NouriMe privacy policy — DRAFT
Status DRAFT. TBD_LEGAL — not reviewed by anyone qualified to approve it.
Derived from the implementation, not from a template. Every claim below is
traceable to code; see the "Where this comes from" table at the end.
Publisher TBD_LEGAL — the named legal entity is an owner decision
Effective TBD_OWNER
Contact TBD_EXTERNALDo not publish this as-is. It is engineering’s honest account of what the software does, written so a lawyer can review facts rather than invent them. Two rules govern any edit: a statement must match the implementation, and it must not overstate. If a claim here and the code ever disagree, the code is the fact — fix the document, or change the code deliberately.
What NouriMe is
NouriMe is a nutrition decision-support app. It helps you decide whether a meal fits your goals right now, how to adjust it, and what it may change in the rest of your day.
NouriMe provides informational nutrition and wellness guidance. It does not diagnose disease, does not treat anything, and does not replace a doctor or a registered dietitian. It gives no medication or insulin instruction.
The short version
- Most of your data never leaves your phone.
- Nothing is sent for analysis until you say yes, and you are asked immediately before the first time.
- We have an account system so the app can tell who is calling. By default that account is anonymous and carries no name or email.
- Your health profile, meals, diary and notes are not uploaded to our servers for storage, and our staff cannot browse them.
- You can delete your account and everything under it from inside the app.
What stays on your phone
All of this is stored locally and is not uploaded:
your diary and logged meals your streak, XP and achievements
your health profile and conditions saved meal presets
your allergies and restrictions decision history and outcomes
your daily targets free-text post-meal notesLocal storage is ordinary device storage. It is not encrypted by the app, and anyone with your unlocked phone can read it. Uninstalling the app removes it.
What is sent, and when
Three separate permissions, all off until you turn them on. Nothing is preselected, and you are asked immediately before the first upload rather than buried in a setup flow.
| You turn on | What is sent | Sent to |
|---|---|---|
| Food analysis | The photo, description or barcode, plus a minimised profile and today’s totals | Our server, then an AI provider |
| Menu analysis | The menu photo only — no profile, no health data | Our server, then an AI provider |
| Learning memory | Nothing. This is local personalisation only | Nowhere |
The minimised profile is age, sex, goals, dietary preferences and restrictions, allergies, governed condition categories, language and daily targets. It excludes your name, your weight and height, your recent meal names and times, and your free-text health notes.
Declining blocks the upload. It never silently produces a made-up result.
Photos are processed to answer your request and are not intentionally kept. Our logs deliberately exclude image data, credentials, full profiles, allergy lists and condition lists.
Your account
The app signs you in anonymously the first time you open it. That is a real account with an identifier, but it carries no name, no email and no device identifier. It exists so our server can tell one caller from another and refuse requests that are not yours.
You may optionally create an account with an email and password. If you do, that credential is linked to the identifier you already had, so nothing you have already logged is lost.
Sign-in is provided by Google Firebase Authentication. What reaches Google is your email and password if you create an account, plus the identifier Firebase itself issued. No health data reaches Firebase.
We store, on our own server:
your account identifier when the account was created
your email, if you gave one when it was last used
whether it is active your app version and platform
whether cloud sync is onCloud sync
Cloud sync is a separate permission, off by default — and it is not yet built. Nothing in the app uploads your diary, profile or conditions, and there is no switch for it in the app today.
The consequence is real and you should know it before you rely on NouriMe: we hold no server-side copy of your health data, so a reinstall, a reset or a new phone loses your history. An account does not change that — it signs you in, it is not a backup.
If cloud sync ships it will stay off until you turn it on, and this page will say so before it does.
Who can see your data
Our staff can see the account-level facts listed above: identifier, email, dates, status, app version.
They cannot see your health profile, conditions, allergies, diary, meals or notes. This is not a policy promise about restraint — our administration tools have no field that carries those things, and there is no “view as this user” control. Every staff access to anything account-related is written to an append-only log recording who did what, to which account, and when.
We do not sell your data. We do not share it with advertisers. We do not use it to train AI models.
AI providers
Food and menu analysis send your image or description to an AI provider that returns a structured reading of it. The provider receives the content you chose to analyse and, for food analysis, the minimised profile above. It does not receive your identity: your account identifier stays between the app and our server.
AI recognises and explains. It never decides your score. Scoring, simulation and ranking are deterministic code.
Usage measurement
If enabled by us and separately agreed to by you, the app may upload coarse usage counts — which operation was attempted and whether it failed. These carry no meal content, no health data and no free text. It is off by default, you can withdraw at any time, and withdrawal deletes what was collected.
Deleting your data
Two controls, and they do different things:
- Clear learning memory — removes decision history and post-meal responses. Your diary, profile and earned XP stay.
- Delete account — removes your account record, everything stored under it, and your sign-in identity, then clears the data on this phone. Permanent and cannot be undone.
- Reset all local data — wipes everything on the phone.
To delete without the app installed: TBD_EXTERNAL (a web form or an email address; both stores expect one to exist).
Children
NouriMe is not directed at children. TBD_LEGAL — the minimum age is a legal determination, not an engineering one, and it changes what the store questionnaires require.
Changes and contact
TBD_LEGAL / TBD_EXTERNAL.
Where this comes from
For the reviewer: each claim above and the code that makes it true.
| Claim | Code |
|---|---|
| Three consents, all default off | features/privacy/remoteAnalysisPolicy.ts, learningConsentPolicy.ts |
| Consent is re-checked inside the service | services/foodAnalysis/FoodAnalysisService.ts |
| Profile minimisation, and what is excluded | services/api/NouriMeApiClient.ts (safeProfile, safeTodayContext) |
| Condition data withheld from the AI payload | backend/src/providers/ai/ChatPersonalizationProvider.ts |
| Logs exclude images, keys and health data | backend/src/utils/logging.ts, backend/tests/logging.test.ts |
| Anonymous by default; linking preserves the identifier | services/auth/firebaseSession.ts |
| Only account fields are stored server-side | backend/src/repositories/UserRepository.ts |
| Staff cannot read health data | backend/src/routes/admin/users.ts — the view has no such field |
| Every staff access is logged | backend/src/services/adminAuditService.ts |
| Account deletion removes record, data and identity | backend/src/routes/me.ts |
| A declined or failed request never becomes fake data | services/foodAnalysis/FoodAnalysisService.test.ts |
| AI never decides the score | features/decision/mealFit.ts, backend/src/services/mealFitScoreService.ts |
Engineering detail behind all of this: ../architecture/privacy-boundaries.md and ../adr/ADR-005-accounts-and-admin-access.md.