Privacy Policy

Last updated: September 2026

1. Data Controller

Markus Köplin
Fehmarner Str. 1, 04159 Leipzig, Germany
Email: support@mkhub.de

2. What Data Is Processed?

NutriTally processes your nutrition, body, activity, and profile data, such as meals, weight, exercise, goals, and settings. Depending on the features used, this also includes health data from Apple Health, images, AI inputs, friends, subscription and usage data, and support messages.

Providing information and using optional features is voluntary. Without the necessary data, the corresponding features cannot be provided.

3. App Data and Storage

Your food diary and profile data are stored on your device and, if you choose, synced through iCloud. Online features process the data described below. Processing to provide the app is based on Article 6(1)(b) GDPR.

4. AI Features

With your explicit consent, inputs, photos, and selected profile, nutrition, and health data are sent to OpenAI to produce analyses and personalized answers. This may include your display name, weight, body fat, and activity values. If sleep support is available and enabled, the date of the night, sleep duration and recording completeness may also be sent to OpenAI for the personal daily review and its follow-up in the coach. Individual sleep stages and raw measurements are not included. Email address and Apple ID are not sent automatically; information you enter yourself forms part of your request. The legal bases are Article 6(1)(a) and, for health data, Article 9(2)(a) GDPR. When you use voice input, audio recordings are sent to OpenAI, converted to text, and then analyzed to identify foods.

When you use the interactive coach, it can retrieve specific data you have shared to address your question: nutrition totals covering up to 31 days, meal entries covering up to 14 days and body measurements covering up to 90 days. A daily review discussed in chat and the required tool results are also sent to OpenAI and may become part of the conversation state stored there. Food entries are saved only after you confirm them in the app. Local chat cards contain only status references and follow the chat retention policy; pending write requests remain encrypted until their outcome is resolved.

Content is encrypted during transfer and, under the applicable contractual terms and settings, is not used to train general models. Conversations may be stored for continuation. Photo analyses saved for later remain encrypted on your device until continued or deleted.

AI answers are non-binding and may be inaccurate. No automated decisions with legal or similarly significant effects are made under Article 22 GDPR.

5. Food Search and Product Submissions

For food searches, we process search terms, product codes, language, and technical connection data, including the IP address, and send necessary information to food services such as Open Food Facts. The legal bases are Article 6(1)(b) GDPR for search functionality and Article 6(1)(f) for secure operation and improvement of the product database.

For voluntary product submissions, product codes and photos are processed to expand the database, analyzed by OpenAI, and then reviewed. The legal bases are Article 6(1)(b) and (f) GDPR; the legitimate interest is the secure maintenance of the product database.

6. Apple Health

With your explicit consent, NutriTally reads and writes health data in Apple Health. Sleep data supports optional insights in the app. If sleep support is available and enabled, the summarized sleep information described in section 4 may also support the personal daily review and its follow-up in the coach with AI consent. Other selected health data may also be processed under section 4. The legal bases are Article 6(1)(a) and Article 9(2)(a) GDPR.

6a. Siri, Spotlight, and Shortcuts

These features access app data on your device. They do not send nutrition or health data to our own servers. Existing device and Health permissions continue to apply.

6b. Friends

To provide the friends feature, we store friend codes, display names, usage days, friendships, and a device identifier online. Friends see your display name, usage streak, and usage days. You can optionally show your macro goal progress as percentages; exact daily amounts and body weight are not shared through this feature. When you send a scan result using “Share Meal”, the selected friend receives the foods, quantities, and nutritional values, together with the split you chose. The legal basis for the requested feature is Article 6(1)(b) GDPR.

Newly selected profile pictures are shared by default with your confirmed friends as a smaller, metadata-free copy via Cloudflare. Existing private pictures remain private. You can turn sharing off before selecting a picture or later; access is then blocked and the copy deleted. Pictures already loaded may remain temporarily visible offline.

6c. Usage Statistics and Security

We process usage and interaction data, along with app and subscription characteristics, under an identifier rather than your name. This data supports secure operation, troubleshooting, support, capacity planning, and improvement of the app and product database. These are our legitimate interests under Article 6(1)(f) GDPR. The data is not used for advertising or tracking across other apps.

6d. Contact and Support

For inquiries sent to support@mkhub.de, we process your contact details, messages, and attachments to handle your request. When you contact us through the app, these may also include the app version, support ID, and technical diagnostic data.

The legal basis is Article 6(1)(b) GDPR for contractual or pre-contractual inquiries, and otherwise Article 6(1)(f) GDPR. Our legitimate interest is to handle inquiries. Providing information is voluntary; without the necessary details, we may be unable to handle your request.

We delete correspondence once the case is closed and it is no longer needed to handle the request. Statutory retention requirements remain applicable (Article 6(1)(c) GDPR). The email provider’s technical recovery and deletion periods may continue thereafter (see section 7).

6e. Website

The website runs on our server hosted by Hetzner Online GmbH. Visits involve processing connection data such as IP address, time, requested page, and browser information. Server logs are used solely for operation, security, and troubleshooting. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure provision of the website. Log storage is limited; older entries are automatically replaced by new ones when the storage limit is reached.

The website stores the light/dark setting in your browser until you change it or delete the website data. It is used solely for display preferences.

7. Recipients and International Transfers

• Hetzner Online GmbH: Hosting the website on our server.
• Apple / iCloud: Optional syncing of app data and processing purchases and subscriptions.
• OpenAI: AI features and analysis of submitted product photos.
• Cloudflare: Providing AI features, food search, and Friends; preventing abuse; pseudonymous usage statistics and technical support.
• Google Workspace / Gmail: Receiving, sending, and storing support emails on our behalf.
• Open Food Facts: Food search and retrieval of product information.

Apple, OpenAI, Cloudflare, and Google may process data outside the European Economic Area, particularly in the United States. Depending on the service, transfers are protected by an adequacy decision, particularly the EU-US Data Privacy Framework, or EU Standard Contractual Clauses. Further details and safeguards: Apple, OpenAI, Cloudflare, Google.

8. Retention and Deletion

• App and Friends data: until deletion through Advanced → Delete All App Data. Meals already accepted by others, Apple Health data, and iCloud data may need to be deleted separately. This does not cancel subscriptions; subscription and usage allowances remain.
• AI chats on your device: up to 14 days and 100 messages per active session. OpenAI generally retains data for abuse prevention for up to 30 days, or longer where required by law or necessary to protect against harm. AI responses stored for conversation continuation are retained for at least 30 days. Further information from OpenAI.
• Product submissions: photos for up to 90 days after upload; status and review data for up to 400 days.
• Usage statistics: individual events for up to 24 months; daily summaries for up to 400 days. Backups may retain deleted individual events for a further seven days. Deleting app data does not automatically remove these records.
• Security and deletion records: as long as needed for secure operation, handling deletions, and preventing unauthorized restoration.
• Support emails: according to the deletion criteria in section 6d.

9. Your Rights

Subject to the legal requirements, you have rights of access, rectification, erasure, restriction, data portability, and objection. You may object to processing based on legitimate interests on grounds relating to your particular situation.

You can withdraw consent at any time for the future: for AI in the app settings, for Apple Health in Health/iOS settings, or by email to support@mkhub.de. Withdrawal does not affect the lawfulness of earlier processing. You can also exercise your other rights at this address.

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:

11. Changes

The current privacy policy is available on this website and under Privacy in the app.