Privacy

Everyone: looking foods up

• Usage statistics through Google Analytics: which pages are viewed, roughly where from (country, city), the device and browser, how people arrive, and a few events, such as that a search, a comparison or a sign-up happened (not what you typed). It uses cookies. We do not turn on Google's advertising features and do not use the data for advertising.
• Server logs at Cloudflare and on our API server: the address a request came from, the page or API call (including search words typed into the search box), the time and the browser. We use them to keep the site running and to stop abuse, and keep them for a limited time.
• Store links. Some foods, mostly packaged products, link to stores that sell them. Following one takes you to that store, which sets its own cookies under its own privacy policy and may pay us a commission (see the Terms). We count the click in Google Analytics by store name, nothing else.
• Your settings in the Food Finder (the ranges you draw) live in the page's address, so you can share them. We do not store them.

With an account

An account is optional. When you make one, we keep:

• Your sign-in. Your email address, and how you sign in. With Google, Google also sends the name and profile picture link on your Google account; with Apple, you may share a private relay address instead of your own. With email, your password is stored only as a secure hash by our sign-in provider.
• Your profile, if you fill it in, all optional: a name, year of birth, sex, height, weight, activity level, and whether you are pregnant or breastfeeding. They are used for one thing: to calculate your daily targets from the National Academies' reference intakes. The targets you set yourself are kept too.
• What you log and make: the foods, amounts, meals and days in your Nutrition log, your usual day, your recipes and plans.
• Meal photos, when you snap or choose one. The app or the page first makes a smaller copy (at most 1,024 pixels on the long side) that carries no location data, and only that copy is sent. An AI model running on a computer ObjectGraph operates names the foods and estimates the amounts; the photo reaches it over an encrypted private network and no outside AI company receives it. We keep the photo and what the model saw with it, so you can see them in your log.
• Barcodes you scan: the app reads the barcode on your phone and sends only its number, to find the product.

We treat what you log as health information. We use it only to run your account: your log, your totals against your targets, your dashboard. Each account's rows are locked to its own sign-in in the database, and meal photos are private: they are served only to the account that took them. ObjectGraph looks at an account's data only to fix a problem you report, to keep the service safe, or when the law requires it.

Who holds it

• Supabase: sign-in and the database that holds your account, on Amazon Web Services in the United States (us-east-1).
• Amazon Web Services: our API server, in the United States (us-east-1).
• Cloudflare: the website, and the private storage that holds meal photos (Cloudflare R2, never public).
• Google: Google Analytics, and Google sign-in if you choose it. Apple: Sign in with Apple if you choose it.

They process data for us under their own security and privacy terms. We do not sell or rent any data, and we do not share it with anyone else except when the law requires it.

Your choices

• Download everything: signed in, go to My food → Profile & targets → Your data. You get a ZIP with every row your account holds and your meal photos.
• Delete your account in the same place. Your sign-in, profile, log, recipes and photos are deleted at once; copies in our database provider's recovery backups age out on their own within weeks. Server logs expire on their own.
• Correct anything by editing it; leave the profile empty and the FDA Daily Values are used instead.
• Block analytics cookies in your browser or with a content blocker; the site works the same.

Accounts are not for children under 13. If you believe a child under 13 has made one, write to us and we will delete it.

For any question about your data, or to ask us to do any of the above for you, write to info@objectgraph.com. If this page changes in a way that matters, it will say so with a new effective date before the change applies to data we already hold.

See also the Terms of Use.