NouriMe privacy policy — DRAFT

Status        DRAFT. TBD_LEGAL — not reviewed by anyone qualified to approve it.
Derived from  the implementation, not from a template. Every claim below is
              traceable to code; see the "Where this comes from" table at the end.
Publisher     TBD_LEGAL — the named legal entity is an owner decision
Effective     TBD_OWNER
Contact       TBD_EXTERNAL

Do not publish this as-is. It is engineering’s honest account of what the software does, written so a lawyer can review facts rather than invent them. Two rules govern any edit: a statement must match the implementation, and it must not overstate. If a claim here and the code ever disagree, the code is the fact — fix the document, or change the code deliberately.

What NouriMe is

NouriMe is a nutrition decision-support app. It helps you decide whether a meal fits your goals right now, how to adjust it, and what it may change in the rest of your day.

NouriMe provides informational nutrition and wellness guidance. It does not diagnose disease, does not treat anything, and does not replace a doctor or a registered dietitian. It gives no medication or insulin instruction.

The short version

Most of your data never leaves your phone.
Nothing is sent for analysis until you say yes, and you are asked immediately before the first time.
We have an account system so the app can tell who is calling. By default that account is anonymous and carries no name or email.
Your health profile, meals, diary and notes are not uploaded to our servers for storage, and our staff cannot browse them.
You can delete your account and everything under it from inside the app.

What stays on your phone

All of this is stored locally and is not uploaded:

your diary and logged meals            your streak, XP and achievements
your health profile and conditions     saved meal presets
your allergies and restrictions        decision history and outcomes
your daily targets                     free-text post-meal notes

Local storage is ordinary device storage. It is not encrypted by the app, and anyone with your unlocked phone can read it. Uninstalling the app removes it.

What is sent, and when

Three separate permissions, all off until you turn them on. Nothing is preselected, and you are asked immediately before the first upload rather than buried in a setup flow.

You turn on	What is sent	Sent to
Food analysis	The photo, description or barcode, plus a minimised profile and today’s totals	Our server, then an AI provider
Menu analysis	The menu photo only — no profile, no health data	Our server, then an AI provider
Learning memory	Nothing. This is local personalisation only	Nowhere

The minimised profile is age, sex, goals, dietary preferences and restrictions, allergies, governed condition categories, language and daily targets. It excludes your name, your weight and height, your recent meal names and times, and your free-text health notes.

Declining blocks the upload. It never silently produces a made-up result.

Photos are processed to answer your request and are not intentionally kept. Our logs deliberately exclude image data, credentials, full profiles, allergy lists and condition lists.

Your account

The app signs you in anonymously the first time you open it. That is a real account with an identifier, but it carries no name, no email and no device identifier. It exists so our server can tell one caller from another and refuse requests that are not yours.

You may optionally create an account with an email and password. If you do, that credential is linked to the identifier you already had, so nothing you have already logged is lost.

Sign-in is provided by Google Firebase Authentication. What reaches Google is your email and password if you create an account, plus the identifier Firebase itself issued. No health data reaches Firebase.

We store, on our own server:

your account identifier         when the account was created
your email, if you gave one     when it was last used
whether it is active            your app version and platform
whether cloud sync is on

Cloud sync

Cloud sync is a separate permission, off by default — and it is not yet built. Nothing in the app uploads your diary, profile or conditions, and there is no switch for it in the app today.

The consequence is real and you should know it before you rely on NouriMe: we hold no server-side copy of your health data, so a reinstall, a reset or a new phone loses your history. An account does not change that — it signs you in, it is not a backup.

If cloud sync ships it will stay off until you turn it on, and this page will say so before it does.

Who can see your data

Our staff can see the account-level facts listed above: identifier, email, dates, status, app version.

They cannot see your health profile, conditions, allergies, diary, meals or notes. This is not a policy promise about restraint — our administration tools have no field that carries those things, and there is no “view as this user” control. Every staff access to anything account-related is written to an append-only log recording who did what, to which account, and when.

We do not sell your data. We do not share it with advertisers. We do not use it to train AI models.

AI providers

Food and menu analysis send your image or description to an AI provider that returns a structured reading of it. The provider receives the content you chose to analyse and, for food analysis, the minimised profile above. It does not receive your identity: your account identifier stays between the app and our server.

AI recognises and explains. It never decides your score. Scoring, simulation and ranking are deterministic code.

Usage measurement

If enabled by us and separately agreed to by you, the app may upload coarse usage counts — which operation was attempted and whether it failed. These carry no meal content, no health data and no free text. It is off by default, you can withdraw at any time, and withdrawal deletes what was collected.

Deleting your data

Two controls, and they do different things:

Clear learning memory — removes decision history and post-meal responses. Your diary, profile and earned XP stay.
Delete account — removes your account record, everything stored under it, and your sign-in identity, then clears the data on this phone. Permanent and cannot be undone.
Reset all local data — wipes everything on the phone.

To delete without the app installed: TBD_EXTERNAL (a web form or an email address; both stores expect one to exist).

Children

NouriMe is not directed at children. TBD_LEGAL — the minimum age is a legal determination, not an engineering one, and it changes what the store questionnaires require.

Changes and contact

TBD_LEGAL / TBD_EXTERNAL.

Where this comes from

For the reviewer: each claim above and the code that makes it true.

Claim	Code
Three consents, all default off	`features/privacy/remoteAnalysisPolicy.ts`, `learningConsentPolicy.ts`
Consent is re-checked inside the service	`services/foodAnalysis/FoodAnalysisService.ts`
Profile minimisation, and what is excluded	`services/api/NouriMeApiClient.ts` (`safeProfile`, `safeTodayContext`)
Condition data withheld from the AI payload	`backend/src/providers/ai/ChatPersonalizationProvider.ts`
Logs exclude images, keys and health data	`backend/src/utils/logging.ts`, `backend/tests/logging.test.ts`
Anonymous by default; linking preserves the identifier	`services/auth/firebaseSession.ts`
Only account fields are stored server-side	`backend/src/repositories/UserRepository.ts`
Staff cannot read health data	`backend/src/routes/admin/users.ts` — the view has no such field
Every staff access is logged	`backend/src/services/adminAuditService.ts`
Account deletion removes record, data and identity	`backend/src/routes/me.ts`
A declined or failed request never becomes fake data	`services/foodAnalysis/FoodAnalysisService.test.ts`
AI never decides the score	`features/decision/mealFit.ts`, `backend/src/services/mealFitScoreService.ts`

Engineering detail behind all of this: ../architecture/privacy-boundaries.md and ../adr/ADR-005-accounts-and-admin-access.md.