Privacy Policy
1. Data Controller
This policy describes how Nutrimind ("Food Memory") processes your personal data in compliance with the EU General Data Protection Regulation (GDPR) and applicable local laws.
Contact: support@emrullah.xyz
2. Personal Data We Collect
We collect and process the following categories, based on your consent or our legitimate interest:
2.1 Account data
- Email address (account identifier, login)
- Display name (optional)
- Password hash (scrypt algorithm with salt; never stored in plaintext)
- Google OAuth subject ID (for "Sign in with Google" users only;
google_sub)
2.2 Meal and health data
- Daily meal entries (food name, calories, macronutrients, time)
- Aliases you define and their mapping rules
- Goals (TDEE, calorie and macro targets)
- This data may constitute health-related data.
2.3 Technical data
- IP address (for rate limiting and abuse prevention, short-lived)
- User-Agent (anonymized for Open Food Facts queries)
- Session cookie (
__Host-nm_session, HttpOnly, Secure, SameSite=Lax, 30-day sliding)
3. Purposes of Processing
- Account creation, session management, authentication
- Meal tracking, daily and weekly reports, trends
- Alias learning to simplify free-text meal entry
- AI feature (photo + text): only with your explicit consent; photo and text are sent to Google Gemini and never stored on our servers.
- Debugging, security, abuse prevention
4. Third-Party Services and Data Sharing
4.1 Google Gemini (AI feature)
When you use the AI feature, your photo and meal text are sent to the Google Gemini API. Google processes this data under their own privacy policy: policies.google.com/privacy. Data is not stored on our servers.
4.2 Open Food Facts (barcode lookup)
When you scan a barcode, the barcode number and product name are sent to the Open Food Facts API with an anonymized User-Agent. See: world.openfoodfacts.org/privacy.
4.3 Google OAuth (sign-in)
When you sign in with Google, only the email and profile scopes are requested. We never request sensitive scopes (calendar, contacts, etc.).
4.4 Hosting
The app is hosted on an Oracle VPS. Data may be processed in data centers outside your country. HTTPS is enforced.
5. Data Retention
Your data is kept while your account is active. When you delete your account, all personal data is immediately and irreversibly deleted (hard delete from the database). Backup copies are purged within 30 days.
6. Your Rights (GDPR Art. 15–22)
You have the right to:
- Access your personal data (Art. 15)
- Rectify inaccurate data (Art. 16)
- Erase your data ("right to be forgotten", Art. 17)
- Restrict processing (Art. 18)
- Data portability — download your data in a machine-readable format (Art. 20)
- Object to processing (Art. 21)
- Withdraw consent at any time (Art. 7(3))
- Lodge a complaint with your supervisory authority (Art. 77)
To exercise these rights, use Settings → Account → "Download my data" or "Delete my account", or contact us at support@emrullah.xyz. We respond within 30 days.
7. Cookies
The app uses only one strictly necessary session cookie:
__Host-nm_session: 32 random bytes, stored as SHA-256 hash in the database. HttpOnly, Secure, SameSite=Lax, 30-day sliding. No third-party cookies.
No marketing, analytics, or advertising cookies are used.
8. Security
- Passwords are hashed with scrypt (never plaintext).
- Session IDs are stored as SHA-256 hashes.
- All traffic is HTTPS-only.
- Rate limiting (per IP and email) prevents abuse.
- CSRF protection via Same-Origin checks.
9. Children's Privacy
Nutrimind is categorized as a Health & Fitness app and is intended for users aged 13 and over. We do not knowingly collect data from children under 13. If we become aware of such data, it will be deleted. Parental consent is recommended for users under 18.
10. Changes to This Policy
Updates to this policy are published on this page. Significant changes are announced in-app and via email to registered users.
11. Governing Law
This policy is governed by the laws of the Republic of Türkiye. EU GDPR rights apply to EU residents regardless of governing law.