1. Introduction
ChewSum ("we", "our", or "the App") is an AI-assisted nutrition and metabolic tracking application designed to help you understand your energy intake, training strain, and expenditure. We believe your health and nutritional data are strictly personal.
This Privacy Policy explains what information we collect, how it is used, how it is secured, and your rights concerning your personal data in full compliance with Apple’s App Store Review Guidelines (including Guidelines 5.1.1, 5.1.1(v), and 5.1.3), the General Data Protection Regulation (GDPR), and applicable privacy laws.
2. Information We Collect and How We Use It
ChewSum collects only the information necessary to provide core app functionality:
- Account Data: If you sign in to sync your data across devices, we collect your email address via Supabase authentication. You may also use the app without an account.
- Nutrition & Food Logs: Meals, food items, ingredient descriptions, portion sizes, calorie counts, macronutrients (protein, carbs, fat), water intake, and timestamps that you log.
- Body & Goal Metrics: Height, weight, birth year, sex, activity level, and dietary deficit goals you provide to calculate basal metabolic rate (Mifflin-St Jeor) and target calories.
- Camera & Photos: With your permission, the App uses your device camera or photo library solely to photograph meals for nutritional estimation and to scan food product barcodes. Photos are only processed for logging and are never stored or used for any other purpose.
- Artificial Intelligence Credentials (BYOK): If you choose to enable AI meal estimation or the Ask coach assistant, you provide your own OpenRouter API key. This key is stored securely on your device using hardware-backed encryption (Apple Keychain).
3. Apple HealthKit & Health Data Compliance (Guideline 5.1.3)
If you grant permission, ChewSum integrates with Apple HealthKit (and Android Health Connect) to synchronize workouts, active calories, resting heart rate, heart rate variability, sleep duration, weight, body fat percentage, and nutrition logs.
4. Data Storage and Security
Your security is foundational to our architecture:
- Local Hardware Security: Sensitive credentials (such as your OpenRouter AI key) are stored in the device’s hardware-backed Secure Enclave / iOS Keychain.
- Cloud Synchronization: When account sync is enabled, your nutrition data is transmitted using encrypted TLS connections and stored securely in an enterprise PostgreSQL database (Supabase) protected by strict Row-Level Security (RLS) policies. Only your authenticated user ID can access your records.
- Open Food Facts: Barcode searches query the public Open Food Facts database anonymously without transmitting any personal identifiers.
5. No Tracking and No Advertising
ChewSum does not track you. Specifically:
- We do not collect or access the Apple Advertising Identifier (IDFA).
- We do not integrate any third-party ad networks, trackers, or commercial marketing SDKs.
- We do not sell, rent, or monetize your personal or health data in any form.
6. Account Deletion and Data Retention (Guideline 5.1.1(v))
You have full ownership of your data at all times:
- In-App Account Deletion: You can permanently delete your ChewSum account directly inside the app at any time by navigating to Profile → Delete account.
- Permanent Wipe: Initiating account deletion executes an immediate, permanent database wipe of all your meal history, weight logs, baseline calculations, workout caches, and user credentials across all tables. This action is irreversible.
- Data Export: You can export a complete CSV file of your entire food history at any time from Profile → Export food log.
7. Children's Privacy
ChewSum is not directed to individuals under the age of 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from children.
8. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us at:
Email: support@chewsum.app
Website: chewsum.app