Legal
Dietect privacy policy
In short
- Your meal diary is stored on your phone, not on our servers.
- Meal photographs are sent to be analysed and are not kept, by us or by the company that analyses them. What the analysis returned is kept.
- We do not sell your data, and we do not use it for advertising.
- There are no third-party trackers or advertising identifiers.
- You can delete your account from inside the app, at any time — see Delete your account.
- Dietect is for adults: you must be 18 or older to use it.
Who we are
Dietect is made by Joshua A. Nyajuaya, an individual in Kenya trading as Konbran, who decides how your data is used. For anything in this policy, write to [email protected].
What we collect, and why
Your account
An account is optional. The diary, setup and food search all work without one; analysing photographs needs one.
An email address and a password, so that you can sign in. The password is stored only as a hash by our authentication provider; we never see it. Your account also has an identifier, a random number that the rest of your data is filed under. Your email address is used to confirm your address, to let you reset your password, and to reach you about the service. It is not used for marketing.
Your nutrition profile
If you complete setup while signed in, we store the answers you gave: sex, age, height, weight, activity level, goal, the pace you chose, an optional target weight, your preferred units, and the date you started. These are stored so your targets follow you to a new device. We store your answers, never the calorie target they imply — that is recalculated on the phone, so a corrected formula reaches you rather than leaving you on a frozen number.
Meal photographs
When you photograph a meal, the image is sent to our analysis service and passed to an AI provider that analyses it on our instructions. The photograph itself is not stored by us, in the database or anywhere else, and that provider does not log or store it or the result. What we store is:
- a one-way fingerprint of the image, which cannot be turned back into the picture, so that a retry or a duplicate submission can be recognised as the same photograph;
- what the model returned — the foods and portions it proposed;
- whether you accepted, edited or rejected that proposal, any corrections you made, and the calories you committed;
- technical details of the analysis, such as how long it took, so we can watch its accuracy and reliability.
These records are linked to your account while it exists. We keep them because they are the only evidence of whether the estimates are any good. When you delete your account they are kept with nothing left that links them to you, and deleted 12 months after they were made.
Food searches and barcodes
When you search for a food or scan a barcode, the search term or the barcode goes through our server to the food databases named below, and the answer comes back the same way. We do not store what you searched for. We keep a record that a search happened — when, which database, and whether it worked — and the same for each photograph, because the limits below count them. These records are linked to your account while you are signed in, and are kept and deleted as the records of photographs are.
Your meal diary
The diary itself — the meals you logged and when — is stored on your phone and is not uploaded. Uninstalling the app or losing the phone loses the diary with it.
Preventing abuse
So that analysis stays available to everyone, we limit how much any one caller can use. When you are signed in, the limit counts your account. When you are not, it counts a device identifier the app generates and your network address. We store only a keyed one-way hash of that address, never the address itself. The identifier is random: it is not tied to your phone’s hardware or advertising IDs, and reinstalling the app replaces it. Records made while you were not signed in belong to no account, and are deleted 12 months after they were made.
Crash reports
If the app crashes we receive a report describing what failed, the device model, the operating system version and a random identifier for this installation of the app. Our crash reporting is configured not to store IP addresses and to scrub data before sending.
On your phone only
Reminders are scheduled on your phone; we send no notifications from a server. The app uses the camera only when you open it to photograph a meal or scan a barcode.
Who else processes your data
We use service providers for the work below. They process data only on our instructions and may not use it for their own purposes. If you would like to know which company does any of it, write to [email protected].
| Provider | What for | Where |
|---|---|---|
| Database and account hosting | Accounts, profile, records of analyses and searches | United States |
| AI image analysis | Analysing meal photographs. It does not log or store the photograph or the result. | United States |
| Crash reporting | Crash reports | United States |
| Email delivery | Sending account emails | United States |
| Backup storage | Keeping encrypted backups of the database, which only we can decrypt | United States |
| Email hosting | Receiving the email you send us | United States |
| Website hosting | Serving this website | Global edge network |
Food figures come from USDA FoodData Central and Open Food Facts. We send them a search term or a barcode. We do not send them anything about you or your account. Their licences and the credit they ask for are on data sources.
How long we keep it
- Your account and profile: until you delete your account. Deleting it from the app takes effect at once; a request by email is carried out within 30 days.
- Records of photographs and searches: linked to your account until you delete it. Then they are kept with nothing that links them to you, and deleted 12 months after they were made. Records made while you were not signed in are deleted 12 months after they were made.
- Backups: each encrypted copy of the database is deleted after 30 days, so a deleted account is gone from every backup within 30 days.
- Crash reports: 30 days.
- Records of the emails we send you, kept by the company that sends them: 30 days.
- Our servers’ request logs: 1 day.
Delete your account says what deleting removes, and how.
Your rights
You can ask for a copy of your data, ask us to correct it, or ask us to delete it. The quickest route to deletion is the deletion page. For anything else, write to [email protected].
We are based in Kenya. Its Data Protection Act, 2019 gives you the right to be told how your data is used, to see it, to object to its use, to have it corrected or deleted, and to have a copy in a form you can take elsewhere. If you think we have mishandled your data, you can complain to Kenya’s Office of the Data Protection Commissioner, at odpc.go.ke. If you live elsewhere, the law where you live may give you similar rights and a regulator of your own, and we will honour those rights too.
Children
Dietect is for adults. You must be 18 or older to use it, and setup does not accept a younger age. We do not knowingly collect data from anyone under 18. If you think a child has given us data, write to [email protected] and we will delete it.
Changes
If this policy changes materially we will update the date at the top and, where the change affects how your data is used, tell you in the app.