Privacy Policy

In short

• Your meals, weight, hunger answers and body data stay only on your device. We have no access to them.
• Photos and texts used to recognise your meals are sent via our server to Google (Gemini) only with your consent. We do not store them.
• There is no account. Instead of a name or email address, the app uses a random device ID.
• No ads, no analytics tools, no tracking, no selling of data.

1. Controller

The controller responsible for data processing in the “Pomilu” app and on this website is:

Sven Grabowski
Pletschmühlenweg 62
50259 Pulheim
Deutschland
Email: sven@pomilu.app

For any privacy questions and to exercise your rights, contact us at the email address above. We have not appointed a data protection officer because there is no legal obligation to do so.

2. Data that stays on your device

The app stores the following information exclusively in its storage on your device:

• Set-up information: sex, pregnancy or breastfeeding if applicable, age, height, weight, everyday activity, goal weight and pace
• Meals with their estimated values, saved meals (“Same again”)
• Weight entries (entered manually or from Apple Health / Health Connect)
• Answers to the evening question about hunger
• Settings, reminder times and your consent choices

This data is not transmitted to us. We can neither see it nor restore it. You can export it in the app as a CSV file and remove it under “Settings → Delete all data” or by deleting the app. Whether it is included in a backup of your device (e.g. iCloud or Google backup) is up to your device settings; Apple’s or Google’s terms apply to such backups.

Storing information on your device is strictly necessary to provide the app function you requested (Section 25(2) no. 2 TDDDG).

3. Anonymous device ID

On first launch, the app creates a random identifier (device ID) and stores it in your device’s protected storage (on iOS in the keychain, where it persists even if you reinstall the app). The app sends this device ID and the app language with every request to our server. We do not collect your name, email address or phone number.

Purpose: counting free entries, linking a subscription to your device and limiting abuse (e.g. a maximum number of recognitions per day).
Legal basis: Art. 6(1)(b) GDPR (providing the app and your subscription) and Art. 6(1)(f) GDPR (our legitimate interest in preventing abuse and cost risks); storing the identifier on the device under Section 25(2) no. 2 TDDDG.
Retention: daily counters per device ID are deleted after 7 days. Device IDs that have not used a free entry and have no subscription are deleted 90 days after last use. If a device ID has used free entries or has a subscription, we keep it together with its counter so that free entries are not granted more than once – for no longer than 13 months after last use.

4. Server connection and abuse prevention

Every connection technically transmits your device’s IP address to our server. Our server is hosted in a data centre of IONOS SE in Germany. We use the IP address to answer the request and for abuse limits (e.g. free entries per network and day). For these counters we do not store the IP address in plain text but only as a keyed hash (HMAC with a secret key) together with the date and a count. These counters are deleted after 7 days.

Legal basis: Art. 6(1)(f) GDPR (secure and economically viable operation).

5. Recognition by photo, voice and text (only with consent)

When you photograph, describe or dictate a meal, the app sends the following data to our server:

• the photo (reduced on the device to at most 1024 pixels) or the text (at most 1,000 characters),
• the app language and the device ID.

Your operating system’s speech recognition converts speech into text – on the device if your device supports this; otherwise Apple or Google may process the recording on their servers under their own terms. We receive no audio recordings. Our server forwards the photo or text, without the device ID, to Google’s Gemini API and returns the result (name of the dish, components, estimated amounts and nutritional values) to the app. We do not store photos or texts and do not write them to any logs. The result is only stored once you save it – and then only on your device.

Please only photograph your food. If a photo shows people or other things, they are transmitted as well.

Why consent: in the context of a weight-loss app, what you eat may allow conclusions about your health. We therefore treat this data like health data.
Legal basis: your explicit consent under Art. 9(2)(a) GDPR in conjunction with Art. 6(1)(a) GDPR, which you give when setting up the app.
Withdrawal: you can withdraw your consent at any time in the app settings. This applies to the future; the lawfulness of processing before the withdrawal is not affected. Without consent, barcode scanning and “Same again” keep working.

Google: the Gemini API is operated by Google as our processor (Art. 28 GDPR). Under Google’s terms for paid use of the API, requests are not used to improve Google products; Google may store them for a limited time to detect abuse. See the Gemini API Terms and Google’s Privacy Policy.

Usage log: for each recognition we store the time, type of task, model used, size (tokens), cost, duration and result status – without the device ID, photo or text. These records are deleted after 30 days; afterwards only aggregated daily figures remain.
Adding items: so that you can add components to a recognised meal, the app receives a key that is valid for 30 minutes. We store it only as a hash together with the device ID and delete it once it expires.

6. Barcode scanning

When you scan a barcode, the app sends the barcode number (with the device ID and app language) to our server. The server looks up the product in its cache and otherwise queries the product database of Tago (api.jointago.app), another service of the same provider, or Open Food Facts (Open Food Facts, an association under French law). Only the barcode number is passed on – neither your device ID nor your IP address; the request comes from our server. Product data (not related to you) is kept in the cache for 30 days; we also count per day where the answers came from.

Legal basis: Art. 6(1)(b) GDPR.

7. Subscriptions and purchases

You buy subscriptions through Apple’s App Store or Google Play. Apple or Google process the payment under their own responsibility; we receive no payment data and neither your name nor your Apple ID or Google account. The privacy policies of Apple or Google apply.

We use RevenueCat (RevenueCat, Inc., USA) as a processor to manage subscriptions. RevenueCat receives the device ID as an anonymous user identifier, the store’s purchase data (e.g. product, price, currency, country, timestamps, transaction identifiers) and technical data (e.g. IP address, device model, operating system and app version). See RevenueCat’s Privacy Policy.

Our server stores the subscription status per device ID (active, trial or regular, product, store, expiry date, last sync). For statistics (e.g. number of subscriptions, revenue per month) we store subscription events with type, product, price and cancellation reason if any – with a hash instead of the device ID.
Legal basis: Art. 6(1)(b) GDPR (subscription), Art. 6(1)(f) GDPR (statistics).
Retention: for as long as the subscription exists and beyond that as far as necessary to clarify claims; empty sync records without a purchase are deleted after 90 days.

8. Apple Health and Health Connect (optional)

If you allow it, the app reads only your weight values from Apple Health (iOS) or Health Connect (Android). The app does not write anything there. The values stay on your device and are not transmitted to us. You grant and revoke this permission in your device settings (Health app or Health Connect).
Legal basis: your explicit consent (Art. 9(2)(a), Art. 6(1)(a) GDPR).

9. Reminders

The app schedules reminders (e.g. in the evening or for weighing) locally on your device. We do not use a push service for this and receive no data. You can switch off notifications in the app or in your device settings.

10. Feedback and error reports

If you rate a result with 👍 or 👎 (optionally with a reason), we store the rating together with the type of task and the model used. If the app crashes or an error occurs, it sends the app version, platform, error message and a technical fingerprint of the error. We store both without the device ID, photo, text or health data; we cannot link this information to you. It helps us improve recognition and fix errors.
Legal basis: Art. 6(1)(f) GDPR.

11. No ads, no analytics, no tracking

The app and this website contain no advertising, no analytics or statistics tools and no tracking technology. We do not track you across other apps or websites and do not sell data. This website sets no cookies and loads no third-party content (e.g. fonts).

12. This website

The website pomilu.app is hosted by Vercel (Vercel Inc., USA). When you visit it, Vercel processes technically necessary access data (IP address, time, page requested, browser information) to deliver the site and fend off attacks, and stores it for a limited time under its own terms. See Vercel’s Privacy Policy.
Legal basis: Art. 6(1)(f) GDPR (secure provision of the website).

13. Recipients at a glance

14. Transfers to third countries

Google, RevenueCat and Vercel may process data in the USA. We base such transfers on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, and otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

15. Retention at a glance

16. Your rights

You have the right to

• access the data we hold about you (Art. 15 GDPR),
• rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR),
• withdraw your consent at any time with effect for the future (Art. 7(3) GDPR).

To do so, write to sven@pomilu.app. Because we do not keep accounts and do not know your name, we can only link data on our side via the device ID (cf. Art. 11 GDPR). You manage the data on your device yourself in the app (export, delete).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence or place of work. The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf.

17. Further information

Obligation to provide data: you are not obliged to provide us with data. Without consent, recognition by photo, voice and text is not possible; without a connection to the server, recognition, barcode lookups and subscriptions do not work.
No automated decision-making: the app’s guidance (“how much still fits today”) is calculated on your device. There is no automated decision-making within the meaning of Art. 22 GDPR.
Age: the app is intended for people aged 18 and over.
No medical advice: Pomilu is not a substitute for medical or dietary advice.

18. Changes

We update this privacy policy when the app, the law or our service providers change. The version published here applies.