Privacy Policy

Effective Date: April 7, 2026 · Last Updated: June 11, 2026

Introduction

Nomscore (“we”, “our”, “us”) operates the Nomscore mobile application (the “App”). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our App.

By using Nomscore, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the App.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Apple ID identifier (Sign in with Apple is required; we do not receive your Apple ID password)
• Email address (the Apple relay address Apple provides to us if you choose to share it)
• Display name (chosen by you, or derived from Apple's full name claim on first sign-in)
• Time zone (detected automatically for accurate daily tracking)

1.1a Subscription Data

Nomscore requires an active auto-renewing subscription to use the app. We receive the following from Apple for each transaction:

• Product identifier (monthly or yearly)
• Original transaction ID, latest transaction ID, purchase and expiration dates
• Auto-renew status and any grace-period / billing-retry flags
• Environment (Sandbox or Production)

We do not receive your payment method, card number, or Apple ID password. Billing is handled entirely by Apple.

1.2 Food Logs

When you log meals, we collect:

• Food descriptions (text you type or speak)
• Point values (calculated by our AI system)
• Timestamps (when meals were logged)
• Meal categories (breakfast, lunch, dinner, snack)

1.3 Voice Data

Nomscore supports voice-based food logging. Voice processing works as follows:

• Speech recognition is performed entirely on your device using Apple's Speech framework
• Audio recordings are never transmitted to our servers
• Only the transcribed text (the words you spoke) is sent to our servers for food-to-points conversion
• You can revoke microphone access at any time in iOS Settings

1.3a Meal Photos

Nomscore supports photo-based food logging. When you tap the camera button on the home screen and capture a photo of a meal:

• The image is downscaled on your device, then sent to our AI provider (Anthropic) for one-time analysis to identify the food and calculate points
• We do NOT store the photo on our servers — it is processed in transit only
• We do NOT request or use access to your photo library. Photo logging is camera-only — Nomscore can only see images you explicitly capture inside the app
• The structured analysis result (item names, portions, point values) IS stored alongside your other food entries so you can review your day
• You can revoke camera access at any time in iOS Settings
• Anthropic's data-handling policy applies to the in-flight processing

1.3b Meal Plan Preferences

Nomscore supports AI-generated weekly meal plans. When you generate a plan, you provide:

• Cooking frequency (how many days per week you plan to cook) and effort level (quick / balanced / love-cooking)
• Preferred proteins and cuisines (closed-list selections)
• Dietary restrictions (closed-list — vegetarian, vegan, gluten-free, dairy-free, nut-free, pescatarian, none). Some restrictions may imply religious practice or a medical condition; we treat these inputs as sensitive and do not share them with any third party other than Anthropic for the in-flight plan generation
• Dislikes — an optional free-text field (max 200 characters) for foods to avoid. Please do not enter health information or other sensitive details into this field
• Which meal slots to plan (any subset of breakfast/lunch/dinner)

These preferences are sent to Anthropic alongside the request that generates your plan. The generated plan (meal titles, ingredients, recipe steps, nutrition estimates, and shopping list) is stored only on your device in local storage — we do not persist meal plans on our servers. When you sign out or delete your account, every locally-stored plan is removed along with the rest of your local data.

1.3c Weight Check-Ins

If you opt to track your weight (visible in Settings → Show Weight Card), Nomscore collects:

• Weight values in kilograms (entered by you in your preferred unit; we store the canonical kg value)
• Recorded date of each check-in (your local calendar date)
• History trend is computed on our servers from these values to drive the Journey screen's sparkline and “vs last week” delta pill

This data is stored on our servers (a Fly.io PostgreSQL database in the US-East region) so that it survives device reinstallation and is included in the GDPR data export. You can disable the Weight card at any time from Settings; existing values stay in your account until you delete them or delete the account. Body weight is health-related data and is treated as sensitive — it is never shared with third parties (including Anthropic) and is included in your account-deletion cascade.

1.4 Gamification and Social Data

• Streaks, badges, XP, and level data
• Group memberships and group names
• Leaderboard rankings (visible to group members)
• Feed posts (achievements shared within your groups)

1.5 Device and Technical Data

• Device token for push notifications (Apple Push Notification service)
• App version and iOS version
• Crash reports (if you opt in via iOS settings)

We do not collect device identifiers (IDFA), location data, contacts, your photo library, or browsing history. Meal photos you capture inside Nomscore are sent to our AI provider for one-time analysis only and are never persisted by us.

2. How We Use Your Information

We do not use your data for advertising. We do not sell your data to third parties.

3. Third-Party Services

3.1 Anthropic Claude API

The Anthropic Claude API powers three Nomscore features:

1. Food point calculation — your food description text is sent to Claude to identify the items and compute points.
2. Meal photo analysis — photos you capture in the app are sent to Claude's vision API for one-time analysis (the photo itself is never persisted by us).
3. Meal plan generation — when you generate a weekly plan, your preferences are sent to Claude to produce the 7-day plan.

In every case we send only what is needed to complete the request — never your identity, account ID, or other context. Anthropic Privacy Policy.

3.2 Apple Sign In

If you choose Sign in with Apple, authentication is handled by Apple. We receive only the information you authorize Apple to share (email, name). Apple Privacy Policy.

4. Data Storage and Security

4.1 Storage Location

Your data is stored on servers hosted by Fly.io in the US-East (IAD) region. Data is stored in a PostgreSQL database with encryption at rest.

4.2 Security Measures

• All data transmitted between the App and our servers uses TLS 1.3 encryption
• Authentication tokens are stored in the iOS Keychain (hardware-backed secure storage)
• There are no Nomscore passwords — Sign in with Apple is the only authentication method, and we never receive your Apple ID password
• Access tokens are short-lived signed JWTs (HS256); refresh tokens are opaque and rotated on each use
• Server access is restricted to authorized personnel only

4.3 Local Data

Food logs are cached locally on your device using SwiftData for offline access. This data is protected by iOS device encryption and your device passcode.

5. Data Retention and Deletion

5.1 Active Accounts

We retain your data for as long as your account is active. Food logs and daily summaries are retained indefinitely to support historical tracking and streak calculations.

5.2 Account Deletion

You can delete your account at any time from the App (Profile > Delete Account). When you delete your account:

• All personal data is permanently deleted from our servers within 30 days
• This includes: account information, food logs, daily summaries, badges, group memberships, and all associated data
• This action cannot be undone
• Data that has already been shared in group feeds may remain visible to other group members in anonymized form

6. Your Rights (GDPR and Global Privacy)

Regardless of where you live, you have the following rights:

• Right to Access: Use the “Export My Data” feature in the App (Profile > Export My Data) to download your data as a JSON file.
• Right to Delete: Delete all your data by deleting your account in the App, or contact us to request deletion.
• Right to Export (Portability): Export your food logs, profile information, and statistics at any time.
• Right to Rectification: Edit your display name, daily budget, and other profile settings directly in the App.
• Right to Object: Opt out of push notifications at any time, and revoke microphone access at any time.
• Right to Restrict Processing: Contact us to restrict processing while a concern is being resolved.

7. Children's Privacy

Nomscore is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will take steps to delete that information promptly.

8. Push Notifications

Nomscore may send push notifications for:

• Daily logging reminders
• Streak warnings (log before your streak resets)
• Badge and level-up celebrations
• Group activity (new members, leaderboard changes)

You can disable any or all notification categories in the App (Profile > Notifications) or in iOS Settings.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you through the App or by other means. The “Last Updated” date at the top of this policy indicates when it was last revised. Continued use of the App after changes constitutes acceptance of the revised policy.

10. Contact Us

If you have questions about this Privacy Policy, your data, or your rights, contact us at:

• Email: support@nomscore.app
• Website: https://nomscore.app/privacy

For GDPR-related requests, please include “GDPR Request” in your email subject line. We will respond within 30 days.

11. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process your data on the following legal bases:

You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

See also our Terms of Use and Community Guidelines.