Last updated: 2 July 2026
This Privacy Policy explains how foodNu ("we", "us", "our") collects, uses, and protects your personal information when you use the foodNu mobile application ("App").
By using the App you agree to the collection and use of information as described in this policy.
foodNu is a food and recipe app for home cooks, currently operated by its individual founder (a corporate entity has not yet been formed). We are the data controller for the personal data you provide when using the App.
Contact: contact@foodnu.io
| Data type | Why we collect it | Examples |
|---|---|---|
| Account data | To create and manage your account | Email address, name, Apple ID (if Sign in with Apple used) |
| Fridge photos | To identify ingredients via AI scanning | Photos you take within the scanner feature |
| Chat messages | To generate personalised recipes via Chef Kai | Text you type in the Chef Kai conversation |
| Dietary preferences | To tailor recipes and avoid allergens | Preferences you set in the Customize tab |
| Diary entries | To log your meals and track eating history | Meals you save, dates, recipe references |
| Usage data | To improve the App and diagnose issues | Feature interactions, error logs |
We do not collect: - Payment card details (handled entirely by Apple) - Location data - Contacts or calendar data
Device permissions we request: - Camera — required for the fridge scanner feature only. Photos are processed immediately and not stored on our servers. Raw photos are sent to OpenAI's API and not retained by us after processing.
We do not sell your personal data to any third party.
We share data with the following third-party processors, each acting under a Data Processing Agreement with us:
foodNu uses OpenAI's API to power its AI features (fridge scanning and Chef Kai recipe generation).
When you use the fridge scanner or chat with Chef Kai, the following data is sent to OpenAI: - Fridge photos (for ingredient identification) - Your chat messages and conversation context (for recipe generation)
You will be asked for your explicit consent to this data sharing before these features are activated. Because these AI features are core to how foodNu works, withdrawing consent means you can no longer use the App. You can withdraw consent at any time by deleting your account (Customize tab → Delete Account), which also permanently erases your data.
OpenAI processes this data under its own privacy policy and data processing terms. We have a Data Processing Agreement with OpenAI. For details, see OpenAI's privacy policy.
OpenAI does not use data submitted via the API to train its models by default. See OpenAI's API data privacy FAQ for details.
foodNu uses PostHog to understand how the App is used so we can improve it.
PostHog receives: - Your account identifier (so usage can be associated with your account) - Product events (which features you use and when) and your subscription status - Basic device and diagnostic information
We use PostHog only for our own first-party product analytics. We do not use it to track you across other apps or websites, and we do not sell this data. See PostHog's privacy policy.
foodNu uses RevenueCat to manage premium subscriptions and entitlements.
RevenueCat receives: - Your account identifier - Purchase and receipt data from the App Store (to determine your entitlement)
Payment card details are handled entirely by Apple and are never seen by us or by RevenueCat. See RevenueCat's privacy policy.
OpenAI, PostHog, and RevenueCat are based in the United States. When you use the relevant features, the data described above is transferred to the US. For EU/EEA and UK users, these transfers are lawful under Standard Contractual Clauses (SCCs) established between us and each processor under their respective Data Processing Agreements.
Supabase infrastructure is hosted in Singapore (ap-southeast-1). Singapore is outside the EU/EEA. For EU/EEA and UK users, this transfer is also covered by Standard Contractual Clauses under Supabase's Data Processing Agreement. Singapore itself operates under the PDPA (Personal Data Protection Act), which provides an adequate level of data protection.
Your food diary entries may constitute health-related data under applicable privacy laws (including GDPR). We treat diary data with heightened protection:
Your data is stored in Supabase (PostgreSQL), hosted on secure cloud infrastructure. We use: - Encrypted connections (TLS) for all data in transit - Row-level security controls in our database - Limited access — only authorised team members can access production data
Data retention:
| Data type | Retention period |
|---|---|
| Account data | Duration of account + 30 days after deletion |
| Fridge photos | Not stored — processed in real time and discarded |
| Chat messages | Duration of account + 30 days after deletion |
| Diary entries | Duration of account + 30 days after deletion |
| Usage/analytics logs | 12 months, then anonymised or deleted |
| Financial transaction records | 7 years (legal/tax obligation) |
If you delete your account, all personal data (except legally required financial records) is permanently deleted within 30 days.
If you are in the EU/EEA or UK, our legal bases for processing are:
| Processing activity | Legal basis |
|---|---|
| Account creation and operation | Contract performance (Art. 6(1)(b)) |
| AI features (OpenAI data sharing) | Explicit consent (Art. 6(1)(a)) |
| Diary entries | Explicit consent (Art. 9(2)(a)) |
| Analytics and improvement | Legitimate interests (Art. 6(1)(f)) |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
EU AI Act (Regulation (EU) 2024/1689): The App uses AI systems for ingredient recognition and recipe generation. These are not classified as high-risk AI systems under the EU AI Act. We disclose the use of AI in all relevant features and label AI-generated content accordingly.
Automated decision-making: We do not make any solely automated decisions that produce significant legal or similarly significant effects on you (GDPR Art. 22). Recipe suggestions are informational only.
The App does not use cookies. We do not track you across third-party apps or websites. We do not use your data for targeted advertising.
Depending on your location, you may have the right to:
To exercise any of these rights, contact us at contact@foodnu.io. We will respond within 30 days.
California residents (CCPA): You have the right to know what data we collect, the right to delete, and the right to opt out of the "sale" of your data. We do not sell your data.
The App is not intended for children under 13. We do not knowingly collect personal data from children under 13. If you believe we have collected data from a child under 13, contact us immediately at contact@foodnu.io and we will delete it.
We may update this Privacy Policy from time to time. We will notify you of material changes via an in-app notification. Continued use of the App after changes constitutes acceptance.
For privacy questions or to exercise your rights:
Email: contact@foodnu.io
For EU/EEA users: if you are not satisfied with our response, you may contact your local supervisory authority.