Privacy policy

What data we process

To make Noots work, we process:

• Account data — your email address and sign-in credentials, so your notebook is private and available across your devices.
• Your notebook — what you write about what you eat, photos of meals you take, scanned barcodes, your weight, and the calories and macros Noots estimates from them.
• Estimation requests — after you give permission in the app, the text or selected photo in your request is sent through our server to Google Gemini to produce an estimate (see “Who we share data with”).
• Device and usage data — technical data such as app version, language, time zone (for reminders) and a notification token.
• Access data — your subscription or purchase status and the start and end time of your free day. To offer the free day once per device and account, we also process an app-specific hash of your device identity. Payment itself goes through Apple; we never receive full payment details.

Why, and on what legal basis

We process your data on the following GDPR legal bases:

• Performance of the contract — to provide the app: storing and syncing your notebook and producing the estimates.
• Consent — for optional push reminders. You can turn these off at any time.
• Legitimate interest — to secure the app, prevent abuse and improve Noots.
• Legal obligation — for example, records relating to payments.

Health-related data

Data about what you eat and your weight may be considered health-related. We use it solely to provide the service to you, and never share it for advertising or with data brokers.

Who we share data with

Noots never sells your data and uses no advertising networks. We do rely on a number of processors that are needed to run the app:

• Supabase — hosting, database, authentication and syncing of your notebook.
• Google (Gemini) — to turn your text or photo into a calorie estimate, grounded in public web sources. The content of your estimation request is processed for this. The app asks for explicit permission before this sharing. You can change your choice in settings; without permission, the app does not send AI requests.
• Google Firebase — to send push reminders, if you enable them.
• Open Food Facts — when you scan a barcode, the code is looked up in this public food database. No personal data is sent with it.
• Apple App Store and RevenueCat — to process and manage your purchase or subscription. Noots uses an opaque account ID with RevenueCat and does not set a name or email address as a customer attribute there.

Transfers outside the EU

Some of the services above may process data outside the European Economic Area. Where that happens, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

How long we keep data

We keep your data for as long as you have an account. If you delete your account, we delete your notebook and account data within a reasonable period, except where we are legally required to keep something longer. Backups may temporarily still contain data.

Account deletion does not automatically erase purchase and transaction history held by Apple and RevenueCat, which may remain linked to the opaque account ID. Deleting your account does not cancel an Apple subscription. You manage or cancel it separately through your Apple subscriptions; the app provides a link.

The free-day usage record remains after account deletion to prevent repeated use on the same device. Its link to the deleted account is removed.

Security

We take appropriate technical and organisational measures to protect your data, such as encryption in transit and access controls. No service can guarantee one hundred percent security, but we do our best to protect your data.

Your rights

Under the GDPR you have the right to:

• access your data;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to processing;
• receive your data in a portable format;
• withdraw consent you have given.

Exercising your rights

You can view and delete your notebook and account yourself in the Noots app settings. For other requests, reach us through the support option in the app or on the Noots App Store page. If you disagree with how we handle your data, you can lodge a complaint with your local data protection authority (in the Netherlands, the Autoriteit Persoonsgegevens).

Children

Noots is not intended for children under 16. We do not knowingly collect data from children under that age.

Changes

We may update this privacy policy from time to time. The date at the top shows the latest change. We will let you know of significant changes in the app.

Contact

Questions about your privacy or this policy? Reach us through the support option in the Noots app or on the Noots App Store page.