Honest PlatePrivacy Policy
- We collect what you put into Honest Plate so the diary works: meals, photos, weight, water and activity.
- Food photos, text and voice entries are sent to OpenAI to estimate calories and macros.
- This is health-related data. We process it only with your explicit consent, given in the app.
- A coach sees your diary only after you accept their invite on a screen that lists what they will see. You can stop sharing at any time.
- We don’t sell your data and don’t use it for advertising.
- You can delete your account and data in the app: Settings → Delete account.
1. Who we are
Honest Plate is operated by TOO “Goalin” (Goalin LLP), a company registered in Astana, Republic of Kazakhstan. We are the controller of your personal data.
Contact: support@honestplate.app.
2. Who can use Honest Plate
Honest Plate is for adults aged 18 and over. The app asks you to confirm your age before you start. We don’t knowingly collect data from anyone under 18. If you believe a minor has created an account, write to us and we will delete it.
3. What we collect
Account
Your email address, name and how you sign in (Apple, Google or an email code). Apple may give us a private relay address instead of your real email.
Profile and questionnaire
Confirmation that you are 18 or older, sex, birth year, height, weight, goal (lose, keep or gain), pace, activity level, units, time zone and language. From these we calculate daily calorie and macro targets. A coach you are linked with can also set your targets.
Your diary
- Food entries: meal type, time, the items and portions, calories, protein, fat and carbs, notes, and “I overate” entries.
- Photos you take or choose for an entry.
- The first AI estimate for an entry, kept next to your edited version so you can see what changed.
- Weight, water and activity (type, minutes, steps, estimated calories), including screenshots from a step or watch app if you add them.
Voice
When you log by voice, the recording is sent to OpenAI to be turned into text. We don’t store the recording.
Coach links
Invites you send or accept, the coach or clients you are linked with, when you gave consent and when a link ended, and the comments and targets a coach adds.
Reminders and devices
Your reminder settings, a push notification token, device model, operating system and app version.
Product analytics
Events about how the app is used, such as “opened the paywall” or “saved a meal”, linked to a pseudonymous ID. They don’t contain your photos, food names or nutrition numbers.
Crash reports
When something breaks: the error message, technical trace, device model, operating system and app version.
Purchases
Your plan, trial and renewal status, and store transaction identifiers. Card details stay with Apple or Google; we never see them.
Support
The emails you send us and our replies.
This website
The website has no analytics, no advertising trackers and no cookies. The web server keeps standard access logs (IP address, browser, page requested) for security. If you choose a language, the choice is saved in your browser’s local storage and never sent to us. The invite page also keeps a short-lived note in session storage so it doesn’t try to open the app twice. Details are on the Cookies and storage page.
4. Health data and your consent
What you eat, your weight and your activity can reveal information about your health. Under the GDPR this is a special category of personal data (Article 9), and we treat it with the same care for everyone, wherever you live.
We process health data only with your explicit consent, which you give in the app before you start logging. You can withdraw consent at any time by deleting the data or your account. Withdrawing doesn’t affect processing that happened before.
We don’t sell health data, use it for advertising, or share it with data brokers.
The exact text of the consent is on the Health data consent page.
5. Why we use your data
| Purpose | Data | Legal basis |
|---|---|---|
| Run your account and diary | Account, profile, diary | Contract; explicit consent for health data |
| AI estimates | Photos, text and voice you submit | Explicit consent |
| Coach sharing | The data listed on the consent screen | Explicit consent, withdrawn when you leave the coach |
| Reminders | Reminder settings, push token | Contract |
| Subscriptions | Purchase data | Contract; legal obligations (accounting) |
| Security and fixing errors | Server logs, crash reports | Legitimate interests |
| Improving the app | Pseudonymous analytics events | Legitimate interests (you can object, see section 11) |
| Answering you | Support emails | Contract; legitimate interests |
6. AI estimates
When you log by photo, voice or text, that content is sent to OpenAI, which returns a draft estimate that you can edit. OpenAI processes it on our behalf. Under OpenAI’s API terms, data sent through the API isn’t used to train their models by default and may be kept for up to 30 days to detect abuse.
Estimates are approximate. They are not medical advice and are not used to make decisions about you that have legal or similarly significant effects.
7. Sharing with a coach
- A coach (a nutritionist, sports trainer or nutrition coach) can see your data only after you accept their invite. Before you agree, the app shows who the coach is and exactly what they will see.
- While you are linked, the coach can see that data, comment on it and set your targets.
- You can leave at any time in the app, and the coach’s access ends immediately. A coach can also remove a client.
- Coaches are independent professionals, not our employees. They are responsible for how they use what they see, and they accept our Coach Agreement, which limits how they may use your data. If a coach copied information outside Honest Plate, we can’t delete it there.
8. Who processes data for us
We share data only with the services we need to run Honest Plate. Each one processes it on our instructions.
| Service | What for | What it receives | Where |
|---|---|---|---|
| OpenAI | AI estimates, voice to text | Photos, text and voice you submit | USA |
| DigitalOcean | Servers, database, file storage | All app data, stored | Germany (Frankfurt), Netherlands (Amsterdam) |
| RevenueCat | Subscription status | App user ID, store receipts | USA |
| Apple and Google | App Store and Google Play purchases; Sign in with Apple and Google | Purchase and sign-in data, under their own privacy policies | USA and worldwide |
| PostHog | Product analytics | Pseudonymous usage events | EU |
| Sentry | Crash and error reports | Error details, device and app version | USA |
| Resend | Sign-in codes and service emails | Your email address, the email content | USA |
| Expo | Push notifications, delivered through Apple Push Notification service and Firebase Cloud Messaging | Push token, notification text | USA |
9. International transfers
We are based in Kazakhstan, our servers are in the EU, and some of the services above are in the USA. When data leaves the EEA we rely on the European Commission’s Standard Contractual Clauses or, where the service is certified, the EU–US Data Privacy Framework.
10. How long we keep data
- Account, profile and diary, including photos: while your account exists. When you delete your account, it is removed from our live systems straight away and from encrypted backups within 30 days.
- Voice recordings: not stored.
- A deletion record (email address, plan, account creation date) stays in our audit log for as long as we may need it to handle a billing dispute or legal claim, and to show the deletion happened.
- Purchase records: as long as accounting and tax law requires.
- Crash reports: up to 90 days. Analytics events: up to 24 months.
- Server logs: up to 30 days. Support emails: up to 2 years after the conversation ends.
11. Your rights
Under the GDPR (if you are in the EEA or the UK) you can ask for access to your data, have it corrected or erased, restrict or object to processing (including analytics), receive it in a portable format, withdraw consent, and complain to your local data protection authority.
Under the Law of the Republic of Kazakhstan “On Personal Data and Their Protection” (No. 94-V of 21 May 2013) you can learn whether we hold your data and get access to it, ask us to change, add to, block or destroy it, withdraw consent, and appeal to the authorised body for personal data protection or to a court.
You can do most of this in the app: edit your profile, delete entries, or delete your account. For anything else, email support@honestplate.app from the address on your account. We reply within one month, or sooner where the law requires.
12. Deleting your account
In the app go to Settings → Delete account, or email us from your account’s address with the subject “Delete my Honest Plate account”. Deleting the account doesn’t cancel an App Store or Google Play subscription; cancel that in your store account. Step-by-step instructions are on the data deletion page.
13. Security
Data travels over HTTPS. Photos are kept in private storage and opened only through short-lived signed links. Sensitive text fields are encrypted in the database, backups are encrypted, and staff access is limited to people who need it. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.
14. Changes to this policy
When we change this policy we update the date at the top. For significant changes we will tell you in the app or by email before they take effect.
15. Contact
TOO “Goalin”, Astana, Republic of Kazakhstan. support@honestplate.app