Privacy Policy

Last updated: October 24, 2026

Fud AI ("we", "our", "the app") is an open-source iOS and Android app developed by Apoorv Darshan. This privacy policy explains how your information is handled across both platforms. In short: the core tracker has no required account, in-app analytics, behavioral tracking, general Fud AI cloud sync, or ads. The sole first-party aggregate-sync exception for scores and profiles is the optional Weekly Challenge described below. The iOS and Android apps also offer an optional Tip Jar and optional Plus/Pro hosted AI (with credit packs). Your detailed app data remains local-first except for operating-system backups or device transfers and the specific AI/STT requests, barcode lookups, update checks, health sync, purchases, exports, sharing actions, optional iCloud / Google Drive backup, hosted-AI proxy requests you initiate, or Weekly Challenge enrollment you initiate. Bring Your Own Key remains fully free forever on both platforms. An earlier iOS "Fud AI Premium" product was discontinued and is separate from today's optional Plus/Pro hosted plans. On supported iPhones, eligible food descriptions can be processed locally by Apple Intelligence as the final fallback after BYOK attempts fail. On iOS 27, if you select Apple Intelligence, food photos can also be analyzed on-device; those photos are not uploaded for that path. If on-device photo analysis fails, the request can continue through your selected image fallback provider. The public website, short meal-share links, Weekly Challenge service, and hosted-AI proxy run on Cloudflare and do not load analytics; Cloudflare, Google Fonts, and the cdnjs asset CDN may process standard request metadata needed to serve and protect them under their own privacy policies.

Discord support

For community moderation, Fuddy also checks new messages in accessible server text channels and active threads approximately once a minute. Deterministic spam rules run on Cloudflare; moderation messages are not sent to an AI provider. We store Discord identifiers, message fingerprints, strike counts and timestamps in a private Durable Object, but do not persist message text there. Member records are eligible for deletion after 30 days without a scanned message; strikes reset after 30 days without a new strike. Warnings appear in the affected channel. Moderation outcomes and uncertain-promotion flags, including identifiers and message links, appear in a private staff log and remain in Discord until removed. Automatic timeouts and third-strike bans follow the server rules. Contact support to appeal or request removal of moderation records.

When you submit /ask, /bug, or /feature, our Discord bot processes your command through Cloudflare. Questions and reports may be sent to Google Gemini. Bug reports and feature requests become public GitHub issues; do not include credentials, private logs, or personal information. New reports do not add your Discord username or ID to GitHub. To notify you when an issue closes, we privately store its number and your Discord user, channel, and bot-response IDs for up to two years. The bot replies in the original channel and mentions you with the closure outcome, which does not imply an app release. Unsent notifications expire after seven days; closure deduplication records expire after two years. Request removal of a report's notification mapping through our support contact.

Information You Provide

• Gender, date of birth, height, weight, and body fat percentage (entered during onboarding; body fat can be used locally for BMR and lean-mass protein target display)
• Activity level, weight goal, target weight, weekly weight-change rate, and custom meal-time boundaries
• One or more food photos taken within the app in a single capture session, plus any optional meal note you add before analysis
• One or more food photos selected from your library through the system picker or shared into Fud AI through the iOS Share Extension, plus any meal notes or text descriptions you submit for AI analysis
• Images attached to Coach messages, including camera captures or photo-library selections where supported
• Barcode values scanned for packaged-food lookup
• Food entries and nutrition data you log, including manual entries and Review Food nutrition edits you save by logging the meal
• Reviewed meal details and current daily macro totals when you tap What if? for an AI meal-impact suggestion
• Weight log entries
• Optional water entries, daily water goal, and water-reminder preference
• Optional fasting settings and sessions you explicitly start, including start/end times, goal duration, completion status, and goal-notification preference
• Food and weight descriptions you provide through iOS Siri Shortcuts / App Intents
• Body fat % readings logged over time, plus an optional goal body fat % (only collected if you opt into body-fat tracking during onboarding or later in Settings)
• Voice recordings (when using voice meal input)
• AI Coach chat messages (multi-turn conversation history)
• AI provider and speech-to-text provider API keys, plus an optional USDA FoodData Central API key for barcode lookups (stored encrypted on device — see below)
• If you voluntarily join the 18+ Weekly Challenge: your chosen display name; optional X or Instagram platform and handle; confirmation that you accepted the current community rules and confirmed 18+ eligibility (timestamps and version only, never your date of birth); a random participant ID; aggregate weekly overall points, activity/nutrition/consistency/hydration days, and activity calories; and any participant report you submit, including target participant ID, reason, optional details, status, and timestamps
• App preferences: appearance mode, theme color, units (metric / imperial), week-start day, meal-time boundaries, notification times, speech-language preferences, Home nutrient-card choices, default grams, optional nutrient goals, Energy Burn Goals, Adaptive Goals, optional water tracking, and optional fasting tracking

How We Use Your Information

• AI Food Analysis: One or more food photos from a camera session or system photo picker, iOS Share Extension photos, optional meal notes, text descriptions, and the text produced from voice input are sent to your selected AI access path only after you choose to analyze them. Multiple photos selected together are included as separate images in the same analysis request; they are not merged into one image. In Bring Your Own Key mode, requests go directly from your device to your chosen AI provider (any of 16 supported: Google Gemini including Gemini 3.5 Flash-Lite and 3.6 Flash, OpenAI, Anthropic Claude, xAI Grok, OpenRouter, Together AI, Groq, Hugging Face, Fireworks AI, DeepInfra, Mistral, DeepSeek, Alibaba Qwen (Alibaba Cloud Model Studio, international region), Cerebras, Ollama running locally, or a custom OpenAI-compatible endpoint you configure). Optional Hosted AI (iOS Plus/Pro): if you subscribe and choose the hosted path, the same kinds of request content (prompts, optional images, Coach tool rounds, and voice audio for hosted transcription) are sent to Fud AI's Cloudflare Worker, which meters usage against your daily pool and credit bank and forwards only the validated payload to Fud-operated Gemini and Deepgram accounts. The Worker identifies you solely by your RevenueCat anonymous app user id ($RCAnonymousID:…); it verifies entitlements with RevenueCat server-side, stores a hashed usage ledger in Cloudflare D1, and does not receive your food diary, Health records, or BYOK API keys. There is no free hosted quota. For text descriptions, text produced from voice input, and Siri food logging on supported iPhones, Apple Intelligence may process the food description locally on-device only as the final fallback after BYOK provider/fallback attempts fail; photo analysis, Coach, and speech transcription continue using the configured AI access path. The onboarding and AI Access settings explain that AI analysis sends request content for processing; manual entry never sends anything to an AI provider. Custom AI Instructions (optional, Settings → AI Access → BYOK): if you fill in the Custom AI Instructions text box, that text is appended to every AI request so the model sees your context. The text stays local except when included in the AI request payload. Fallback AI Provider: in BYOK mode, if your primary provider returns an error, the request can retry with the secondary provider you configured. Note on OpenRouter openrouter/free: when you pick the free-tier default model on OpenRouter, OpenRouter itself selects the upstream provider that handles your request.
• iOS Siri Shortcuts / App Intents: If you use Siri to log food, the spoken food description is handled as text input and sent through your selected AI access path to estimate nutrition; on supported iPhones it may use Apple Intelligence locally only as the final fallback after BYOK provider/fallback attempts fail. The resulting entry is logged locally and written to Apple Health if Health access allows nutrition writes. If you use Siri to log weight, the app parses the number locally, respects pounds/kilograms in the phrase or your unit setting, stores the weight locally, and writes it to Apple Health if authorized. If you ask Siri for today's calories, the app reads today's local totals and calorie goal. Phrase examples are shown under + → Describe Meal → Siri Phrases.
• Meal What-If Suggestions: If you tap What if? on the Review Food screen, the app locally previews the meal's calorie/protein/carbs/fat impact. If it asks AI for a suggestion, it sends the reviewed meal name and macros, your current daily totals, daily goals, and minimal profile context through your selected AI access path. The meal is not logged until you tap Log.
• Barcode Lookup: On iOS and Android, if you choose Barcode from the logging menu, the scanned barcode is sent from your device to the public Open Food Facts API. Fud AI requests only product fields needed for nutrition logging, such as product name, brand, quantity, serving size, and nutriments. If Open Food Facts has no product or incomplete nutrition, the app reuses a nutrition label you previously scanned for that barcode, which stays on your device. Optional USDA FoodData Central (Settings → Product Information): only if you add your own free FoodData Central API key and neither Open Food Facts nor a saved label has the product, the app sends that barcode (in its common zero-padded forms) directly from your device to the USDA FoodData Central API to look up a branded food with the same GTIN/UPC. Your key is sent only in a request header, never in the URL; nothing is sent to USDA without a key, and removing the key stops these requests. If no source has the product, the app reports that it could not be used; you can instead photograph the packaging with Camera or Photos. Barcode lookup does not use your AI provider key.
• AI Coach Chat: When you use the Coach tab, the app sends a slim system prompt (your profile, BMR/TDEE/macro formulas, weight forecast, current date/timezone, and a one-line "data available" snapshot) plus your conversation history through your selected AI access path. The snapshot can indicate how many explicitly recorded fasting sessions are available. Coach can additionally call tool functions mid-turn to fetch relevant ranges of your weight, body-fat, calorie, food-entry, fasting-session, workout-plan, workout-preference, or completed-workout history when you ask about specific dates, fasting, or training. If you attach an image to a Coach message, that image is included in the AI request. The fetched data is sent as part of the AI request and may include meal nutrients, explicitly recorded fasting start/end/goal data, or workout exercises, sets, reps, weight, RPE, and calculated calorie burn when relevant. Coach does not infer fasting from a gap in your food log. Full chat history is kept locally; only the last 20 messages are included in each LLM request to cap token cost.
• Optional Nutrient Goal Estimation: If you tap the AI estimate button for detailed nutrient goals, the app sends the minimum profile context needed for that estimate, such as your goal, body measurements, activity level, and current calorie/macro targets, through your selected AI access path. Returned detailed goals such as fiber, sugar, fats, cholesterol, sodium, potassium, calcium, iron, magnesium, zinc, vitamins, folate, omega-3, and related nutrients are stored locally as settings and do not change the calorie/protein/carbs/fat calculator.
• Speech-to-Text: If you pick the on-device option (Native iOS on iPhone, Native Android SpeechRecognizer on Android), voice recognition happens on your device and the selected language is passed as a local recognition hint when applicable. On Android, if the native recognizer reports that the selected language is unsupported or unavailable on-device, the app may retry native Android recognition with network/provider defaults before showing an error. In BYOK mode, if you pick a remote provider (Gemini Audio, OpenAI Whisper, Groq, Deepgram, AssemblyAI), a short audio recording is uploaded directly from your device to that provider and its text response is returned to the app. Groq (Whisper) and Deepgram are recommended alternatives when native Android speech is inconsistent on a specific phone. If you choose a fixed speech language or "Use Device Language" instead of Provider Auto, the corresponding language code may be sent with the audio so it can bias transcription.
• Local Storage: All food entries, Siri-created food entries, saved Review Food nutrition edits, weight entries, Siri-created weight entries, body-fat readings, optional body-circumference measurements (waist, hips, neck, chest, arms, thigh, calf, wrist) you choose to enter, optional water entries and goals, explicitly started fasting sessions and fasting settings, workout plans and logged sets, workout preferences, calculated workout-burn history, user profile (including any goal body fat %), Coach chat history, food photos, cached thumbnails, optional nutrient goals, Adaptive Goals preferences, Home nutrient-card choices, meal-time boundaries, and app preferences are stored in the app's local container — primarily UserDefaults on iOS and DataStore Preferences on Android. Body-fat-aware protein target display, water progress, fasting elapsed time, and workout-burn estimates are calculated locally from that data. Fasting sessions use a separate local model and never alter calories, macros, or meal grouping. Data leaves that container only through operating-system backup/transfer behavior or the specific requests and sharing actions described in this policy.
• Optional Weekly Challenge: The challenge is off until you choose to join, confirm that you are 18 or older, and accept its community rules. The app creates a random participant ID and one-time bearer credential; the credential is kept in secure device storage and the service stores only its SHA-256 hash. Cloudflare D1 receives only your chosen display name, optional X or Instagram handle, acceptance timestamps/version, weekly aggregate metrics, and service timestamps. It does not receive your birth date, detailed food or workout logs, photos, body measurements, API keys, Coach history, fasting/water history, or camera frames. Challenge names, optional handles, aggregate scores, ranks, and stable participant IDs are visible only to other enrolled participants with a valid challenge credential, not to anonymous website visitors or search engines. A social handle may let other participants identify or contact you on that external service, so adding one is optional. Authenticated participants can report another participant; reports store the reporter and target IDs, a selected reason, optional details of up to 300 characters, moderation status, and timestamps. We use focused display-name filtering, participant reports, and transient rate-limit counters to protect the community; raw bearer tokens and IP addresses are not written to the challenge database or application logs.
• API Key Storage: On iOS, your API keys (including an optional USDA FoodData Central key) are stored in iOS Keychain using the app's private Keychain service and become available after the device is first unlocked. On Android, they are stored in EncryptedSharedPreferences using AES-256 with a master key managed by Android Keystore (hardware-backed when the device supports it).
• Widgets and Apple Watch: To display today's calorie, selected nutrient, and optional water totals in iOS Home Screen widgets (Fud AI, Fud AI Protein, and Fud AI Water), iOS Lock Screen widgets, Android Glance widgets (Calorie, Protein, Today, and Water), and Apple Watch, the main app writes a small snapshot of the relevant totals and goals into a shared container — App Group on iOS, the same DataStore on Android. iOS also sends a small nutrition snapshot to the paired Watch app through WatchConnectivity when available. These snapshots never leave your devices and contain only totals, goals, nutrient labels, theme choice, and whether water tracking is enabled — no food names, photos, account identifiers, or API keys.
• Water Tracking and Reminders: Water tracking is off by default. If you enable it, the amounts you log, your freely chosen daily goal, and progress are stored and calculated locally. Optional water reminders are scheduled as local notifications and do not send your water history to a server, Apple Health, or Health Connect.
• Fasting Tracking and Goal Alerts: Fasting tracking is off by default. If you enable it, the app stores only sessions you explicitly start, end, cancel, edit, or delete, plus your freely chosen 1–168 hour goal. The active timer is derived locally from its saved start time and continues across app restarts until you end or cancel it. An optional one-time local notification can alert you when the goal is reached; there is no permanent timer notification, and the fast continues until you end it. Disabling fasting cancels an active session but preserves completed history. Fasting data is not sent to Apple Health or Health Connect and is included in an AI request only through Coach as described above.
• Optional iCloud / Google Drive Backup: Off until you turn it on in Settings → Data Management. iCloud on iPhone or Google Drive app-data access on Android is used only when you turn it on there, or when you choose Restore from iCloud or Restore from Google Drive on the Welcome back screen while setting up the app — never automatically at install. A restore turns backup on again with the restored settings. The app then uploads a snapshot of your food log, saved meals, meal photos, weight, body fat, measurements, water, fasting, workouts, goals, preferences, and Coach history to your iCloud or Google Drive. API keys, Weekly Challenge credentials, and device-specific Health tokens are not uploaded. On Android, workouts imported from Health Connect are not uploaded either; they are imported again from Health Connect on the new phone. Restore keeps original entry IDs so Apple Health / Health Connect do not double-write. You can back up, restore, or delete the cloud file from the same Settings card. iCloud backups and Drive backups are not interchangeable. Fud AI still has no account of its own.
• Operating-System Backups and Device Transfer: Apart from the optional Weekly Challenge's aggregate fields and the optional iCloud / Google Drive backup above, Fud AI does not run its own cloud-sync service. Apple and Android may nevertheless include eligible app-container data in encrypted device backups, Google backup, or direct device transfer according to your platform and account settings. The iOS Keychain accessibility class used by Fud AI also allows saved keys to migrate with an encrypted backup. These copies are controlled by Apple or Google, not by Fud AI. Delete All Data clears the current app installation but cannot rewrite an older platform backup that already exists.
• Exports and Shared Meal Links: Diary exports (JSON, Markdown, or CSV) are created locally and leave the app only when you save or share the resulting file. When you explicitly share a meal link, its meal names, nutrition values, serving details, ingredients, custom notes, barcode product details, and emoji are encoded in the link itself so the recipient can preview and import the meal. Anyone who receives or gains access to that link can read its contents; do not share it publicly if it contains information you consider private. The static add-meal.html page decodes the link in the recipient's browser and does not upload the payload to a Fud AI backend, though the hosting provider may receive the requested URL as standard request metadata.
• Apple Health (iOS) / Health Connect (Android): If you enable health integration in Settings, the app writes body measurements (weight, height, body fat percentage where supported), per-meal nutrition, and calculated workout calories to the platform's health store. Workout plans, individual set details, water history, and fasting sessions stay in Fud AI in this version; only the calculated active-energy summary is synced for workouts. On iOS, the app also reads weight + body fat + height + date of birth + biological sex back into your profile, can automatically import external weight + body-fat samples from other Health-compatible apps, can import Apple Watch / iPhone workout sessions (type, duration, calories, source) into Workouts and Progress as read-only history, can read daily step counts for display on Home, and can read active/total energy burned when you turn on Energy Burn Goals. Imported Apple Health workouts are not written back to Health and do not affect Energy Burn goal math. On Android, Health Connect sync covers nutrition, weight, body fat, calculated workout active calories, daily step reads for Home, and active/total energy reads for Energy Burn Goals, with permission reconciliation and backfill support. If you also grant the optional Exercise read permission, the app imports exercise sessions that other apps (for example Garmin Connect, Coros, Strava, Samsung Health, or Fitbit) wrote to Health Connect — activity type, start and end time, duration, distance when the session includes lap lengths, active calories over the session, and the recording app and device names — into Workouts and Progress as read-only history kept on your device. When two apps record the same workout (for example Garmin Connect and Strava), it is shown once, and time shared by overlapping sessions counts toward only one session's calories. Sessions written by Fud AI itself are skipped, Fud AI's own calculated workout calories are never counted toward an imported session, imported sessions are not written back and do not affect Energy Burn goal math, and the imported copies are removed the next time you open the app after you revoke Exercise access (or all of Fud AI's Health Connect access). Everything else keeps working if you decline it. Adaptive Goals use local food, weight, and profile data to make small weekly calorie corrections and do not send that calculation to an AI provider. On first enable where supported, historical backfill pulls past weight/body-fat samples into Progress. After a reinstall or on a new phone, the app can read back the nutrition, weight, body-fat, and calculated workout-burn records it previously wrote (identified by its own record tags) to restore those Fud AI summaries; fasting history, water history, workout diary plans, and set details remain local app data and require an eligible OS backup/device transfer to survive reinstall. You can review or revoke access from the app's Health settings using Manage Access, from iOS Settings → Health → Data Access & Devices → Fud AI, or from Health Connect on Android.
• Notifications: If you enable streak, daily-summary, log-weight, log-body-fat, meal, water, or fasting-goal notifications, they are scheduled locally via iOS local notifications or Android alarm/notification services plus the POST_NOTIFICATIONS permission on Android 13+. Metric-aware reminders can skip on days you have already logged the corresponding item. Enabling fasting on Android creates its dedicated notification category; disabling it removes that category and cancels a pending fasting-goal alert. No notification content is sent to a Fud AI server.
• App Update Checks: About can check whether a newer app version exists. On iOS, the app requests public metadata from Apple's iTunes Lookup API for the Fud AI App Store ID. On Android, it asks Google Play through the Play In-App Update API whether an update is available for the installed app. The app does not send your food log, profile, API keys, or health data for update checks. If an update is available, tapping Update opens the App Store or Play Store listing.
• Website Hosting and Assets: The marketing website is statically hosted by Cloudflare and does not load an analytics script. Cloudflare may process standard request metadata, such as IP address and browser information, to deliver and protect the site, authenticated Weekly Challenge API, and optional iOS Hosted AI proxy. Pages also request fonts from Google Fonts and icon CSS/font files from cdnjs; those services receive the normal technical metadata associated with an asset request. Shared-meal URLs may be visible to Cloudflare because the meal payload is part of the requested URL; the page sets a no-referrer policy so that payload is not sent as a referrer when a visitor follows an App Store, Play Store, or privacy link. Website processing remains separate from detailed local tracker data; only explicitly shared meals, hosted-AI request payloads you initiate, and the listed optional challenge data use the first-party service.

Information We Do NOT Collect

• We do not use any in-app third-party analytics, advertising, or crash-reporting SDKs
• We do not track your behavior, location, or browsing activity
• We do not sell your personal data
• We do not operate general tracker accounts, in-app analytics, or behavioral-tracking servers; the optional challenge uses a pseudonymous participant credential only
• We do not require an account, sign-in, or cloud sync for the core tracker; optional meal sharing and Weekly Challenge send only the fields described above
• We do not see your BYOK API keys; in Bring Your Own Key mode, AI/STT requests go directly from your device to the provider you configure. In optional iOS Hosted AI mode, request content is processed by the Fud AI Worker and upstream providers as described above, but your diary and Health records stay on-device except for the fields included in that request. Apple Intelligence fallback, when used for supported iOS text, voice-transcribed, or Siri food-description analysis, is processed on-device. On iOS 27, food-photo analysis you select with Apple Intelligence is also processed on-device.

Tips & Hosted Plans (iOS In-App Purchases)

The iOS and Android apps offer optional Tip Jar purchases that support development and unlock nothing, plus optional Plus/Pro subscriptions and consumable credit packs for hosted AI convenience. Payment is processed entirely by Apple under your Apple ID or by Google Play under your Google account; we never see your payment details. The apps use RevenueCat to fetch products, validate purchases, and identify the anonymous subscriber used for hosted quota — RevenueCat receives an anonymous app-generated identifier and the App Store receipt or Google Play purchase token, never your food, health, or profile data. Hosted quota and credit balances are stored as a hashed ledger on Cloudflare D1 and verified against RevenueCat on the server. In Hosted AI mode, the photos, text, audio, and Coach messages of each request you make are forwarded through Fud AI's server to Gemini or Deepgram and are not stored by Fud AI.

Voice assistant

The optional voice assistant is a live spoken conversation that you start and can end at any time. While a session is open, your voice audio, the live captions of what you and the assistant say, camera frames while you have the assistant's camera open, and the results of the in-app actions it performs for you (for example a draft meal's items and nutrition, or totals it reads to answer you) are streamed to the provider you chose: Google (Gemini Live) when you use Fud AI Plus/Pro hosting, or Google Gemini, OpenAI, xAI, or Alibaba Qwen (Alibaba Cloud Model Studio, international region) directly from your device when you use your own API key. Hosted sessions pass through Fud AI's Cloudflare Worker, which relays them without storing their content and records voice allowance and credit use in a hashed usage ledger. Random billing receipts also record the charge source and timestamp and are removed after 30 days; they contain no conversation content. Resumption handles are authenticated for your subscriber identity, expire after two hours, and are not stored or logged by Fud AI. Deleting anything always needs your confirmation, and finished turns are added to your on-device Coach history only when Save conversations to Coach is on. The chosen provider's privacy policy applies to what it receives.

Optional Meal Sharing

The first time you share a meal, the app asks which link to send, and you can change it later in Settings → App Settings. With Short Link (the default) while online, the app sends the selected meals (names, nutrition, ingredients, serving details, barcode product details, and any custom notes; no photos, API keys, or profile) to Cloudflare Workers KV to create a short link. Links expire automatically after approximately seven days. Anyone with the link, including a messaging service generating a preview, can read and copy the shared meals. Expiry does not remove copies already imported or saved by recipients or messaging services. Cloudflare processes request metadata for delivery and rate limiting. If creation fails or you are offline, sharing falls back to the existing link containing the meal payload. With Direct Link, the app sends nothing to Fud AI: the meals are carried in the link itself, which opens Fud AI directly and does not expire. Share pages use a no-referrer policy.

Data Storage & Security

Third-Party AI Providers

When you send a request to an AI or STT provider, including food analysis, optional nutrient-goal estimation, Coach chat, or remote voice transcription, you are subject to that provider's privacy policy. Each provider handles data differently — some log prompts, some don't; some train on inputs, some don't. We recommend reviewing the policy of whichever provider you choose:

• Google Gemini
• OpenAI
• Anthropic
• xAI
• OpenRouter
• Together AI
• Groq
• Hugging Face
• Fireworks AI
• DeepInfra
• Mistral
• DeepSeek
• Alibaba Cloud (Qwen)
• Cerebras
• Deepgram
• AssemblyAI

If you use Ollama or a custom OpenAI-compatible endpoint, requests go to whatever URL you configure — typically your own machine or a self-hosted server.

Barcode/Product Data Provider

Barcode lookup uses the public Open Food Facts API. When you scan a barcode, the barcode value is sent to Open Food Facts so the app can retrieve public product and nutrition data when available. Open Food Facts' own policies apply to that lookup.

USDA FoodData Central is an optional second source that is off by default. Only when you add your own free FoodData Central API key, and Open Food Facts and your saved labels have no nutrition for a scanned barcode, the barcode value is sent with your key to the USDA FoodData Central API (operated by the U.S. Department of Agriculture through api.data.gov). USDA's own policies apply to that lookup and to the key you registered with them.

• Open Food Facts Privacy
• USDA Privacy Policy

Website Service Providers

• Cloudflare Privacy Policy — static hosting, Weekly Challenge API/database protection, rate limiting, and cdnjs assets
• Google Privacy Policy — Google Fonts

Permissions Requested

• Camera — for snapping food photos, scanning barcodes, and showing food to the voice assistant. Prompted on first use.
• Microphone / Speech Recognition — for voice meal input and the voice assistant. Prompted on first use.
• Photo Library / Storage — to pick existing food photos. iOS uses PHPicker; Android uses the system PickVisualMedia photo picker — neither requires broad photo-library access.
• Notifications — only if you enable meal, streak, daily-summary, weight, body-fat, water, or fasting-goal notifications. On Android 13+, this triggers the runtime POST_NOTIFICATIONS permission prompt.
• Health — only if you enable Apple Health (iOS) or Health Connect (Android) integration. The system sheet lists the requested read/write types. Energy reads are used for goal calculation only when Energy Burn Goals is enabled; active-energy writes are used only when you calculate and sync a workout burn. On Android, the Exercise read permission is optional and is used only to show workouts that other apps shared with Health Connect, read-only.
• Internet — required for AI/STT requests to your chosen providers, optional app-update checks, and the optional Weekly Challenge when you join or view it. Implicit on iOS; declared in AndroidManifest.xml on Android.
• Battery Optimization (Android, optional) — Settings exposes a deep-link to whitelist Fud AI in Android's battery-optimization list. This is needed on aggressive OEM skins (OriginOS, MIUI/HyperOS, One UI) where exact alarms are killed otherwise. Whitelisting only affects local reminder reliability — it does not change anything about data handling.

Open Source

Fud AI is open source under the MIT License. You can review exactly what the app does — including every network call — at github.com/apoorvdarshan/fud-ai.

Data Retention & Deletion

• Short meal-share payloads expire from Cloudflare Workers KV after approximately seven days; recipients may retain their own copies.
• Local app data remains on your device until you delete it in the app or remove the app, subject to operating-system backup and restore behavior.
• Weekly Challenge scores are retained for 13 challenge weeks. Reports are retained for up to 180 days for moderation. An active challenge profile remains until you leave; profiles inactive for 90 days are automatically deleted, cascading their remaining scores and reports.
• Choosing Leave Challenge sends an authenticated remote-deletion request. Delete All Data also requests challenge deletion when an enrollment exists and the service is reachable. If a reinstall or lost device destroys the only bearer credential before deletion can be requested, the 90-day inactivity rule provides automatic cleanup; you may also contact us with a privacy request.
• Delete All Data (Settings → Delete All Data) wipes the app's local storage on both platforms: food log, weight log, body-fat log, water log, fasting sessions, workout diary/plans/history, profile, Coach chat history, saved meals, optional nutrient goals, Home nutrient-card choices, widget / Watch snapshot, API keys, and preferences. It intentionally does not touch Apple Health or Health Connect — those samples are personal and survive the reset. If you want them removed too, on iOS go to Settings → Health → Data Access & Devices → Fud AI; on Android use Health Connect's data management screen.
• Clear Food Log (Settings → Clear Food Log) removes local food entries only; previously-synced Apple Health / Health Connect samples are kept.
• Uninstalling removes the app sandbox, but Apple Health / Health Connect samples persist unless deleted separately. On iOS, Keychain items can also survive an uninstall by platform design; use Delete All Data before uninstalling if you want Fud AI to explicitly remove its saved API keys.

Children's Privacy

Fud AI is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. The optional Weekly Challenge is restricted to people who confirm they are 18 or older; we store that confirmation timestamp/version and never send or store the locally held date of birth for this purpose. If you believe a child has provided us with personal data, please contact us so we can assist.

Changes to This Policy

We may update this privacy policy from time to time as the app evolves. Changes will be reflected in the "Last updated" date above. Continued use of the app after changes constitutes acceptance of the updated policy.

Contact

For privacy questions or deletion requests, contact either of: apoorv@fud-ai.app or ad13dtu@gmail.com