Privacy Policy

1. Introduction

Kippenhuck Industries Inc. ("NutraForge," "we," "us," or "our") is based in Newfoundland and Labrador, Canada. This Privacy Policy explains what information we collect, how we use it, who receives it, and what choices you have when you use our mobile application and website (collectively, the "Service").

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

2. Information We Collect

Information you give us

• Account: your name, your email address and a user ID we assign. You sign in through Auth0, which handles your password and any social sign-in.
• Profile and health details: date of birth, gender, height, weight, goals, activity level and exercise frequency. Your dietary restrictions and preferences can include allergies, intolerances and religious or ethical choices such as halal or vegan. If you enter any health conditions, we collect those as well. This information can reveal details about your health or your beliefs.
• Location details you type: your city and country.
• Food and drink records: the meals, foods and drinks you log, your favourite meals, your custom drinks, and the nutrition values and reports we calculate from them.
• Feeling check-ins, if you choose to use them: how you feel, the symptoms or other things you note, anything you write in your own words, the time, and internal references to the foods you logged before it. This can reveal details about your health. We ask for your consent before your first check-in and keep a record of it. We use check-ins only to show them back to you and to show you patterns between what you eat and how you feel. A pattern is not medical advice or a diagnosis.
• Chat: the messages you send to the NutraForge assistant, its replies, photos you attach, barcodes you scan, and text from voice dictation. Your phone's own speech service turns your voice into text, and the app receives the text.
• Purchases and promo codes: your subscription status, purchase token or transaction ID, price and currency, and any promo or referral code you enter. Card payments are handled by Apple, Google or Stripe.
• Organisation membership: if your account is linked to an organisation, a record of that link.

Information collected automatically or from your sign-in provider

• Usage: the screens you open and the features you use, how much you use our AI features, and the comments you write when you give an answer a thumbs down.
• Device and identifiers: device and operating system details, the app version, identifiers that the services we use create for your installation, your IP address, and a push notification token that identifies your phone.
• Crash and diagnostic reports: technical details about errors in the app and on our servers.
• Screen recordings: the app can record your screen activity for analytics. In app version 1.1.42 and later, text and images are hidden in these recordings.
• Server records: our servers record which feature a request used, together with your user ID, so we can measure performance and fix errors.
• Sign-in provider details: your profile picture web address, timezone and language setting, where your sign-in provider supplies them.

Our website

Our website does not run analytics, advertising cookies, tracking pixels or third-party scripts. Like any web host, our hosting provider receives your IP address and the pages you request when you load it.

3. How We Use Your Information

We use your information to:

• Create your account, sign you in and keep the Service running
• Calculate your targets and personalize your nutrition insights and recommendations
• Answer your chat messages, read your meal photos and turn your food descriptions into logs, using AI
• Process purchases, subscriptions and promo codes
• Send you messages and push notifications about updates, features and support
• Measure how the Service is used, find and fix errors, and improve the Service
• Let a practitioner in your organisation see your information, if your account is linked to one (see section 5)
• Protect the security of the Service and comply with legal obligations

4. Who Receives Your Information

We do not sell your personal data. We use the providers below to run the Service. Each one handles the information it receives under its own terms and privacy policy.

AI answers

• OpenRouter and the AI model providers it routes our requests to, which by default is Anthropic (Claude), served from providers that keep no copy of your requests: your chat messages, the photos you attach, the text from your voice dictation, the text of your Groups posts and replies and the name of any meal attached to them (see Groups below), and, when the assistant needs them to answer you, your profile, health profile (including dietary restrictions), targets and food logs.
• Exa: for some answers the assistant searches the web. OpenRouter's web search uses the model provider's own search or, for some models, Exa, and the search text is derived from your messages.
• FatSecret and Open Food Facts: FatSecret receives the names of the foods the assistant looks up for you, and both receive the barcode number when you scan a barcode. These requests do not include your name, email or user ID.

Analytics, crash reports and messages

• PostHog: usage events, your user ID, screen recordings (text and images hidden from app version 1.1.42), error reports, logs, your thumbs down comments, and, from our servers, records of AI requests that include the text of messages and replies (image data is redacted) and records of each request our servers handle.
• Sentry: crash reports.
• Customer.io (older app versions only): app versions before 1.1.43 send your name, email address, age, push notification token, and your organisation ID if you have one. We no longer use Customer.io, and version 1.1.43 and later send nothing to it.
• Firebase, from Google: sends push notifications. It receives a token that identifies your phone.

Sign-in, purchases and hosting

• Auth0: signs you in and holds your login details, including your password if you sign in with one.
• RevenueCat: handles purchases and subscriptions in the app, using your user ID.
• WinWinKit: checks promo and referral codes. It receives the code you enter and your user ID.
• Stripe: handles billing for organisation accounts.
• Google Cloud Storage: stores the photos you upload to chat. They are private and are only shown through short-lived links.
• Railway: hosts our servers, our database and its backups, and this website.
• Google Fonts: the app fetches its fonts from Google when it runs, so Google receives your IP address and device details with that request.
• Apple or Google speech service: when you dictate, your phone's speech service turns your voice into text. It may send your audio to its own servers.

Other members, if you join a group

Groups are optional and only for people 18 or older, which we check against the date of birth on your profile. Being in a group can reveal something about your health, so we treat group membership as health information. If you join one, the other members can read what you post in it, under the community name you choose. That name never comes from your account. We don't show member lists, except to a group's owner so they can manage it. Group membership and posts are kept on our own servers and are not sent to our analytics providers. Before a post or reply appears, our own filter screens it, then an AI check looks for signs that someone may be at risk. For that check we send only the text of the post or reply and the name of any meal attached to it. We do not send your name, your community name, your account details or the name of the group. It goes through OpenRouter to our default AI model, Anthropic's Claude, served only from providers that keep no copy. If the check finds a risk, the post is held for our team to read and you are shown support resources. If you can no longer post there, for example because you left the group, the text is not stored and our team does not see it, but you are still shown support resources. If the check is unavailable, our own filter still runs. Log this meal is your choice and works separately: it puts that meal's name in your own chat with our AI. If a Groups request breaks, our error tracking records only that it failed. Our team can read reported and held posts to moderate them. We keep a record of the version of the Groups notice you accepted and when. Deleting your account deletes your posts and that record. You can delete any post yourself at any time, although a post that has been reported, or held because someone may be at risk, stays with our team until they have reviewed it.

Other situations

• Your organisation: if your account is linked to an organisation, its practitioners can see your information (see section 5).
• Legal Requirements: when required by law or to protect our legal rights.

5. Organisations and Practitioners

If your account is linked to an organisation account, for example after the organisation invites you, practitioners in that organisation can see your meal and drink logs, your nutrition targets, your health profile, your favourite meals and your drinks. They can also see your name and profile picture on your client card, and a personal info card that shows your name, gender, date of birth, weight, height, city and country. They can also run an AI assistant over this information, which sends it to the AI providers listed in section 4.

Practitioners cannot see your feeling check-ins. What you enter in a check-in is not sent to AI providers or analytics, although analytics may show that you opened the screen.

The app does not currently ask you to approve this link. If you have questions about organisation access to your information, contact us at privacy@nutraforge.ca.

6. Your Choices and Rights

• Usage analytics and crash reports: in app version 1.1.42 and later, go to Settings, then Privacy, and turn off "Share usage analytics and crash reports." It is on by default. It covers PostHog and Sentry. It does not cover messages from Customer.io, or the records our servers send to PostHog.
• Your profile: you can review and edit your profile details in the app.
• Feeling check-ins: in the app, go to Settings to export your check-ins as a file, or to stop using them and delete them all. Stopping withdraws your consent. We delete every check-in from our database at that point, and we ask again before you make another. Copies in our database backups at Railway remain until those backups expire.
• Delete your account: in the app, or by email (see section 7).
• Other requests: depending on where you live, you may have the right to access your personal data, correct it, object to or restrict how it is used, or withdraw your consent. To make a request or ask a question, email privacy@nutraforge.ca and we will respond within 30 days.

7. Retention and Data Deletion

We keep your account information until you delete your account. You can delete your account at any time. For step-by-step instructions, what is deleted, and what is not, see our dedicated Account & Data Deletion page.

In summary, you can:

• Open Settings in the app, go to Account, and choose "Delete Account," or
• Email us at privacy@nutraforge.ca

When your account is deleted in the app, we delete your profile and health profile, meal and drink logs, favourite meals, custom drinks, feeling check-ins, chat history, reports, promo code redemptions, the photos you uploaded, your organisation membership records and your Auth0 login.

Copies held by PostHog, Customer.io, RevenueCat, Sentry, WinWinKit, Firebase and Stripe are not deleted automatically, and neither are server logs kept by our hosting provider or anything the AI providers keep under their own policies. Conversations that a practitioner in your organisation held with the AI assistant about you belong to that practitioner and are not deleted with your account. Feeling check-ins and other data in our database backups at Railway remain until those backups expire. You can email us to ask for these copies to be removed. RevenueCat and Stripe may keep purchase records for accounting.

We may keep billing and tax records, and records we need for security or fraud prevention, where the law requires it or for those purposes.

8. Data Security

We use the following measures to protect your information:

• The app's store builds connect to our API over HTTPS, and our website is served over HTTPS
• Requests for your profile, logs, chats, favourites and billing information must carry a valid sign-in token from Auth0
• Your password is handled by Auth0 and is not stored in our database
• Our database requires credentials, which are held by our backend services

No method of storing or transmitting information is completely secure, so we cannot guarantee absolute security.

9. International Processing

Kippenhuck Industries Inc. is based in Newfoundland and Labrador, Canada. The providers listed in section 4 process your information in the United States and Canada. Your information may therefore be stored and processed outside your province or country, where privacy laws can differ from those where you live.

10. Cookies and Tracking

Our website does not use advertising cookies, analytics cookies, tracking pixels or third-party scripts. The app contains no advertising, and it uses the analytics services described in section 4, which identify you by your user ID. You can turn off usage analytics and crash reports in the app (see section 6).

11. Children's Privacy

Our Service is not intended for anyone under the age of 16. The app asks for your date of birth when you set up your profile, and its date picker does not offer a date that would make you younger than 16. We do not knowingly collect personal information from anyone under 16. If we learn that we have collected information from a person under 16, we will delete it. Groups have a higher limit: they are only for people 18 or older.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

13. Contact Us

If you have questions about this Privacy Policy, please contact us at: