Privacy Policy

The short version.

• When you photograph a meal, we send the photo to an AI provider, Anthropic, to estimate its nutrition. We don’t keep the photo on our servers. It stays on your phone. We keep the estimate and a fingerprint of the photo, so the same plate can’t be scored twice.
• Your birthday, sex, height and (adults only) weight set your targets and score your day. They never appear on share cards, in duels or leagues, or in analytics.
• Other players see your display name and your scores. They never see your meals, photos or body details.
• We count how the app is used with PostHog, without building a profile of you. We don’t sell your information or use it for ads.
• Delete everything in the app under Me → Delete my account, or email legal@blacktop.social.

That summary is here to be useful, not to be the agreement. The sections below describe the app in detail.

1. Who we are

Nutrilogue is an iPhone app made by Blacktop Social LLC (“Blacktop Social,” “we,” “us”). We are responsible for the personal information described here.

Blacktop Social LLC
606 Metropolitan Avenue, 6B, Brooklyn, NY 11211
legal@blacktop.social

Nutrilogue is in prerelease testing. This policy covers the app, its server, and the duel invite pages it links to. The blacktop.social website has its own privacy policy.

2. What Nutrilogue collects

• Your sign-in. You sign in with Apple or Google. From them we receive your email address, which may be an Apple private relay address, and an account identifier. We also receive your first name if they share it. That first name becomes your display name; without one, you’re “Player.” Your sign-in is part of Blacktop Social’s shared account system, which links it to one Blacktop Social profile keyed to your email (see section 9).
• Your profile. Your goals, birthday, sex, height and time zone. If you’re 18 or over, also your weight and activity level. We compute your daily targets from these. We also keep your settings: whether calorie numbers are shown, and your reminder time.
• Your weight log. Adults can add a goal weight and weigh-ins. Both are optional.
• Your meals. For each meal:
  • when you logged it, and how: camera, photo library, typed, or barcode
  • a short title
  • the foods we estimated and their nutrition: calories, protein, carbs, fat, fiber, added sugar, saturated fat, sodium, 11 vitamins and minerals, whether a food is ultra-processed, and the colours of plants on the plate
  • the portion you chose
  • any protein or calorie guess you made before the reveal
• Your play. Daily scores, streaks, your duel record and rating, and your league weeks.
• Notifications. If you turn them on, we store a push token for your phone and a copy of each notification we send you.
• Photo fingerprints. See section 3.

What stays on your phone:

• your meal photos
• meals waiting to upload, including anything you typed
• your answers during setup, until you sign in
• your sign-in session

Nutrilogue asks for camera and photo library access and nothing else. It doesn’t ask for your location or contacts. It sees only the photos you pick.

3. Meal photos

• How a photo is analysed.
  • When you snap a meal or pick a photo, the app shrinks it and sends it to our server over an encrypted connection.
  • The server makes two fingerprints of the photo, one exact and one visual, so the same meal can’t be scored twice.
  • It then sends the photo to Anthropic’s Claude models, which estimate the foods and their nutrition.
• What we keep.
  • The photo is not saved on our servers. It isn’t written to our database or to file storage.
  • We keep the estimate and the two fingerprints.
• Anthropic processes the photo to send the estimate back to us.
• Typed meals work the same way. Your description goes to Anthropic, and we keep the estimate, not your words. Your words stay in the app’s queue on your phone.
• Barcodes don’t go to an AI at all. See section 7.
• On your phone.
  • A copy of each photo stays in Nutrilogue’s storage on your phone, so your history and share cards can show it.
  • Deleting the app removes these copies. Deleting your account does not.
  • Your phone’s own backups may include them.
• Sharing. When you share a card, it can include your meal photos. You choose where it goes.

4. Health and body information

We treat your birthday, sex, height, weight, weigh-ins, goals, activity level and meal nutrition as sensitive.

• What we use it for. To set your protein, fiber and energy targets, fill your daily rings, check the fuel floor that keeps a very low-calorie day from scoring well, and calculate your daily score. Your goals choose which rings you see first. They never change a target.
• Weight is adults only. Weight, goal weight and weigh-ins are shown to you alone.
• Calorie numbers are off unless you turn them on, and teens can’t turn them on.
• What never happens.
  • Your height, weight, age and calorie numbers never appear on a share card.
  • Your body details, goals and meals are never shown in duels or leagues.
  • Your weight, height, birthday and calorie numbers are never sent to analytics. (Analytics does see your goals, adult or teen mode, and activity level. See section 6.)
  • We never use any of it for advertising, and we never sell it.

5. What other people see

• Duels. Your opponent sees your display name, both scores, who won, and the rating change. The notifications they get about the duel include your display name and the scores.
• Leagues. Leagues are weekly groups of up to 30 people in the same mode, adult or teen, and can include people you don’t know. Everyone in your league sees your display name, your weekly score, your rank, and whether you’re moving up or down.
• Duel links. An invite link carries only a six-character code. The page it opens shows no name and runs no tracking.
• Never shared with other players: your meals, photos, nutrition numbers, goals, or body details.
• Share cards show what’s on the card: scores, rings, meal photos, and on a duel result both players’ display names. They never show calories, weight, height or age. Sharing is always your choice.

Teens only play teens. Adults only play adults.

6. Analytics

We use PostHog, in its US region, to understand how the app is used.

• How it’s set up. No person profile is kept. Events aren’t tied to your account or email. PostHog is told not to look up your location, and we don’t record your screen.
• What events say.
  • which setup steps you finish
  • that a meal was logged, and how
  • score ranges (such as 60–79, never your exact numbers)
  • streak length
  • duel and league actions
  • paywall views and taps
  • which kind of card you shared
  • your chosen goals, adult or teen mode, activity level, units, and sign-in method
• What never goes. The app removes anything labelled as calories, weight, email, phone, token or name before it sends an event.
• Device identifier. PostHog’s app library assigns your phone a random identifier and may record basic device and app-version details.
• Test builds. Analytics is off in development builds, and test builds are labelled as such.
• Opting out. There’s no in-app switch to turn analytics off yet.
• Crash reporting. Nutrilogue doesn’t use a crash-reporting service today.

7. Who we share it with

We don’t sell personal information, and we don’t share it for advertising. We disclose it only to the service providers below, when valid legal process requires it, to protect rights or safety, or as part of a merger, acquisition or transfer of the business. Each provider acts on our instructions.

• Supabase runs sign-in, the database, and the server code behind Nutrilogue.
• Anthropic analyses meal photos and typed descriptions to estimate nutrition (section 3).
• Expo delivers push notifications. It receives your push token and the notification text, which can include another player’s display name and scores.
• Apple handles Sign in with Apple, delivers notifications to your iPhone, and distributes the app through TestFlight and the App Store.
• Google handles Sign in with Google, if you choose it.
• PostHog handles app analytics (section 6).

Open Food Facts is not a service provider. When you scan a barcode, our server asks Open Food Facts for that product and sends only the barcode number. Nothing about you goes with it.

Payments. There are none today. Test builds charge nothing. When Nutrilogue Pro opens, Apple will handle payment.

Where it’s handled. We are based in New York. If you use Nutrilogue from outside the United States, your information may be transferred to wherever our providers process it.

8. How long we keep it

• Your profile, meals, scores, guesses, streaks, duels, league history, weigh-ins, photo fingerprints and estimates, and copies of notifications stay until you delete your account. Nothing expires on its own today.
• Deleting one meal takes it off your log and your scores straight away. Its estimate and photo fingerprint stay in an internal record until you delete your account.
• Unfinished estimates are discarded after two minutes.
• Barcode lookups are cached for 30 days and aren’t linked to you.
• Analytics events are kept on PostHog’s schedule.
• Your sign-in and Blacktop Social profile stay until you ask us to delete them (section 9).
• Emails you send us are kept as long as reasonably needed to answer them and keep business records.

9. Delete your data

In the app: open Me, scroll to the bottom, tap Delete my account, then Delete.

This deletes, straight away:

• your profile, body details and goals
• your meals and their estimates, and your guesses
• your scores, streaks and rating
• your weigh-ins
• your duel and league history
• your photo fingerprints
• your push tokens and the copies of your notifications

A duel you played is removed for the other player too. You’re then signed out. You can sign up again later, but you’ll start fresh. Nothing is restored.

What in-app deletion doesn’t remove:

• Photos and queued meals on your phone. Delete the app to remove them.
• Your Blacktop Social sign-in and shared profile (your email address and account identifier). One sign-in can be used across Blacktop Social apps, so they’re kept separately, along with a note that your Nutrilogue access was deleted. To delete those too, email us (below).
• Analytics events, which aren’t linked to your account.

Without the app, or to delete everything: email legal@blacktop.social from the address you signed in with, or tell us which Apple or Google account you used. Say “Delete my Nutrilogue data” and whether you also want your Blacktop Social sign-in deleted. We’ll confirm the request comes from you, then delete it.

You can also email us to ask what we hold about you, for a copy of it, or to correct it. Depending on where you live, you may have other rights, such as objecting to a use or complaining to your data protection authority. We won’t treat you differently for using a privacy right.

Signing out isn’t deleting. It only signs you out on that phone.

10. Children and teens

Under 13. Nutrilogue isn’t for children under 13. The app asks for your birthday first. If you’re under 13, it stops there, and nothing you entered is saved. If you believe a child under 13 is using Nutrilogue, email legal@blacktop.social and we’ll delete the account.

13 to 17: teen mode. If you’re 13 to 17, Nutrilogue:

• never asks for or stores your weight
• has no goal weight or weigh-ins
• never offers a “lose weight” goal
• doesn’t ask for an activity level
• always hides calorie numbers
• sets your protein target from a reference weight for your age and sex
• only puts you in duels and leagues with other teens

We still ask for your birthday, sex and height, and you pick your goals. If a birthday correction moves an account into teen mode, its weight history is deleted.

11. Security

Nutrilogue uses encrypted connections from your phone to our server and from our server to the database. Every request is checked against your sign-in. The app can’t reach the database directly: one server function with restricted access does all reads and writes. We don’t store your meal photos at all. No method of transmission or storage is perfectly secure, so we can’t guarantee absolute security.

12. Changes

Nutrilogue is a prerelease, and what it collects may change as it’s built. When our practices change, we’ll update this page and its “last updated” date. If a change is material, we’ll say so here before it applies.

13. Contact

Privacy questions, requests and complaints:

Blacktop Social LLC
606 Metropolitan Avenue, 6B, Brooklyn, NY 11211
legal@blacktop.social

Help with the app: support@blacktop.social

See also the Nutrilogue Terms.