Nectasia is a food and weight diary, so almost everything it holds about you is personal and some of it concerns your health. This policy says plainly what we collect, why we collect it, who else sees it, and what you can tell us to do with it.
We do not sell your data. We do not show you advertising. We do not track you across other companies’ apps or websites.
Contents
- 1. Who is responsible for your data
- 2. What we collect
- 3. Why we use it, and on what legal basis
- 4. What happens when you photograph a meal
- 5. Apple Health
- 6. Who else sees your data
- 7. Where your data goes
- 8. How long we keep it
- 9. What you can ask us to do
- 10. How we protect it
- 11. Children
- 12. Changes, and how to reach us
1. Who is responsible for your data
Nectasia is built and run by Benoit ECCLI, an individual developer in Hong Kong SAR. Under European data protection law, that person is the controller of your data. For anything in this policy, write to privacy@nectasia.com and it will reach him directly.
2. What we collect
Your account: your email address, and a password stored only as an irreversible hash. If you use Sign in with Apple or Google instead, we receive an identifier and the email address you chose to share — with Apple, that may be a private relay address, and that is fine.
About your body and your goal: your date of birth, sex, height, the weights you record over time, the weight you are aiming for, the pace you chose, how active your ordinary day is, what you want from your muscle, and any dietary preferences you set. This is health data, and we treat it as such.
What you log: the food and drink you record, portions, meal times, and any photograph you take of a meal. If you describe a meal by voice, your phone converts the speech to text and we receive the text.
From Apple Health, only if you connect it: steps, workouts, energy burned, body weight and sleep. You choose which of these to share and you can withdraw any of them at any time in the Health app.
How the app is used: which screens you open, what you tap, how long steps take, and errors and crashes, together with your device model, operating system version, app version and language. We process this in Nectasia’s own backend and review it in our internal admin tools to find what is broken and what is confusing. We do not send these usage analytics to third-party analytics services.
Your subscription status, which Apple tells us so the app knows what to unlock. We never see your card details — Apple handles payment and does not pass them to us. And, if you turn on notifications, a device token so we can send them.
3. Why we use it, and on what legal basis
- To run the app you asked for — keeping your diary, working out your targets, showing your trend, managing your account and subscription. Legal basis: performance of our contract with you.
- To handle information about your health, including your weight, body data and anything you bring in from your phone’s health store. Legal basis: your explicit consent, which you give when you enter this information and which you can withdraw at any time by deleting the data or your account.
- To keep the service working, secure and free of abuse, and to understand which parts of it need fixing. Legal basis: our legitimate interest in running a service that works.
- To send you notifications and emails you asked for. Legal basis: your consent, withdrawn whenever you turn them off.
- To keep records the law requires us to keep, such as records of purchases. Legal basis: our legal obligations.
4. What happens when you photograph a meal
To turn a photograph or a written description into a nutrition estimate, we use Google’s Gemini service and OpenRouter. Some requests go directly to Google; others go through OpenRouter to the model provider handling the request. We send the meal photograph or description, portion hints and relevant meal context. We do not attach your Nectasia account name or email address to these requests.
Direct requests to Google’s Gemini service use its paid API terms. Google does not use the prompts or responses from these requests to improve its products, but may retain them for a limited period for safety and abuse prevention. The terms are available at ai.google.dev/gemini-api/terms.
OpenRouter routes the request to a model provider and does not itself use inputs or outputs for model training. The model provider’s retention and training practices depend on its terms and the applicable settings and agreements; some providers may use submitted content to improve their models. More information is available at openrouter.ai/privacy.
Meal photographs you keep are stored in our object storage so the app can show them back to you. Delete an entry and its photograph goes with it.
5. Apple Health
Connecting Apple Health is entirely optional and Nectasia works without it. We read only the categories you tick, and only to credit the energy you burned and to save you entering a weight twice.
We never use Health data for advertising or anything resembling it, we never sell it, and we never share it with anyone for their own purposes. It is not sent to our AI provider. You can withdraw access at any time in the Health app under Sharing, and delete what we already hold by deleting your account.
6. Who else sees your data
We use the following services to run Nectasia. The AI services’ handling of meal content is described in section 4:
- Google — analysing the meal photographs and descriptions you submit, and signing you in if you choose Google.
- OpenRouter and the model providers it routes requests to — analysing meal photographs, descriptions and meal context for nutrition estimates.
- Apple — payments and subscriptions, Sign in with Apple, and delivering push notifications.
- Hetzner — hosting our API, database and meal-photograph storage in Finland.
Beyond that we share your data only where the law requires it, or where it is needed to establish or defend a legal claim. If Nectasia is ever sold or transferred, your data would go with it, and you would be told first.
7. Where your data goes
Our API, database and meal-photograph storage are hosted by Hetzner in Finland. Nectasia is operated from Hong Kong SAR, where the developer may access data to maintain the service and respond to support requests. Meal analysis also sends content to Google or through OpenRouter, whose services may process it in other countries. For information about international transfers of your data and the safeguards that apply, contact privacy@nectasia.com.
8. How long we keep it
We keep your data for as long as your account exists. A diary is only useful with a history behind it, so we do not quietly expire it.
When you delete your account, we delete your data from our live systems within 30 days, and it disappears from our backups within 90 days as those backups age out. We keep only what the law requires us to keep — records of purchases, for instance — and information that has been stripped of anything identifying you.
9. What you can ask us to do
You can ask us for a copy of what we hold about you, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable form, and to withdraw a consent you have given. Deleting your account, which you can do in the app, does most of this immediately.
Write to privacy@nectasia.com and we will answer within one month. We will not charge you, and we will not treat you differently for asking.
If you think we have handled your data badly, please tell us first — but you can complain to a regulator whatever we say. In the European Union that is the data protection authority where you live, such as the CNIL in France; in Hong Kong SAR it is the Office of the Privacy Commissioner for Personal Data, and you also have the right to ask us for access to and correction of your data under the Personal Data (Privacy) Ordinance.
10. How we protect it
Traffic between the app and our servers is encrypted. Passwords are stored as irreversible hashes, never as text. Access to the production database is limited to the developer who maintains it.
No service is perfectly secure, and we will not pretend otherwise. If a breach ever puts your data at real risk, we will tell you and the relevant regulator as the law requires.
11. Children
Nectasia is for adults. We do not knowingly collect anything from anyone under 18, and if we discover that we have, we delete it and close the account. If you believe a child has given us their information, write to privacy@nectasia.com.
12. Changes, and how to reach us
When what we do with your data changes, this policy changes with it, and the date at the top moves. If the change is significant we will tell you in the app or by email rather than leaving you to notice.
Questions, requests and complaints all go to privacy@nectasia.com. This document was written in English; any translation is for your convenience, and where the two differ the English version applies.