Privacy policy

Last updated 13 October 2026

This policy covers the You Eat website, launch list and iPhone app. The app sections apply when you use those features; joining the launch list does not create an app account or collect meal or health information.

Who is responsible for your data?

Shinefort Ltd is the data controller, registered in England and Wales under company number 17081874. Our registered office is 3rd Floor, 86–90 Paul Street, London, England, EC2A 4NE, United Kingdom. For privacy requests, contact us or email [email protected].

Information we collect and why

• Launch list: your email, signup and confirmation dates, form source, valid campaign tags, consent wording version and a keyed hash of your IP address for abuse prevention. With your consent, we send a confirmation email and, once confirmed, one launch announcement. You can unsubscribe at any time. Joining does not start a trial or subscription.
• Account: your account identifier, email and sign-in information supplied through email sign-in or Sign in with Apple. These let us authenticate you and provide your account under our contract with you.
• Food and health information: meal descriptions, photos if enabled, food and portion estimates, dietary preferences, allergies, optional health and life-stage answers, training preferences, supplements, check-ins and the reports and suggestions derived from them. We use this information to provide and personalise the app. For health-related processing, we rely on your consent and explicit consent to process special-category health data.
• Purchases: app-account identifiers, subscription products, transaction references, entitlement and renewal status. We use these to provide paid features under our contract and meet applicable accounting obligations. Apple processes payment; we do not receive your full payment-card details.
• Support: your email, query category, message, submission time and an IP-derived abuse-prevention hash. We use these to reply, investigate problems and handle requests, based on our legitimate interests in supporting users and keeping the service secure. A privacy request may also require processing to meet a legal obligation. Please avoid sending passwords, payment-card details or unnecessary health information.
• Technical information: hosting and security services may process IP addresses, request paths, access times, browser or device information and operational errors to serve and protect the service. This is based on our legitimate interests in security, reliability and preventing abuse.

We receive information directly from you, from your use of the service, and from Apple and our subscription provider for sign-in and purchase status. Your setup answers stay on your phone until you sign in to save them. An account and the required food-and-health consent are needed to provide the personalised app. Optional answers and photo processing are not required to join the launch list.

Meal photos and AI processing

If you enable photo processing, we send meal photos to an AI service to identify foods and estimate portions. You can type a meal instead. The app removes location metadata before upload. Typed meal descriptions and relevant saved meal and preference information may also be processed by AI to prepare food analysis, reports and personalised suggestions.

We currently use Google Gemini. Information sent for analysis is subject to the terms and data-processing arrangements applicable to our API service. A provider may retain information separately for security, abuse prevention or legal requirements; deletion from You Eat does not necessarily delete every provider-held copy at the same time. Contact us for details of the current processing arrangements.

Our photo-retention setting defaults to 30 days. You can choose deletion after a meal is confirmed, or retention for 7, 30 or 90 days. Expired photos are queued for automatic removal from our storage. Deleting a photo does not delete the meal details saved from it, or a copy you keep in your own photo library.

Food recognition, portion estimates and nutrition suggestions can be wrong. They personalise general information; they do not diagnose a deficiency or make decisions with legal or similarly significant effects on you.

Your consent choices

The app records your consent choices and the policy version shown. You can turn off optional photo processing and food-library improvement in Settings. The core food-and-health processing is needed for the personalised service; withdraw it by deleting your account in Settings, or contact us for help. Withdrawal does not affect processing that was lawful before you withdrew.

If you choose to help improve the shared food library, eligible information from confirmed meals may contribute to combined food data. This is separate from the consent needed to provide your own meal diary and is optional. Contributions are designed to avoid identifying individual users; genuinely anonymous combined information cannot be linked back to you for deletion.

Website storage and measurement

The website uses browser storage for interface preferences and a broad traffic-source category for the current browsing session. It does not store meal or health information in these website preferences. Security services may also use cookies or similar technologies to protect the site.

Where website measurement is enabled, our event adapter sends event names and page, traffic-channel and button-location codes. It does not send email addresses, message contents, meal information or confirmation tokens. Any non-essential measurement that requires consent must only operate with that consent. You can use the forms without optional measurement.

Who receives information?

We do not sell your personal data. We use service providers to run the service, including Hetzner Online GmbH for hosting in Helsinki, Finland; Cloudflare for website delivery and security; Google for Gemini AI processing; Resend for transactional email where configured; and RevenueCat for subscription management where enabled. Supabase software runs our account, database and storage services on our hosting infrastructure.

Providers receive the information needed for their role. Apple handles App Store purchases and Sign in with Apple under its own privacy terms. Information you deliberately share, such as an exported report, is also received by the people you choose. We may disclose information where required by law, to establish or defend legal claims, or as part of a business transfer with appropriate protection for your information.

International processing

Our principal application hosting is in Finland. Other providers may process information outside your country, including in the United States and other locations used by their subprocessors. International-transfer requirements depend on the countries and services involved. Recognised protections can include adequacy decisions and approved contractual clauses with applicable UK addenda. You can contact us for information about the destinations and safeguards applicable to your data and to request a copy of relevant safeguards.

How long we keep information

• App account and meal information: while your account is active, until you delete individual records or request account deletion, subject to any specific legal requirement to retain limited information.
• Photos: according to your selected retention period, as described above. Local copies you save yourself remain under your control.
• Launch list: for the launch-list purpose. Unsubscribing stops launch communications; a limited record may remain to respect your choice and document consent. We remove launch-list records no later than 90 days after launch.
• Support enquiries: while the enquiry is open and for up to 12 months after resolution, unless a legal requirement or an ongoing dispute requires longer retention.
• Security and operational records: for as long as reasonably needed to investigate faults, prevent abuse and protect the service; purchase or accounting records may need to be retained for the applicable statutory period.

Account deletion removes account information from the active application database and queues stored photos for deletion. Restricted database backups expire on a separate retention cycle, normally within 30 days; they are not used for routine product access. Provider-held records and legally required purchase records may follow separate retention rules. Deleting your account does not cancel an App Store subscription.

Security

We use encrypted connections, access controls and restricted server-side access to protect information. No internet service can guarantee absolute security. Please secure your device and sign-in account, and report suspected unauthorised access through our support form.

Your rights and choices

Depending on the law that applies and the processing involved, you can request access, correction, deletion, restriction or a portable copy of your personal data. You can object to processing based on legitimate interests and withdraw consent at any time. We do not sell personal data or share it for cross-context behavioural advertising.

In the app, Settings provides data export and account deletion. Exported photo links are temporary, and photos already removed under your retention setting are no longer available. For other requests, choose “Privacy or data request” in our support form or email [email protected]. We may need to verify your identity. We normally respond within one month, or within the period required by applicable law, and explain any permitted extension.

You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint, or to your local data-protection authority where applicable. Contacting us first is optional.

Children

You Eat is intended for adults aged 18 and over. If you believe a child has provided personal information, contact us so we can investigate and remove it where appropriate.

Changes and contact

We update the date above when this policy changes. We will provide additional notice of material changes where appropriate and seek fresh consent where required. For questions or requests, contact support or email [email protected]. You can also write to our registered office.