Privacy Policy

1. About this policy

EatyWise (“we”, “our”, “us”) is an AI-powered nutrition builder. This Privacy Policy explains what data we collect, why we collect it, how we use it, the services that process it, and what rights you have.

By using EatyWise, you acknowledge that you have read this Privacy Policy. Where we rely on your consent for specific processing activities, such as optional analytics, we will request that consent separately.

2. Data we collect

a) Data you provide directly

• Onboarding and profile information: goals, activity level, diet, priorities, gender, height, weight, date of birth, unit system, meals per day, and nutrition targets calculated from your information
• Pre-onboarding and survey responses, including lifestyle, eating habits, preferences, obstacles, how you heard about us, and other research answers you choose to provide
• Meal ingredients and other builder information you enter
• Contact details provided for Early Access rewards and communication, including email, phone number, or social and messenger handles such as Telegram, WhatsApp, X, or another selected contact method
• Feedback, contact submissions, and messages you send to us

b) Data created or collected through use of EatyWise

• Meal plans, generated meals, generated recipes, nutrition results, and builder state
• Anonymous research sessions, research answers, research metadata, and related analytics events; research data may later be linked to your EatyWise account when you register or connect it
• Analytics, feature usage, and interaction events (such as macro-math toggle states, ingredient changes, plan additions, recipe and meal generation counts, onboarding answers, and user/session identifiers)
• Meal-generation and observability data, including prompts, profile and nutrition inputs, ingredients, generated output, nutrition and matching data, timings, errors, and related technical data

c) Technical and infrastructure data

Hosting and application infrastructure may process standard request information such as IP address, browser type, referring URL, page visited, timestamp, and error or diagnostic information. The exact fields and retention depend on the applicable service and operational requirements.

For authenticated users, relevant profile, target, plan, recipe, research, contact, and usage data may be securely stored in Supabase and associated with the user's EatyWise account. Some of the same profile, target, plan, and recipe data is also stored in browser storage.

d) Sources of information

We collect information directly from you, automatically through your use of EatyWise, from authentication providers such as Google, and from service providers that process information on our behalf.

3. How we use your data

• To generate personalized meal and nutrition recommendations
• To remember your preferences and support account synchronization
• To deliver Early Access rewards, launch updates, and voluntary invitations to user feedback interviews
• To operate, secure, troubleshoot, and improve EatyWise
• To measure application performance and usage with analytics consent
• To conduct internal product analysis, evaluate feature engagement (such as ingredient and builder interactions), and perform marketing research using onboarding and user activity data.
• To comply with legal obligations

4. Cookies and local storage

EatyWise uses different types of browser storage. Cookies are sent with web requests; localStorage persists in your browser until cleared; and sessionStorage normally lasts for the current browser session or tab.

Essential cookies

• ew_consent stores your consent choice in an HttpOnly cookie; its retention depends on the configured consent cookie and applicable operational requirements.
• ew_onboarding_completed may record onboarding completion in a cookie in some application flows.

LocalStorage

Depending on your use of the application, localStorage may contain:

• ew_consent, ew_onboarding_completed, ew_onboarding_dismissed, and ew_generations_count for consent and application state
• ew_user_profile, ew_user_targets, and ew_meals_per_day for profile, targets, and meal-frequency data
• eatywise-plan, eatywise-recipes, and eatywise-recent-ingredients for plans, recipe cache data, and recent ingredients
• Account-specific pending synchronization data while local changes are being synchronized

These values do not have a universal application-controlled expiration period. Some cached recipe entries expire after approximately one hour, while plan and account data may remain until cleared or replaced. Signing out clears many EatyWise-specific account and temporary keys.

SessionStorage

SessionStorage may contain in-progress builder state, recently added plan item markers, the previous route, and temporary email or Google OAuth continuation data. Temporary continuation data can include profile, target, meals-per-day, user, research-session, and attempt identifiers and is cleared after completion, failure, sign-out, or expiration where applicable.

Optional analytics

Google Analytics, Vercel Analytics, and Vercel Speed Insights are initialized only after you provide analytics consent in the application. Provider-controlled cookies, storage, and retention are subject to the applicable provider's terms and settings.

5. Third-party services

EatyWise uses the following third-party services to deliver its functionality. Their handling and retention of data also depends on their applicable terms and operational requirements.

• Google Gemini AI — generates meals, recipes, and nutritional analysis. Meal-generation requests may contain profile and nutrition information such as age, height, weight, gender, activity, diet, goals, targets, meals per day, and ingredients. These requests are not described as anonymized.
• Supabase — provides authentication, database storage, and first-party product analytics, storing account, profile, survey, plan, recipe, meal generation, and feature usage event logs.
• Vercel — provides application hosting and infrastructure.
• USDA FoodData Central — looks up nutrition information using ingredient queries. Account and profile identifiers are not sent with these queries.
• Image providers (Pexels, Pixabay, Unsplash) — provide food photography. Generated food or meal search queries may contain ingredients or dish descriptions, but are not sent with account or profile identifiers by the application.

How we share information

We do not sell your personal information. We may disclose information to service providers that process data on our behalf, including providers for authentication and databases, hosting and infrastructure, AI generation, analytics, nutrition information, and food imagery. We may also disclose information where necessary to provide requested functionality, maintain security, resolve issues, or comply with legal obligations.

International processing

Your information may be processed in countries other than the country in which you live, depending on the location of our service providers.

Security

We use reasonable technical and organizational measures designed to protect your information, including encrypted connections, authenticated access controls, and access restrictions for account data. However, no method of transmission or storage is completely secure.

6. Authentication

EatyWise uses Supabase Authentication for email/password sign-in and Google Sign-In. Supabase receives and manages authentication credentials, email addresses, sessions, and provider identity information as applicable. EatyWise never receives your Google password.

7. Data retention

Data is retained as necessary to provide EatyWise, maintain accounts, deliver requested communications and rewards, support research and analytics, maintain security, resolve issues, and meet applicable legal or operational requirements. Retention depends on the applicable service and data type; this policy does not assign a fixed retention period where the repository does not establish one.

Browser storage remains until it expires according to the behavior described in Section 4, is replaced, is cleared by the application, or you clear your browser's site data. Account deletion and service-level retention depend on the applicable account and provider processes.

8. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to or restrict processing
• Withdraw consent at any time without affecting prior processing
• Lodge a complaint with your local supervisory authority

You can manage locally stored information by clearing your browser's site data for eatywise.com. You may also contact us regarding account-associated information or requests concerning your data.

9. Children

EatyWise is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can review the matter.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the Last Updated date at the top of this page. Continued use of EatyWise after changes are posted constitutes acceptance of the updated policy.

11. AI limitations

AI-generated recommendations may contain inaccuracies and should not replace professional medical or nutritional advice.

12. Contact

If you have questions about this Privacy Policy or how we handle your data, please visit our Contact page or email us directly at eatywise@gmail.com.