Privacy Policy: How Food Signals Handles Your Data

Last Updated: October 19, 2026

This Privacy Policy explains how Food Signals ("we", "us", or "our") collects, uses, discloses, and protects your personal information when you use our web or mobile application (the "Service"). We are committed to handling your data with transparency and care.

1. What Data We Collect

We collect only the minimum information necessary to provide the Service:

Data you provide directly:

Body Measurement Data: We collect and store the body measurements you provide — your height, body weight, and (optionally) waist — as part of your nutrition profile and weight tracking. Your current height, weight, and waist are stored on our servers against your account so they are available across your devices, and each weight/waist entry you record is kept with its date so we can show you your trend over time. Providing waist is optional, and you can update or delete these values.
Profile Inputs: Your age, sex, and activity level, if you provide them. These are stored on our servers against your account, alongside your height and weight, because they are the inputs your nutrition targets are calculated from and we recalculate those targets when any one of them changes. You can update them at any time, and they are deleted with your account.
Meal and Food Logs: What you log eating or drinking — logged by photo, description, or selecting a previous meal — plus the nutrient values we calculate from it.
Symptom Logs: Which symptoms you record (for example nausea, fatigue, bloating) and the severity you select, only if you have opted in to health-data collection.
Injection-Event Logs: The date/time of injections you log and, where you choose to record it, a relative dose-change category — First Dose, Increased, Same, Reduced, or Restarted After Break — only if you have opted in to health-data collection. We do NOT collect the name, brand, type, active ingredient, or identity of any medication, and we do NOT collect a numerical dose amount or dose multiplier. We do not know what drug you are taking or how much of it you take.
Injection Interval: If you set one, your preferred number of days between injections — a scheduling preference used to help the app plan around your routine. This is a cadence you choose, not a dose.
Observed Patterns: Where you use the Patterns feature, statements describing correlations we observe between your own logged data (for example, between a symptom and foods logged nearby in time). These are generated from your other logged data, shown only to you, and treated as consumer health data — see Section 9.3 and our Consumer Health Data Privacy Policy.
Usage preferences: Settings and preferences you configure within the application.
Plan Builder answers: If you build a day of meals on a page that saves it to Food Signals, we keep the settings you choose (foods you leave out, how much cooking you're up for, and who you cook for) so the plan can be sent and kept. Your answer about how eating feels right now is sent to our server only to choose the meals for that plan, and is not stored. On pages that build the day in your browser, none of your answers leave your device.
Waiting-list and admission records: If you join the waiting list we keep your email address, your first name if you gave it, the time, and where you joined from (for example a page on our website or the Plan Builder). If you made a plan in the Plan Builder first, we link your address to that plan so it is kept for you. When you are let in we record an admission: your address, the time, how you were admitted (from the waiting list, directly by us, or by an access code you entered) and who or what admitted you. We email you an invitation link that works once and expires after 30 days; we keep only a one-way hash of that link, never the link itself. These are account and commercial records. They contain no health information.
Access records: Which access your account has and why: when your 14-day trial ends, any other period of access we have given you, and when and why that changed, together with a reference to any access code you have redeemed and when (the code itself is held only as a one-way hash). The app also records, as first-party product analytics (see below), that you tapped a feature your account does not currently have, or redeemed an access code, with the feature name and your access state only. This is commercial data. It contains no health information.
Purchase records: If you buy access, we keep a record of the purchase: what you bought, the amount and currency, the status (paid, refunded or disputed), the dates, and the email address and billing country our payment provider reports to us. It holds none of your food, symptom, injection or measurement data, and none of your card details.

Data collected automatically:

Technical Data: Device identifiers, operating system version, application version, and usage logs collected to operate and maintain the Service.
Product Analytics Data: A record of how you interact with the Service — screens you open, features you use, actions you complete or abandon, and errors you hit. This is first-party: it is collected by us, stored on our own infrastructure, and never sent to any third-party analytics provider. It records that you logged a meal and which recipe it referred to — never what the meal was. Your food entries, symptom entries, journal text, and any other free text you write are never included, and we do not record your IP address or location. You can turn this off at any time (see Section 9).
Getting-Started Prompt State: Whether you have dismissed a getting-started suggestion for the day, and whether you have reached certain one-time usage milestones (for example, generating a shopping list or checking an item off one) — used only to decide which suggestions to show you next. This is never your food, symptom, or shopping-list content, only that a suggestion was shown or a milestone was reached. You can turn these suggestions off at any time (see Section 9), and this state is deleted with your account.

What we do NOT collect:

We do NOT collect the name, brand, type, classification, or identity of any GLP-1 medication or any other medication.
We do NOT collect a numerical dose amount or dose multiplier for any medication.
We do NOT collect diagnoses, medical records, prescriptions, or health conditions.
We do NOT collect your precise GPS location.
We do NOT collect or store your card or bank details. If you buy something, you enter them on our payment provider's own page, never on ours. We keep a record of the purchase itself, described in the next list and in Section 3.

2. How We Use Your Data

We use the information we collect exclusively for the following purposes:

Purpose	Description
Injection Cycle Scheduling	Your injection timing, relative dose-change category, and injection-interval preference are used solely to calculate your GLP-1 injection schedule and cycle timing. This is the only purpose for which this data is used.
Service Operation	Technical data is used to operate, maintain, and improve the reliability and performance of the Service.
Support	If you contact us for support, we may use your account and technical information to diagnose and resolve issues.
Waiting List and Admission	Your email address and admission record are used to hold your place, to email you when it is ready, to send your invitation, and to check that a person creating an account has been let in.
Access	Your access records are used to decide which features your account can use, and to show you when your full access ends.

We do NOT use your data for:

Advertising, profiling, or marketing to you or any third party.
Building behavioural profiles.
Selling, licensing, or commercially exploiting your information.
Any purpose other than those listed above.

3. Third-Party Processing and International Transfers

This section names the categories of third party that process any part of your data, what they do with it, and where they do it. We do not permit any third party to use your data for their own advertising or unrelated purposes, and we do not have an undisclosed secondary use for any data we collect. This list reflects the processors in use as of the date of this policy; if we add a new category of processor, we will update this section and notify you before that processor receives your data.

By using the Service, you acknowledge and expressly consent to the following:

To generate meal suggestions, answer questions about GLP-1 medication management, and provide the AI-assisted features of the Service, your queries and the contextual data necessary to respond to them are transmitted to a third-party artificial intelligence model provider. The current provider is:

OpenAI (openai.com) — provider of the GPT family of AI models

This is the only AI model provider currently integrated into the Service, and it is kept in sync with our internal processor register. Depending on the AI feature you use, a future version of the Service may add or change providers; if that happens, we will update this section and notify you before the new provider receives any data.

What data is sent to AI providers:

Only the information necessary to respond to your query — the content of your meal/drink photo or description, a portion hint where relevant, and the text of your question or request. We do not send your name, symptoms, injection data, measurements, or any account identifier beyond what is technically necessary to route the request. The name, brand, or type of your medication is not stored by us and therefore cannot be sent, and there is no numerical dose value to send.

Protections under our arrangements with AI providers:

We use the API (application programming interface) offerings of these providers, not their consumer products. Under our API service agreements:

Your query data is not used by AI providers to train their models.
The AI provider may keep your queries and the AI-generated responses — including any meal or drink photo you sent — for up to 30 days in order to detect and prevent abuse of its service. After that they are deleted, unless the provider is required by law to keep them. The provider does not keep them for any other purpose.
Your data is processed by the AI provider solely on our behalf for the purpose of generating a response.

These protections reflect the commitments made by these providers in their API terms of service as of the date of this policy. If those terms change materially to your detriment, we will update this policy and notify you.

International data transfer:

Because AI providers operate globally, your query data may be processed on servers located outside your country of residence, including in the United States. By using the Service, you consent to this transfer.

Infrastructure sub-processors:

Cloudflare — The Service runs on Cloudflare's infrastructure: our application servers, our databases (including your food, symptom, injection and measurement logs), and the storage holding your meal photos. Cloudflare processes your data solely to deliver the Service under our instructions. Cloudflare is a United States company operating a global network, and we do not pin our databases or file storage to a specific country — your data may be stored and processed on Cloudflare infrastructure outside your country of residence, including in the United States.
Brevo — Our transactional email provider, used solely to send account-related emails (email verification, password reset, support responses) and, if you have opted in, our email updates. Brevo processes your email address and the content of these messages under our instructions. We also sync a limited set of lifecycle attributes to Brevo to personalise those messages and measure whether they're useful — for example whether and when you last logged a meal, and how many meals you've logged in total. We also use Brevo to send the waiting-list confirmation and, when you are let in, your invitation email, and one of the lifecycle attributes we sync is a status showing where you are in sign-up (for example on the waiting list, invited, or registered). Brevo never receives the content of any meal, symptom, injection, or measurement entry, only these summary attributes.

Brevo also hosts a separate purchase-intent waiting list for visitors to `/onecart_us/` who activated a buy control and gave us an address through the panel. The waiting list is a commercial-interest record (the offer and price shown, the arm and page, the timestamp, the address — for the sole purpose of telling them when orders open) and contains no health data. The list id is environment-specific (preprod, production, local dev), so a non-production environment cannot write to the production list. An address added to the waiting list is removed on account erasure and on withdrawal of the address from the panel; if you erase your account, the address is also removed from the list as part of erasure. The waiting list is a separate Brevo list from the marketing lists — your address recorded through this flow alone never reaches our general marketing communications.

If you tick the box offered when we email you your plan on our family plan page ("Also send me Ruby's practical food tips and news from Food Signals"), Brevo also holds your address on a separate follow-up list, used for a short series of emails (no more than four over 14 days) with practical food tips and our current offer. The box is never ticked for you, and nothing else puts an address on this list. We record when you ticked it. You leave the list when you unsubscribe from any of these emails, if you untick the box, when you buy, or when you erase your account. The list holds your address only, with no health or dietary information.

Brevo is a French company and processes this data in the European Union.

Payment processor (only if you buy):

Stripe — Our payment provider, used only if you buy something on our website. You pay on Stripe's own hosted page, so your card or wallet details go to Stripe and never to our servers or pages. Stripe processes your email address, your name and payment details as you enter them, your billing country, and the device and network data it collects itself, together with the product name and price. We send Stripe only the neutral product name, the price, and opaque reference numbers that let us match the payment to your account. We never send Stripe any food, symptom, injection, measurement, medication or plan information. Stripe is a United States company (operating through Stripe Payments Australia Pty Ltd for accounts in Australia) and processes data in the United States and on its global infrastructure, and it keeps its own records for as long as the law requires it to. Stripe sends you the receipt.

Identity sign-in processors:

Apple — If you sign in with Sign in with Apple, Apple processes the identifier and, if you choose to share it, the name/email associated with your Apple ID to authenticate you. Apple does not receive any food, symptom, injection, or measurement data.
Google — If you sign in with Google Sign-In, Google processes the identifier and profile information associated with your Google account to authenticate you. Google does not receive any food, symptom, injection, or measurement data.

Health-professional access (only if you opt in):

Food Signals dietitian — If, and only if, you turn on dietitian data sharing in Settings, our dietitian can view your food history and your progress toward your targets, read-only, for the purpose of supporting you. Every access is logged. This is off unless you turn it on, you can turn it off again at any time, and the dietitian keeps no separate copy of your data. Our dietitian practice operates in Australia.

Marketing website only (food-signals.com):

Our own anonymous visit counts. Every page of our website, including pages about symptoms and medications, adds to simple anonymous daily counts that we keep on our own servers. They record how many times each page was viewed, whether people stayed or scrolled, where they arrived from in broad terms (for example "a search engine", "social media" or "an email link"), which page they went to next on our site, and roughly which country and kind of device (phone, tablet or computer) they used. These counts use no cookies and no device storage, carry no identifier of any kind, and do not keep your IP address, your browser details, or any answer you give. They are not sent to any other company. Because they cannot tell one visitor from another, they run whether or not you accept analytics below.

Google Analytics runs on our public website — not in the app — and never receives any of your account, food, symptom, injection, or measurement data. It does not run at all until you accept it; if you decline, no request is made to Google.

Google Analytics (including Google Tag Manager) — Measures website traffic so we know which pages are useful. Processed in the United States.
Meta — We do not run Meta's advertising pixel on our website, and visiting it makes no request from your browser to Meta. If you arrive from one of our Meta adverts and then create a plan or sign up, our servers may tell Meta that an advert click led to that sign-up. That notice is keyed on the advert's click identifier (or Meta's own identifier for a lead you submitted to Meta) and carries no name, email address, page, answers, or health information. Processed in the United States.

4. We Do Not Sell or Share Your Data

We do not sell, rent, lease, trade, license, or otherwise transfer your personal information — including your injection-event data, query history, or account information — to any third party for any commercial, marketing, or other purpose. This includes your consumer health data (meal, symptom, and injection-event logs, body measurements, and observed patterns) specifically — we do not sell or share consumer health data, and we do not use it for advertising.

The categories of third party that receive any portion of your data are:

Our AI model provider as described in Section 3, solely to generate responses to your queries.
Cloudflare, solely to operate the Service's infrastructure.
Brevo, solely to send account-related transactional emails, the limited lifecycle attributes described in Section 3, and — for visitors to `/onecart_us/` who supplied an address through the buy-click panel — to host the purchase-intent waiting list described in Section 3, and — for visitors who ticked the follow-up box on our family plan page — to host the follow-up list described in Section 3.
Apple and/or Google, solely to authenticate you if you choose to sign in with them.
If you opt in to dietitian data sharing (Settings), the Food Signals dietitian — solely to view your food history and your progress toward your targets, read-only, for the purpose of supporting you. This is off unless you turn it on, and you can turn it off again at any time.
On our public website only, and only if you accept it, Google Analytics — solely to measure website visits, as described in Section 3. Separately, if you arrive from one of our Meta adverts and sign up, Meta — solely to be told that the advert click led to a sign-up, keyed on the click identifier only. Neither receives anything from the app: no account, food, symptom, injection, or measurement data ever reaches them.

We do not permit any processor listed above to use your data for its own advertising or unrelated purposes. If we add a new category of processor, we will update this section and notify you before that processor receives your data.

5. Data Retention

We retain your data only as long as necessary to provide the Service. How long that is depends on the category:

Category	How long we keep it
Meal and food logs, including the nutrient values calculated from them	For as long as your account exists
Meal photos	For as long as your account exists
Symptom logs, injection-event logs, and observed patterns	For as long as your account exists
Body measurements — height, weight, waist, and each dated entry in your trend	For as long as your account exists
Profile inputs — age, sex, activity level — and your nutrition targets	For as long as your account exists
Injection-interval preference, meal plans, and other preferences	For as long as your account exists
Getting-started prompt state — dismissals and usage milestones described in Section 1	For as long as your account exists
Account details and sign-in credentials	For as long as your account exists
Waiting-list and admission records — the entries described in Section 1, including the invitation hash	The admission that let you in, its invitation, and any link to a plan you made before joining are deleted when you erase your account. If you joined the waiting list but never created an account, you can ask us to remove your entry at any time through our contact page.
Access records — trial and access dates, the history of changes, and any access code redemption	For as long as your account exists
Purchase records — what you bought, the amount, the status and dates, described in Section 1	Kept as a financial record for 7 years, including after your account is deleted. When you delete your account we remove your account link, your email address and your billing country from the record, so it no longer identifies you. Stripe keeps its own records under its own retention.
Consent records — which consents you gave and when	For as long as your account exists; the fact that your deletion request was carried out is kept separately, see below
Product analytics — the per-user interaction record described in Section 1	Deleted automatically 90 days after collection
Anonymised, aggregated statistics derived from product analytics	Contain no identifier of any kind; may be retained indefinitely
Anonymous website visit counts (page views, referrer type, country, device type)	Contain no identifier of any kind; may be retained indefinitely
Access logs — a record of who viewed your data and when (not what your data says)	7 years. These record access events, never a health value. They are kept so that any improper access to your records can be investigated later, including after your account is gone.
Proof that a deletion request was carried out	7 years, identifying you only by a one-way cryptographic hash — enough to prove we deleted your data, not enough to reconstruct who you were

When you delete your account

Deleting your account deletes it immediately — not as a request queued for later processing. Every category above marked "for as long as your account exists" is erased from our live systems as part of that action, including your meal photos. The one exception is any purchase record, which we keep without your account link, email address or billing country, as described in the table.

A copy of the deleted records is placed in a restricted internal store for 7 days and is then destroyed automatically. That copy exists only so that a deletion made in error or caused by a fault can be investigated within a short window. It is not indexed by your name, email, or account identifier, it is not used for any other purpose, and no part of the Service can read it. After 7 days it is gone. The same disclosure is shown to you in the deletion flow itself, before you confirm.

Residual copies held in our infrastructure provider's automatic point-in-time backups are purged within 90 days. These are platform-level backups of the whole system, not a copy of your account we can search or use. If we ever restore from such a backup, any record covered by a completed deletion request is re-deleted as part of that restore before the restored system is brought back into service — a backup restore never silently brings back data you asked us to delete.

6. Data Security

We implement reasonable technical and organisational security measures to protect your data, including:

Encryption of data in transit (TLS 1.2 or higher).
Access controls limiting data access to authorised personnel and systems.
Regular review of our security practices.

No method of transmission or storage is completely secure. In the event of a data breach likely to cause you harm, we will notify you and the relevant regulator without unreasonable delay and within the timeframes required by applicable law: within 30 days to the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme, and, for US users, without unreasonable delay and no later than 60 days under the FTC Health Breach Notification Rule. Some US state breach-notification laws may require a shorter timeframe than the FTC rule; where that applies, we will follow the shorter one.

7. Not Medical Advice

The Service is a personal food, water, and symptom logging tool that does not provide medical advice, diagnosis, or treatment. It records what you log and shows you observations drawn from your own logged data. Nothing in the Service — including AI-generated responses — constitutes or should be relied upon as professional medical advice. Always consult your licensed healthcare provider before making any changes to your GLP-1 medication regimen.

8. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, please contact us immediately.

9. Your Rights

This Privacy Policy applies wherever you use the Service. If you are in Australia, the United States, or elsewhere, the sections below describe rights specific to your jurisdiction, in addition to the general rights every user has: to access, correct, delete, and receive a portable copy of your data, and to opt out of product analytics.

Access the personal information we hold about you.
Correct inaccurate or incomplete personal information.
Delete your account and associated data — Settings → Delete account in the app. This deletes your account immediately; you do not need to ask us and you do not need to wait. See Section 5 for exactly what is erased and what is kept.
Object to or restrict certain processing of your personal information.
Data portability — Settings → Download my data in the app gives you a copy of everything we hold about you as a machine-readable JSON file, straight away.
Withdraw a consent you have given — Settings → Your data & consent rights lists each consent, when you gave it, and lets you withdraw it.
Opt out of product analytics — turn off "Help improve Food Signals" under Settings → Privacy at any time. Doing so stops collection immediately and deletes the interaction record we already hold about you. Anonymised aggregates already derived from it are retained, as they contain no information that identifies you.

The access, deletion, portability and consent-withdrawal rights above are all available directly in the app, without contacting us. If you would rather we handled it, or you want to exercise a right not listed as an in-app action, please contact us.

9.1 Australia

This Privacy Policy is governed by the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). The Office of the Australian Information Commissioner (OAIC) is the regulatory authority for the APPs, and we notify the OAIC of an eligible data breach within 30 days under the Notifiable Data Breaches (NDB) scheme, per Section 6.

9.2 California (CCPA/CPRA)

Applicability. Where the CCPA/CPRA applies to Food Signals, California residents may exercise the rights described in this section. Regardless of whether a particular statutory threshold applies to us, Food Signals provides the privacy controls described in this Privacy Policy to all users through the Service.

Notice at collection. The table below identifies, for each category of personal information we collect, examples, our purpose for collecting it, how long we retain it, and whether it is sold or shared.

Category	Examples	Purpose	Retention	Sold or shared
Identifiers	Account ID, email address	Account operation	Account lifetime	No
Sensitive Personal Information	Health and body information — meal, symptom, and injection-event logs; body measurements; observed patterns	Provide the food-logging, nutrition, and pattern-insight features you request	Account lifetime	No
Meal and food logs	Foods, meals, and drinks you record	Logging and personal insights	Account lifetime	No
Injection-event data	Timing and relative dose-change category	Cycle/scheduling functionality	Account lifetime	No
Body measurements and profile inputs	Height, weight, waist, age, sex, activity level	Nutrition target calculation	Account lifetime	No
Technical information	Device/app version, diagnostics	Security and operation	See Section 5	No
Product analytics	Feature-interaction events (first-party)	Product improvement, opt-out available	90 days	No

Sensitive Personal Information. Certain information we collect may constitute Sensitive Personal Information under California law (Cal. Civ. Code §1798.121), including information relating to your health and body measurements. We use Sensitive Personal Information only to provide and improve the services you request, maintain security, and for other purposes permitted by applicable law as described in this Privacy Policy. We do not sell or share Sensitive Personal Information, or any other personal information, for cross-context behavioural advertising, and we never have.

Your rights. Subject to certain exceptions, California residents have the right to: know what personal information we collect and how we use and disclose it; delete personal information we hold about you; correct inaccurate personal information; limit the use of Sensitive Personal Information (we do not use it for any purpose beyond providing the Service to you, so there is nothing additional to limit); and not be discriminated against for exercising these rights.

How to exercise your rights. Use the in-app controls described at the start of Section 9, or contact us. We will verify your request using the information associated with your authenticated account before acting on it.

9.3 Washington (My Health My Data Act)

If you are in Washington State, or anywhere else in the United States, your consumer health data (meal, symptom, injection-event, and body-measurement logs, and the patterns we derive from them) is additionally protected by our standalone Consumer Health Data Privacy Policy, which applies to all US users regardless of state — we do not geofence these protections to Washington or Nevada residents. That policy covers: the categories of consumer health data we collect and where it comes from, the affirmative opt-in required before we collect this data, your right to withdraw that consent and to learn who we've shared it with, our commitment to complete deletion requests within 30 days, and our statement that we do not sell consumer health data.

9.4 Other US States

This Privacy Policy applies to all Food Signals users in the United States, whether or not the particular state in which you reside has enacted a consumer-health-data or comprehensive privacy law of its own. We provide the same access, correction, deletion, portability, consent-withdrawal, and analytics opt-out rights described in this Section 9 to every US user, rather than limiting them to residents of states with an applicable statute.

10. Contact

For privacy enquiries, access requests, or complaints, please contact us

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notice at least 14 days before the change takes effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy. The current version is always available at this URL.