Privacy policy

In short

• Your food diary, weight history and settings are stored on your device.
• Optional online features send the information needed to provide them. AI requests go through our server to Google.
• We use technical records, crash reports and basic usage statistics to run and improve Protio.
• No ads, no sale of personal data and no tracking across other companies’ apps or websites.

Data that stays on your device

Your diary, food library, saved meals, weight, goals and settings are kept locally. An online feature may send selected information as described below; it does not upload your entire diary. Queued photos and text are encrypted on your device. Exported backups are password-encrypted and go only where you send them.

Health sync is optional. Protio can read the weight and protein data you select from Apple Health or Health Connect and save what you log there. Raw health records are not uploaded to us or included in analytics or crash reports. If you ask for an AI recipe, the remaining protein amount sent with the request can reflect imported protein data. Your weight and individual health records are not sent with that request.

Features that use AI

AI features run when you choose to use them. Before first use, the app explains online processing and asks you to agree. Depending on the feature, it sends:

• Meal photo or nutrition label: the resized image, with camera metadata such as location removed.
• Voice logging: your phone’s speech service turns speech into text, on the device or on Apple’s or Google’s servers. Protio’s AI service receives the text, not the recording.
• Text logging: the meal description you enter.
• Recipe ideas: your message, remaining protein amount, food filters, exclusions and likes, selected food names, your chat for the day until you clear it, shown recipes with ingredients and portions, and previous recipe titles. This helps follow your wishes and avoid repeating dishes.
• Saved filters, exclusions and likes remain across chats until you change them. Clearing a chat deletes the local conversation, not those preferences or information already processed online. If you include an allergy or other health information, it is sent as part of the request.

How AI requests are processed

Requests pass through Cloudflare Workers to Google’s AI service. Our server receives the content, language, relevant calorie setting, random installation ID, request ID, IP address and, for subscribers, store purchase evidence. Google receives the content and language, without our installation ID, purchase evidence or your IP address.

Our server does not keep original photos or a separate archive of request texts. It temporarily saves the answer, linked to your installation ID, so a retry can retrieve it. Recipe answers can include preferences and cooking context from the conversation. Answers can be retrieved for 30 minutes. Expired copies are deleted by the next successful scheduled cleanup, normally daily, rather than exactly at 30 minutes.

Google states that it retains requests, context and answers for 55 days for abuse prevention; authorised staff may review flagged content. Under its paid-service terms, content is not used to improve Google’s products. These terms also apply to developers based in the EEA, such as Protio.

AI results are estimates, not medical advice. You can review and edit them before logging. Protio does not make automated decisions with legal or similarly significant effects.

Your choices for AI features

You can decline AI processing or turn features off under Settings, Personalize Protio, Features and privacy. Turning them off stops new requests; it does not undo earlier processing.

If you allow offline queuing, photos or text wait encrypted on your device until you reconnect. You can remove them in the queue. They are deleted after processing or after 14 days at the latest.

Food databases

Barcode lookup sends the barcode directly to Open Food Facts and, if needed, USDA FoodData Central. Online food search sends your search words to these services. They receive your IP address and handle requests under their own privacy terms. Results are cached on your device.

Purchases and subscription checks

Apple or Google handles payments; we do not receive card or bank details. Our server checks purchase evidence with the store to confirm access to paid features.

It keeps a purchase-evidence hash, subscription reference, status, expiry and linked installation IDs to verify access and prevent sharing or misuse. Inactive verification records and installation links are removed through scheduled cleanup around 60 days after last use; negative checks and store-lookup IP counters are cleared through daily cleanup.

For Google Play refunds and revoked purchases, purchase references may be kept for 400 days to prevent cancelled access from being restored.

Free tries and usage limits

Our server keeps installation-linked counters for free tries and daily limits, and IP or IPv6 network counters to prevent misuse. Scheduled cleanup removes daily usage counters older than three days; network and temporary request records through daily cleanup, generally within two days. Free-try totals remain while Protio offers free tries. Scheduled cleanup removes installation records after 60 days without use. Resetting app data does not reset the installation ID.

Cost records linked to an installation or subscription enforce monthly service limits. Scheduled cleanup removes completed request-cost records older than 40 days; monthly totals are removed when their month falls outside that window. Aggregate cost totals can be retained without personal identifiers. These records contain no meal content; temporary AI answers are described above.

Crash reports and usage statistics

Sentry (Functional Software, Inc.) receives error reports and sampled performance measurements in its EU region. Reports include device and app details, technical events and, for purchase issues, store error codes and country. We attach no screenshots and do not set your name or email in Sentry. Error reports are filtered to remove file paths and URL paths and query parameters. Retention follows our Sentry plan.

Aptabase (Technov Solutions SRL, Romania) records screens and features used, app and operating-system version, language and session information in the EU. It derives country and region from the IP address but does not store the IP itself. It uses a daily-changing identifier, not our persistent installation ID. Events contain no food names, typed text or photos and are kept for up to five years.

Neither service is used for advertising or cross-app tracking. There is currently no in-app opt-out for diagnostics and statistics. You can contact us to object to processing.

Other connections

Update checks contact Apple or Google and may include the app ID and store country. Notifications, widgets and Live Activities run on your device without a push service.

If you contact support, we use your message and any reply email to answer you, keeping them only as long as needed. In-app forms also send app version, platform and language through Cloudflare to our Gmail inbox. Abuse-prevention counters are cleared through daily cleanup.

Legal bases

• Optional AI: consent, which you can withdraw by switching the feature off (Art. 6(1)(a) GDPR).
• Subscriptions and online food lookups: providing the requested service (Art. 6(1)(b) GDPR).
• Security, usage and cost limits, diagnostics, usage statistics, support and website operation: our legitimate interests in running a reliable service and preventing misuse (Art. 6(1)(f) GDPR). You may object to this processing.

Recipients and international transfers

Our providers are Cloudflare (server), Google (AI and support email), Sentry (diagnostics), Aptabase (usage statistics) and STRATO (website hosting in Germany). Apple and Google handle store purchases independently. Open Food Facts and USDA receive the food lookups you request. Some providers are based outside the EU; Sentry and Aptabase are configured for their EU regions.

Cloudflare, Inc., Google LLC and Sentry (Functional Software, Inc.) are based in the USA. On 10 October 2026 all three were listed as active participants in the EU-U.S. Data Privacy Framework, so transfers to them rely on the European Commission's adequacy decision of 10 July 2023. Requests your phone sends to USDA go to the USA at your request.

Your rights

You may request access, correction, deletion or portability of your personal data, restrict or object to processing, and withdraw consent without affecting earlier lawful processing. You may complain to a data protection authority, including BayLDA, Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

Delete local data under Settings, Reset All Data, or uninstall the app. This does not automatically delete server records. Email us about those; an installation ID or purchase reference may help us find them because Protio has no accounts.

You can use core tracking without providing data for online features. A feature that needs the information described here cannot work without it.

This website

STRATO hosts protio.info in Germany. Technical access logs, including IP, page, time and browser, are kept as needed to operate and protect the site. There are no advertising or analytics tools on the website; fonts and images are served locally. Sending the support form loads Cloudflare Turnstile, which processes IP and browser/device signals to prevent spam. Submitting it sends your message, reply email and language to support. Turnstile does not load just to read the site. Details: https://www.cloudflare.com/turnstile-privacy-policy/.

Changes

We update this policy when Protio changes. The date at the top shows the latest version.

Who is responsible

Controller under the EU General Data Protection Regulation (GDPR): Anastasia Paskar. Email: kleinetoolsstudio@gmail.com. Postal address: see the legal notice.

Email us for any privacy question or to exercise your rights.