Privacy Policy — Loki Nutrition
Effective date: 2026-05-24 Last updated: 2026-11-08
1. Who we are
Loki Nutrition is operated by UnstablePixel SRL (the "Controller").
- Company name: UnstablePixel SRL
- Registered address: Str. Victor Babeș nr. 2, Oradea, Bihor, Romania
- Privacy contact:
privacy@unstablepixel.com
For any question about your personal data or to exercise the rights described in Section 9, write to the privacy contact above. We answer within 30 days (one 60-day extension may apply for genuinely complex requests).
2. What this policy covers
The Loki Nutrition mobile app (iOS and Android), the web onboarding +
payment surfaces at nutrition.loki.unstablepixel.com, and the
supporting backend API that those clients talk to.
It does not cover:
- AI providers you connect to your account (Claude, ChatGPT, others). When you connect one, data you choose to share with it is processed by that provider under their own privacy policy. We disclose the data at your explicit request, recorded by the consent screen you confirm during connection. See Section 7.
- Open Food Facts. When you search for a food in the app, the
query is sent to the public Open Food Facts database
(
world.openfoodfacts.org) to look up nutrition information. We only send the query text — not your identity. Their terms apply to that query. - Apple Health and Health Connect. The health store on your phone belongs to Apple or Google and is governed by their terms, not this policy. What Loki writes into it and reads out of it — and only when you switch that on — is Section 8.
3. Data we collect
| Category | Examples | Lawful basis | How we get it |
|---|---|---|---|
| Account identity | Firebase user id, email, display name | Contract (Art. 6(1)(b)) — needed to provide the service | From Firebase, when you sign in with Google or Apple |
| Onboarding profile | Goal, dietary style, when in the day you eat, how much detail you track, preferred units, the year you were born, sex (optional) | Contract | You enter it during onboarding |
| Health data you give us | Your height, your weight, what you eat, and any health notes you add (allergies, foods to avoid, anything you want your assistant to know) | Your explicit consent (Art. 9(2)(a)), plus contract (Art. 6(1)(b)) to provide the service over it. One consent, for the whole app, on the A bit about you screen during onboarding. You cannot use Loki Nutrition without it, and if you don't give it nothing is sent to us | You enter it in the app, or your connected assistant logs it for you |
| Meal & food data | Logged meals, portions, custom foods, timestamps, notes | Explicit consent as above, plus contract | You log it in the app |
| Body data | Bodyweight entries, water intake, date, optional notes | Explicit consent as above (weight), plus contract | You log it in the app |
| Health-data consent record | That you agreed, the version of the wording you saw, the platform you agreed on, and when you ticked the box | Consent, and our record that it was given (Art. 7(1)) | Recorded when you tick the box during onboarding |
| Health-store imports | Body-weight readings and daily active + resting energy read from Apple Health / Health Connect, with the originating app or device name | Explicit consent (Art. 9(2)(a)) + Art. 6(1)(a) — per data type, off by default | Read from your phone's health store, only for the types you switch on. Section 8 |
| Health-store consents | The data type, the direction (import, or letting your assistant see imports), whether it is granted, the wording you agreed to, the platform, and the grant / withdrawal times | Consent, and our record that it was given (Art. 7(1)) | Recorded when you use a switch on the Health screen |
| Derived insights | Daily macro / calorie summaries, trend aggregations | Contract | Computed from your meal + weight data |
| Maintenance estimates | Your estimated maintenance calories and the date each estimate takes effect | Contract | You or your connected assistant set them |
| Subscription data | Your subscription status, billing cadence and current period end; for web purchases the Stripe customer id, for App Store purchases the store product and transaction reference | Contract — needed to grant paid features | Sent to this app by our subscription service, after a payment through Stripe (web) or the App Store (confirmed through RevenueCat) |
| Setup analytics | Anonymous counts of which onboarding questions were shown, answered or skipped, and whether you reached the result, the paywall and the connect step. No user id, no device id, no IP address, never your answers | Legitimate interest (Art. 6(1)(f)): to see which setup question people give up on, so we can fix it. The data can't be tied to you, and you can turn it off in Settings | Sent from the app to our server, which passes the counts to New Relic (EU) without your IP address |
| AI-connector consents | Your user id, the connected AI's client id, the scopes granted, the timestamp | Consent (Art. 6(1)(a)) | Recorded by the OAuth consent screen when you connect an AI |
| Tool audit log | Your user id, MCP tool called, a SHA-256 hash of the arguments (never the arguments themselves), latency, calling client, and — when the call failed — the error message the AI was shown, which can quote back a value it sent us | Legitimate interest (Art. 6(1)(f)) — security, abuse prevention, debugging | Server-side per request |
| AI activity log | Your user id, which AI acted, and a short display line for each write it made on your behalf (e.g. "Breakfast · 620 kcal") | Contract — it is the in-app record of what touched your data | Server-side, when a connected AI writes |
| Crash diagnostics | Stack traces, device model, OS version, app version | Legitimate interest — keep the app working | Firebase Crashlytics, when an error occurs |
| Backend telemetry | Request traces, error rates, response times, server logs | Legitimate interest | Server-side, no user-content payload, sent to New Relic (EU) |
We do not collect:
- Meal photos. When the AI assistant identifies a meal from a photo, the image is processed on the assistant side and never sent to our backend — only the resulting structured meal (name, quantities) is written server-side. See Section 7.
- Body-fat percentage, skinfold readings, blood-glucose logs, or clinical measurements. These are excluded from the product on purpose. The health data we do hold is listed in the table above — your height, your weight, what you eat and the notes you add — and it is held under the explicit consent you give during onboarding. What you choose to import from your phone's health store (body weight and daily energy burned) carries a second, per-type consent on top of it. See Section 8.
- Allergen or medical-diet advice. We hold the notes you write for your own assistant to read; the app has no allergen fields and no "is this safe for me" feature, and we do not interpret your notes.
- Behavioural tracking for advertising. The app has no ad SDKs.
- Your location.
- Your contacts, calendar, photos, microphone, or camera.
4. Why we collect each category
In short: to run the service you signed up for, to keep it working, and to satisfy a few specific obligations.
- Account, onboarding, meal, body, subscription data — needed to deliver the app's core function. Without them, there is no product.
- Your health data, and the record of your consent to it — your height, weight, meals and notes are what the app is for: they are how your targets are worked out and how your progress is tracked. Because they are health data, we ask for your explicit consent before any of it is sent to us, and we keep the record of that consent so we can show what you agreed to and when.
- AI-connector consents — recorded so that when you authorise Claude or ChatGPT to read your nutrition data, that authorisation is documented and revocable.
- Tool audit log — to detect abuse and to debug AI-tool failures. We store a hash of the arguments, not the arguments themselves. A failed call also keeps the error message the AI was shown, because that message is the whole point of a debugging record.
- AI activity log — so the Assistant activity screen can show you what a connected AI did on your behalf, including what it tried and failed to do. It exists to be read by you.
- Health-store imports and consents — because you asked Loki to read those types from your phone, and because we have to be able to show what you agreed to and when. See Section 8.
- Crash diagnostics + backend telemetry — to know when the app is broken so we can fix it. We don't profile you with this data.
5. Who we share data with (sub-processors)
We use these processors to run the service. Each acts on our documented instructions; each is bound by a Data Processing Agreement.
| Processor | What they do | Where data is processed | Transfer mechanism |
|---|---|---|---|
| Microsoft Azure | Hosting, Postgres database, Key Vault | EU region (West Europe / North Europe) | Intra-EU — no transfer mechanism needed |
| Google Firebase | Authentication, Crashlytics | EU where supported; Crashlytics has fixed regions | EU–US Data Privacy Framework + Standard Contractual Clauses |
| Stripe | Card payment processing for web purchases | US (Stripe holds card data; we never see card numbers) | EU–US DPF + SCCs |
| RevenueCat | Confirms App Store purchases and their renewals, keyed by your Loki user id | US | EU–US DPF + SCCs |
| New Relic | Backend telemetry and logs; the anonymous setup counts (off in Settings) | EU region | Intra-EU — no transfer mechanism needed |
| Open Food Facts | Public food database (search queries only, no user identity attached) | France (EU) | Intra-EU — no transfer mechanism needed |
| The AI provider you connect | Whatever you ask it to do with your data | The provider's regions | Disclosure happens at your explicit request via OAuth consent |
Apple's App Store sells in-app subscriptions as the seller, under Apple's own terms and privacy policy; Apple is not a processor of ours. We receive only what we need to grant access (the product, the status, the renewal date), never your payment details.
Apple and Google are not processors of ours for the health store. Apple Health and Health Connect run on your phone; Loki exchanges data with them on the device, under the platform's own permission prompt. Nothing about that exchange — which types are switched on, when the last sync ran — leaves your phone. Records you import land in your Loki account and are then held by the processors above, like any other app data. See Section 8.
We do not sell personal data. We do not share it with advertisers.
6. How long we keep it
- Account, meal and body data — for as long as your account is active.
- Subscription record — the Stripe customer and subscription ids, the status, the billing cadence and the current period end. This one is kept after you delete your Nutrition data: it is the record of a commercial relationship that may still be live, so it is how we know that a payment you are still making entitles you, and it is part of our billing trail. Retained under Art. 6(1)(b) — the contract is still running — and, for the billing trail, Art. 6(1)(c). It is kept for as long as the Loki sign-in it belongs to, and it is removed when you delete your whole Loki account (Section 9): that path cancels the subscription first, then deletes the record together with the sign-in.
- Health-store imports — until you delete your account or turn that import off, whichever comes first. Turning it off deletes every record already imported for that type immediately, with no grace period.
- Health-store consent records — kept for as long as the account, including withdrawn ones, because they are the evidence of what you agreed to and when. Deleted with the account.
- Your health-data consent record — kept for as long as the account, as the evidence of what you agreed to and when. Deleted with your Nutrition data: withdrawing that consent is deleting your Nutrition data (Section 9), so there is nothing left for the record to be the basis of.
- Tool audit log — 90 days from each entry, then deleted.
- AI activity log — 30 days from each entry, and at most the 1000 most recent entries per account, then deleted.
- Crash diagnostics — Firebase Crashlytics default retention (currently 90 days for crashes, 30 days for non-fatal events).
- Backup snapshots of the Postgres database — 7 days rolling.
When you delete your Nutrition data (Section 9), every category above is removed from our systems within 30 days, with two exceptions:
- Your account identity — the Firebase user id, email and display name you sign in with. That sign-in is shared across every Loki app, so deleting it from inside Nutrition would lock you out of the others and of your subscription.
- Your subscription record, for the reason given in its bullet above: the commercial relationship can outlive the data, and dropping our copy of it would leave you paying for a plan this app no longer knows about.
Both are removed when you delete your Loki account (Section 9), not your Nutrition data. Be aware of the knock-on: because the subscription record is keyed to that shared sign-in, signing back in to Nutrition with the same account restores your paid access. Your meals, foods and weigh-ins do not come back — the subscription does. The audit-log entries are deleted along with your Nutrition data; we do not retain a "tombstoned" trail of past activity.
7. AI connectors (Claude, ChatGPT, others)
This is unusual enough to deserve its own section.
Loki Nutrition doesn't send your data to any AI company. Neither the app nor our servers use an AI provider. Your data reaches an AI only if you connect your own assistant, and that is up to you: you can change or disconnect it any time.
The app lets you connect an AI assistant — Claude, ChatGPT, or any other client that supports the Model Context Protocol — to your account. Once connected, that AI can call a defined set of tools against your data (read your meals, log a new meal, fetch your food catalog, update your macro targets, etc.) only within the scopes you explicitly granted at the OAuth consent screen.
Photo-to-meal logging deserves its own note. The assistant identifies a meal from a photo you send in your conversation with the AI; that image is processed by the AI provider, not by us. Only the resulting structured meal (name, portions, macros) is written to our backend, via the same MCP tool the AI would use if you'd typed the meal yourself.
What this means in plain terms:
- The AI provider becomes a recipient of whatever data you ask it to see. Your conversation with the AI is governed by their privacy policy, not ours.
- You can revoke a connector at any time from Settings. We honor the revocation immediately — the next tool call from that AI returns unauthorised.
- We log each tool call (Section 3, "Tool audit log") for security: a hash of the arguments, not the content — plus, when the call failed, the error message the AI was shown.
If you do not connect any AI, no AI provider receives any of your data.
8. Health data from your phone (Apple Health / Health Connect)
Loki Nutrition can exchange data with the health store on your own phone — Apple Health on iOS, Health Connect on Android. Both directions are off by default and chosen one data type at a time, from Settings → Apple Health / Health Connect, and you can turn any of it off at any time.
This is a second consent, on top of the one in Section 3: that one covers the health data you give the app, this one covers data crossing to and from a store someone else runs. Giving one does not give the other, and withdrawing this one leaves your account intact.
What Loki publishes to your phone. Dietary energy, carbohydrates, protein and fat from the meals you logged, and your water entries. These are values you already entered in Loki; publishing puts a copy in a store you control, on your device, behind the platform's own permission prompt. Loki asks for write-only access to these types. Nothing new is collected and nothing about publishing reaches our servers.
What Loki reads from your phone — only for the types you switch on. Two things: your body weight readings (from a smart scale or another app) and your daily active and resting energy. These come from a medical-grade store and count as health data under GDPR Article 9, so before a single sample is read we ask for your explicit consent, for each type separately — a sheet that says what is read, where it goes and who sees it — and we record that consent on our server (the type, the wording you saw, the platform, the date). Reading happens when you open the app, over a window capped at 30 days. It never happens in the background.
Where imported records go. Into your Loki account on our servers, marked with where they came from: the platform, the store's own id for that sample, and the name of the app or device that recorded it. They are never merged into, and never overwrite, anything you typed yourself. Deleting a record in Apple Health or Health Connect does not delete it in Loki — the app says so, and you can delete the record in Loki directly.
Who sees them. Only you — until you separately switch on Let my assistant see imported data. Until you do, no AI connector (Section 7) can read, count or summarise an imported record; we filter them out on our server, not in the app. If you do switch it on, the AI provider you connected becomes a recipient of that data as well, on the same terms as the rest of your Loki data.
Withdrawing. The same switch that granted it takes it back. Turning an import off deletes every record already imported for that type, in the same operation that records the withdrawal — there is no grace period and nothing is kept back. Turning the assistant switch off stops the assistant seeing imported data from then on. Deleting your account (Section 9) removes the imported records and the consent record along with everything else — and removes what Loki published to your health store: the app clears the dietary energy, carbohydrate, protein, fat and water entries it wrote there, and only those. Nothing another app put in the store is ever touched.
What Loki never reads. Nothing beyond the two types above — no heart rate, no sleep, no reproductive-health data, nothing else the store may hold. Loki also ignores the samples it published itself, so your own entries cannot loop back and be counted twice. Which types you switched on and when the last sync ran is bookkeeping that stays on your phone — and it belongs to your account, not to the handset: signing out clears it, so if someone else signs in on the same phone they start with everything off and are asked for themselves.
Apple and Google are not processors of ours for any of this: the store is on your device and the exchange is local to it (Section 5).
9. Your rights
Under the GDPR you have eight rights over your personal data. The app implements concrete mechanisms for the ones that need them:
| Right | How to exercise it |
|---|---|
| Be informed | This document |
| Access (a copy of your data) | Settings → Download my data — returns a JSON bundle of everything we hold |
| Rectification | Edit the underlying data in the app (meals, weigh-ins, profile) |
| Erasure — your Nutrition data | Settings → Account → Delete my Nutrition data — removes your Nutrition data within 30 days: every category in Section 3 except the two Section 6 names as kept, your sign-in and your subscription record. It also removes what the app published to your phone's health store. You stay signed in to Loki: your sign-in, your other Loki apps and your subscription are untouched |
| Erasure — your whole Loki account | Settings → Account → Delete my Loki account, or the same option on your account page at loki.unstablepixel.com/account — deletes your data in every Loki app, any assistant you connected, your subscription record and your sign-in, and cancels a subscription you bought on the web. A subscription billed by the App Store or Google Play only you can cancel, in the store, so cancel it there first: the app names it before anything is deleted. It cannot be undone. You can also ask us at privacy@unstablepixel.com |
| Restrict processing | Disconnect AI connectors, disable optional features |
| Withdraw consent (Art. 7(3)) | Settings → Health-data consent → Withdraw… — withdraws the consent the app runs on and deletes your Nutrition data with it (it does not cancel your subscription; the confirm says where to cancel that). Settings → Apple Health / Health Connect — each switch withdraws the consent it granted and deletes what that type imported (Section 8). Disconnect an AI connector for the consent you gave it. |
| Portability | The export endpoint returns a structured machine-readable JSON |
| Object | Settings → Anonymous setup counts turns the setup counts off; disconnect AI connectors; email the privacy contact for anything else |
| Avoid automated decision-making | Not applicable — we make no automated decisions with legal or significant effect |
If you believe we have mishandled your data, you have the right to
lodge a complaint with your local supervisory authority. In Romania
this is the ANSPDCP (https://www.dataprotection.ro/).
10. International data transfers
Our infrastructure is in the EU. The cross-border transfers that happen are documented in Section 5. Each one has a valid Article 46 transfer mechanism (EU–US Data Privacy Framework certification + Standard Contractual Clauses) where the processor is outside the EU.
Connecting an AI provider is a transfer that happens at your explicit instruction under Article 49(1)(a) — we disclose it clearly via the OAuth consent screen and you can refuse.
Exchanging data with the health store on your phone is not a transfer at all: it happens on your device, between Loki and Apple Health or Health Connect (Section 8).
11. Children
Loki Nutrition is for people aged 16 and over. Onboarding asks for the year you were born and will not let you continue if you are, or might still be, under 16: because a year cannot tell 15 from 16 inside the year you turn 16, that year is turned away too. The same check runs on our server, so it cannot be worked around by the app or by a connected assistant.
We do not knowingly collect personal data from children. If you become aware that a child has provided personal data through the service, contact the privacy address in Section 1 and we will delete it.
12. Security
We follow GDPR Article 32 — appropriate technical and organisational measures. In specific terms:
- TLS 1.2 or higher in transit, everywhere.
- AES-256 encryption at rest on the database (Azure default).
- Secrets in Azure Key Vault, never in source control or configuration files.
- The backend's authorisation server scopes every API call to the user it was issued to; one user cannot see another user's data by construction.
No system is breach-proof. If a personal-data breach occurs we will notify the supervisory authority within 72 hours and, where the risk to you is high, notify you directly.
13. Cookies (web surfaces)
The web onboarding and payment pages use only strictly necessary cookies before consent — the session cookie that keeps you signed in, the CSRF token, and the consent record itself. We do not run advertising trackers. If we ever introduce optional analytics on the web surface, you will see a separate opt-in banner before any analytics cookie loads.
14. Changes to this policy
We may update this policy when the service changes or the law requires. The "Last updated" date at the top is the canonical version marker: when it changes, this document has changed, and the copy published at this address is always the current one.
There is one in-app step that asks for a new agreement rather than an acknowledgement: if your account is older than the health-data consent in Section 3, the app asks for it once, on your next launch, and waits for it — the same box, the same wording, before anything else.
Otherwise there is no in-app step that asks you to re-acknowledge a new version. When a change is material — a new category of data, a new recipient, a longer retention period, or anything that narrows your rights — we announce it in the app's What's new, on the next launch after you update. Where a change needs your consent, we ask for it before it applies to you, per data type, on the screen that switches that feature on (Sections 7 and 8).
15. Contact
For privacy questions, data subject requests, or anything in this document that doesn't read clearly to you, write to:
privacy@unstablepixel.com
UnstablePixel SRL — Str. Victor Babeș nr. 2, Oradea, Bihor, Romania