Privacy Policy

2.1 Personal Information

• Email address and display name
• Optional private profile photo, preset avatar icon, initials, and any related review notices
• Account sign-in identifiers and app preferences
• Authentication handled by Firebase/Auth providers. NutriPet does not store your password in plain text
• Pet profiles, including name, species, breed, age, weight, sex, and ingredients to avoid
• Onboarding nutrition answers and prepared plan inputs
• Scan history and product analysis results created while Pro access or a store-confirmed trial is active
• Subscription status, entitlement details, and store transaction references from Apple, Google, or RevenueCat

2.2 Food Journal Data (Pro Feature)

If you use Food Journal, we collect the meal details you choose to log, such as:

• Meal type, such as breakfast, lunch, dinner, snack, or treat
• Portion sizes and units (cups, grams, oz, pieces)
• Calorie information for logged meals
• Meal dates and feeding times
• Product names associated with meals
• Personal notes about meals

2.3 Reaction & Symptom Data (Pro Feature)

• Pet reactions to food (great, good, neutral, poor, bad)
• Observed symptoms (e.g., digestive issues, skin irritation, behavioral changes)
• Reaction notes and dates
• Food patterns suggested from your own logged reactions

2.4 Prepared Plan & Smart Feeding Profile Data

To prepare your plan preview and calculate feeding recommendations when Pro is active, we collect:

• Activity level (sedentary to very active)
• Body condition score (underweight, ideal, overweight, obese)
• Life stage (puppy/kitten, adult, senior, pregnant, nursing)
• Spayed/neutered status
• Feeding goals (maintain, lose, or gain weight)
• Meals per day preference
• Treat calorie percentage allowance

2.5 Daily Tracking Data

• Daily calorie consumption progress
• Meal logging activity and streaks
• Day-over-day feeding patterns
• Weekly calorie summaries

2.6 Scout AI Assistant Data (Pro Feature)

• Scout questions you choose to ask
• Recent Scout chat turns sent as context for the current answer
• Selected pet profile context needed to personalize the answer, such as name, species, breed, age, weight, activity, allergies, sensitivities, and medical conditions saved in the app
• When Cloud Backup is enabled, a bounded summary of the selected pets' cloud-synced history: meal and reaction patterns from the last 30 days, the two most recent weights, activity from the last 7 days, and up to three recent saved scans
• The cloud-history summary may include selected pet names, but excludes free-text notes, symptom details, medication data, images, and raw log records
• Bounded food and profile facts generated locally by NutriPet, such as ingredient matches and saved ingredient triggers relevant to the question

2.7 Subscription Access

• Free or inactive account: basic account, preferences, onboarding, and plan-preview data. Scans, OCR, ingredient analysis, scan history sync, Food Journal, Smart Feeding, exports, and cloud sync require active Pro access or a store-confirmed trial.
• Pro access: Food checks, pet profiles, Food Journal, Smart Feeding, Nutrition Trends, Cloud Backup across devices, and PDF data export; current usage limits are shown in the app

2.8 Automatically Collected

• Device information, such as type, OS version, and app version
• App usage information, such as feature use and scan counts
• Camera input when you choose to scan barcodes, labels, or food photos
• Optional pseudonymous analytics and install attribution after you consent
• Crash and performance diagnostics (via Sentry) so we can detect and fix stability problems. This is on by default under our legitimate interest in a reliable, safe app. Reports use a pseudonymous account identifier, and NutriPet applies technical filters designed to exclude email, pet-profile, journal, Scout-question, and image content. You can turn it off anytime in Settings > Privacy Preferences > Essential Diagnostics
• Limited onboarding funnel metrics (the onboarding step reached, app version, platform, locale, timestamp, and step order) are collected by default so we can see where onboarding is confusing and improve it. The event payload excludes user, account, advertising, and device identifiers and uses only an ephemeral per-launch session key. We keep this stream separate from account analytics and do not intentionally join it to your account. It is processed by NutriPet and the service providers described in section 6; raw events are kept for up to 13 months and reporting aggregates for up to 36 months as described in section 7

2.9 Cloud Backup

Cloud Backup is on by default so your pets, scans, Food Journal, health logs, and saved product favourites can be restored on a new device. We use Firebase and Google Cloud; your data is encrypted in transit (TLS) and at rest by the provider, kept private to your account, and never sold. Cloud Backup is not end-to-end encrypted, and you can turn it off anytime in Settings. Turning it off prevents these records and their images from being uploaded or downloaded; deletion requests can still reach the service so previously backed-up records are not trapped in the cloud.

2.10 Account Progress

For a registered account, NutriPet syncs a minimal badge, challenge, and care-streak progress record separately from Cloud Backup. This keeps lifetime achievements consistent across devices and makes retried progress updates idempotent. The record contains badge and challenge identifiers, bounded counters, event identifiers and types, and occurrence, receipt, and completion dates. It does not contain pet names, journal notes, ingredients, images, Scout conversations, or raw scan or health records. Guest progress remains on the device until the guest creates or links an account. Turning Cloud Backup off does not stop this minimal account-progress sync. Short-lived usage receipts expire after about 30 days, and achievement-delivery receipts are eligible for automatic deletion after 400 days; deleting the account removes the progress record and any remaining receipts sooner.

2.11 Private Account Profile Photos

Profile photos are optional. They are private to your account, not shown in a public profile, and can be seen only by you and authorized NutriPet team members when needed for support, security, or photo review. They are stored separately from optional Pro cloud sync and are available to free and paid accounts.

NutriPet does not use profile photos for facial recognition, biometric templates, identity matching, attribute inference, advertising, sale, or AI model training.

2.12 Smart Scan Data (Pro Feature)

When Smart Scan or ingredient OCR uses the camera, NutriPet analyzes and saves only the orientation-normalized, unobstructed part of the live preview: unseen aspect-filled sensor edges and the areas behind the header and capture controls are excluded. The on-screen label guide helps composition and is not a crop boundary. When you choose a gallery image, the complete selected image is analyzed. Before third-party processing, that analyzed artifact is resized when needed, re-encoded, and stripped of embedded metadata. Alibaba Cloud Model Studio (Qwen), through our Germany (Frankfurt) workspace, receives the Smart Scan artifact and a dog, cat, or mixed-species label derived from the pets selected for that scan. Google Cloud Vision receives the same Smart Scan artifact through its EU OCR endpoint to provide independent label text evidence. When you separately use food-photo recognition, Google Cloud Vision receives its processed artifact through the EU label-detection endpoint. Neither provider receives pet names, pet IDs, or other pet-profile details with these photos. NutriPet does not save raw provider responses. To recover a successful scan after a lost network response without processing the photo again, NutriPet keeps the bounded, normalized scan response-not image bytes or a raw provider response-in a user-scoped server cache for up to 15 minutes. The cache expires automatically and is included in account-deletion cleanup. The analyzed artifact saved with a successful result can remain in local scan history and, when enabled, private Cloud Backup until you delete the scan. Registered users may separately opt in to the Scan Quality Observatory in Privacy Preferences. It is off by default, and Smart Scan works the same if you decline. When enabled, NutriPet may retain the exact metadata-stripped, resized artifact sent to the scan providers, the structured extraction, provider timings, and your structured accuracy feedback solely to diagnose and improve Smart Scan extraction accuracy. The artifact is pseudonymized, quarantined for privacy review, and kept in isolated CMEK-encrypted EU object storage. The bounded diagnostic record is kept in a separately access-controlled restricted backend collection. Authorized privacy reviewers may inspect quarantined evidence before ordinary accuracy reviewers receive access. Observatory data is never used for general model training and is deleted when no longer needed or no later than 90 days after capture. You may delete retained evidence or withdraw consent at any time; NutriPet immediately blocks new reviewer access, any already-issued short-lived evidence link expires within at most two minutes, and deletion is confirmed or durably queued for retry. Account deletion includes this evidence and its consent records.

Legal Basis (GDPR)

• Contract performance: provide account services and requested features
• Legitimate interests: improve reliability, prevent fraud, secure accounts, review uploaded content, run essential crash and performance diagnostics (Sentry), and measure aggregate onboarding drop-off using the limited stream described in section 2.8. You can opt out of essential diagnostics in Settings
• Consent: optional analytics, the separate Scan Quality Observatory, and other optional processing where consent is required
• Legal obligation: comply with applicable law

Local Storage

Without active Pro access, NutriPet stores basic account, preferences, onboarding, and plan-preview data. Product scans, OCR, Food Journal, Smart Feeding, exports, and cloud sync are available only with active Pro access or a store-confirmed trial. If Cloud Backup is off, pet, scan, journal, health, image, and saved-product data stays on your device. For registered accounts, only the minimal account-progress record described in section 2.10 continues to sync.

Cloud Storage (Cloud Backup)

Firebase and Google Cloud host your Cloud Backup data and the separate minimal account-progress record described in section 2.10. Records are encrypted in transit (TLS) and at rest by the provider and kept private to your account. International transfers are handled under Google data-processing terms and transfer safeguards, and we review deployment regions against the live service configuration.

Security Measures

• Cloud Backup data is encrypted in transit (TLS) and at rest by the provider
• Secure local key storage through the device keychain where supported
• TLS for network communications
• For Smart Scan and ingredient OCR, camera artifacts are limited to the unobstructed visible preview while gallery artifacts use the complete selected image; the label guide is a composition aid, not a crop boundary. For separate food-photo recognition, camera photos use the visibly dimmed object frame while gallery photos use the complete selected image. Each artifact is orientation-normalized, resized when needed, re-encoded to a standard image format, and stripped of embedded metadata before processing. Smart Scan uses Alibaba Cloud Model Studio (Qwen) in Germany (Frankfurt) and Google Cloud Vision EU OCR; food-photo recognition uses Google Cloud Vision EU label detection. NutriPet does not save raw provider responses. A bounded, normalized successful response is held in a user-scoped server cache for no more than 15 minutes so an interrupted request can be recovered without another provider call. The analyzed artifact saved with a successful result can remain in local scan history and, when enabled, private Cloud Backup until you delete the scan. Separately, registered users can opt in to the default-off Scan Quality Observatory. With consent, the exact metadata-stripped, resized provider artifact may be held in isolated CMEK-encrypted EU object storage, while the bounded diagnostic record is held in a separately access-controlled restricted backend collection. Both are available only for restricted privacy and accuracy review, solely to improve extraction accuracy, never for general model training, and for no longer than 90 days. Withdrawal, delete-evidence, and account-deletion requests immediately block new reviewer access; any already-issued short-lived evidence link expires within at most two minutes; deletion is completed directly or through a durable retry queue
• Profile photos are resized, stripped of metadata, and stored privately until replaced, removed, or the account is deleted
• Access to your Cloud Backup data is restricted to your account

GDPR/CCPA Rights

• Access: ask for a copy of your data, including profile-photo metadata and review notices
• Correction: fix inaccurate data
• Deletion: delete your account and associated profile photo, subject to limited lawful retention
• Export: download your data, including pets, scans, journal entries, achievement progress and event receipts, avatar metadata, and policy status
• Limit processing: ask us to limit how we use your data
• Object: object to certain processing
• Withdraw consent: revoke optional permissions anytime

How to Exercise Rights

• In the app: Settings > Data & Storage > Export/Delete
• Food Journal data can be exported separately
• Email: support@nutripet.app
• We aim to respond within 30 days