Mu Plate — Privacy Policy
Last updated: 2026-05-21
Effective date: TBD (set when published)
TL;DR
- We don't track you across apps or websites. Ever.
- Your meal photos are sent only to our private proxy → Google's Gemini API for calorie analysis. They aren't stored on our server beyond inference and aren't used to train any model by us.
- Your food log lives on your device. We don't sync it to any cloud.
- If you grant access, we read a few values from Apple Health (weight, height, biological sex, active energy) to compute your calorie target, and write back the weight you log. This data stays on your device — it is never sent to our proxy or any server.
- We only know who you are if you choose to sign in with Apple. You can use Mu Plate fully without signing in.
- You can delete everything at any time by signing out and uninstalling the app.
Who we are
Mu Plate is operated by Ke Zhu (datastix.com.au). For privacy questions: open an issue on the GitHub repository, or email the address listed on the support URL.
What data we collect, why, and where it goes
Meal photos
- What: When you tap the camera button and capture or pick a meal photo, the JPEG bytes are sent to our Vercel-hosted proxy.
- Where: Our proxy adds a Google Gemini API key (which never lives in the app) and forwards the photo to Google's Gemini Flash-Lite API. Google's Generative AI Terms apply to that hop.
- How long: Our proxy does not persist the image. Google's API processes the image to return a structured response and is governed by Google's terms above.
- Linked to you: Yes — to enforce the 5-scans-per-day limit, the proxy associates each request with your user identifier (Apple Sign-In
sub if signed in, otherwise an anonymous device UUID stored only in your iPhone's Keychain).
Food log entries (calories, food names, timestamps)
- What: Every meal you save (after editing the AI's estimate) lives as a
FoodEntry row.
- Where: A SwiftData store on your device. Not transmitted to any server.
- How long: Until you delete the app or sign out. Sign-out clears the local store.
User identity (only if you Sign in with Apple)
- What: Apple's stable user identifier (
sub), and optionally email (real or hide-my-email relay) and name.
- Where: Stored in your iPhone's Keychain on-device; the user identifier is sent as a Bearer token to our proxy for quota enforcement.
- How long: Until you sign out (which deletes Keychain entries) or delete the app.
Anonymous device ID (when not signed in)
- What: A random UUID generated on first launch.
- Where: iPhone Keychain only.
- Why: To enforce the 5-scans-per-day quota for unsigned users.
- How long: Until sign-out or app delete.
Settings (daily calorie goal, units, notifications toggle)
- What: Your preferences.
- Where:
UserDefaults on your device. Not transmitted.
Apple Health (HealthKit) — only if you grant access
- What we read: body mass (weight), height, biological sex, and active energy.
- Why: to compute an accurate daily calorie target on your device.
- What we write: the weight you record inside Mu Plate is saved back to Apple Health so your progress stays in sync with your other apps.
- Where it goes: nowhere. HealthKit data is read and used entirely on your device. It is never sent to our proxy, to Google, or to any server, is never stored in iCloud by us, and is never used for advertising or data-mining.
- Control: access is optional and off until you grant it. You can revoke it anytime in iOS Settings → Privacy & Security → Health → Mu Plate.
What we do NOT collect
- Location.
- Contacts.
- Apple Health data beyond the on-device reads/writes described above (none of it leaves your device).
- Tracking identifiers (no IDFA, no third-party analytics SDKs, no Firebase, no advertising networks).
- Crash logs (Apple's standard system crash reports are subject to Apple's own privacy policy; we don't operate any third-party crash service).
Third-party services
| Service | Purpose | Provider |
|---|
| Vercel | Hosts the recognizer proxy | Vercel Inc. (privacy) |
| Vercel KV / Upstash | Per-user daily quota counter | Upstash (privacy) |
| Google Gemini API | Calorie estimation from photo | Google LLC (privacy, Gen AI terms) |
| Apple Sign in with Apple | Optional account creation | Apple Inc. (subject to Apple's privacy policy) |
We do not embed any analytics or advertising SDKs.
Your rights
- Access: Your food log lives on your device. View, edit, or delete entries within the app.
- Sign out: Settings → Sign out clears your Apple identity, Keychain entries, and the device-local food log.
- Account deletion: If you signed in with Apple, you can revoke Mu Plate's access at any time via Apple ID Settings. We don't store any data about you on our servers other than the per-user daily quota counter, which expires automatically at the next UTC midnight.
- Withdraw consent: Stop using the app and delete it. No data persists outside your device once you sign out.
Children's privacy
Mu Plate is not directed at children under 13. We don't knowingly collect data from children under 13. Apple's age requirements for App Store accounts apply.
Changes to this policy
If we materially change this policy, we'll publish an update at the URL where this policy is hosted and bump the "Last updated" date at the top.
Contact
Open an issue at github.com/kezhu2008/calorie_counter_app/issues or email the address listed on the App Store support URL.