Lettuceburn Privacy Policy

Effective date: October 25, 2026

This Lettuceburn privacy policy explains what personal data the Lettuceburn website (lettuceburn.com) and the Lettuceburn mobile app for iPhone and Android collect, why, who else processes it, and how you can see or delete it. Lettuceburn operates the website and the app and is responsible for the personal data described here. "Lettuceburn", "we", "us" and "our" mean that operator. You can reach us about anything in this policy at lettuceburncal@gmail.com.

The short version

Your food log stays on your phone. Meals, meal photos, weight and nutrition data are stored on your device. You don’t need to sign up to use the app.
Free lane: if you use your own AI key, your meal photos go straight from your phone to the AI provider you chose. They never pass through our servers.
Pro lane: if you subscribe to Pro, your photos pass through our server on their way to the AI model, through OpenRouter. Our server stores no photos and no nutrition data. It keeps only a daily count of analyses and token totals for your account.
No ads, no selling. We don’t sell your data, show ads, or use advertising trackers on the website or in the app.
You can delete your data. In the app, Settings → Data → Delete all data removes your data from your phone and deletes your server account, if you have one.

The website

Contact form

When you send a message through the form on our contact page, we collect your name, your email address and your message. The form (Fluent Forms, on our WordPress site) stores the submission in the website’s database and may also record technical details such as your IP address and your browser’s user agent. A copy is sent to our inbox, lettuceburncal@gmail.com. We use it only to reply to you and handle your request.

Waitlist

When you join the waitlist, we collect your email address and, if you give it, your name, along with the same technical details as the contact form. It’s stored in the website’s database and sent to the same inbox. We use it only to email you about Lettuceburn’s launch, and nothing else. You can ask us to remove you at any time.

Server logs

Like most websites, our web server automatically records technical information about each request, such as your IP address, browser type, the page requested, the referring page and the time. We use these logs to keep the site running, secure and protected from abuse, and keep them only for as long as our hosting provider retains them for those purposes.

Cookies and analytics

We don’t use advertising or tracking cookies, and we don’t track you across other websites. The site may use privacy-friendly, cookieless analytics to count visits and popular pages in aggregate. These analytics don’t use cookies, don’t track you across sites, and don’t build a profile of you.

The app

Data stored on your phone

The app stores your food log, meal photos, your answers from the onboarding quiz (such as sex, birth year, height, weight, activity level, goal and diet preference), your plan, weight entries, water, exercise, fasting, favorites, recipes, custom foods, streaks and achievements on your device. Any keys you add (an AI key, a transcription key or a USDA key) are kept in your phone’s secure storage: the Keychain on iPhone and Keystore-backed storage on Android. We can’t see this data, and it isn’t sent to us.

If your phone backs up app data to Apple’s or Google’s cloud, that backup is handled by Apple or Google under their terms. Files you create with the app’s JSON backup or CSV export go wherever you choose to save or share them.

AI analysis: the free lane (your own key)

If you add your own API key from Anthropic or OpenRouter, the app sends what you ask it to analyze directly from your phone to that provider. That can include meal photos (up to three per meal), photos of nutrition labels, any text hint, typed meal descriptions, corrections you make with Fix Results (along with the previous result), and your diet preference if you set one (for example, vegetarian), so the AI can take it into account. If you use OpenRouter, it passes the request on to the AI model you picked.

With your own key, the weekly review also sends your provider a short summary of the week so it can write a few sentences explaining it. The summary can include days logged, average calories and net calories after exercise, your calorie and protein targets and any change the app made to your calorie target, protein and fiber, active minutes, water, your weight trend and number of weigh-ins, and your streak. Without a key, the app uses built-in text instead.

These requests never pass through Lettuceburn’s servers. Your own agreement with the provider governs how it handles them, such as Anthropic’s Commercial Terms or OpenRouter’s privacy policy and the terms of the model provider it routes to.

AI analysis: the Pro lane

If you use Lettuceburn Pro, the same kinds of content (photos, label photos, hints, descriptions, corrections with the previous result, and your diet preference, if you set one) go from your phone to our server, which runs on Supabase. The server sends them, using our own account, to an AI model through OpenRouter, and returns the result to your phone. OpenRouter and the AI model provider it routes to process this content under their own terms (OpenRouter’s privacy policy).

Our server does not store your photos, the analysis results, your notes, or any nutrition numbers. For each account it keeps only:

how many analyses you ran each day (by UTC day), and
the total number of AI tokens those analyses used.

We use these counts to apply the daily usage limit and to understand our AI costs. The weekly review’s written summary isn’t part of Pro; it only runs with your own key.

Your anonymous account ID

The app creates an anonymous account ID the first time you open the Pro offer, leave a Support the app tip, restore a purchase, or turn on the Friends League. If you never do any of these, no ID is created. The ID doesn’t include your name or email. Our authentication provider (Supabase) keeps basic records for it, such as when it was created and last signed in, and authentication logs that can include IP addresses. RevenueCat is first contacted at the same moment (see Subscriptions and tips below).

Our infrastructure provider may keep standard request logs (such as time, IP address and response status) for security and operations. When a request fails, our own logs record the error message only, not your content.

Voice logging

When you speak a meal or a command, the app uses your phone’s built-in speech recognition. It runs on the device where your phone supports that; otherwise your phone’s speech service, provided by Apple or Google, may process the audio under their terms. To improve recognition, the app also sends that speech service a list of food words, including your recent meal names and the names of your favorites.

If your phone has no built-in speech recognition and you’ve added your own Groq or OpenAI key, your recording, with the same list of food words, is sent directly from your phone to that service for transcription. The transcript comes back as text you can edit before anything is analyzed. Lettuceburn doesn’t receive your audio.

You never have to sign in. If you choose Sign in with Apple or Sign in with Google, our authentication provider (Supabase) stores your sign-in account identifier, the email address the provider shares, and any basic profile details the provider includes in the sign-in. With Google, that can include your name and a link to your profile picture. With Sign in with Apple, the email can be a private relay address. We use this only so that Pro and the Friends League follow you to a new phone.

Friends League (opt-in)

The Friends League is off unless you turn it on. When it’s on, our server stores:

your display name (up to 24 characters, "Friend" unless you change it) and your friend code,
your weekly XP, your league tier and how many days you logged this week,
who you’ve added as friends, and any kudos you give or receive.

It never stores calories, weight or macros. Only you and the friends you add by code can see your entry. There’s no public board or search. Removing a friend deletes the friendship and the kudos between you, for both of you. Turning the Friends League off stops syncing but keeps this server data so you can turn it back on, so friends you’ve added can still see your last synced entry. To remove it, use Delete all data.

Subscriptions and tips

Pro subscriptions and the optional Support the app tip are bought through Apple’s App Store or Google Play. Apple or Google processes your payment, and we never see your card details. We use RevenueCat to manage subscription status. RevenueCat receives your anonymous account ID, purchase and subscription details, and device information its software collects, under RevenueCat’s privacy policy. RevenueCat tells our server about subscription events, and our server stores your subscription status, product, expiry date and the time of the last update, so it knows whether Pro is active.

Food databases and exercise content

When you scan a barcode or search for a food, the app sends the barcode or search words to Open Food Facts. If you add a free USDA (api.data.gov) key, searches also go to USDA FoodData Central. These requests don’t include your name or account, but those services see your IP address like any website would. Exercise instructions and demo images load from a public content delivery network (jsDelivr) when you open them.

Health data

If you turn on Apple Health or Health Connect sync and grant permission, the app reads your weight, active energy and steps, and writes the nutrition from meals you log. This health data stays on your phone. We don’t send it to our servers, and we never use it for advertising. The one exception is under your control: if you use your own AI key, weights imported from Apple Health or Health Connect can be part of the weight trend in the weekly review summary that your phone sends to your chosen AI provider, as described above. You can turn sync off or change permissions in your phone’s settings at any time.

Notifications

Reminders are optional and off by default. If you turn them on, they’re scheduled on your phone. No push notification service is needed for them.

What the app doesn’t include

The app contains no advertising software and no third-party analytics or tracking software.

How we use personal data, and on what basis

We use personal data only to:

provide the website and the app, including Pro, the Friends League and optional sign-in,
reply to messages and email waitlist members about the launch,
apply usage limits and keep our services secure, and
meet legal obligations.

Where data-protection law such as the GDPR applies, we rely on: performing our agreement with you (for example, running Pro analyses or the Friends League you turned on), your consent (for example, the waitlist, optional sign-in and health permissions, which you can withdraw at any time), our legitimate interests in running and protecting our services (for example, server logs and usage limits), and legal obligations.

We don’t sell or rent personal data, and we don’t share it for advertising. We share it only with service providers that help us run Lettuceburn, and only as needed for the purposes above:

our website hosting provider (stores contact and waitlist submissions and server logs),
Google (the Gmail inbox that receives contact and waitlist messages),
Supabase (our server, database and authentication for Pro, sign-in and the Friends League),
OpenRouter and the AI model provider it routes to (Pro lane analyses only),
RevenueCat, Apple and Google (subscriptions and tips).

In the free lane, you choose your AI provider and send data to it directly. We may also disclose data if the law requires it, to protect people’s safety or our rights, or as part of a sale or reorganization of Lettuceburn, in which case this policy would continue to apply to your data.

International transfers

Our service providers may process data in the United States and other countries, and the AI model provider that handles a Pro analysis may be located outside the United States. These countries may have different data-protection rules from where you live. Where the law requires it, we rely on appropriate safeguards, such as standard contractual clauses, for these transfers.

How long we keep data

Contact messages: as long as needed to handle your request and any follow-up, then deleted.
Waitlist sign-ups: until we’ve sent the launch emails, or until you ask us to remove you, whichever comes first.
Server logs: only as long as our hosting and infrastructure providers keep them for security and operations.
Pro usage counts, subscription status, sign-in and Friends League data: while your server account exists. They’re deleted when you use Delete all data.
Data on your phone: until you delete it in the app or uninstall the app.

Deleting your data

In the app: go to Settings → Data → Delete all data. The app first deletes your server account, which removes your Friends League profile, friendships, scores, kudos, Pro usage counts and subscription status. If you used Sign in with Apple, it also asks Apple to revoke the app’s access to your Apple ID. Then it removes the meals Lettuceburn wrote to Apple Health or Health Connect, erases your data on the phone, and removes any Anthropic or OpenRouter key. If our server can’t be reached, nothing is deleted, not even on your phone, so you can try again.

A transcription key or USDA key you added stays in your phone’s secure storage until you remove it in Settings or uninstall the app.

Delete all data doesn’t cancel a Pro subscription, and it doesn’t remove purchase records held by Apple, Google or RevenueCat. Cancel a subscription in your App Store or Google Play settings. If you’d like your RevenueCat customer record deleted too, email us and we’ll ask RevenueCat to delete it.

For website data such as a contact message or waitlist sign-up, email us at lettuceburncal@gmail.com.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict how we use it, and to withdraw consent at any time. To make a request, email lettuceburncal@gmail.com. We’ll respond within 30 days. We may need to confirm it’s really you before acting.

Server accounts are anonymous, so if you email us about app data, include your Friends League friend code or the email you signed in with, so we can find your account. The quickest route is usually Settings → Data → Delete all data. Data stored only on your phone is under your control, and you can export it or delete it in the app at any time. We can’t access it, so we can’t retrieve or delete it for you.

If you’re a California resident: we don’t sell or share personal information as those terms are defined in the California Consumer Privacy Act, and we don’t use it for cross-context behavioral advertising.

You also have the right to complain to the data-protection authority where you live.

Children

Lettuceburn isn’t directed at children under 13, and we don’t knowingly collect personal data from them. If you’re under the age of digital consent or the age of majority where you live, which may be 16 or 18 depending on local law, please use Lettuceburn only with a parent’s or guardian’s permission. If we learn that we’ve collected personal data from a child under 13, we’ll delete it. If you think that has happened, email us.

Security

We protect data in transit with encryption (HTTPS), keep keys in your phone’s secure storage, and limit what our servers store in the first place. Access to server data is restricted by database security rules. No system is perfectly secure, but collecting less is one of the best protections we have.

Changes to this policy

If we change this policy, we’ll post the new version on this page with a new effective date. If a change is significant, we’ll also tell you in the app or on the website before it takes effect.

Contact

For privacy questions or requests, email lettuceburncal@gmail.com or use our contact page.