Privacy Policy

This policy explains what Verda (“we”, “us”) collects when you use the Verda nutrition app, why we collect it, and what choices you have.

Verda Nutrition is a food and body tracking app. By its nature it handles information about your body and what you eat, which is sensitive. We have tried to write this plainly rather than defensively.

1. Information we collect

Account information

When you create an account we collect your email address and name. You can register with an email and password, or with Sign in with Apple. If you use Sign in with Apple and choose to hide your email, we only ever receive Apple’s private relay address, not your real one. Authentication is handled by Google Firebase Authentication; we do not store your password.

Profile and body information

To calculate your calorie and macronutrient targets, and to analyse body photos, we collect:

• Date of birth (used to derive your age)
• Sex
• Height
• Weight, and your goal weight
• Body fat percentage and muscle mass — either entered by you or estimated by AI from a photo
• Your calorie, protein, carbohydrate and fat goals

Food and nutrition information

For each meal you log we store the food name and description, the date, and the estimated calories, protein, carbohydrates, fat, fibre, sugar, sodium, potassium and vitamin C, along with a per-ingredient breakdown.

Photographs

Verda uses your camera and photo library, with your permission, for three purposes:

• Meal photos — the plate you scan to get a nutrition estimate.
• Body and progress photos — used to estimate body composition and to generate a visualisation of your goal body. These are typically minimally-clothed images of you.
• Profile picture — optional.

These photos are stored on your device and uploaded to our cloud storage. See sections 2 and 3.

Subscription information

Verda Pro is sold through Apple. Your purchase is processed entirely by Apple and we receive only a signed confirmation from your device that an active subscription exists. We never receive your payment details, and no purchase information is stored on our servers.

Technical information

When your device asks our server to analyse a photo, our server records a log entry containing your account identifier, which feature was used, which AI model ran, and how long it took. We use these logs to operate and debug the service.

2. What we deliberately do not do

We think the absences matter as much as the collection. Verda contains:

• No analytics SDK — no Firebase Analytics, Mixpanel, Amplitude, Segment or similar.
• No advertising and no ad identifiers — we do not access the IDFA and never show you the App Tracking Transparency prompt, because we do not track you.
• No crash or performance reporting SDK.
• No Apple Health integration — Verda does not read from or write to HealthKit.
• No sale of personal information, and no sharing for cross-context behavioural advertising.

3. Artificial intelligence and your photos

This is the most important section of this policy, so please read it.

Verda’s nutrition and body estimates are produced by the Verda AI Engine. When you scan a meal or a body photo, the image is uploaded from your device to our server, which forwards it to the Verda AI Engine for analysis and returns the result to you.

Photos are downscaled and recompressed on your device before upload. Your name and email address are not sent to the Verda AI Engine.

Every photo you submit is also archived in our cloud storage under your account identifier, including AI-generated goal-body images. Google acts as our processor for this analysis and is contractually restricted in what it may do with the content.

4. Where your information is stored

Verda uses Google Cloud infrastructure across two projects:

• Firebase (verda-nutrition-6603e) — your account, your profile, your meal and body-composition records, and your profile picture.
• Google Cloud Storage (verda-nutrition) — your meal photos, body photos, and AI-generated goal-body images, each filed under your account identifier.

Our processing servers run in Google’s us-central1 region in the United States. If you use Verda from outside the United States, your information is transferred to and processed in the United States. Where required, we rely on the European Commission’s Standard Contractual Clauses for these transfers.

A copy of your meals, body records and photos is also kept on your device so the app works offline. Signing out erases that local copy. Aggregate daily totals — calories, macros and your goals, with no photos or identifying details — are shared with the Verda widgets and Apple Watch app on your own devices.

5. Legal bases for processing (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we process your information on these bases:

• Performance of a contract — to provide the tracking, analysis and sync features you signed up for.
• Explicit consent — for health and body data, including body photographs, which are special category data under Article 9 GDPR. You may withdraw consent at any time by asking us to delete your account.
• Legitimate interests — to keep the service running, secure and debuggable.

6. How long we keep it

We keep your account, meals, body records and photographs for as long as your account exists.

We do not currently apply an automatic retention limit to uploaded photographs. They remain in our storage until your account is deleted. If this concerns you, you can ask us to delete specific photos at any time using the contact address below.

7. Your rights and choices

Whoever and wherever you are, you can ask us to:

• Access a copy of the information we hold about you.
• Correct anything inaccurate — most profile fields you can edit yourself in the app.
• Delete your account and everything associated with it.
• Export your data in a portable format.
• Object to or restrict processing.

Deleting your account

To delete your Verda account and all associated data — your profile, meals, body records, and every photo you have uploaded — email [PRIVACY EMAIL] from the address on your account. We will action it within 30 days and confirm when it is done.

Signing out of the app erases Verda’s data from your device, but does not delete your account from our servers.

If you are in California

You have the rights above under the CCPA/CPRA, plus the right not to be discriminated against for exercising them. We do not sell or share your personal information, and we have not done so in the preceding twelve months.

If you are in the EEA or UK

You may lodge a complaint with your local supervisory authority. We would appreciate the chance to resolve it first.

8. Security

Your data is transmitted over encrypted connections (HTTPS/TLS) and stored on Google Cloud infrastructure, encrypted at rest. Requests to our analysis servers must carry a valid authentication token tied to your account, and your stored files are namespaced to your account identifier.

Data held on your device is protected by your device’s own passcode and encryption. The optional profile PIN in the app is a convenience lock, not a security boundary — it does not encrypt anything, and you should not treat it as protecting your data from someone who has your unlocked phone.

No system is perfectly secure, and we cannot guarantee absolute security.

9. Children

Verda is not intended for children under 13, and we do not knowingly collect information from them. If you believe a child has given us information, contact us and we will delete it. Some jurisdictions set a higher age of digital consent; if you are under the age of consent where you live, please use Verda only with your parent or guardian’s permission.

10. Changes to this policy

If we change this policy materially we will update the date at the top and notify you in the app before the change takes effect. Continuing to use Verda after that means you accept the revised policy.

See also the Terms of Service.