There is no account, so there is no profile to leak. Analysis happens on the device; the only thing that leaves on its own is a photo or a voice clip sent for recognition, and that is deleted as soon as it has been read. The exceptions are an analysis you choose to publish as a share link, and a short nutrient summary you send when you build a grocery list. Nothing is used to train anything.
0
Accounts required
0
Advertising or telemetry
0
Recordings retained
CSV
Export your own data
01
Entries, symptoms, and analysis live on the phone. There is no sign-up and no account, so there is nothing to log into and nothing to breach.
02
The app works offline. A request leaves the device only to identify food from a photo or a voice clip; that photo or clip is deleted from the server immediately after analysis. Nothing else is sent, except when you create a share link (see 07) or build a grocery list (see 08).
03
No advertising, no telemetry, no third-party analytics on your food log or your symptoms.
04
Your entries are never used to train or fine-tune models.
05
Nutrition data is written to Apple Health, and activity data read back, only with your permission — both revocable in the Health app at any time.
06
Export the full log to CSV whenever you want. Deleting the app deletes the log with it, so export first if you want to keep it.
07
Nothing is shared unless you create a share link. Doing so uploads that one analysis and, if you choose, its food photo, with the photo's metadata removed. The page is public: anyone can view it, and it can appear in search engines and be read by AI tools, with the photo if you included it. Links created with earlier versions of the app, which said they would not be searchable, are never listed. The page stays online until you delete it in the app — deleting the analysis or clearing your history deletes it too — or until you ask support@justaddtofu.com to remove it. Search engines drop a deleted page the next time they check it. No account or personal identifier is attached to a share; the upload's IP address is used briefly to prevent abuse and is not stored with the page.
08
A grocery list is built only when you tap “Build my grocery list”. The app then sends a short summary: the average daily amounts of the nutrients it flagged, the names of up to 30 foods you log often, your diet type, your allergies, your “foods I don't eat” text, and the app language. No photos, meal times, Apple Health data or account details are sent. The summary passes through our server to our AI provider, Cerebras, which generates the suggestions; we do not store it after the list is returned. To enforce the weekly limit, a random ID the app creates when it is installed is kept for up to 8 days. It is not linked to your identity.
No. Audio is converted to text for the entry and discarded. Where recognition can run on the device it does, and nothing is transmitted at all.
No. Without an account there is no identity attached to a request, and your food log is not sent to us. A share link you create uploads that one analysis, with no identifier attached. Building a grocery list sends a short summary (see 08), which is not stored after the list is returned.
A photo sent for recognition is analysed and deleted immediately. It is not retained, not associated with you, and not used for training. If you include the photo in a share link, that copy is stored with the shared page, metadata removed, until you delete the link.
privacy@justaddtofu.com for anything about data handling, or support@justaddtofu.com for the app itself. See support.