit them freely.
Health-related data
Your height, weight, age, sex, activity level and goal, together with your food diary, are data from which conclusions about your health can be drawn. This data:
- is used solely to calculate your daily calorie and nutrition targets and to track your nutrition,
- is never used for advertising, marketing or data mining, and is never shared with third parties for such purposes,
- is processed only with your explicit consent.
You can withdraw your consent at any time: delete your account from inside the app, or ask us at the contact address above to delete your goal data. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Who we share data with
Your data is shared only to the extent necessary to provide the service, with these providers:
- Supabase (hosting: database and authentication) — your data is stored on servers in Frankfurt, Germany (EU).
- Google — Gemini API (photo analysis, transient processing) and Sign in with Google (authentication).
- Apple — Sign in with Apple (authentication).
- Open Food Facts (a non-profit based in France) — barcode lookups send only the barcode number; no personal data is sent.
- App Store / Google Play and RevenueCat (once paid subscriptions launch) — purchase processing.
Product information obtained from label scans (barcode, product name, nutrition values per 100 g) contains no personal data and is saved to our shared product database so other users benefit too.
Beyond this, your data is never sold, rented or shared for marketing. We may disclose data to competent authorities where legally required (e.g. a court order).
International transfers
Because our servers are in the EU (Frankfurt) and photo analysis is performed by Google, your data is transferred abroad. For users in Türkiye, these transfers are carried out under KVKK Art. 9 on the basis of the standard contractual clauses published by the Turkish Personal Data Protection Board. For EU users, transfers to the US rely on the EU-US Data Privacy Framework (DPF) and/or the EU Standard Contractual Clauses (SCCs).
Retention
- Account and profile data and diary entries: kept until you delete them. Account deletion is irreversible and permanently deletes your data on the server.
- Food photos: not stored on the server; the copies on your device remain until you remove them or delete the app.
- Device identifier and scan counter: unlinked from your account when the account is deleted; the counter record may be kept without any personal data.
- In guest use, your records are tied to your device identifier; deleting the app removes your access to them.
Your rights
Under the GDPR you have the right to access, rectify and erase your data, to restrict processing, to data portability, to object, and to withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority.
Users in Türkiye additionally have the rights listed in KVKK Art. 11, including learning whether their data is processed, requesting information, knowing the third parties it is transferred to, requesting correction, deletion or destruction, objecting to results arising exclusively from automated analysis, and claiming compensation for unlawful processing; complaints can be lodged with the Turkish Personal Data Protection Board (kvkk.gov.tr).
You can exercise these rights via the contact address above.
Security
Your data is encrypted in transit (HTTPS/TLS). On the server, access to your data is restricted to you and to the systems strictly required to run the service, using row-level access control and authorization rules. Additional technical and organizational measures required for health-related data are applied.
Children
Trophic AI is not designed for and is not directed at anyone under 18. If we learn that a user is under 18, we delete their account and data.
Deleting your account and data
You can permanently delete your account from inside the app via Settings > Delete my account; this irreversibly deletes all your scan records, your profile and your account on the server. You can also delete diary entries individually or in bulk. If you use the app as a guest, deleting the app removes all data on your device.
Changes
This document may be updated as new features are added to the app. Significant changes will be announced in the app; the latest version is always available on this page.