Privacy Policy
Last updated: 1 June 2026
Health and account data
Retain is local-first. Your core logs are stored on your device unless you choose account-backed features such as Pro cloud sync, household, StoreKit entitlement checks, or consent-gated cloud AI. Server-side records may include your Sign in with Apple account identifier, refresh tokens, encrypted sync records, conflict records, entitlement status, household membership, and consent history.
Encryption and sync
Cloud sync stores per-record encrypted ciphertext and tombstones. The server is designed to preserve divergent versions as conflicts instead of silently overwriting them. Free export/import produces a local file you control; it stays on your device unless you choose to share it, and is protected by your device's data protection at rest.
AI providers and consent
Cloud AI is optional and Pro-gated, and requests are only sent after provider-specific consent. Photo food scanning sends your meal photo to a food-recognition processor, then sends only the resulting text description — never the photo — to a separate nutrition-estimation processor. Education answers use a separate cloud processor and cited sources. The app identifies each processor before consent. Consent is per provider and purpose: consenting to one provider does not authorize another. You can withdraw consent at any time, and future requests to that provider and purpose are blocked unless you consent again.
Food scan personalization
Your meal photo is used only in memory for the scan and is never stored on our servers. To make future scans of the same food more accurate, we keep a small food-scan record — a normalized dish name and the macro numbers you confirm or correct — tied to your account. These records never contain the photo or your notes, and they are removed when you delete your account.
Payments
Subscriptions are processed by Apple StoreKit. The server verifies signed StoreKit transactions and App Store Server Notifications to keep entitlement status current. We do not receive payment card details.
Export and deletion
You can export your local app data from the app. You can delete your account and server-held data from the app. Account deletion revokes refresh tokens and removes server-side user rows, encrypted sync records, conflicts, consent records, entitlement rows, and household links tied to your account.
Contact
Email nora@halehearth.com for privacy requests or support.