NomsAI is a minimalist calorie-tracking app built and operated by a solo developer based in the United Kingdom. References to "we", "us", or "our" mean that developer. We are the data controller under UK GDPR (for UK users) and EU GDPR (for users in the EEA, including Ireland). Our lead supervisory authority for UK users is the Information Commissioner's Office (ICO). For users in Ireland and the wider EEA, the competent supervisory authority is your national Data Protection Authority; in Ireland this is the Data Protection Commission (DPC). Because NomsAI's processing of EEA data is occasional, pseudonymous, and poses no systemic risk to individuals' rights and freedoms, we do not appoint an EU Representative pursuant to Article 27(2) of the EU GDPR. For US users, applicable federal and state privacy laws govern. For questions or data requests, contact [email protected].
NomsAI does not require you to create an account or provide any personal
information such as your name, email address, or date of birth. When you
first open the app, a random UUID (e.g. a3f8…) is generated
on your device. This is your only identifier. We have no way to link it to
you as a person.
The following data is stored on our server, associated only with your anonymous Device ID:
We do not collect your name, email, location, contacts, passwords, or payment card details. Food-entry text and meal ingredient lists are sent transiently to our AI provider to deliver the service and are not stored on our server — see Section 4 for details.
Voice input: If you use the optional voice input feature, your speech is processed by your device's built-in speech recognition engine (provided by Apple or Google). The resulting text is placed into the input field on your device and treated identically to typed input. No audio is recorded or transmitted by NomsAI. Microphone access is requested only when you tap the mic button and is not used at any other time.
The following data is stored exclusively in your app's local storage and never sent to our server:
Barcode scanning: When you use the barcode scanner, your camera is accessed temporarily to read the barcode. No image is stored or transmitted. The barcode number is sent to our server solely to look up nutritional data; it is not stored after the lookup completes.
Your original free-text input (e.g. "2 eggs and toast") and any ingredient lists you enter in the Meal Ideas feature are sent to our AI provider to estimate macros or generate recipe suggestions, and are then discarded. They are not saved anywhere — not on our server, not on your device.
Consequence: If you uninstall the app or switch to a new phone, your log history, goals, and weight entries are gone. We have no copy and no way to restore them. On iOS, a random device identifier is retained in the system Keychain after uninstall solely to preserve your credit balance if you reinstall; it contains no personal data and is permanently deleted when you use Settings → Delete Account.
Pro subscribers: your subscription is managed by Apple / Google. Tap Restore Purchases in Settings to recover your Pro on a new device.
We process your data under UK GDPR Article 6 (UK users) and EU GDPR Article 6 (EEA users, including Ireland). The table below sets out each processing activity, its purpose, and the legal basis we rely on.
| Processing activity | Purpose | Lawful basis |
|---|---|---|
| Storing your Device ID and credit balance | To identify your account and deliver the core service (AI macro estimation, credit deduction) | Contract — Art. 6(1)(b): necessary to perform the service you use |
| Updating the last-session timestamp | Aggregate, anonymised retention analysis | Legitimate interests — Art. 6(1)(f): understanding whether the app is useful, balanced against minimal privacy impact (only a timestamp, no personal data) |
| Tracking daily AI usage counter (Pro subscribers only) | Enforce the daily fair-use limit; protect service sustainability | Contract — Art. 6(1)(b): necessary to fulfil the Pro terms |
| Sending food-entry text to Google Gemini | Parse free-text food input and estimate macros | Contract — Art. 6(1)(b): the app cannot function without this; the text is not stored by us after processing |
| Sending meal ingredient lists to Google Gemini | Generate meal ideas with macros and cooking instructions via the Meal Ideas feature | Contract — Art. 6(1)(b): necessary to deliver the Meal Ideas feature; ingredient lists are not stored by us after processing |
| Sharing Device ID with RevenueCat | Verify and restore in-app purchases and Pro status | Contract — Art. 6(1)(b): necessary to deliver paid features |
| IP address processing by infrastructure providers (Cloudflare, Fly.io) | Routing requests to our servers, DDoS protection, and abuse prevention. We do not log IP addresses ourselves; they are processed transiently by our hosting and security providers as an inherent part of internet infrastructure. | Legitimate interests — Art. 6(1)(f): necessary to operate a secure and reliable service |
We do not sell, rent, share, or use your data for advertising. We do not use your data to train AI models.
Transfers to the United States (Google Gemini, RevenueCat, Cloudflare, Fly.io) are made under Standard Contractual Clauses approved by the European Commission and the UK ICO, providing equivalent safeguards to EU/UK data protection law. Where applicable, transfers may also rely on the UK-US Data Bridge adequacy decision.
Because food logs, weight measurements, and dietary goals are stored entirely on your device and never processed on our servers, NomsAI does not process special category data as a data controller. The only data we hold server-side — a random ID, a credit balance, and a last-session timestamp — does not fall under Article 9.
Food-entry text and meal ingredient lists are transiently processed by Google Gemini to extract macro estimates or generate recipe suggestions, and are immediately discarded. This transient processing touches on dietary information; however, it is not stored or linked to any identifiable person, and Google's API terms prohibit its use for any purpose beyond fulfilling the API request.
NomsAI does not engage in automated decision-making or profiling within the meaning of GDPR Article 22. AI-generated macro estimates are informational only, have no legal or similarly significant effect on you, and you retain full control to edit or discard them before saving.
NomsAI is an informational macro-tracking tool, not a medical device. It does not provide medical, clinical, or dietary advice. Do not use it to manage any medical condition. Always consult a qualified healthcare professional before making health decisions.
If you are in the EEA or UK you have the following rights. Because NomsAI holds minimal pseudonymous data, most are exercisable directly in the app:
For any requests, contact [email protected]. We will respond within 30 days. Because all data is stored under an anonymous Device ID with no name or email attached, we may ask you to provide your Device ID (visible in Settings) to action your request.
You have the right to lodge a complaint with a supervisory authority at any time — you do not need to contact us first.
NomsAI is intended for users aged 18 and over. We do not knowingly collect data from minors. If you are under 18, you must not use the App.
If you are a US resident, applicable federal and state privacy laws grant you rights regarding your personal information. This section covers California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other states with comprehensive privacy laws. The same rights and contact point apply regardless of which state you are in.
We do not sell your personal information. We do not share your personal information with third parties for cross-context behavioural advertising. There is no "sale or sharing" to opt out of.
To exercise any of these rights, contact [email protected]. We will respond within 45 days (extendable by a further 45 days where reasonably necessary). Please include your Device ID (visible in Settings) so we can locate your record.
If you are a Canadian resident, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) governs how we handle your personal information. Quebec residents are additionally protected by Quebec's Act respecting the protection of personal information in the private sector (Law 25), which imposes similar obligations to EU GDPR.
For the purposes of Quebec Law 25, the solo developer acts as the Person In Charge of Personal Information (Privacy Officer) and can be reached at [email protected].
Cross-border transfers: Your pseudonymous server-side data (Device ID, credit balance, Pro status) is stored in the European Union via MongoDB Atlas. Transient food-entry text sent for AI processing is handled in the United States by Google Gemini and immediately discarded. By using the app you acknowledge that this data crosses borders and may be subject to the laws of those jurisdictions.
We do not sell your personal information. The same data rights that apply to UK/EU users apply to you:
We will respond to requests within 30 days. If you have a complaint about how we handle your personal information, you may contact:
We may update this policy. The "last updated" date at the top will change when we do. Continued use of the app after changes are posted constitutes acceptance of the updated policy.