Privacy policy

Last updated 15 October 2026.

Snapkin is a calorie tracker. You photograph a meal and it works out what was on the plate. Doing that means handling food photographs, your weight and your body details, which is about as personal as ordinary software data gets. This page says exactly what is stored, who else sees it, and how to make it stop.

Who is responsible

The controller for everything below is Robot Studios IT Consultancy BV, Hemelshoek 277, 2590 Berlaar, Belgium, enterprise number 0732.991.584. Questions, requests and complaints: hello@getsnapkin.app.

There is no data protection officer, because the law does not require one at this size.

What is stored, and why

What	Why
Your name, email address, password, language and time zone	To have an account at all, and to show your day in the right language and the right day boundary. The password is stored hashed and cannot be read back.
Sex, year of birth, height, activity level, whether you do strength training, goal, diet and any dietary note you write	To compute your calorie and protein targets. The dietary note is free text and is sent to the analyser along with the photo, so anything you type there goes with it.
Your weight, over time	The trend is the point of the app. Entered by hand, or read from Apple Health or Health Connect if you switch that on. A weight you type always wins over an imported one.
Every meal: photographs and the camera settings stored in them (lens, exposure, light, the time, and the country the photo was taken in, never the exact location; for a photo with no location in it, the country your phone's time zone is in), the ingredients found, grams, calories and macros, the assumptions behind each, questions asked and your answers, and any chat about the meal	This is the food diary. It is what the app is for.
On an iPhone, what the camera measured around a meal photo: the table it found, the phone's height and angle above it and the distance to it. On an iPhone with LiDAR also the depth map, the full-size original photo, and measurements made from them (picture size, height, footprint and volume)	To help the analyser judge portion sizes, and to make those measurements better. Only the measurements go to the analyser. The depth map and the original are kept with the meal, and are deleted with it.
Things it has learned about how you eat, stored as short sentences	So it stops asking the same question. Every one of these is visible in the app under Memory, where you can correct any of them or tell it to forget one. A forgotten sentence is no longer used, and is deleted with your account.
Coach messages	Only generated when you ask for one.
Devices you have signed in on: a hashed sign-in token, a label, the platform, which version of the app it runs, when it was last used, and a push notification token if the app registered one	To keep you signed in, to let you sign a lost device out, to tell the phone an estimate is ready, and to know which phones run an old version of the app.
If you sign in with Apple or Google: the identifier that provider gives us for you and the email address it shares. For Apple, also the token Apple needs to revoke the sign-in when you delete your account	To recognise you next time without a password.
If you switch on Apple Health or Health Connect: the weight readings, and your height if you let it fill that in during setup. If you also switch on measured movement: one active-energy figure per day, and the date you agreed to it	There is no account to link and no token to hold. Your phone reads your health store and sends us only what is listed here; permission lives in the phone's own settings, not here. Your height is read once, during setup, because it does not change. The daily active-energy figure is only sent while measured movement is switched on, and switching it off deletes every day already stored.
Short-lived codes we email you to confirm an address or reset a password	Stored hashed, and expire within an hour.
If somebody gave you Snapkin rather than you paying for it: the email address and first name they invited you under, and the hashed link we sent	So the invitation can be accepted once and not twice. It stops working after 30 days, and once you have an account it is deleted along with the account.
Subscription status, the store it came from, and the receipt identifiers the store returns. For each payment: what it cost, when, and the store's order number	To know whether the app is paid for, and to show you what you paid. Card details are never sent to us and we could not see them.
A record of each analyser call: how much computing it used, what it cost, and the analyser's answer	Cost control, abuse limits and debugging a bad estimate. The answer is wiped when you delete your account.
Your IP address, in the web server's access log and in the check that limits sign-in attempts	To keep somebody from guessing passwords, and to diagnose a fault.
Error reports: when something goes wrong, and for one request in a hundred, what was asked for, how long it took, your IP address and your account number	To find and fix faults. Never your name, your email address, your meals or your photographs.
A note that a meal or weight was deleted, kept for 30 days	So a phone that was offline learns the deletion when it comes back, instead of showing a meal that no longer exists. It carries the item's id and nothing about the meal.

Photographs are stored privately. They are not on a public URL and not in a public bucket. Where the app shows one back to you it does so through a short-lived signed link. Photographs are re-encoded on your phone before they are uploaded.

A photo's camera settings are sent with it, to read the photo better. A camera saves details in every photo file. We keep them, because these help work out what is on the plate and how much of it there is:

• The lens and the angle of the phone. With these we can work out how big the plate and the food really are, instead of guessing from the picture.
• The exposure and the colour of the light. These show whether the food looks darker or warmer than it is, for example under restaurant lighting.
• The time. This tells breakfast from dinner when you add a photo later.
• The country. What a normal portion looks like, and which dishes are common, differ from country to country. When the photo has a location in it, your phone works out the country itself and sends only that. When it has none, we take the country of the time zone your phone is set to.

The exact location never leaves your phone. Neither does anything in the file that names you or your phone, such as a serial number or an owner name.

The legal bases

Your account, your subscription and the actual analysis of your meals are processed because we have a contract with you and cannot deliver the app without them (Article 6(1)(b) GDPR). Your name, email address and body details are therefore required: without them there is no account and no target to compute.

Your weight, your body details and what you eat are health data under Article 9 GDPR. That category cannot be processed on the basis of a contract, so it is processed on your explicit consent under Article 9(2)(a), which the app asks for in its own words, separately, before your body details are saved. Some diet choices, such as halal or no pork, can say something about your religion. They are optional, used only to describe your food correctly, and covered by the same explicit consent. You can withdraw that consent at any time. Because the app cannot work without those details, withdrawing is the same action as deleting your account. Withdrawing does not make the processing before it unlawful.

Switching on Apple Health or Health Connect is your choice and your consent; switching it off, or withdrawing the permission in your phone's own settings, withdraws that consent (Article 6(1)(a)).

Server logs, the sign-in attempt check and the analyser cost record are kept on our legitimate interest in keeping the service secure and paid for (Article 6(1)(f)). Nothing in that set is used to profile you.

Snapkin makes no decision about you that has a legal or similarly significant effect. The estimates are automated, and every one of them can be corrected by you.

Who else sees it

OpenRouter, Google and OpenAI, the analyser

Every estimate, question, meal chat, coach answer and learned sentence is written by an AI model. What goes to it depends on the feature:

• Analysing a meal: the photograph, any depth measurements taken with it, your diet and dietary note, and the short sentences the app has learned about how you eat.
• Chatting about a meal: the photograph, your diet and dietary note, the meal as it stands, the questions it asked, your answers and your messages.
• The coach: your calorie and protein targets, what you have eaten today, your latest weight, your diet and dietary note, and the conversation.
• Learning how you eat: once a night, the previous day's meals as text, and what it already knows about you. No photographs.

Your name, email address, account number, age and height are never sent to it. Three companies handle these requests:

• OpenRouter passes each request to the right model and passes the answer back. It does not store your prompts or the answers. It keeps only figures about each request, such as its size and how long it took.
• Google runs the model that does the first three of those jobs, on its paid service. It does not use what it receives to improve its products. It keeps it for a limited time, only to detect abuse.
• OpenAI runs the model that learns how you eat. It does not use what it receives to train its models. It keeps it for up to 30 days, only to detect abuse.

Every request tells OpenRouter to send it only to a company that does not store it beyond that or train on it. OpenRouter is our processor under its data processing agreement, and Google and OpenAI work for it as sub-processors. All three are in the United States, see below.

OpenAI and TypeSafe, grouping your meals into dishes

So that two photographs of the same breakfast count as the same dish, the name of each meal and its ingredients are sent as text to two services. OpenAI turns the text into numbers that can be compared. It does not use it to train its models, and keeps it for up to 30 days, only to detect abuse. TypeSafe compares a new meal with up to three earlier descriptions of the same dish of yours, and says whether they are the same. It does not train on it. Neither receives a photograph, your account number, or anything else about you. Both are in the United States.

Apple Health and Health Connect, only if you switch them on

These are not third parties we send anything to. They are stores on your own phone, and the traffic goes one way: we read, and we never write. Your phone reads your weight, and your height once during setup, and sends them here, the same as if you had typed them. Your steps stay on the phone, always. They are drawn under your day, never sent to us, never stored on our server, and never included in anything sent to the analyser. During setup, averages from the previous 14 completed days can suggest an activity level; only the level you confirm is saved to your account. Your active energy stays on the phone too, unless you switch on measured movement under Settings › Active calories. That setting is off until you turn it on. While it is on, we keep one number per day: what your watch reported the last time you opened the app, so your history can show the target you were actually eating against. It is stored with your account, and the coach is told that day’s target, which includes it. Switching the setting off stops new readings and deletes today’s. The days before it stay, so your history keeps the target you ate against on each of them. They are deleted with your account, or sooner if you ask us. Switching the health connection off stops the reading; there is no token to discard because there was never one to hold.

Apple and Google: payments, sign-in and push notifications

If you subscribe, the store handles the payment and tells us whether the subscription is live, until when, and what each payment cost. We keep the store's own messages about it for a year, to settle a question about a payment. If you sign in with Apple or Google, we receive a verified identifier and your email address. For the purchase itself Apple and Google are the seller and act as their own controllers, not ours. When the app tells your phone an estimate is ready, that message travels through Apple's or Google's push service. It carries the meal's id, its status, the day it belongs to and your account number, plus that day's totals and targets for calories, protein, carbs, fat and added sugar, so the widgets on your phone can update without the app being open. It never carries the meal itself: no photo, no name, no ingredients. On Android that service comes from Google's Firebase, which gives the phone an installation identifier to deliver the message to. It is used for that and nothing else: there is no Firebase analytics in the app.

Cloudflare

This website and the app's connection to it pass through Cloudflare, which protects the server and caches the public pages. Cloudflare sees the IP address and the traffic of every request, as anything sitting between you and the server must, and acts as our processor. Cloudflare also sends the few emails the app sends, so it sees your address and the message. It draws the picture for a meal you choose to share. And it stores our backups, which are encrypted on our server before they leave it, so Cloudflare cannot read them.

Hosting

The server that runs the app and holds your data is in Amsterdam, in the European Union, with DigitalOcean.

Laravel Nightwatch, error reports

The error reports described above go to Laravel Nightwatch, which shows us what broke. It gets your account number and IP address with a report, and never your name, email address, meals or photographs. The reports are stored in the European Union, in Frankfurt.

Slack, our own team chat

When somebody subscribes, or accepts an invitation, a message with their name, email address and plan goes to our own Slack, so that we notice. Slack is our processor.

Apart from Apple and Google selling you the subscription, every company in this list works for us, on our instructions, and may not use what it receives for anything else. None of them is an advertiser or a data broker.

Snapkin does not track you. Nothing here shows you an advertisement, and there is no tracking pixel, no advertising network and no data broker. The app does not read your phone's advertising identifier, and nothing about you is ever sent to an advertising platform. Your food diary is not sold, shared for advertising, or used to train anybody's model. We do buy advertising elsewhere, and we measure how well it worked ourselves; "Measuring our own advertising" below says exactly how.

Data leaving the EU

Your data is stored in the EU. The analyser runs in the United States, so your meal photographs and the context listed above are transferred there for the time it takes to answer. That transfer is covered by the European Commission's Standard Contractual Clauses in OpenRouter's data processing agreement. The meal text sent to OpenAI and TypeSafe and the messages in Slack are in the United States too. Cloudflare, Apple and Google are US companies and rely on the Standard Contractual Clauses or the EU-US Data Privacy Framework for what passes through them. You can ask us for a copy of the clauses at hello@getsnapkin.app and we will send it.

How long it is kept

• Meals and weights: until you delete them, or until you delete your account.
• Photographs: until you delete them, or until you delete your account. When your subscription, your free access or your free days end, the photographs are deleted 14 days later. Your meals and their numbers stay.
• A meal you delete: it leaves your diary straight away. We keep it, with its photographs and its chat, for 14 more days, to study which meals people log and then take back. That is how the estimates get better. After 14 days it is erased for good. If you delete your account, these meals are erased at once with everything else.
• Your account: until you delete it. Deletion is immediate, and the data is removed rather than hidden. The subscription record goes with it; the store keeps its own record of what you paid it.
• What survives deletion: a record of how much computing each analyser call used and what it cost, with nothing left that points at you; the stores' own messages about a payment, for a year; and the backups, error reports and logs below, until they expire.
• A data export you asked for: the zip is deleted from the server after seven days, whether or not you downloaded it.
• Device sessions and push tokens: dropped when you sign out or remove the device.
• Backups: the database and the photographs are backed up every night, encrypted. A backup is kept for up to three years, so a deleted account or photograph can remain in one that long.
• Error reports: deleted by Nightwatch after 14 days.
• Server access logs: deleted within 90 days.

Your rights

You can ask for a copy of your data, correct it, delete it, restrict or object to how it is used, or receive it in a portable form. Two of those need nobody's permission and happen immediately, from Menu → Profile in the app: Email me my data sends you a link to a zip holding every meal, photograph and number this app holds about you, and Delete your account removes all of it (how to delete your account). For anything else, email hello@getsnapkin.app and you will get an answer within a month.

If you think this is being handled badly you can complain to the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be. You may also complain to the authority in the EU country you live in.

Email

The app emails you to confirm an address, reset a password and deliver a data export. There are no other emails and no newsletter. Meal reminders are push notifications, which you can switch off in Settings.

Measuring our own advertising

We buy advertising, and we would rather buy less of it badly. When you arrive here from one of our advertisements, the link carries parameters naming the campaign, and our own server writes down that a visit happened: the campaign, the page you landed on, the country Cloudflare resolved from your connection, and the click identifier the advertising platform put on the link. If you then tap App Store or Google Play, we write that down too. So that a tap still counts after you open another page first, the links on that page carry a random string pointing at the visit. It lives in the address you are reading, not on your device.

There is no identifier for you in any of it. A row says that somebody came from a campaign and what they did next. It does not say who, it is not joined to your account except in the one case below, and none of it is sent to the advertising platform or to anybody else. That much happens whether or not you answer the cookie question, on the basis of our legitimate interest in knowing which advertising is worth paying for (Article 6(1)(f)). The click identifier is deleted after 90 days and the row itself after 24 months.

One exception, and it is deliberate: tapping the Google Play button carries the campaign name to Google Play, because Play is the only thing that can tell us whether a tap became an install. With it goes a random string that points at the visit row above, and means nothing to anybody without our database. It does not carry the advertising platform's click identifier or anything about you.

If you then install the Android app, the app reads that string back from Google Play once, after you sign in, and sends it to us. We note on your account which campaign it came from, so we can tell whether an advertisement brought people who stayed. That note stays on our server, never carries the advertising platform's click identifier, and is never sent to the advertising platform. The iPhone app does not do this.

You can object to this at any time under Article 21. Email hello@getsnapkin.app and it stops.

Counting the setup screens

Before you have an account, the app asks a few questions, one screen at a time. The first time you see each of those screens, the sign-up screens after them, and the email confirmation, the subscription screen and a started subscription before your first day in the app, the app tells our server the name of the screen and whether it is the iPhone app, the Android app or the web app. The Android app also sends where Google Play says it was installed from, such as an advert or the Play Store itself, and our server only keeps which of six groups that falls in: Meta, Google or Reddit adverts, another link, no campaign, or unknown. Nothing else is sent. Our server only adds one to a count for that screen, group and day. It keeps no row for you, no account, no device and no identifier, so it cannot say who reached which screen, and it is never sent to anybody. Like every request to our server, a report can still appear in the web server's access log and, if something goes wrong with it, in an error report, as described at the top of this page. We use the counts to see which screen people give up on, on the basis of our legitimate interest in making setup work (Article 6(1)(f)).

Cookies

If you reached this site from one of our own advertisements, you will have been asked about one cookie, and it is the only one the pages you read here ever set. Everybody who arrives any other way is asked nothing and given nothing: no cookie, no banner, no script. There are no analytics, advertising or third-party cookies anywhere, and there never have been.

Accepting stores two things: a random string that points at the click you arrived on, for thirty days, and the fact that you accepted, for six months. Declining stores only the fact that you declined, for the same six months, so you are not asked again. Neither carries your name, your email address or anything else about you, and the random string stops meaning anything once the row it points at is deleted.

The cookie buys one thing: if you come back a week later and install the app then, we can tell it was the same visit rather than a new one out of nowhere. Declining costs you nothing and breaks nothing.

Signing in on the web, and sending a form such as the waiting list, sets a session cookie. It holds a random id and nothing else, it expires two hours after your last visit, and without it the sign-in or the form cannot work, so it is not asked about.

The app keeps your sign-in token, your language and a small offline copy of your day on your own device, and nowhere else.

Fonts are served from this domain rather than from Google, so loading a page here involves no third party other than Cloudflare, described above. One page is the exception: the list of sites that feature Snapkin shows two of their badges from their own servers, because they only list us if we do.

Children

Snapkin is not for children and you must be at least 16 to have an account. Do not create an account for a child, and do not use it to set a calorie target for one.

Changes

When this policy changes, we update this page and the date at the top. We do not email you about it, so check this page when you want to know what applies. The date at the top is the date of the last change.