Skip to main content
Hysa Tech LogoHYSA TECH

Privacy Policy

Last updated: October 31, 2026

Nutrio ("we", "our", or "us"), operated by Hysa Tech, respects your privacy. This Privacy Policy explains how we collect, use, share, and protect information when you use the Nutrio mobile application (the "App"), including its Apple Watch app, widgets, and extensions. By installing or using the App, you agree to the practices described below. If you do not agree, please do not use the App.

1. Information We Collect

1.1 Information You Provide

  • Account Information: email address, display name, and profile photo when you create an account with email, Google Sign-In, or Sign in with Apple. If you start without an account, your data is kept under an anonymous account ID with no email address until you save it to a login.
  • Body & Profile Details: age, sex, height, current weight, goal weight, goal and pace, activity level, eating style, dietary preferences, the motivation and challenges you choose during setup, and unit preference (metric or imperial).
  • Meal Photos, Descriptions & Food Logs: photos you take or choose (up to four per meal), meal descriptions you type or paste, and the resulting nutrition data (calories, macronutrients, micronutrients, nutrition score, portion sizes). You can delete any meal entry and its photos at any time.
  • Voice Descriptions: recordings of you describing a meal, made in the App or on your Apple Watch. A recording is sent for analysis (see section 3.1) and then deleted from your device. We do not store recordings on our servers.
  • Content You Share Into Nutrio: photos, text, and web links you share to Nutrio from other apps, and recipes you send from the Nutrio Safari extension. For a web link, the address is sent to our AI provider, which reads the linked page to find the recipe; the recipe's photo is saved as the meal photo.
  • Progress Photos: photos you choose to keep with a weigh-in. They are stored privately in your account, only you can open them, they are never sent to AI services, and they leave the App only when you share a comparison image yourself.
  • Exercise Logs: exercise type, intensity, duration, and estimated calories burned.
  • Water Intake Logs: daily water consumption records.
  • Weight Entries: the weight records you log over time to track progress.
  • Energy Level Feedback: optional self-reported energy ratings after meals.
  • Chats With Cal: messages and images you send to Cal, our AI nutrition assistant, your conversation history, and short summaries and notes Cal keeps from your conversations (Cal's memory) so later chats can follow on from earlier ones.
  • Reports About Cal's Replies: if you report one of Cal's replies, the reply, the message it answered, the reason you chose, and any note you add. Reports are kept in your account and deleted with it.
  • Weekly Reports: the weekly reports generated from your logs, and the weekly challenges you accept.
  • Saved Foods: foods you save for quick re-logging, including how often you use them.
  • Notification Preferences: your chosen meal reminder times and notification settings.
  • Feedback: messages you send us, including the feedback you can leave when you cancel a subscription.
  • Health Platform Data: if you choose to connect Apple Health (iOS) or Health Connect (Android), we read daily step counts, workouts (type, duration, and calories burned), weight measurements, and active energy burned. With your permission, we also write your Nutrio data back to the health platform: food logs (calories and macronutrients), water intake, weight entries, and workouts. Each data type can be enabled or disabled in your sync preferences.

1.2 Sensitive Health Data (Pregnancy & Breastfeeding)

If you tell us you are pregnant or breastfeeding, we collect additional sensitive health data: pregnancy or breastfeeding status, due date, breastfeeding type (exclusive or partial), and related details. This data is collected only with your explicit consent, given in a dedicated consent step before the feature is activated, and we keep a record of your consent with its timestamp. It is used to adjust your nutrition targets. Your status is included in the profile details sent to Google Gemini when your personalised plan is written (see section 3.1), and the answer you choose during setup is recorded as a setup event in Firebase Analytics. It is never shared with advertising partners. You can withdraw consent and delete your pregnancy data independently at any time in Settings without deleting your account. This data is processed under GDPR Article 9(2)(a) (explicit consent for special category data).

1.3 Automatically Collected Information

  • Device & Notification Tokens: Firebase Cloud Messaging (FCM) tokens to deliver the notifications you opt in to receive.
  • Analytics Data: usage events (such as screens viewed and features used), app version, device model, crash reports, and performance data, collected with Firebase Analytics and Firebase Crashlytics. Once you have an account, analytics events are linked to your Nutrio user ID. They include some answers you give during setup (such as your goal, age, sex, and pregnancy or breastfeeding status) so we can understand which parts of setup work. We do not send meal photos, chat messages, voice recordings, or health platform data to analytics.
  • Subscription Data: purchase identifiers, subscription status, entitlements, and expiration dates, processed through RevenueCat.
  • Gamification Data: streak counts, longest streaks, collected Cal cards, achievements, and daily calorie totals that power motivational features.
  • Advertising Identifiers: on iOS, we ask your permission through Apple's App Tracking Transparency (ATT) prompt before collecting your Identifier for Advertisers (IDFA). You may decline, and the App works the same without it. On Android, Meta's SDK may read the Android advertising ID, which you can reset or delete in your device's settings.
  • Install Attribution: on iOS, an Apple Search Ads attribution token, which tells us whether the App was installed from an Apple Search Ads campaign. It does not identify you to advertisers and does not require ATT permission.
  • Health Sync Metadata: when health platform integration is enabled, the App syncs data (such as steps and workouts) when you open it, and stores sync timestamps and connection status to manage the integration.

2. How We Use Your Information

  • Analyse your meals from photos, descriptions, voice recordings, shared content, and recipe pages, using Google Gemini.
  • Write your personalised plan at the end of setup, using Google Gemini, and create, adjust, and recalibrate your calorie and macronutrient targets based on your profile, goals, and progress.
  • Adjust nutrition targets for pregnancy or breastfeeding when you opt in to that feature.
  • Power Cal, the AI nutrition assistant, including chat, Cal's memory, and your weekly report, using Google Gemini.
  • Track exercise, water intake, weight history, progress photos, and energy levels to give you a complete view of your nutrition journey.
  • Maintain streaks, Cal cards, and other motivational features, and create your year recap and its film.
  • Send the reminders and notifications you opt in to.
  • Measure advertising campaign effectiveness and attribute app installs (with your permission on iOS where ATT applies).
  • Improve the App through analytics and crash reporting.
  • Sync health and fitness data between Nutrio and Apple Health or Health Connect, and import workouts and steps to credit the calories you burn.

3. Third-Party Services & Data Sharing

Nutrio does not sell your personal data. We share personal data only with the service providers listed below, and only to run and improve the App. Each of them is bound by its terms with us to protect your data with the same or equal protection as this Privacy Policy describes, and to use it only to provide its service, except where this policy says otherwise (advertising measurement by Meta, described in section 3.4).

3.1 AI Services (Google Gemini)

Nutrio's AI features run on Google's Gemini models, through Firebase AI Logic and the Gemini Developer API. When you use them, the following is sent to Google for processing:

  • meal photos, descriptions, voice recordings, and content you share into Nutrio, to identify foods and estimate nutrition (for a shared web link, Gemini reads the linked page);
  • your profile details (age, sex, height, current and goal weight, activity level, goal, pregnancy or breastfeeding status, and the motivation and challenge you chose), to write your personalised plan at the end of setup;
  • your messages and images, your goals and recent logs, and Cal's memory notes, so Cal can answer you in chat;
  • a summary of your week (meals and nutrition, energy check-ins, weight entries, workouts and steps, and last week's challenge), to write your weekly report;
  • descriptions of exercise you log, to estimate the calories burned.

We use Gemini as a paid service. Under Google's Gemini API Additional Terms of Service for paid services, Google does not use your prompts, files, or the responses to train its models or improve its products, and processes them for us under its data processing terms. Google keeps them for a limited period (currently 55 days) only to detect abuse and meet legal obligations. We do not send your account name or email address to Gemini. AI estimates can be wrong; you can correct or delete any meal, chat, or report at any time.

3.2 Infrastructure & Backend

  • Google Firebase and Google Cloud: authentication, database (Cloud Firestore), file storage (Firebase Storage), server functions (Cloud Functions, which also render your year recap film from your logs), push notifications (Cloud Messaging), remote configuration, app integrity checks (App Check), analytics, and crash reporting (Crashlytics).

3.3 Payments

  • RevenueCat: manages in-app subscriptions and purchases. RevenueCat receives purchase identifiers, entitlement data, subscription status, your Nutrio user ID, the device identifiers used for attribution (on iOS, the IDFA only with your ATT permission), your Firebase app instance ID, your Meta anonymous ID, and the Apple Search Ads attribution token. RevenueCat reports trial starts and purchases to Meta so we can measure our advertising. Payment card details are handled entirely by Apple (App Store) or Google (Google Play) and are never accessible to us.

3.4 Analytics & Advertising

  • Firebase Analytics: usage events and user properties, as described in section 1.3.
  • Firebase Crashlytics: crash reports and device diagnostics to help us fix bugs.
  • Meta (Facebook) SDK: install attribution and advertising measurement. It records app events such as installs and sign-ups; automatic event logging is disabled. On Android, and on iOS only when you grant ATT permission, your email address and Nutrio user ID, hashed by Meta's SDK on your device, are attached so Meta can match these events to your Meta account. On iOS you can stop this at any time by turning off tracking for Nutrio.
  • Apple Search Ads and SKAdNetwork: Apple's privacy-preserving attribution, used to measure campaigns without sharing personal identifiers.

3.5 Health Platforms

  • Apple Health (iOS) and Health Connect (Android): if you connect them, Nutrio reads and writes the data listed in section 1.1 through Apple's HealthKit framework or Google's Health Connect SDK. Imported steps, workouts, and weight are stored in your Nutrio account on Firebase so they can be shown throughout the App, and your weight entries, workouts, and steps can be included in the weekly summary sent to Google Gemini to write your weekly report (section 3.1). Health platform data is never used for advertising or marketing, never shared with advertising or analytics partners, never sold, and never stored in iCloud.

3.6 Authentication

  • Google Sign-In & Sign in with Apple: if you choose social login, the provider shares your name, email, and profile photo with us. We never receive your password. When you delete an account created with Sign in with Apple, we also revoke Nutrio's access to your Apple ID.

3.7 Sharing You Choose

When you share a card, poster, progress comparison, year recap, or film, it goes to the app or person you pick through your device's share sheet. We do not share it anywhere else.

4. Data Storage, Retention & Deletion

Your data is stored on Google Firebase servers (Cloud Firestore and Firebase Storage). We keep it for as long as your account is active or as needed to provide the service.

  • Full Account Deletion: you can permanently delete your account and its data (nutrition logs, meal photos, progress photos, chat history and Cal's memory, weekly reports, exercise, water and weight logs, year recaps and films, gamification data, goals, preferences, and profile data) from within the App (Settings → Delete Account) or through our Account & Data Deletion page. Signing in again may be required to confirm deletion.
  • What Deletion Does Not Remove: feedback you sent when cancelling a subscription is kept, with your user ID, to help us improve the App; email us to have it removed. Purchase records are kept by Apple, Google, and RevenueCat as their billing and tax obligations require. Copies held by Google for abuse monitoring expire as described in section 3.1.
  • Pregnancy Data Deletion: you can delete pregnancy and breastfeeding data independently in pregnancy settings without deleting your account. Your nutrition goals return to their previous values.
  • Individual Deletion: you can delete any food log entry and its photos, any progress photo, and any chat at any time.
  • Voice Recordings: not stored by us (see section 1.1).

5. Data Security

We use industry-standard encryption in transit (TLS) and at rest. Access to your data is restricted to authorised personnel who need it to operate the service. Firebase Security Rules ensure that users can only access their own data. Despite these measures, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

6. Your Choices & Rights

  • Access & Deletion: request access to or deletion of your personal data at any time by contacting us or using the in-app deletion feature.
  • AI Features: meal analysis, the personalised plan, chat, and the weekly report rely on Google Gemini as described in section 3.1. You can delete any meal, chat, or report at any time, and deleting your account deletes them all.
  • Withdraw Consent: if you consented to pregnancy data collection, you can withdraw consent and delete that data at any time.
  • Device Permissions: revoke camera, microphone, photo library, or notification permissions at any time in your device's settings.
  • Tracking Opt-Out (iOS): decline or revoke tracking permission in iOS Settings → Privacy & Security → Tracking.
  • Health Data Permissions: you can disconnect Apple Health or Health Connect at any time in the App's settings, or turn individual sync categories (steps, workouts, weight, nutrition, water) on and off. Revoking health platform access does not delete data already synced to your Nutrio account. You can also revoke Nutrio's access directly in your device's health platform settings.
  • GDPR Rights (EEA and UK Users): you have the right to access, rectify, erase, restrict processing, data portability, and object to processing of your personal data. Contact us at the address below to exercise these rights.

7. International Data Transfers

Your data may be processed on servers outside your country of residence (including the United States) by our service providers (Google, RevenueCat, and Meta). Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or the provider's compliance frameworks.

8. Children's Privacy

Nutrio is intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us data, contact us and we will promptly delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced in the App, and the "Last updated" date at the top will change. Continued use of the App after changes means you accept them.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

Hysa Tech

Email: support@hysa-tech.com