Get App ↗

Privacy Policy

Effective Date: January 13, 2026 · Last updated: July 21, 2026

1. Introduction

Lauer j.d.o.o. ("we," "us") values your privacy. This Privacy Policy explains how we handle your data in the RealFoods app. We are the Data Controller for users in the EU/EEA/UK.

2. Data We Collect

We abide by the principle of data minimization; we only collect what is necessary.

2.1 Data You Provide

  • Age Confirmation: Before you can use the App, you must affirmatively confirm, on a single required screen presented early in onboarding, that you are 16 years or older and that you accept our Terms of Service and this Privacy Policy. You cannot proceed past this screen without confirming. We collect this confirmation before we create any record of you on our servers, including before the temporary anonymous identifier described in Section 2.3, and therefore before any account exists. Because it is collected once at the start, you are not asked to confirm your age again if you later create an account. Separately, you may be asked for your birth year during onboarding to personalize your results; this is stored only on your device and is never transmitted to our servers or any third party.
  • Personalization Data (stored only on your device): To tailor your results, you may enter details such as your height, current and goal weight, sex, waist measurement, and any metabolic or health consideration you choose to select (for example, a condition such as PCOS or diabetes). Like your birth year, this information is stored only on your device and is never transmitted to our servers or any third party; it is used solely on your device to personalize what you see. It is included only if you exercise your right to export your own data.
  • Health & Nutrition Data (Dietary Inputs): Photos of food, barcode scans, and chat messages you submit for AI analysis.
  • Account Data: Email address (only if you create an account).

2.2 Data Collected Automatically

  • Usage Data: Device type, OS version, and app crash logs (via Firebase Crashlytics, see Section 5). This runs automatically for all users to help us diagnose crashes and maintain app stability, and is not controlled by the Analytics toggle described below.
  • First-Party Product Analytics: We record onboarding steps, screen views, and in-app feature interactions (e.g., photo analysis attempts, paywall views) to our own secure backend (Supabase) to understand how the App is used and to improve it. This is separate from Mixpanel (Section 5), but it is controlled by the same optional Analytics toggle in Profile > Privacy, which governs both. If you are in the EU or EEA, that toggle is switched off unless you turn it on; elsewhere you can switch it off at any time.
  • Purchase Data: Transaction receipts and subscription status, collected via Apple for payment verification and fraud prevention.
  • Fraud Prevention: We use pseudonymous identifiers (Identifier for Vendor - IDFV and Keychain tokens) to prevent subscription abuse and verify entitlement. These are not anonymous: as explained in Section 9, they can be matched to you again if you sign up on the same device or with the same Apple or Google account. This is not used for advertising.

2.3 Anonymous Use and Account Linking

You can use certain features, including a free food analysis, without creating an account. During this period, your usage is associated with a temporary anonymous identifier rather than a real account. If you subsequently create an account, this usage data may be linked to your account to give you a continuous experience.

3. Legal Bases for Processing (GDPR)

If you are in the EU/EEA, we process data based on:

  • Consent (Articles 6 & 9): We process your photos and nutrition queries (Health Data) based on your explicit consent, given through the affirmative age-and-terms confirmation described in Section 2.1 and your act of submitting these inputs for analysis. You may withdraw this consent at any time by ceasing to use these features or requesting data deletion. Analytics processing, both Mixpanel and our first-party product analytics (Section 2.2), is based on separate consent, which you can opt in or out of at any time via Profile > Privacy.
  • Contract: To deliver the App's features (including Supabase cloud sync and authentication) and manage your subscription.
  • Legal Obligation (Article 6(1)(c)): To comply with financial, tax, and consumer protection laws (e.g., managing refunds and chargebacks).
  • Legitimate Interest (Article 6(1)(f)): To prevent fraud, ensure App security and stability (including automatic crash diagnostics via Firebase Crashlytics), and comply with Apple Store policies. This includes retaining pseudonymous identifiers (one-way SHA-256 hashes) to prevent account sharing and trial abuse.

4. How We Use Artificial Intelligence

We use third-party LLMs (Large Language Models) to analyze your inputs.

  • Google Gemini & OpenAI: When you scan food or chat, your text/image is sent to these providers.
  • Week's Reflection: To write this summary, we send that week's logged meals. If you track your weight, we also send a general description of its direction, for example "trending down gradually over the last 4 weeks". Your actual weight readings never leave your device, and neither do your height, sex, birth year, or waist measurement.
  • Privacy Controls: We send only the data needed to produce the result you asked for. We do not send your name, email, or user ID to these AI providers.
  • AI-Generated Images: Some food images shown in the app are created by AI image-generation tools rather than being photographs of your actual food.

5. Sharing and Disclosure

We DO NOT sell your personal data. We share data only with Service Providers who process data on our behalf:

  • Supabase: Backend hosting, database, cloud sync, and authentication. This runs for all users. The first-party product analytics described in Section 2.2 also runs on Supabase, but only when you have Analytics enabled in Profile > Privacy.
  • Mixpanel: Optional third-party behavioral analytics, controlled by the Analytics toggle in Profile > Privacy as described in Section 2.2. We rely on Mixpanel as a Service Provider and do not share data for cross-context advertising.
  • Google Gemini, OpenAI, and fal.ai: AI food recognition, chat, and image-generation features (see Section 4). fal.ai receives only a short text description of the food, never your photos, account information, or any other personal data.
  • Firebase Crashlytics (Google Ireland Limited): App crash diagnostics and stability monitoring. Collected data includes stack traces, device model, OS version, and a device-generated pseudonymous identifier not tied to your name, email, or account. Runs for all users regardless of the Analytics toggle, under Legitimate Interest; data is retained for 90 days and then automatically deleted by Google Ireland Limited.
  • Apple: Payment processing and subscription verification.
  • Apple iCloud (CloudKit): If you enable iCloud Sync, meal photos you choose to save are stored in your own private iCloud database via Apple's CloudKit framework. This applies to photos only; your food log, scores, and account data are stored in Supabase, not iCloud.

6. International Data Transfers (Chapter V)

Your data may be processed by companies located outside your country, including in the United States (e.g., Supabase, Mixpanel, OpenAI, Google, and fal.ai). We ensure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses (SCCs) or the processors' active adherence to the EU-US Data Privacy Framework (DPF), to protect your data during transfer.

7. Your Privacy Rights

7.1 Global/GDPR Rights

You have the right to access, correct, delete, restrict processing of, object to processing of, or export (port) your personal data. Your right to deletion (Right to Erasure) is subject to exceptions under Article 17(3), such as processing necessary for compliance with a legal obligation or for the establishment, exercise, or defense of legal claims (e.g., fraud prevention). You can delete your account directly inside the App settings. You also have the right to lodge a complaint with a supervisory authority; for users in Croatia, this is AZOP (Agencija za zaštitu osobnih podataka), and for users in the United Kingdom, the Information Commissioner's Office (ICO). If you are elsewhere in the EU or EEA, you may contact your national data protection authority.

7.2 US States (CCPA/CPRA)

  • Right to Know: You may request details on the specific data we collect.
  • Right to Delete: You may request deletion of your data.
  • Do Not Sell/Share: We do not sell your data or share it for cross-context behavioral advertising.

To exercise these rights, email: ppa.sdooflaer@ofni.

8. Children's Privacy

Strict 16+ Policy: RealFoods is not intended for children under 16. We do not knowingly collect data from children under 16. If we discover a user is under 16, we will immediately delete their data and block access.

9. Data Retention

  • Images/Chats: Processed momentarily for the AI response. We do not retain raw user images on our servers long-term unless necessary for debugging or unless you save them to your "Food Log."
  • Account Info: Your profile, consent records, and authentication data are deleted immediately upon your erasure request.
  • Crash Diagnostics: Crash data processed by Firebase Crashlytics, which carries a device-generated pseudonymous identifier rather than your name or account, is retained for 90 days, after which it is automatically deleted by Google Ireland Limited.
  • Fraud Prevention: For fraud prevention and Apple App Store compliance, we retain pseudonymous identifiers (one-way hashes of device and sign-in identifiers, and Apple transaction identifiers) after account deletion. Some usage-history and product-analytics records (Section 2.2) are likewise disconnected from your account rather than erased. We do not use these records to identify you; their only purpose is to recognize whether a device or subscription has already used a free trial or been through a deletion. Because of that purpose, if you later sign up again on the same device or with the same Apple or Google account, these records can be matched to your new account. This is processed under Legitimate Interest to prevent subscription abuse.

10. Security

We use industry-standard encryption (TLS/SSL) for data in transit and secure database practices. However, no mobile application is 100% secure.

11. Contact Us

Lauer j.d.o.o. (Lauer jednostavno društvo s ograničenom odgovornošću za računalne usluge) Zapoljska ulica 36, 10000 Zagreb, Croatia Email: ppa.sdooflaer@ofni

Registered in the court register of the Commercial Court in Zagreb (Trgovački sud u Zagrebu) Court register number (MBS): 081677018 · Company number (MB): 06178588 Personal identification number (OIB): 99386656303

We are the Data Controller for the purposes of the GDPR. For any privacy question or to exercise your rights, contact us at the email address above.