NutriLogPrivacy
Version: October 2026 · applies to the NutriLog app and the website nutrilog.org
In short: NutriLog has no account and no ads. Your entries, your weight and your goal live on your iPhone and, if you have iCloud switched on, in your own iCloud. We don’t see them. Only when you use the AI with NutriLog Plus does the photo or text you send for it go to the AI to be analysed (see below). In detail:
Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
The website nutrilog.org
When you visit the website, the hosting provider automatically records in server log files: IP address, date and time, file requested, referrer URL, browser and operating system. This is technically necessary to deliver the page and to detect attacks (Art. 6(1)(f) GDPR). The hosting provider deletes the logs after a short period.
The website sets no cookies (the one exception: an optional tick box in the blog’s comment form, see below), uses no analytics tool and loads nothing from third-party servers. Your email address only goes to MailerLite when you submit the download form (see below). Your language choice is remembered locally in your browser (localStorage) and not transmitted. The calculator on the start page runs entirely in your browser; the values you enter are neither stored nor sent.
Your email address for the download
When you get NutriLog through this website, you enter your email address. You receive an email with a button; only when you tap it is the address confirmed and the download starts. We store your address, your language, which button on the page brought you there, whether you want to hear when the full version launches, and when you signed up and confirmed. The same applies if you sign up for news about NutriLog Pro. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, through the unsubscribe link in every email or by writing to privacy@nutrilog.org.
For sending and storage we use MailerLite (MailerLite, Inc., USA) as our processor. The data is kept in data centres in the EU (Netherlands); the transfer to MailerLite is covered by the EU Standard Contractual Clauses. If you don’t tick the box for the full version, we delete your address 12 months after you signed up. If you tick it, or signed up for Pro, it stays until you unsubscribe.
The blog and comments
The blog at nutrilog.org/blog runs on WordPress on the same server with the same hosting provider. The same applies to it as to the rest of the website: no analytics, no tracking, nothing from third-party servers — no Google fonts, no Gravatar profile pictures, no emoji images from WordPress.org.
When you write a comment, we store the comment, your name, your email address, the optional website field, your IP address and the date and time. Your email address is not published. We need these details to approve comments and to act on abuse (Art. 6(1)(f) GDPR); every comment is approved by hand before it appears. Only if you tick the box to save your details does the blog set cookies in your browser, so you don’t have to type your name and email again next time (Art. 6(1)(a) GDPR); they expire after just under a year. Comments stay up as long as the post is online. On request we delete your comment with all its details — a message to privacy@nutrilog.org is enough.
The app: what stays on your iPhone
Everything you enter in NutriLog — meals, weight, goal, profile details such as height and date of birth, your own products and portions — is stored in a local database on your device. There is no user account and no server of ours holding this data.
iCloud
If your iPhone is signed in to iCloud, NutriLog mirrors its database into the private iCloud database of your Apple account (CloudKit). This serves as backup and keeps your devices in step. Only you have access; we have none. Apple is responsible for processing in iCloud under the Apple privacy policy. You can switch iCloud off for NutriLog in the iOS settings at any time.
Apple Health
With your explicit permission, NutriLog reads from Apple Health: body weight, body fat percentage, workouts with their energy, active energy and steps. From these the app calculates your daily target and your weight trend. You grant permission in Health per data type and can withdraw it there at any time.
Health data leaves your device only through your own iCloud backup (see above). It is not transmitted to us or to third parties, not sold, not used for advertising or marketing, and not combined with other data. That is a condition set by Apple, and it is our stance anyway.
Open Food Facts
When you search for a product or scan a barcode, the app sends the search term or the barcode number together with your chosen language to the servers of Open Food Facts (Open Food Facts Association, France). This is needed to retrieve nutrition data. No personal data is transmitted; technically, Open Food Facts sees your IP address. Optionally you can store your own Open Food Facts account in Settings to contribute portion sizes to the database. The credentials live in your iPhone’s keychain and are used for those contributions only.
AI estimate (NutriLog Plus)
With NutriLog Plus you can have an AI analyse a photo of your food or a short description (“spaghetti bolognese, one plate”). Before the first time, the app asks whether you agree. Only when you send a photo or text for this does exactly that photo or text go to our server and from there to Anthropic (Anthropic, PBC, USA), the provider of the AI Claude. What comes back is a list of foods, amounts and nutrition values, which you check before it goes into your diary. Nothing else from your diary, from Apple Health or from your iPhone is sent.
Our server runs at Cloudflare (Cloudflare, Inc., USA) and stores neither photos nor texts. Using the purchase receipt signed by Apple, it checks that you have Plus and counts how many AI entries you have used in the current month (up to 100). For this it stores only the subscription number Apple assigns — it doesn’t tell us who you are — and the current month’s count, which is overwritten the next month. Technically, Cloudflare and Anthropic see your IP address. Anthropic does not use photos and texts to train its models and deletes them within 30 days at most. Only requests that Anthropic’s automatic safety checks flag as possible misuse may be kept for up to 2 years.
Both providers process the data on our behalf; transfers to the USA are covered by the EU Standard Contractual Clauses. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by no longer using the AI; NutriLog works fully without it.
Notifications
NutriLog has two notifications, both scheduled locally on your device and containing no figures: the optional weigh-in reminder (off by default) and, with NutriLog Plus only, a note on Sunday at 7 pm that your weekly review is ready (can be switched off in Settings). Neither goes through a server.
What we don’t do
No analytics or tracking tools, no advertising IDs, no sharing with third parties (apart from the photo or text you send to the AI yourself), no selling of data, no profiling. The app tells us nothing about you.
Retention and deletion
Your data stays as long as you want to keep it. You delete individual entries in the app; you delete everything by removing the app and, if active, deleting the NutriLog data in the iCloud settings. Since we hold no copy, there is nothing for us to delete.
Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a supervisory authority (in France: CNIL). Because your app data lives only with you, you exercise most of these rights directly in the app. For anything else, write to us:
Changes
If anything about the processing changes — for instance when new features are added — this statement will be updated and the change made visible in the app.