Nutrinity Privacy Policy

Effective Date: October 5, 2026

Last Updated: October 5, 2026

This Privacy Policy describes how Nutrinity LLC ("Nutrinity," "we," "our," or "us") collects, uses, discloses, and protects your personal information when you use the Nutrinity mobile application, the website at nutrinity.app, and related services (collectively, the "Services").

Nutrinity is an AI meal planner app for iPhone. It personalizes meal plans, recipes, and shopping lists based on your dietary preferences, goals, schedule, body measurements, kitchen, budget, and the grocery store you choose.

By creating an account or otherwise using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, do not use the Services.

You must be at least 13 years of age to use Nutrinity. If you are under 18, you may use it only with the permission of a parent or legal guardian. The Services are not intended for, marketed to, or directed at children under 13.

1. Information We Collect

1.1 Information You Provide Directly

Account Information. When you create an account, we collect your name, email address, and password or sign-in identifiers. If you sign in through Apple or Google, we receive the basic profile information those providers share (such as name and email).

Profile and Goals. During onboarding and through ongoing use, we collect your sex, age, height, current weight, primary goal, and reported activity level.

Dietary and Lifestyle Preferences. We collect your preferred eating style, favorite cuisines, foods you dislike, allergies and foods you avoid, meals per day, servings, cooking time, available cooking equipment, and self-reported cooking experience.

Health-Related Information. Several of the data types listed above, including body measurements (height, weight), dietary restrictions, allergies, and activity level, may qualify as health-related or sensitive personal information under applicable laws. We treat this information with heightened protection and use it solely to provide the Services.

Grocery and Location Preferences. We collect your grocery budget per meal, the ZIP code or address you enter, your preferred store distance, and the grocery store or stores you select. We save the ZIP code, city, and approximate coordinates (about 1 kilometer); a street address you type is used once to find nearby stores and is not saved with your profile. See Section 4 for how location is handled.

Pantry and Plans. We store the pantry items you add, the meal plans we generate for you, your meal swaps, the meals you mark as eaten, and your shopping list progress.

Chat Messages. If you use the in-app chat ("Your sous-chef") and agree to the in-app notice, we collect the messages you send so we can answer them.

Profile Photo. If you add an avatar photo, we store it with your account. To pick or take a photo, the app asks for access to your photo library or camera; you can refuse. If you sign in with Google or Apple and your account there has a profile picture, we may store a link to that picture.

How You Heard About Us. If you answer "Where did you hear about Nutrinity?", we store your answer, including any text you type, with your account to understand which channels work.

Game Progress. Your Pal's Kitchen progress (such as your level, treats, streak, and your cat's name) is stored on your device. If we start syncing it to our servers, we will update this Privacy Policy first.

Referral Information. See Section 1.5.

Subscription Information. If you subscribe to a paid plan, payment is processed by Apple through the App Store. We do not receive or store your payment card details. We receive the subscription product, purchase and renewal status, and transaction identifiers, through Apple and our subscription processor, RevenueCat.

Support Communications. When you contact us by email or through in-app support, we collect the content of your messages, your contact information, and any attachments.

1.2 Information Collected Automatically

Device Information: device model, operating system version, app version, and language and region (locale). We do not collect the Identifier for Advertisers (IDFA) or any other advertising identifier.
App Usage (first-party analytics): described in Section 1.4.
Creator link cookie (website): if you open a creator's link (nutrinity.app/r/CODE), the website saves that code in a first-party cookie and your browser's local storage for up to 180 days, so it can be shown again and saved with a waitlist sign-up (Section 1.6). It is not used to track you on other sites. We also record the visit: the creator code, the time, any campaign tags in the link, and one-way, salted hashes of your IP address and browser user-agent string, so we can count visits per creator and limit abuse. We do not store your IP address itself. The hashes are cleared after 180 days; the visit count stays.
Log Data: IP address, access times, and error logs on our servers. Logs can contain parts of a ZIP code or address you entered.
Location: only if you allow it in iOS, and only while you use the app. The app asks iOS for your approximate location, rounds the coordinates to about 1 kilometer (0.6 miles) before saving or sending them, and uses them to find stores near you. It saves the ZIP code, city, and these approximate coordinates with your profile, not a street address. See Section 4.

1.3 Information From Third Parties

Sign-In Providers. If you sign in using Apple or Google, we receive the basic profile information those services share, in accordance with the permissions you grant.

Apple and RevenueCat. We receive your subscription status so we can unlock the features you paid for.

We do not receive advertising or attribution data about you from marketing partners.

1.4 First-Party Analytics

We run our own analytics to understand how the app is used and to fix problems. It is built into the app and stored with our database provider (Supabase). We do not use a third-party analytics or advertising SDK for it.

What is recorded: app usage events, such as screens opened, features used, meal plans created, and the onboarding steps you complete or skip; the time of each event; a random install ID created on your device when the app is installed; a session ID; the app version; and device model, operating system version, and locale. We may also record which version of a screen or feature you were shown when we test changes.
Linked to you: events sent before you sign in are tied only to the install ID. Once you are signed in, events are linked to your account.
Not recorded: advertising identifiers, your contacts, your precise location, or the content of your chat messages.
Your choice: you can turn analytics off at any time with the toggle in the app's settings. When it is off, the app stops sending analytics events from that device.
Retention: analytics events are deleted 180 days after they are recorded. When you delete your account, events not yet deleted are unlinked from your account. Install-level records (install ID, device model, operating system version, locale, and first and last seen times) are not deleted on a fixed schedule: we keep them until we remove them or you ask us to. To ask, write to privacy@nutrinity.app.

1.5 Referral Program

Nutrinity lets you share a personal referral code and enter a code someone shared with you. To run it, we collect and store:

your referral code;
who referred whom, meaning which account's code was used by which other account, and when;
where the code was entered (for example, after a purchase or from your profile);
subscription attribution: the subscription plan and product of the referred account at the time the code was used, so we can tell whether a referral led to a subscription; and
attempts to enter a code, to prevent abuse. Attempts that fail are deleted after one day.

Sharing your code uses the standard iOS share sheet; Nutrinity does not read your contacts. The person whose code you used can see how many of their referrals succeeded. We do not show them your name or email. Referral records are deleted when either account is deleted.

1.6 Website Waitlist

If you join the waitlist on nutrinity.app, we collect and store:

your email address and when you joined;
which form you used (for example, the home page or the waitlist page);
the creator code in the link you arrived through, if you came from a creator's link (see the first-party cookie described in Section 1.2); and
which version of the sign-up wording you saw, and when you submitted the form;
a one-way, salted hash of your browser's user-agent string; and
for a few days, counters that are labeled with a one-way, salted hash of your IP address (for IPv6, of your network prefix), used only to stop automated and repeated sign-ups. We do not store your IP address itself, and these counters are not linked to your email.

Why: to email you when Nutrinity is available on the App Store and, occasionally, about major Nutrinity news, and to understand which pages and creators bring people to the waitlist. We do not sell your email or share it for anyone else's marketing. Before we send news, we may first send one email asking you to confirm that the address is yours. The form may use Cloudflare Turnstile to check that a sign-up comes from a person and not a program; for that check Cloudflare receives your IP address and details about your browser.

How long: until you unsubscribe or ask us to remove you, and at most 24 months after you join either way. A nightly job deletes waitlist sign-ups older than 24 months, and invalidates the confirmation link in any confirmation email that has gone unanswered for 30 days.

How to be removed: use the unsubscribe link in any email we send, or write to privacy@nutrinity.app from that address. We stop emailing you within 10 business days and, if you ask, delete your email from the list. After you unsubscribe, we keep a record of your address marked do-not-email for up to 24 months, so we don't accidentally email you again during that time.

2. How We Use Your Information

We use the information collected to:

Provide the Services: create your account, generate personalized meal plans, suggest recipes, build shopping lists, find nearby stores, check products and estimated prices, and answer chat questions.
Personalize your experience: refine plans based on your goals, feedback, pantry, and swaps.
Process payments and manage subscriptions through Apple and RevenueCat.
Run the referral program: record referrals and measure whether they lead to subscriptions.
Communicate with you: send messages about your account and subscription, such as sign-in and security emails, and, if you joined the website waitlist, launch news (Section 1.6).
Provide customer support: respond to your questions and troubleshoot issues.
Improve the Services: use first-party analytics to understand usage, fix bugs, improve onboarding, and test changes.
Maintain security: detect, investigate, and prevent fraud, abuse, and security incidents.
Comply with legal obligations: respond to lawful requests, enforce our Terms of Service, and protect our rights and users.

3. Artificial Intelligence and Automated Processing

Nutrinity uses artificial intelligence to generate meal plans, recipes, ingredient substitutions, and chat answers. To do this, the preferences you give us for meal planning (age, sex, height, weight, activity level, goal, diet style, allergies, foods you avoid, cuisines, cooking equipment, budget, and pantry items) are sent to OpenAI. If you use the chat feature and agree in the app, OpenAI also receives your chat messages. OpenAI does not receive your name, email, or location.

We limit the data sent to AI providers to what is needed for the request. Under OpenAI's API terms, data sent through the API is not used to train OpenAI's models by default. We do not use your personal information, including your health-related information, to train AI models.

Nutrinity is not a medical service. AI-generated recommendations are not medical advice, diagnosis, or treatment. Consult a qualified healthcare provider before making significant dietary changes, especially if you have a medical condition, are pregnant or nursing, take medication, or have a history of disordered eating.

We do not make solely automated decisions that produce legal or similarly significant effects about you. You may contact us with questions about how recommendations were generated.

4. Location

To find grocery stores and products near you, Nutrinity uses your ZIP code. You can type a ZIP code or an address, or let the app use your device's location (only while you use the app).

If you type an address, the app may use Apple's map search on your device to find it, and our server reads the ZIP code from the result. Our servers do not send the street address itself to any store or map service.
If you use device location, the app may use Apple's geocoding service on your device to look up the matching address. To find your ZIP code, our server may send OpenStreetMap's Nominatim service an approximate point: your coordinates rounded to about 1 kilometer (0.6 miles).
To find stores and products near you, our servers search store and product listings. To list the stores near you, a search includes a ZIP code and a reference street address near the center of that ZIP code (the same address for everyone in the ZIP code, not yours). To find products and prices, a search includes the store you selected (its public name, address, and ZIP code) and an ingredient name. We do not include your name, email address, account details, or your own address in these searches.
We save your location with your profile so we can build your plans: the ZIP code, the city, and approximate coordinates (rounded to about 1 kilometer), together with the store you choose (its public name and address). A street address you type, or a spot you pick on the map, is used once to find nearby stores and is not saved with your profile.

5. Legal Bases for Processing (EEA, UK, Switzerland)

If you are located in the European Economic Area, United Kingdom, or Switzerland, we process your personal information on these legal bases:

Performance of a contract: providing the Services you request.
Consent: for location data and for chat messages sent to our AI provider. You may withdraw consent at any time. The app does not ask for a separate consent for the body and diet details you enter, such as age, height, weight, goals, and dietary restrictions; we use them to build your meal plans.
Legitimate interests: first-party analytics, the referral program, improving the Services, securing our systems, and preventing fraud, provided these interests are not overridden by your rights. You can turn analytics off in the app's settings.
Legal obligation: complying with applicable laws.

6. How We Share Your Information

We do not sell your personal information, and we do not use it for advertising or cross-app tracking. We share information only as described below.

Service Providers. We share only what each provider needs to do its job for us:

OpenStreetMap Foundation (Nominatim): a ZIP code, or your device's coordinates rounded to about 1 kilometer, to convert between ZIP codes and map points.
Apple: if you type an address or use device location, the app may use Apple's map search and geocoding services to find the address or to turn your location into an address.
OpenAI: the meal-planning preferences described in Section 3, and chat messages if you agree in the app.
Supabase: stores your account, profile, meal plans, pantry, profile photo, referral records, first-party analytics events, and waitlist sign-ups, and provides sign-in.
Email delivery provider: we have not sent any waitlist email yet. Before we send the first one, we will name here the provider that receives waitlist email addresses to send the emails described in Section 1.6 and to handle unsubscribes.
RevenueCat and Apple: process your subscription and purchase status.
Apple and Google: sign-in, if you choose Sign in with Apple or Google.
Cloudflare: delivers and protects the nutrinity.app website and the connection to our application servers, and forwards email sent to our nutrinity.app addresses. It receives standard web request data (such as IP address and browser type) when you visit the website, and relays app requests to our servers over encrypted connections.
Stock-photo providers (such as Unsplash): our server sends dish names to find meal photos. When the app shows those photos, your device loads them from the provider, which receives your IP address and standard request data.
RackNerd: rents us the server that runs our application servers and the nutrinity.app website.

Each provider is bound to use your information only to provide its services to us and to protect it appropriately.

Store and product searches. To find stores, products, and prices near you, our servers search store and product listings, as described in Section 4. The store search contains a ZIP code and a reference address near the center of that ZIP code. The product search contains the store you selected (its public name, address, and ZIP code) and an ingredient name. Neither contains your name, email address, account details, or your own address. Store logos and product images that appear in the app are loaded by your device from the image hosts named in those listings, and those hosts receive your device's IP address and standard request data.

Referral Program. The person whose code you used can see a count of their successful referrals, as described in Section 1.5.

Shared grocery list. If you share your grocery list, or join someone's, the other member sees the list's items, amounts, aisles, store names, who checked each item, and the first name you choose to show. They never see your meals, nutrition, allergies, health data, budget, prices or location. Items added while you share are stored on our servers. Remove a member or leave in Profile → Household; removed items are deleted within 14 days.

Business Transfers. If Nutrinity is involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you as required by law.

Legal and Safety. We may disclose information when required by law, regulation, legal process, or governmental request, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, the safety of others, or to investigate fraud or abuse.

Aggregated or De-Identified Data. We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you.

7. Your Privacy Rights and Choices

7.1 Controls Available to All Users

You can:

Review and update your profile, preferences, and goals at any time in the app.
Turn first-party analytics off with the toggle in the app's settings.
Manage location, camera, and photo access in iOS Settings.
Cancel your subscription through your Apple ID subscription settings.
Delete your account and associated data from the app (Profile, then Account & settings, then Delete account) or by contacting us at privacy@nutrinity.app.
Request a copy of your data (data access or export) by emailing privacy@nutrinity.app from the address on your account.

7.2 EEA, UK, and Swiss Residents

You have the right to: access your personal information; correct inaccurate or incomplete information; request deletion; restrict or object to processing; withdraw consent; receive your data in a portable format; and lodge a complaint with your local data protection authority.

7.3 U.S. State Residents

Depending on your state of residence (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Washington, and others), you may have the right to: know what personal information we collect; access a copy of your personal information; correct inaccuracies; delete your personal information; opt out of the sale or sharing of personal information (we do not sell or share personal information for advertising); opt out of targeted advertising (we do not engage in it); opt out of profiling; limit the use of sensitive personal information; and not be discriminated against for exercising your rights.

Washington My Health My Data Act. If you are a Washington resident, you have additional rights regarding "consumer health data," including the right to withdraw consent and the right to confirm whether we collect, share, or sell your health data. Contact us at privacy@nutrinity.app to exercise these rights.

California Shine the Light. California residents may request information about our disclosure of personal information to third parties for direct marketing purposes once per year by emailing privacy@nutrinity.app.

7.4 How to Exercise Your Rights

To exercise any of these rights, contact us at privacy@nutrinity.app. We will verify your identity before processing your request and respond within the timeframes required by applicable law (typically 30 to 45 days). You may use an authorized agent, subject to verification.

We will not discriminate against you for exercising your privacy rights.

8. Data Retention

Your account, profile, plans, pantry, and photo: kept until you delete your account in the app.
Referral records: kept while both accounts exist; deleted when either account is deleted.
Website waitlist: kept until you unsubscribe or ask us to remove you, and at most 24 months after you join either way (Section 1.6).
Creator link visits: the hashed IP address and user-agent are cleared after 180 days; the visit record without them is kept (Section 1.2).
Sign-up and code-entry limits: counters labeled with a hashed IP address are deleted one day after their time window ends, so after a few days at most.
Server logs (described in Section 1): web server logs (IP address, access time, page requested, browser type, and error logs) are deleted after 14 days. Logs from our application servers, which can contain parts of a ZIP code or address you entered, are kept in fixed-size files that overwrite their oldest entries as new ones arrive, so how long an entry lasts depends on traffic.
Analytics events: deleted 180 days after they are recorded, and unlinked from your account sooner if you delete it; install-level records are kept as described in Section 1.4.
Store search, earlier versions: until the evening of September 25, 2026 (Eastern time), our servers could send the address you entered, or an address based on your device location, to the store search, and it could be saved on accounts that we operate with a store data provider. Those saved addresses are not linked to your Nutrinity account and are not deleted on a fixed schedule, and the provider may keep its own copies, which we cannot delete. You can ask us to remove one by writing to privacy@nutrinity.app. Searches today use only the ZIP-level reference address described in Section 4.
Meal-plan requests: kept in our server cache for up to 24 hours.

When you delete your account, we delete or de-identify your personal information within a reasonable time, except where retention is required for legal, tax, accounting, or regulatory obligations; resolving disputes or enforcing our agreements; preventing fraud and abuse; or backup systems, which are deleted on a rolling schedule. Aggregated or de-identified data that can no longer be linked to you may be retained indefinitely.

9. Data Security

We use reasonable safeguards, including HTTPS between the app and our servers, access controls on our databases so that an account can read only its own data, and limits on how often our servers can be called.

No method of transmission or electronic storage is 100% secure. You are responsible for keeping your account credentials confidential and notifying us promptly at security@nutrinity.app if you suspect unauthorized access.

10. International Data Transfers

Nutrinity is operated from the United States. If you access the Services from outside that country, your information will be transferred to and processed in the United States and other countries where our service providers operate. For transfers from the EEA, UK, or Switzerland to countries without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses or other appropriate safeguards.

11. Children's Privacy

Nutrinity is not intended for children under 13. We do not knowingly collect personal information from anyone under 13. If we learn that we have collected information from a person under 13, we will delete it promptly. Contact us at privacy@nutrinity.app if you believe a child under 13 has provided us with personal information.

People aged 13 to 17 may use Nutrinity only with the permission of a parent or legal guardian. A parent or guardian can write to privacy@nutrinity.app to ask what we hold about a teen's account and to have it deleted. Nutrinity's nutrition guidance is general information, not medical advice. Nutrinity does not set weight-loss calorie deficits for people under 18. If you are under 18, talk to a parent or guardian and to a doctor or registered dietitian before you change how you eat.

12. Third-Party Services and Links

The Services may contain links to third-party websites, services, or content (including grocery stores and recipe sources). We are not responsible for the privacy practices of those third parties. Review their privacy policies before providing them with information.

13. Apple-Specific Disclosures (iOS)

App Tracking Transparency. Nutrinity does not track you across other companies' apps and websites and does not collect advertising identifiers, so it does not ask for tracking permission.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app, by email, or by other means before the change takes effect. The "Last Updated" date above indicates the most recent revision. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.

15. Contact Us

Nutrinity LLC

83 Forest Dr, Jericho, NY 11753

Email (Privacy Requests): privacy@nutrinity.app

Email (General Support): support@nutrinity.app

For residents of the EEA or United Kingdom, you may contact your local data protection authority if you have unresolved concerns. UK residents may contact the Information Commissioner's Office at ico.org.uk.

Questions? privacy@nutrinity.app