Privacy Policy

WSIET is a meal tracking and AI suggestion app. You log what you eat, set your preferences, and we use AI to suggest meals suited to your habits and the time of day.

Account data

Your email address and a unique ID from Firebase Authentication (our authentication provider, operated by Google). We do not store passwords — Firebase handles that.

Meal logs

Every meal you log: name, description, meal type, cuisine, and the time you ate it. This is the core data the app runs on.

Preferences and dietary restrictions

The cuisines you prefer and any dietary restrictions you set (vegan, gluten-free, nut allergy, halal, kosher, etc.).

Device and usage data

Standard server logs: IP address, browser type, pages visited, timestamps. We use this for security and debugging. We do not use it for advertising.

Signup provenance (anti-fraud)

The first time you create an account, we store on your user record: the IP address and User-Agent of the signup request, the sign-in method you used (Google, Apple, or email/password), and basic device information reported by the app — whether you signed up from a real device or an emulator, the platform (iOS / Android / web), and, on mobile, the device model name. From these we derive an internal quality classification (human / suspected automated test account / unknown). We use this only to detect and exclude automated and test-lab accounts from our real-user counts and to prevent abuse — never for advertising or profiling. It is captured only at first signup, never refreshed, and kept until you delete your account.

Region and timezone

We store your device's timezone (so meal slots, daily resets, and reminders use your local time) and a coarse country code derived from it (used only for aggregate measurement). Neither is precise location.

Location data (optional)

If you enable "Find restaurants near me," we request your device's GPS coordinates at that moment. Coordinates are sent to our API to query nearby restaurants. Precise coordinates are never stored in our database. For internal cost monitoring, each Google Places API call is logged with the coordinates rounded to 2 decimal places (approximately ±1.1 km accuracy), along with the type of request, page number, and result count. These rounded coordinates are not linked to your account or identity.

Food photos (optional)

If you use photo logging, your photo is sent to our API, processed by AI to identify the dish and estimate nutrition, and stored in Supabase Storage associated with your meal log. Photos are retained for as long as your meal log entry exists and are deleted when you delete the meal or your account.

Daily nutrition goals (premium, optional)

If you set daily nutrition targets, we store four numbers on your user record — a daily calorie target and daily protein, carbohydrate, and fat targets (grams) — plus the timestamp when you last set them. These are entered by you, are entirely optional and skippable, and any subset can be left blank. We use them only to shape your meal suggestions toward the headroom remaining for the day and to show approximate dashboard progress; they are AI-estimate-based guidance, not precise tracking. You can clear all of them at any time in Settings.

We do not use your data for advertising. We do not sell your data. Ever.

WSIET uses two AI providers.

Anthropic (Claude) generates meal suggestions and nutrition estimates for each suggestion. We send:

• Your meal history (last 7–14 days of meal names, types, cuisines)
• Your dietary restrictions and cuisine preferences
• The time of day

Google DeepMind (Gemini) is used for three separate tasks:

• Food photo identification: when you upload a photo, we send the image to identify the dish, estimate nutrition, and pre-fill your meal log
• Suggestion image generation: when you have AI images enabled, we send the meal name and cuisine to generate a food photograph for the suggestion card
• Restaurant scoring: when nearby restaurants are shown, we send restaurant names and types (no personal data) to score how likely each restaurant is to serve your suggested meal

We do not send your name, email, or account ID to either provider. Both act as data processors under Data Processing Agreements. Neither Anthropic nor Google uses API inputs to train their models under standard API terms.

Current AI models in use: meal suggestions + nutrition — claude-haiku-4-5-20251001 (Anthropic); restaurant scoring — gemini-2.5-flash-lite, food photo identification — gemini-2.5-flash, and suggestion image generation — gemini-2.5-flash-image (Google DeepMind)

When you tap "Find near me":

1. Your browser or device requests your GPS coordinates
2. You choose to share or deny — we never auto-collect location
3. If you share: coordinates go to our API → we query Google Places API to find nearby restaurants → results are returned to you
4. Precise coordinates are never stored against your account or shared beyond the single Places query. For internal cost monitoring, each Places lookup is logged in rounded form (~1.1 km, no user identifier)

When you submit a photo:

1. Your browser compresses and converts the image to JPEG before sending
2. The compressed image is sent over HTTPS to our API
3. Our API sends the image to Google DeepMind (Gemini) to identify the dish and estimate nutrition
4. The API returns the dish name, cuisine, meal type, and nutrition estimates to your browser
5. If you log the meal, the image is stored in Supabase Storage and associated with that meal log entry
6. If you discard the result without logging, the image is not stored

We do not use food photos to train AI models. Google does not use Gemini API inputs for training under standard API terms.

These companies process data on our behalf under Data Processing Agreements:

We do not use advertising networks, tracking pixels, or analytics SDKs that share data with third parties.

You can:

• Access all data we hold about you — email us
• Delete your account and all associated data — email privacy@wsiet.org to request deletion (we purge within 30 days)
• Correct any meal log or preference — editable in the app
• Export your meal history — email us and we'll send a CSV
• Withdraw consent for location or photo features — just don't use them; no penalty
• Clear your nutrition goals at any time — use "Clear goals" in Settings, which removes all four targets and the timestamp; no penalty
• Object to any processing — email us

For EU residents (GDPR): you have the right to lodge a complaint with your national supervisory authority.

For California residents (CCPA/CPRA): you have the right to limit the use of sensitive personal information (dietary restrictions and nutrition goals) to what's necessary to provide the service. We already do this — we don't use it for anything else.

For Washington state residents (My Health My Data Act): dietary data, nutrition goals, and location data qualify as consumer health data. You have the right to access, delete, and withdraw consent at any time.

WSIET suggests meals. It is not a medical device, a dietitian, or a healthcare provider. Nothing in the app constitutes medical or nutritional advice. If you have a medical condition that affects your diet, consult a qualified healthcare professional.

WSIET is not intended for users under 13. We do not knowingly collect data from children.

If we make material changes (new data types, new processors, new uses), we'll update the "Last updated" date at the top and notify you by email if the change affects how we use sensitive data.

Questions about your data: privacy@wsiet.org