1. Who we are and what this covers

Thaya ("Thaya," "we," "us," or "our") provides an AI-assisted nutrition, meal logging, and progress-tracking application. This Privacy Policy applies to the Thaya mobile app, related support communications, and backend services used to operate the app.

For privacy questions or requests, contact [email protected]. Thaya is the controller of personal data described here, except where a service provider acts as an independent controller under its own terms.

2. Information we collect

Information you provide

• Account and identity: email address, password credentials handled by our authentication provider, name, sign-in provider, provider user ID, avatar, and authentication metadata.
• Profile and goals: date of birth or age, gender, height, current and desired weight, activity level, nutrition or weight goal, target pace, dietary preferences, biggest challenge, language, and how you heard about Thaya.
• Meals and nutrition: meal names, dates and times, food items, portions, calories, protein, carbohydrates, fat, fiber, sugar, sodium, manual edits, scan results, and confirmations or corrections.
• Progress and habits: weight entries, step goals, water logs, fasting preferences and records, streaks, progress measurements, optional progress photos, and optional meal photos.
• Communications: information you include when contacting support or making a privacy request.

Information collected from your device or use

• Health data, only with permission: steps, active calories burned, and weight read from Apple Health or Health Connect. See Section 4.
• Camera and photo access: an image you capture or select for meal analysis or progress tracking. The app does not need continuous camera access.
• App and device data: app version, operating system/platform, device or app instance identifiers used by integrated services, language, time zone, push notification token, permission state, and basic network/request metadata.
• Usage and diagnostics: feature interactions, onboarding and paywall events, subscription state, scan quota and performance information, model/provider version, token and cost telemetry, crash logs, error context, and app performance.
• Purchase information: product ID, entitlement and subscription status, platform, transaction or purchase identifiers/tokens, renewal/expiry time, and store event data. Apple or Google processes your payment details; Thaya does not receive your complete card number.

We obtain information directly from you, automatically when you use the app, from Apple Health or Health Connect after you grant permission, and from Apple, Google, authentication providers, and subscription infrastructure when you sign in or purchase a plan.

3. Why we use information

We do not use health data, meal photos, or progress photos for targeted advertising. We do not sell personal or sensitive data.

4. Health and sensitive data

Connecting Apple Health or Health Connect is optional. If you choose to connect it, Thaya asks for permission to read steps, active calories burned, and weight so the app can show activity and weight context and support your nutrition and progress tracking. Current app functionality does not write health records.

• You can use core meal logging without connecting a health service.
• You can deny or revoke permissions at any time in Apple Health, Health Connect, or your device settings. Previously imported data may remain in Thaya until you delete it or your account.
• Health data is not used for advertising, sold, or shared with data brokers.
• Thaya does not use HealthKit or Health Connect data for credit, employment, insurance, or eligibility decisions.

Camera and photo-library access is also optional and requested only when you choose a photo feature. You can log a meal manually if you prefer not to provide a photo.

5. Meal photos, progress photos, and AI

Meal analysis

When you ask Thaya to scan a meal, the selected image is sent securely to our backend and then to a configured AI provider (Google Gemini or a model provider accessed through OpenRouter) to identify likely foods, portions, and estimated nutrition. AI providers receive the image and an analysis instruction, plus technical request metadata. Do not include faces, documents, or unrelated sensitive information in meal photos.

Meal photos you save are stored in private cloud storage linked to your account so they can appear with your meal history. Progress photos are stored separately in private account-scoped storage and are used only for your progress-tracking feature.

Improving scan quality

If you confirm or correct a scan, Thaya may create a training-quality sample containing the original model output, your corrected values, dish/portion information, model version, locale, and an image reference. We use these samples to evaluate and improve meal recognition. If you delete your account, personal identifiers and account/meal links are removed and image paths are deleted; strictly de-identified nutrition examples may be retained where they can no longer reasonably be linked to you.

6. Service providers and other recipients

We disclose only the information reasonably needed for the recipient’s role:

• Supabase: database, authentication, private storage, and server functions.
• Google Firebase: app analytics, stability monitoring, and crash reporting.
• RevenueCat: purchase validation, subscription status, and entitlement management.
• Apple and Google: sign-in, app distribution, in-app purchases, subscription management, and — only when you enable it — Apple Health or Health Connect.
• AI providers: Google Gemini and/or model providers accessed through OpenRouter for meal-image analysis.
• Professional advisers and authorities: when reasonably necessary to obtain advice, enforce terms, protect users or the service, comply with law, or respond to a valid legal process.
• Business transfers: a successor in a merger, financing, reorganization, or sale, subject to appropriate confidentiality and notice where required.

Providers process data under their own security and privacy obligations. We require service providers acting on our behalf to protect personal data consistently with this policy and applicable platform requirements.

7. Retention and account deletion

We keep personal data only as long as needed to provide Thaya, satisfy the purposes above, meet legal or accounting requirements, resolve disputes, and protect the service. Retention depends on the record:

Delete your account

In the app, go to Profile → Delete account and confirm. This deletes your authentication account, profile, meal and progress records, private meal and progress photos, device tokens, preferences, and other account-linked app data. It also removes your identifiers from retained training, notification, and RevenueCat event records.

Deleting Thaya does not cancel an active subscription. Cancel it separately in your Apple App Store or Google Play account settings. If you cannot access the app, request deletion at [email protected]. We may ask you to verify account ownership.

We may retain a narrowly limited record when required by law, necessary for security/fraud prevention, or needed to establish or defend legal claims. Any retained data remains protected and is not used for other purposes.

8. Your choices and privacy rights

Depending on where you live, you may have rights to access, correct, download, delete, restrict or object to processing, withdraw consent, or receive a portable copy of personal data. You may also have a right to complain to your local data protection authority.

• Edit profile, goals, language, reminder, and notification settings in the app.
• Revoke camera, photo, notification, Apple Health, or Health Connect permissions in device settings.
• Cancel or manage subscriptions through the store where you purchased.
• Delete your account from Profile or contact us for a privacy request.

Withdrawing consent does not affect processing already completed lawfully. Some features will not work without the information they require. We will not discriminate against you for exercising applicable privacy rights.

9. Security and international transfers

We use reasonable administrative, technical, and organizational safeguards, including encrypted network connections, access controls, private storage buckets, row-level database permissions, and provider security controls. No online service can guarantee absolute security, so keep your credentials confidential and contact us if you suspect unauthorized access.

Thaya and its providers may process information in countries other than the one where you live. Where required, we rely on lawful transfer mechanisms and contractual safeguards. The MVP backend is configured for an EU region, while some providers may process data globally under their service terms.

10. Age requirements

Thaya is not directed to children under 13. Users who are under the age of legal majority where they live must use Thaya only with permission and supervision of a parent or legal guardian. If you believe a child provided personal data without required consent, contact us so we can investigate and delete it.

11. Changes to this policy

We may update this policy when Thaya, our providers, or legal requirements change. We will post the revised version with a new effective date and provide additional notice in the app when a change is material. Your continued use after the effective date is subject to the updated policy, except where the law requires renewed consent.