FuelWise Privacy Policy
The short version
FuelWise has no accounts. You never give it an email address, a password, or a name, and there is no profile of you on any server we run. Your food log lives on your iPhone, in your own iCloud account, and — if you turn it on — in Apple Health.
Two things do leave your phone, and only when you ask for them:
- A meal description, and a photo if you took one, when you ask for an AI estimate.
- A barcode, when you scan a packaged food.
Nothing else. No advertising, no analytics, no tracking, and nothing sold or shared with anyone for their own purposes.
1. Who is responsible
Andrew Hunt (“we”, “us”) is the data controller for the limited processing described below.
Contact: piiqlabs@icloud.com
We are a single independent developer, not a company with a data protection officer. Questions go to a person, and that person is reachable at the address above.
2. What stays on your iPhone
Almost everything. The following never leaves your device except through the routes named in section 3, or through an export you perform yourself:
- Every meal, food item, portion, and nutrient value you log
- Your goals: protein target, calorie limit, sugar limit, body weight if you enter it
- Favorites, recent meals, and your corrections to any product
- Products you have scanned, cached so they work offline
- App settings and preferences
- Diagnostic counters, if you switch them on
Photos
A meal photo is re-encoded before it is stored or sent: re-rendered to at most 1024 pixels on its longest side, which drops GPS coordinates, camera make and model, and the original timestamp. What remains is a plain JPEG carrying nothing that identifies you, your camera, or where you were.
Photos are kept for 30 days by default. You can change this to delete-after-analysis, or to keep them indefinitely, in Settings.
Voice
Speaking a meal description uses Apple's on-device speech recognition. FuelWise never creates an audio file — the microphone buffer is converted to text in memory and only the text is kept.
Nutrition labels
Photographing a Nutrition Facts panel runs Apple's Vision framework on your iPhone. The label image is not uploaded. It is read locally and discarded.
3. What leaves your iPhone, and when
3.1 AI meal estimates — only when you ask for one
When you request an estimate, FuelWise sends your meal description, and the sanitized photo if you attached one, to a server we operate on Cloudflare Workers. That server adds our own credentials and forwards the request to OpenAI, which returns the nutrition breakdown.
- We do not store your meal descriptions or photos on our server. They pass through it.
- OpenAI retains API inputs and outputs for up to 30 days for abuse and misuse monitoring, then deletes them. They do not use this data to train their models. This is OpenAI's standard API policy, not a setting we chose.
- Do not put anything in a meal description you would not want processed this way. It is a box for describing food.
If you never use AI estimation, no meal content ever leaves your phone.
3.2 Barcode lookup — only when you scan
Scanning a packaged food sends the barcode number and nothing else to our server, which looks it up in the USDA FoodData Central database. No meal history, no photo, no health data, no identifier of you.
Results are cached on our server by barcode so the same product is not looked up repeatedly. That cache is a copy of public USDA product data. It records nothing about who asked.
3.3 Proving the app is genuine
The first time FuelWise needs our server, your iPhone uses Apple's App Attest to prove it is running an unmodified copy of the real app. This is how the app works without asking you to sign in or enter a key.
This produces an anonymous install identifier derived from a cryptographic key held in your iPhone's Secure Enclave. It is not linked to you, your Apple Account, your device's serial number, or any advertising identifier, and it does not follow you to another app. If you delete and reinstall FuelWise, a new and unrelated identifier is created.
Our server stores, against that identifier: when it was created, whether it has been revoked, and counters of how many requests it has made.
3.4 Network information
Delivering any internet request necessarily exposes your IP address to the server receiving it. Cloudflare processes IP addresses to route and protect traffic.
For the setup request in 3.3 only, we compute a one-way hash of the IP address to count requests per network and stop abuse. The hash is discarded within two hours and cannot be reversed to recover the address. We do not otherwise log, store, or analyse IP addresses.
4. Apple Health
Apple Health integration is off unless you turn it on, and iOS asks your permission separately for each type of data.
- Written, when you save a meal: calories, protein, carbohydrates, fiber, sugar, fat and water.
- Read, if you allow it: body weight, to suggest a protein target; active energy, to adjust your calorie budget.
Health data goes between FuelWise and Apple Health on your device only. It is never sent to our server, never sent to OpenAI, and never used for advertising — which Apple's rules prohibit and which we would not do regardless.
Deleting your data in FuelWise asks Health to remove the entries FuelWise wrote. Apple only permits an app to delete what it created; anything you added yourself in Health stays yours to manage.
5. iCloud sync
FuelWise stores your log in your own private iCloud database, using Apple's CloudKit. This means your history survives losing or replacing your iPhone.
The important part: this is your Apple Account, not our server. We have no access to it and no ability to read, export, or delete what is in it. Apple's privacy policy governs iCloud, and Apple's terms govern your storage. Settings always states which store is in effect — "This iPhone only" means the log is not being synced.
6. Subscriptions and payment
FuelWise is a paid subscription with a free trial. All payment is handled by Apple. We never see, receive, or store your name, card number, billing address, or Apple Account email.
To check whether your subscription is active, your iPhone sends Apple's signed receipt for the purchase to our server. That receipt tells us that an active subscription exists and when it expires. It carries an anonymous Apple-generated transaction identifier — not your identity.
Apple provides us with aggregate sales and download reports, as it does for every developer on the App Store. Those reports are counts and totals, not information about individuals.
7. What we do not do
- No advertising, and no advertising identifiers
- No third-party analytics, and no tracking SDKs of any kind
- No selling or sharing of personal information, in the ordinary sense or as those terms are defined by the California Consumer Privacy Act
- No profiling, no automated decisions with legal effects, and no cross-app or cross-site tracking
- No email list, because we have no email addresses
The app's PrivacyInfo.xcprivacy manifest declares no tracking and no collected data types, and lists no tracking domains. That declaration is enforced by Apple and matches this document.
8. Diagnostics
Optional, off by default, and local to your device. Diagnostic records can only hold a predefined event code, a component name, a count, a timestamp, and app and iOS version numbers. The format has no field capable of holding meal content, nutrient values, photos, URLs, credentials, or health identifiers. Nothing is transmitted.
Crash reports are handled by iOS. If you have opted in to share analytics with app developers in your iPhone's own settings, Apple may pass us crash logs — that is Apple's mechanism and your setting, controllable in Settings → Privacy & Security → Analytics & Improvements.
9. Children
FuelWise is not directed at children under 13, and we do not knowingly collect personal information from them. Because the app has no accounts, we have no practical way to identify a user's age. A nutrition tracker is not an appropriate tool for a child without adult guidance.
10. Your rights and your control
Because there is no account, most of your rights are exercised directly in the app rather than by asking us:
| You want to | How |
|---|---|
| See everything held about you | Settings → export as JSON or CSV. It is the complete local record |
| Correct anything | Edit it in the app. Corrections stick and take precedence over the database |
| Delete everything | Settings → delete all data. Removes local records, photos, settings, cached products and credentials, and asks Health to remove what FuelWise wrote |
| Stop all transmission | Do not use AI estimation or barcode scanning. Manual entry and label scanning are entirely on-device |
| Stop iCloud sync | Turn it off in Settings, or sign out of iCloud |
| End the subscription | Settings app → your name → Subscriptions. Apple handles cancellation |
If you are in the UK, EU, or a jurisdiction with comparable law, you also have rights to access, rectification, erasure, restriction, portability, and objection, and a right to complain to your data protection authority. Our lawful basis for the processing in section 3 is performance of the contract — you asked for an estimate and the estimate requires the request — and, for the abuse controls in 3.3 and 3.4, our legitimate interest in preventing our service from being misused at our expense.
Deleting the app removes everything held locally. It does not delete your private iCloud copy (manage that in iOS Settings → your name → iCloud), and it does not cancel your subscription.
11. Where data is processed
Our server runs on Cloudflare's global network and requests are handled at a location near you. OpenAI processes AI estimation requests in the United States. If you are outside the United States, using AI estimation involves an international transfer of the content of that request. Apple's own terms govern where iCloud and Health data are held.
12. Retention
| Data | Held for |
|---|---|
| Your log, on your device and in your iCloud | Until you delete it |
| Meal photos | 30 days by default; your setting, changeable to immediate deletion or indefinite |
| Meal descriptions and photos sent for AI estimation | Not stored by us. Up to 30 days by OpenAI |
| Cached barcode products on our server | 30 days. Public product data, not linked to any user |
| Install identifier and its counters | Until the install is deleted or revoked; counters expire within days |
| Hashed IP for setup rate limiting | Under two hours |
13. Security
Everything travels over HTTPS. Credentials on your iPhone are held in the iOS Keychain, protected so they cannot be read while the device is locked and never leave the device in a backup. Our server stores only a hash of an install's credential, so even full access to our storage yields nothing that could be used to impersonate an install. API keys are held as encrypted secrets on Cloudflare and are never present in the app.
No system is perfectly secure, and we will not claim otherwise.
14. Changes
If this policy changes in a way that affects what leaves your iPhone, we will say so in the app before the change takes effect, not only by editing this page. The effective date at the top always reflects the current version.