How Nomvy handles your information.

1. Summary

• We use your data to run Nomvy: to estimate nutrition from your meals, calculate your targets, save your diary and manage your subscription.

• We process health data (meals, food photos, weight, body measurements, goals) only with your explicit consent, which you give during sign-up and can withdraw at any time.

• We do not sell your personal data, we do not show ads, and we never share health data with advertisers or use it for advertising.

• Food photos are stripped of location and other metadata on your phone. Raw scan photos are deleted after 30 days unless you save the photo with a meal. Voice is transcribed on your device and the audio never leaves it.

• You can export your data or delete your account from the app at any time.

2. Who we are

Nomvy (the "app", together with these web pages the "Service") is made and run by QuantumPlug Technologies LLP, registered in India (LLPIN ADA-4147), with its registered office at Sinuar Gopal, Laheriasarai, Darbhanga, Bihar 847429, India ("we", "us"). We decide how the data described here is used: we are the controller under the EU and UK GDPR, the "data fiduciary" under India's Digital Personal Data Protection Act, 2023, and the "business" or "regulated entity" under US state privacy laws.

Privacy contact and Grievance Officer: apps@quantumplugtech.com (subject "Privacy request").

3. Data we collect

Items marked health data are special-category data under the GDPR and "consumer health data" or sensitive personal information under some US state laws.

• Account data: email address, name, password (stored only as a one-way hash), Sign in with Apple or Google account identifier, or an anonymous guest ID. From you, and from Apple or Google when you use their sign-in.

• Profile and goal data (health data): sex, date of birth, height, weight, target weight, activity level, goal and pace, diet preference (for example vegetarian, halal, kosher or keto), allergies, preferred cuisines, and calculated calorie and macro targets. From you.

• Food and nutrition logs (health data): meals, food items, portions, calories and nutrients, food photos, text and transcribed voice descriptions of meals, corrections, saved dishes and recipes, and Smart Memory portion adjustments. From you, and generated by the Service.

• Body and activity logs (health data): weigh-ins, optional progress photos, water intake, steps and active energy (if you connect Apple Health or Health Connect), and fasting sessions. From you, and from Apple Health or Health Connect with your permission.

• AI scan records: the input you submitted for analysis (a reference to the photo, or your text), the AI model's output, model name, timing and cost. Generated by the Service.

• Consent records: which consents you gave (health data, terms), the version, date and time, IP address and device user agent.

• Subscription data: plan, product, store, trial and renewal status, and transaction identifiers. We never receive your card or bank details. From the App Store or Google Play, via RevenueCat.

• Device and technical data: push notification token, platform, app version, time zone, language, IP address, and crash and error diagnostics.

• Usage data: product events such as "onboarding step completed", "meal logged (method)" or "paywall viewed", without health values.

• Support communications: emails you send us and our replies.

Some information you choose to give us, such as a halal or kosher diet preference, may reveal religious beliefs. A diet preference is optional and is covered by the same explicit consent as your health data.

What we don't collect: precise location, contacts or advertising identifiers. Photo location (GPS/EXIF) metadata is removed on your device before upload. Voice input is converted to text by your phone's own speech recognition; we receive only the text.

4. Health data and your explicit consent

Before you can enter health data, the app asks for your explicit consent to process it for the purposes described in this policy (GDPR and UK GDPR Article 9(2)(a); consent requirements under laws such as India's Digital Personal Data Protection Act and Washington's My Health My Data Act). We record the date, time and version of the consent text you accepted.

You can withdraw consent at any time by deleting your account (see "Deleting your account") or by contacting us. Withdrawing consent stops further processing but does not affect processing that already took place. Because the Service cannot work without processing health data, withdrawing consent means we can no longer provide it to you.

We use health data only to provide and improve the Service for you, to keep it safe and secure, and to comply with the law. We do not sell it, use it for advertising or share it with data brokers.

5. How we use data and our legal bases

• Create and run your account and sync your diary across devices (account and device data): contract.

• Estimate nutrition from photos, text and voice, apply corrections, calculate targets, show progress and run Smart Memory (health data, AI scan records): contract, and your explicit consent for health data.

• Send reminders and notifications you turn on (device token, settings): contract, and your device-level permission.

• Manage subscriptions, trials and restored purchases (subscription and account data): contract.

• Send service emails such as password resets, sign-in links and important changes (email): contract and legitimate interests.

• Security, fraud and abuse prevention (for example rate limits and AI usage limits), debugging and crash diagnosis (technical data, account, AI scan records): our legitimate interest in keeping the Service secure and working; for health data, your explicit consent.

• Understand how features are used and improve the product, using events without health values (usage and technical data): legitimate interests, or consent where the law requires it.

• Quality checks on AI estimates, for example reviewing scans you flag with a thumbs down (AI scan records, feedback): explicit consent; kept no longer than 30 days.

• Respond to support requests and to requests to exercise your rights: contract and legal obligation.

• Comply with the law, enforce our terms and defend legal claims: legal obligation and legitimate interests.

Where we rely on legitimate interests, we have balanced them against your rights. You can object (see "Your rights").

6. AI processing

When you log a meal with a photo, text or voice, or use "Fix it with a sentence", we send the photo or text, plus a short context (such as your locale, diet preference, preferred cuisines, foods you often eat and the names of your saved dishes), to our AI provider, Anthropic, to produce a nutrition estimate. If Anthropic is unavailable, the same request is sent instead to a backup AI provider, OpenAI or Google (Gemini API), so that logging keeps working. We do not send your name or email address with these requests, and photo metadata (such as location) is removed first.

• We use these providers' paid business APIs, whose terms do not allow them to use your inputs or outputs to train their models.

• We do not use your photos or meals to train AI models.

• AI results are estimates that you review and can edit before saving. They do not produce decisions with legal or similarly significant effects about you, so they are not "automated decision-making" under GDPR Article 22.

• Results are labelled as AI-generated estimates.

7. Who we share data with

We do not sell personal data or share it for cross-context behavioural advertising. Service providers process data on our behalf under written contracts that limit their use of it to providing services to us:

• Anthropic, PBC (United States): AI analysis of meals and corrections. Food photos, meal text, limited diet context.

• OpenAI, L.L.C. (United States) and Google LLC, Gemini API (United States and other countries where Google operates): backup AI analysis when our primary AI provider is unavailable. Food photos, meal text, limited diet context.

• MongoDB, Inc., MongoDB Atlas (United States, AWS us-east-1): database hosting. All account and app data.

• Render Services, Inc. (United States, Virginia): hosting our servers and short-lived caching for rate limits. All data in transit, logs, account IDs and cached results.

• Cloudflare, Inc. (global network): photo storage (R2), network security and content delivery. Photos and technical data.

• RevenueCat, Inc. (United States): subscription management. App user ID, purchase and subscription status.

• Functional Software, Inc., Sentry (United States): crash and error reporting. Technical data and error details; request bodies with health data are scrubbed.

• PostHog, Inc. (United States): product analytics. Usage events and technical data, no health values.

• Expo (650 Industries, Inc.), with Apple Push Notification service and Google Firebase Cloud Messaging (United States): delivering push notifications. Push token and notification content.

• Resend (United States): sending service emails. Email address and email content.

Independent third parties:

• Apple and Google process payments, subscriptions and refunds as independent controllers under their own privacy policies, and provide Sign in with Apple and Google sign-in if you use them. If you connect Apple Health or Health Connect, data moves between the app and those services on your device according to the permissions you choose.

• Food databases: to look up foods and barcodes, our servers send search terms and barcodes (never your identity) to USDA FoodData Central and Open Food Facts.

• Legal and safety: we may disclose data if required by law, court order or a valid request from a public authority, or where necessary to protect the rights, safety or property of our users, us or others.

• Business transfers: if Nomvy is involved in a merger, acquisition or sale of assets, data may transfer to the new owner, who must honour this policy. We will tell you before that happens and, where required, ask for your consent for health data.

• With your direction: for example, when you share a meal or daily summary card.

8. Advertising, analytics and tracking

• Nomvy has no ads and contains no advertising SDKs. We do not track you across other companies' apps or websites.

• Product analytics (PostHog) receive event names, counts and technical details only, never meal contents, weights, photos or other health values. Session replay is not used on health screens.

• Crash reporting (Sentry) is configured not to send personal data by default, and request bodies on meal, AI and progress endpoints are scrubbed.

• We honour Global Privacy Control (GPC) signals where required by law. Because we don't sell or share data for advertising, there is nothing further to opt out of.

9. How long we keep data

• Raw food photos uploaded for AI analysis: 30 days, then deleted automatically, unless you save the photo with a meal or recipe.

• AI scan records (your input text and the model's output): 30 days.

• Saved meal photos, progress photos and profile picture: until you delete them or your account.

• Meals, recipes, Smart Memory, weight, water, activity and fasting logs, profile and goals: for the life of your account, until you delete them or your account.

• Consent records: for the life of your account.

• Sign-in sessions (refresh tokens): up to 60 days, or until you sign out.

• Password reset tokens: 1 hour.

• Push notification tokens: 180 days after you last open the app.

• Server logs (no request bodies, personal data redacted): 14 to 30 days.

• Crash reports: up to 90 days.

• Guest accounts: until you delete them. We may delete guest accounts after 90 days without activity.

• Database backups: deleted data ages out of backups within about 35 days.

• Support emails: up to 2 years after the conversation ends.

We may keep data longer where the law requires it or to establish, exercise or defend legal claims, and only for as long as necessary. Apple and Google keep their own purchase records under their policies.

10. Security

We protect your data with encryption in transit (TLS) and at rest, hashed passwords, short-lived sign-in tokens, access controls that scope every request to your own account, private photo storage with short-lived links, least-privilege access for our staff and systems, and monitoring. No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authorities as the law requires (for example the Data Protection Board of India, the supervisory authority within 72 hours under the GDPR, and under the US FTC Health Breach Notification Rule).

11. International transfers

We are based in India, and our servers and most of our providers are in the United States, so your data is transferred to and processed in countries that may not have data protection laws equivalent to yours. For transfers from the European Economic Area, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and/or the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified. You can ask us for a copy of the relevant safeguards.

12. Your rights

Depending on where you live (for example under the GDPR in the EU, EEA or UK, or India's Digital Personal Data Protection Act), you have some or all of these rights:

• Access a copy of your data. You can also export it in the app from Settings › Data & privacy › Export my data.

• Correct inaccurate data. Most data can be edited directly in the app.

• Delete your data, including by deleting your account.

• Restrict processing in certain circumstances.

• Portability: receive your data in a structured, machine-readable format (JSON), free of charge.

• Object to processing based on legitimate interests.

• Withdraw consent at any time, without affecting earlier processing.

• Nominate another person to exercise your rights if you die or become incapacitated (India).

• Complain to a data protection authority: in India the Data Protection Board of India; in the UK the Information Commissioner's Office (ico.org.uk); in the EEA the supervisory authority where you live or work.

To exercise a right, email apps@quantumplugtech.com from the email address on your account. We may need to verify your identity. We reply within 30 days (extendable by two further months for complex requests where the GDPR allows), or within the time the applicable law sets. Exercising your rights is free unless a request is manifestly unfounded or excessive.

13. US state privacy rights (including California)

This section applies to residents of California and other US states with comprehensive privacy laws, and is our notice at collection under the California Consumer Privacy Act as amended by the CPRA.

Categories collected in the last 12 months:

• Identifiers: email, name, account ID, IP address, device push token.

• Customer records and commercial information: subscription and purchase status.

• Internet or network activity: app usage events and diagnostics.

• Sensitive personal information: health information (meals, food photos, weight, body measurements), account login credentials, and any religious belief revealed by a diet preference.

• Characteristics of protected classifications: age (date of birth) and sex.

• Inferences: calculated calorie and macro targets and Smart Memory portion adjustments.

Sources, purposes and retention are described in the sections above. We disclose these categories to the service providers listed in "Who we share data with" for business purposes.

We do not sell or share (for cross-context behavioural advertising) personal information, and have not done so in the last 12 months. We do not knowingly sell or share the personal information of consumers under 16. We use sensitive personal information only for the purposes the CCPA regulations permit, so the "right to limit" does not apply.

You have the right to know, access, delete and correct your personal information; to opt out of sale, sharing, targeted advertising and significant profiling (we do none of these); and not to be discriminated against for exercising these rights. Email apps@quantumplugtech.com (subject "US privacy request"). We verify requests by matching them to the email address on your account. You may use an authorised agent with your signed permission. We respond within 45 days (extendable once by 45 days with notice). If we decline, you can appeal by replying with "Appeal" in the subject line, and if we deny the appeal you may contact your state Attorney General.

California "Shine the Light": we do not disclose personal information to third parties for their own direct marketing.

14. Consumer health data privacy notice

This notice applies to consumer health data under the Washington My Health My Data Act, Nevada SB 370, Connecticut's consumer health data provisions and similar laws.

• Categories collected: food and nutrition logs, food photos, body measurements and weight, goals and targets derived from them, diet preferences and allergies, activity and water data, and fasting sessions.

• Sources: you, your device, and (with your permission) Apple Health or Health Connect.

• Purposes: providing the nutrition tracking features you request, Smart Memory personalisation, security, and legal compliance.

• Sharing: only with the service providers listed above to provide the Service, and with others only with your separate consent or as required by law.

• We never sell consumer health data, and we do not use geofencing around health facilities.

• Your rights: to confirm whether we collect, share or sell your consumer health data; to access it, including a list of the third parties it was shared with; to withdraw consent; and to have it deleted. Email apps@quantumplugtech.com. If we deny a request, you can appeal as described above.

15. Deleting your account

You can delete your account in the app at Settings › Delete account, or by emailing us. Deletion signs you out on every device immediately and permanently deletes your account, profile, meals, photos, weight history, Smart Memory, consent records and other app data, as well as your subscriber record at RevenueCat, within 30 days. Copies in backups age out within about 35 days. Deleting your account does not cancel an App Store or Google Play subscription; cancel it in your store account. Full details: quantumplugtech.com/apps/nomvy/delete-account.

16. Children

Nomvy is not intended for, or directed to, anyone under 16. The app blocks sign-up for anyone who enters an age under 16, and we do not knowingly collect personal data from children under 16. If you believe a child under 16 has given us personal data, contact us and we will delete it.

17. These web pages

The Nomvy pages are part of quantumplugtech.com. When you visit them, the QuantumPlug website privacy policy (quantumplugtech.com/privacy-policy) and cookie policy (quantumplugtech.com/cookie-policy) apply to that visit. If you email us, we use your message only to respond.

18. Changes to this policy

We may update this policy as the Service or the law changes. We will post the new version here with a new "Last updated" date and, for material changes, tell you in the app or by email before they take effect. If a change needs new consent (for example a new use of health data), we will ask for it first.