Privacy Policy

2. Information we collect

• Account information, such as your email address, authentication provider, account identifier, and account status.
• Profile and onboarding information you choose to provide, such as age range, height, weight, goals, dietary preferences, activity context, preferred communication tone, and other personalization settings.
• Meal and nutrition information, including meal descriptions, ingredients, portions, meal times, calories, macronutrients, edits, favorites, recurring meals, notes, and other diary entries.
• Photos and other media you choose to submit for meal analysis. A photo may be stored with a saved meal and is handled under the retention and deletion practices described below. Production meal media is stored in Google Cloud Storage in us-central1 (United States).
• Chat and voice information, including messages, assistant responses, and voice recordings or transcripts when you use voice features.
• Measurements and body check-ins you choose to record, including weight and other supported measurements, and private subjective check-ins such as tiredness or satiety.
• Personalization and memory data derived from your use of Swicy, such as remembered meal corrections, preferences, routines, and other context used to make future interactions less generic.
• Apple Health data, only after you explicitly connect Apple Health. Swicy currently requests read-only access to supported categories described in Section 5.
• Subscription and purchase information necessary to verify entitlement, such as Apple transaction and subscription status information and an app-specific account token. Apple processes the payment itself.
• Device, usage, network, and diagnostics information needed to operate, secure, debug, and improve the service, such as IP address where recorded in service or security logs, app/device identifiers, app version, app interactions, notification tokens, crash data, and service logs.
• Support communications and other information you send to us directly.

3. How we use information

• Provide, authenticate, maintain, and secure your Swicy account.
• Log meals, calculate and display nutrition estimates, create daily and weekly views, and provide features you request.
• Generate AI-assisted meal analysis, chat responses, summaries, and personalized insights.
• Use profile information and interaction context, such as recurring foods or corrections, to personalize features.
• Connect optional Apple Health information with your diary when you authorize that feature.
• Operate subscriptions, restore purchases, prevent entitlement abuse, and maintain legally or operationally necessary purchase records.
• Send service, security, account, subscription, and optional reminder notifications according to your settings.
• Diagnose errors, protect Swicy from abuse, measure product performance, and improve the service.
• Comply with applicable legal obligations and enforce our Terms of Use.

4. AI processing

Swicy uses third-party AI services, including OpenAI, for features such as meal-photo analysis, chat, voice transcription, and personalized responses. Depending on the feature and context, information sent to the configured AI provider may include your request, meal text or images, selected diary facts, profile information, Apple Health information when connected, and personalization context. AI outputs may be inaccurate and are not medical advice. Do not rely on them to diagnose a condition, prescribe treatment, or determine whether food is safe for an allergy.

5. Apple Health and health information

• Apple Health is optional and is connected only after you explicitly choose to connect it and respond to Apple’s permission sheet.
• Access is read-only. Swicy does not write health values back to Apple Health.
• Swicy does not receive raw HealthKit samples. The app sends selected daily totals and workout details to Swicy’s server, with dates, timezone, and synchronization information.
• The current supported categories are step count, active energy, exercise time, dietary water, optional body mass, sleep analysis, and workouts. Workout details may include activity type, duration, and energy.
• Swicy does not currently request heart rate, HRV, oxygen saturation, respiratory rate, VO2 max, body fat, lean mass, basal energy, clinical records, medications, reproductive-health data, or blood glucose.
• Selected health aggregates may be used with your meals, goals, profile, and current request to provide contextual insights or AI-assisted responses.
• Swicy does not use Apple Health information for advertising, marketing, data brokerage, or unrelated profiling.
• You can disconnect Apple Health from Swicy. Disconnecting deletes imported Apple Health daily summaries from Swicy’s server and prevents further synchronization until you reconnect. Historical reports or chat messages already created from previously available context are not silently rewritten.

6. Personalization and Swicy Memory

Swicy may retain information such as preferences, recurring foods, corrections, routines, and other context to personalize features. This information is associated with your use of Swicy and is handled as described in this Policy. You may contact support@swicy.app with a request about your information.

7. Analytics and sensitive data

When configured for the production website, Google Analytics measures website visits and interactions and may use cookies or similar technologies. It does not load until you select “Allow analytics” in the website notice; “Reject analytics” keeps it disabled. You can change or withdraw your choice using “Cookie settings” in the footer. The website stores this choice in your browser’s local storage. If the browser cannot save the choice, analytics stays disabled for that session. When you withdraw permission, the site disables Google Analytics and clears analytics cookies available to the site. You can also manage or delete cookies through your browser settings. The mobile app uses separate Firebase Analytics and provides an app setting to control collection. Mobile analytics events use predefined interaction and feature fields rather than free-form meal, chat, or health content. Analytics providers may collect device and usage information as described in their own notices.

8. Service providers and sharing

• Google/Firebase for authentication and related platform services.
• Cloud and database infrastructure used to host Swicy’s API, PostgreSQL data, storage, and operational services.
• OpenAI or another configured AI provider for AI-assisted features described above.
• Expo and platform push-notification services for push delivery and device tokens.
• Apple for App Store purchases, subscription status, StoreKit transaction processing, and Apple Health permissions/data on your device.
• Analytics, diagnostics, security, email-delivery, and infrastructure providers used to operate the app and website.
• Authorities or other parties when disclosure is required by law or is reasonably necessary to protect users, the service, or legal rights.

9. Sale and advertising

Swicy does not sell personal information. We do not use Apple Health information or other sensitive health/nutrition information for targeted advertising, data brokerage, or third-party advertising profiles.

10. Legal bases and sensitive-data processing

For ordinary personal data, we rely on the contract with you to provide the account and diary features you request; on legitimate interests, where permitted by applicable law, to secure, support, and maintain the service; and on legal obligations when we must retain or disclose records. Analytics and diagnostics are described in Section 7. This Privacy Policy is a notice, not consent to processing. Acknowledging the notice or accepting the Terms does not by itself authorize optional or sensitive-data processing. Health and other sensitive information may require an additional legal condition under the law that applies; the applicable condition depends on the purpose and data involved. In Türkiye, processing is subject to Law No. 6698 on the Protection of Personal Data (KVKK) and applicable secondary legislation.

11. International data transfers

Some information is processed outside the country where you live. The production API and SQL database are hosted in an EU region, and meal photos are stored in a US region. Other providers may process data in additional locations. Contact support@swicy.app to ask about the service providers and processing locations relevant to your request.

12. Retention

• Account, diary, chat, profile, personalization, reports, achievements, and related user-owned data are generally retained while your account remains active or until you delete the relevant data, subject to product controls and legal obligations.
• Apple Health daily summaries are currently retained until you disconnect Apple Health or delete your account.
• Meal images may be stored with saved meal entries until the meal or account is deleted. Deletion from active storage may not immediately remove provider-held or backup copies.
• Successful account-deletion and email-change confirmation outbox records are removed after delivery; undelivered rows expire after seven days.
• Some operational copies may be subject to provider, backup, security-log, and diagnostic retention schedules. Their exact periods and deletion completion depend on the active provider settings and release operations; Swicy does not promise that every external or backup copy disappears immediately when an in-app deletion starts.
• The production API and SQL database run in an EU region. Meal photos are stored in a US region. When a photo is deleted from active storage, the storage provider keeps a recoverable copy for seven days before that soft-deleted copy expires.
• The SQL database is configured to retain seven backups by count, not for a guaranteed seven-day period. Point-in-time recovery transaction logs are retained for seven days. A backup’s age depends on when it was created.
• For log entries stored in the configured global logging buckets, ordinary service logs have a 30-day retention setting and required infrastructure audit logs have a 400-day retention setting. Other providers or systems may keep separate operational copies under their own schedules.
• After account deletion, a limited deletion record and information that must be retained for legal, security, accounting, or App Store transaction purposes may remain in minimized form.

13. Your choices and rights

• Access and review information associated with your account.
• Correct inaccurate profile or diary information.
• Use available in-app features to edit account information, disconnect Apple Health, request account deletion, or export supported account data. If a control is unavailable in your app or account, contact support@swicy.app.
• Contact support@swicy.app to request access, correction, deletion, restriction, objection, portability, or other privacy rights available under the law that applies to you. You do not need a paid subscription to submit a privacy-rights request.
• Disconnect Apple Health and delete imported Apple Health summaries.
• Change notification permissions and other optional settings.
• Request restriction, objection, portability, withdrawal of consent, or other rights where applicable law provides them.
• Complain to a competent data-protection authority if you believe your rights have been violated.

14. Account deletion

You can request account deletion through the in-app controls or by contacting support@swicy.app. The request starts an account-deletion process and may restrict further account changes while it is processed. Deletion is not necessarily immediate: data in active Swicy systems is processed for removal, while some operational, legal, transaction, provider-held, or backup copies may remain under the retention periods described above. Apple purchase entitlement may remain associated with your Apple ID after Swicy account deletion; restoring purchases does not restore deleted account data.

15. Security

We use technical and organizational measures intended to protect information. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

16. Age requirement

Swicy is intended for adults, and the Terms require users to be at least 18 years old. If you believe a minor has provided information to Swicy, contact support@swicy.app.

17. Health and safety limitations

Swicy is a general wellness and nutrition tool, not a medical device or healthcare provider. AI-generated food recognition, portion sizes, calories, macronutrients, and other outputs are estimates and can be wrong. Do not rely on Swicy to diagnose, treat, prevent, or manage a medical condition, to determine whether food is safe for an allergy or intolerance, or for emergency decisions. Consult an appropriate qualified professional for medical or individualized dietary advice.

18. Changes to this policy

We may update this Privacy Policy as Swicy or applicable law changes. We will update the “Last updated” date and provide notice where applicable law requires it. This notice does not itself create consent for a new purpose.

19. Contact

For privacy questions, rights requests, or complaints, contact support@swicy.app. We may need to verify your identity before completing certain requests.