1. What we collect
Information you give us
- Account: your email address and name, and an identifier from Apple or Google if you sign in with them. We never see your password when you use Apple or Google sign-in.
- Profile and goals: date of birth, height, current weight, target weight, activity level, dietary goal, daily calorie and macronutrient targets, and preferred languages.
- Food and health logs: the meals, drinks, recipes and ingredients you log, with times and amounts; weight entries; and the history of your goals.
- Photos and voice: food photos you take or upload, and voice messages you record, when you use those ways of logging. We do not access your photo library beyond the pictures you choose.
- Chat: the messages you exchange with the Omu assistant.
- Support: anything you send us when you contact us.
Information collected automatically
- Device and app data: device model, operating system version, app version, language, time zone, a push notification token if you enable notifications, and a random installation identifier.
- Usage and diagnostics: which features you use, how many AI messages you send (to apply the free-tier limit), errors and crashes.
- Purchase information: whether you have an active subscription, the product, renewal and expiry dates, and store transaction identifiers. Apple or Google process your payment; we never receive your card details.
- Website: omu.fit uses PostHog analytics to count page views and clicks on the contact button. Until you accept cookies, analytics runs without storing anything in your browser. If you accept, PostHog sets a first-party cookie with a random visitor identifier so that repeat visits are counted as one person. There are no advertising cookies, and you can change your choice at any time in .
We do not collect precise location, contacts, or data from Apple Health or Google Health Connect. If we add such features in the future we will ask for your permission first and update this policy.
2. Your health data
Your weight, height, date of birth, goals, food logs, photos and related chat are information about your health. We treat all of it as sensitive data under the laws that apply to you, including the GDPR, the California Consumer Privacy Act and Washington’s My Health My Data Act.
We collect this data only with your explicit consent, which you give in the app during onboarding before you enter any body measurements or goals. We record when you gave it. You can withdraw it at any time as described in Section 6.
We commit that we will:
- use it only to provide the features you asked for, to keep the Service secure, and to improve Omu, including training our own AI models to recognize food and estimate nutrition better, as described below;
- never sell it, never share it with advertisers or data brokers, and never use it for advertising or marketing;
- never use it to make decisions about credit, insurance, employment or housing;
- share it only with the processors named in Section 4, who act under our instructions;
- delete it when you delete your account.
3. How we use information
| Purpose | What we use | Legal basis (GDPR) |
|---|---|---|
| Create and secure your account, sign you in | Account, device data | Contract |
| Estimate calories and macros, remember your foods, run the chat | Food logs, photos, voice, chat, profile | Explicit consent (health data), contract |
| Set and track your daily targets and progress | Profile, goals, weight and food logs | Explicit consent (health data), contract |
| Apply the free-tier limit and unlock your subscription | Usage counts, purchase information | Contract |
| Send reminders and notifications you turned on | Push token, your notification settings | Consent |
| Fix bugs, prevent abuse, keep the Service secure | Device, usage and diagnostic data | Legitimate interest |
| Improve Omu: check why an estimate was wrong, and train and evaluate our own AI models | Food logs, photos, chat and the estimates you corrected, reviewed in samples by the Omu team or used as training data | Explicit consent (health data), legitimate interest for non-health data |
| Answer support requests and legal obligations | What you send us, account data | Contract, legal obligation |
We do not build advertising profiles, we do not show third-party ads, and we do not make automated decisions about you that have legal or similarly significant effects.
4. Who processes your data
We do not sell personal data. We share it only with service providers that process it on our behalf under contracts that require them to protect it at least as well as this policy requires and to use it only for the purposes we specify. The current providers are:
| Provider | Purpose | Data | Location |
|---|---|---|---|
| OpenAI | AI food recognition, nutrition estimates, chat replies, voice transcription | Food photos, meal descriptions, voice recordings, chat messages, and the profile details needed for an answer (goals, targets) | United States |
| Convex | Database, file storage and backend hosting | All account, profile, log and content data; uploaded photos | United States |
| Clerk | Sign-in and account security | Email, name, sign-in provider identifier, session tokens | United States |
| Adapty | Subscription status and paywall configuration | Anonymous device identifier, subscription and purchase events from the store, app version | United States |
| Apple and Google | App distribution, payment, sign-in (when you choose it), push notifications | Purchase receipts, push token; Apple or Google account details stay with them | Per their policies |
| Expo | Delivering push notifications | Push token, device platform | United States |
About the AI provider
When you log a meal by photo, voice or text, or send a message to the assistant, that content is sent to OpenAI’s API to be interpreted. Under OpenAI’s API terms, data sent this way is not used to train their models and is deleted from their systems after a short retention period used for abuse monitoring (currently up to 30 days). We send only what is needed for the request. If we change or add an AI provider we will update this table.
Our own models
We may use your food photos, logs, chat and the corrections you make to train, fine-tune and evaluate models used by Omu so that food recognition and nutrition estimates improve. Such models may be hosted by us or built on a third-party AI platform. This processing is covered by the consent you give in onboarding. When you delete your account the underlying data is deleted; a model already trained with it cannot be un-trained, but it does not contain your data in a form that identifies you.
Other disclosures
We may also disclose information if required by law or a valid legal request, to protect the rights, safety or property of Omu, our users or others, or to a successor if Omu is acquired or merged, in which case this policy continues to apply and you will be notified of any change.
5. How long we keep data
- While you have an account: we keep your profile, logs, photos and chat so that Omu can remember your foods and show your history.
- When you delete your account: your profile, logs, photos, chat and recipes are deleted from our live systems within 30 days, and from backups within 90 days. Our processors are instructed to delete their copies on the same schedule.
- Purchase records: we keep subscription and transaction records for as long as tax and accounting laws require, without the associated health data.
- Inactive accounts: if you have not opened Omu for 24 months we may delete your account after emailing you a warning.
- Support messages: kept for up to two years so we can follow up.
6. Your choices and rights
In the app
- Edit your profile, goals and any log at any time.
- Delete your account from Settings. This starts the deletion described above and cannot be undone.
- Withdraw consent for health data at any time by deleting your account. Processing that happened before withdrawal stays lawful.
- Notifications can be turned off in Settings or in your device settings.
By request
Wherever you live, you can ask us to access, correct, export, or delete your personal data, to restrict or object to how we use it, or to withdraw consent, by emailing privacy@omu.fit. We will verify the request using your account email and answer within 30 days (45 days for California residents, extendable once where the law allows). You will not be treated differently for exercising your rights, and you can appeal a decision by replying to our response.
European Economic Area, United Kingdom and Switzerland
The data controller is Aleksandr Lider, an individual developer based in Spain, publishing as Omu. Our legal bases are listed in Section 3. Your data is stored and processed in the United States; transfers are protected by the European Commission’s Standard Contractual Clauses (and the UK Addendum) with each provider, and by the EU-US Data Privacy Framework where the provider is certified. You have the right to lodge a complaint with your local data protection authority.
California
The categories of personal information we collect are listed in Section 1; the sensitive personal information among them is your health data, precise account credentials, and the contents of your messages. We collect them only for the purposes in Section 3, we do not sell or share personal information for cross-context behavioral advertising, and never have. You have the rights to know, delete, correct, limit the use of sensitive information, and non-discrimination. We honor Global Privacy Control signals on omu.fit.
Washington and other US states: consumer health data
This section is our consumer health data privacy policy under Washington’s My Health My Data Act and similar laws in Nevada and Connecticut. The consumer health data we collect is: body measurements (height, weight, date of birth), dietary and nutrition information (food and drink logs, photos of food, recipes), health goals, and chat messages that describe them. We collect it directly from you when you type, speak, photograph or enter it in the app, and we use it only for the purposes in Section 3. We share it only with the processors in Section 4, and we do not sell it. You can access, withdraw consent for, or delete your consumer health data as described above, and you may appeal by replying to our response; if the appeal is denied you may contact the Washington Attorney General.
7. Security
Data is encrypted in transit (TLS) and at rest with our hosting provider. Access to production systems is limited to the people who need it to run Omu and is protected by multi-factor authentication. Photos are stored in private storage and served through expiring links. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the relevant authorities as the law requires.
8. Children
Omu is not intended for anyone under 16, and we do not knowingly collect data from children under 16 (or under 13 in the United States). If you believe a child has created an account, email privacy@omu.fit and we will delete it.
9. Changes to this policy
We will post any changes here with a new “last updated” date. If a change materially affects how we use your health data, we will ask for your consent again in the app before it applies.
10. Contact
Omu is operated by Aleksandr Lider, an individual developer based in Spain. Privacy questions and requests: privacy@omu.fit. See also our Terms of Use.