Privacy Policy

In short

• Your diary (meals, photos, weight, chat history, profile) is stored only on your iPhone.
• There is no sign-up: no email, name, phone number or password.
• When you use AI features, the request passes through our server to an AI model and back. We don't store photos, descriptions, messages or answers.
• No ads, no analytics SDKs, no tracking. We don't sell your data.
• Settings → Delete all data removes everything on your phone and your anonymous account on our server.

Data controller

The data controller for the Service is Cem Bayat. For any privacy question or request: [email protected].

1. Data stored only on your device

The app stores the following on your iPhone, in the app's own storage. It is not sent to our server except as described in section 3:

• Profile: height, birth year, activity level, start weight and date, goal weight and date.
• Meals: name, time, calories and macros per item, and a small thumbnail of the photo if you took one.
• Weight entries and the chat history with Coach Tofi.
• Settings such as reminders and whether activity calories are added to your target.

A small summary of today's progress is shared with the app's Home Screen widget on the same device. Your iPhone's own backups (iCloud or computer) may include this data under Apple's terms.

2. Anonymous account

On first launch the app generates a random ID (format $diyet-<uuid>) and a random device key, both stored in your iPhone's Keychain. They are used only to authenticate requests to our AI server.

Our server stores: the ID, a SHA-256 hash of the device key (never the key itself), your app language and time zone, and when the account was created and last used.

Purpose: to protect the AI service from abuse and apply fair-use limits without asking for an email or password.

3. AI features (food analysis and Coach Tofi)

AI features only run when you use them. The app then sends the following to our server, which forwards it to OpenRouter (openrouter.ai), a service that routes the request to an AI model provider such as Anthropic or OpenAI:

• Food analysis: the photo you took or chose (resized), your description and, if you ask for a correction, the current result and your correction note.
• Coach Tofi: your message, recent chat messages, and a summary from your diary: profile, daily target, today's meals, daily calorie totals for the last 7 days, recent weight entries and, if connected, steps and active energy for the last 7 days.

Our server does not store this content and does not write it to logs. For each request it records only the type (food analysis, correction or coach), the model used, the duration, the token count and the cost, linked to your anonymous account, so we can apply daily limits and keep costs under control.

OpenRouter and the model providers process the request to generate the answer under their own privacy terms. We send no name, email or other direct identifier. Don't include personal details you don't want to share in photos or messages.

4. Apple Health

If you allow it, the app reads your daily steps and active energy from Apple Health to adjust your daily calorie target. The app never writes to Apple Health.

Health data is stored on your device. It is shared only as part of the Coach Tofi summary described in section 3, when you send a message to the coach. It is never used for advertising and never sold.

5. Barcode lookup

When you scan a barcode, the app sends only the barcode number directly to Open Food Facts (openfoodfacts.org) to fetch the product's nutrition values. Nothing else is sent.

6. Server logs

Like any web server, ours records the IP address, time, requested path and response status of each request, for security and troubleshooting. Request bodies (photos, messages) are never logged. Logs are kept only as long as needed for these purposes.

7. Notifications

Reminders (weigh-in, movement breaks, evening plan, logging reminder) are scheduled locally on your iPhone. No push notification service or token is used.

8. What we don't do

• No advertising, analytics or tracking SDKs, and no cross-app tracking.
• No selling or renting of data, and no profiling for marketing.
• No sign-in with email, phone, Apple or social accounts.

9. Retention and deletion

On-device data stays until you delete it or delete the app. Settings → Delete all data erases your meals, weight entries and chat history and deletes your anonymous account and its request records on our server.

If you just delete the app, your on-device data is removed. Your anonymous account on our server then holds no diary data; you can ask us to delete it at the address above.

10. Security

All traffic between the app and our server is encrypted (HTTPS). The device key never leaves your Keychain in readable form on our side; we store only its hash. Our server sits behind Cloudflare.

11. Children

Tofi is intended for adults (18+). It is not designed for children, and we don't knowingly process children's data.

12. Your rights

Depending on where you live (for example under GDPR or KVKK), you may have the right to access, correct, delete or object to the processing of your data. Most data lives on your device and is under your control. For anything on our server, write to [email protected]; include your account number from Settings → AI if possible.

13. Changes

If we change how data is handled, we'll update this page and the date above. Significant changes will also be announced in the app.