Privacy notice

What this covers

This notice covers both the Protein Buddy app and this website. They are different systems that collect different things, so each has its own section below. Where a rule applies to both, it says so.

The controller for both is Melloway, Inc. If you want the short version: the app keeps your food log on your device and backs up selected data under an install identifier. The website has no accounts, and neither asks for more than it needs.

The app

Your food log lives on your device, and logging works offline. The app also backs up your saved meals, goals, profile, favorites, water, manually entered weight and chosen settings to our servers. Before you sign in, this backup is tied to an identifier for this app installation, not to an email address. Creating an account is optional.

If you do sign in with Apple or Google, we attach that backup to your account so you can restore it and sync across your devices. We receive the account identifier the sign-in provider gives us, which for Sign in with Apple can be a relay address rather than your real one. Assistant conversations and meal photo files are not included in this backup.

AI photo and voice analysis. When you use these, only the item being analysed is sent, never your whole log or photo library. Voice is transcribed on your device, so no audio is uploaded. Analysed photos are stored afterwards, which is covered in detail under How the AI analysis works.

Health app sync is off until you turn it on. When enabled, protein and body weight sync two ways with Apple Health or Health Connect. That data moves between the app and the platform health store on your device under permissions you grant and can revoke in the operating system at any time.

Purchases. Subscriptions and one-off purchases are processed by Apple or Google. We receive confirmation of what was bought and its status so we can unlock the right features. We never see your card details.

Diagnostics, usage and advertising identifiers. The app collects crash diagnostics and usage data to find bugs and see which features get used. It also uses advertising identifiers, and those identifiers may be used to track you across apps and websites owned by other companies, which is how we measure whether our app install campaigns work. On iOS this requires the App Tracking Transparency prompt, so if you chose Ask App Not to Track the tracking identifier is not used. You can reset or limit the identifier in your device settings at any time.

The categories above are the ones we declare as privacy labels on the App Store listing: health and fitness, purchases, identifiers, usage data and diagnostics, plus identifiers used for tracking. Where this page and those labels ever disagree, treat this page as the fuller description and tell us, because one of the two needs correcting.

How the AI analysis works

When you use photo or voice logging, the meal you are analysing is sent to our own server, which passes it to a large language model to be turned into an estimate. We use Anthropic's Claude models for this: Sonnet for meal photos and for Protein Scout, and Haiku for voice. If Anthropic is unavailable we may fail over to an equivalent model so the feature keeps working, and we only route to providers whose terms match what this notice promises.

Those model calls do not go straight to Anthropic. They pass through an AI gateway we run ourselves, which holds the provider credentials and forwards the request. The practical effect is that the provider sees the meal being analysed, but not your account, your email or your log.

Voice never leaves your device as audio. Speech-to-text runs on your phone, and only the resulting text is sent for analysis. We never receive a recording of your voice, because none is ever uploaded.

Meal photos are kept after analysis. This is the part people do not expect, so it is stated plainly. When you analyse a meal by photo, we store that original image in our own storage in the European Union (Ireland) so we can check and improve how accurately the app judges portion sizes. It is deleted automatically 90 days after the analysis. It is stored under a random analysis identifier, not under your name or email. It is not used to advertise to you, it is not sold, and it is not shared with data brokers. If you would rather we did not keep your photos at all, email us and we will delete what we hold and tell you how to avoid photo analysis while still logging by barcode, voice or grams.

We look at analyses to fix the app. Each analysis produces a technical trace: which model ran, how long it took, how many tokens it used, and the answer it returned. For voice, the trace also contains the transcribed text you spoke. For photos, the trace holds a pointer to the stored image rather than the image itself. Traces are tied to a random per-install identifier, not to your name or email, and they exist so we can find bugs and bad estimates. Crash reports go to our own self-hosted Sentry.

Your meals are not used to train AI models. We do not train models of our own, and we use Anthropic through their commercial API, under which the content we send is not used to train their models either. There is no setting to opt out of, because there is nothing to opt out of.

The website

Google Tag Manager loads CookieYes and the measurement tags configured for this website. CookieYes manages your measurement choice. Before consent, analytics and advertising storage are denied. If you accept, Google Analytics can receive page views, interactions and calculator milestones. There is no website account.

The protein calculator works in your browser. Your answers, current question and result are saved in this browser for 30 days so you can continue after a refresh. You can remove them sooner by clearing this site's browser data. The calculator also creates a random session identifier and sends Protein Buddy the steps you reach, their order, the acquisition campaign, your browser language and the time of each step. After you start the quiz, Protein Buddy may save your quiz answers as you complete them. A saved answer includes the question and its wording, the answer you chose, and, where the question asks for them, health information or body measurements. These records are linked to the random session identifier and are saved even if you leave before the result. They never include an email address, because the calculator does not ask for one: the plan-building animation hands straight to your target. We use them to provide your calculation and understand and improve how the calculator is used. The only place this website leads to that asks for an email is the RevenueCat checkout, described below, and the address you type there stays with RevenueCat.

Google Ads conversion measurement is configured through Tag Manager rather than called directly by the website. Its conversion tags can receive selected calculator milestones and, for a completed purchase, the value, currency and transaction identifier. They do not receive email addresses, quiz answers, calculated targets, health information or body measurements.

If you choose to see paid tracking options, the site opens a RevenueCat checkout with the acquisition campaign that brought you here and nothing else about you. RevenueCat asks for the email it needs to send a receipt, and handles the account and payment details needed to complete a purchase and make it redeemable in the app. Apple Pay, Google Pay and card details are handled by the checkout and its payment provider, not by this website. Your calculator answers are not placed in the checkout URL and this website never receives the address you give the checkout.

The support form stores your email address, your name if you provide it, the topic and platform you select, your message, your browser language, and the time you sent it. We use these details only to understand your request and reply to you. Please do not include health records, payment card details, passwords, or other sensitive information in your message.

A note on the health-related answers

Whether you take a GLP-1 medication is health information, and we treat it as the sensitive category it is. The calculator uses that answer in your browser because it materially changes the target. After you start the quiz, that answer is saved by Protein Buddy when you select it. It is not sent to analytics, placed in a URL, or passed to the RevenueCat checkout. It is never used for advertising, sold, or shared with advertisers or data brokers.

Why we are allowed to hold it

Checkout and subscription details are processed to take the steps you ask us to take and to perform the purchase contract. Support-form details are processed to answer the request you send and for our legitimate interest in answering product and account questions. Quiz answers are saved on the consent you give when starting the calculator, and you can withdraw that consent by contacting us. Calculator step progress is used for our legitimate interest in understanding how the calculator is used. Optional Google site and advertising measurement follows the CookieYes choice you make. You can reject it without losing any site function and change your choice later through the CookieYes settings control.

In the app, we process your log and account data to perform the contract you enter into by using it, health app sync and AI analysis run on the permission you grant and can revoke, and advertising identifiers are used only on your consent through the platform tracking prompt. Crash diagnostics rest on our legitimate interest in the app not being broken.

How long we keep it

Calculator sessions, answers and results. Calculator data is kept until you ask us to delete it, or for two years after your last interaction with us, whichever comes first. The same two-year limit applies to a session that ends part way through the quiz.

App data. Saved data stays on your device until you delete it or remove the app. The server backup remains until you delete it. In the app, open Settings, then Sync and backup, then Delete account to remove the server backup and local data, whether or not you signed in. You can also ask us to delete it.

Meal photos. Deleted automatically 90 days after the analysis. You can have them deleted sooner by emailing us.

Analysis traces. Short-lived operational records covering which model ran and what it answered, kept only as long as they are useful for debugging.

Who else sees it

Nobody buys any of it, because none of it is for sale.

RevenueCat and the configured payment processor handle the hosted web checkout, subscription state and payment. They receive only what is needed for that purchase, not the answers you gave the calculator.

For the app, these are the parties involved and what each one gets:

• Anthropic — the meal you are analysing, as a photo or as transcribed text, to produce the estimate. Reached through our own gateway, so it does not receive your account or your log.
• Amazon Web Services — hosting, and the storage in Ireland that holds analysed meal photos.
• Apple and Google — optional sign-in, mobile storefront purchases, and wallet payments when you choose Apple Pay or Google Pay on the web.
• RevenueCat and its configured payment processor — subscription checkout, entitlement state, billing and purchase redemption across web and app.
• Our analytics and error tooling — Langfuse for analysis traces and a self-hosted Sentry for crash reports, both keyed to a random install identifier.
• Attribution and ad partners — advertising identifiers for install measurement, as described under The app. This is the one place data is shared with advertisers, and it is why the App Store labels list identifiers as used for tracking.

Health data from Apple Health or Health Connect is never sent to advertisers, never sold, and never shared with data brokers.

Google processes the website measurement and Google Ads conversion events described above. We see aggregate reports, not a website user account or a raw list of people who visited.

Your rights

If you are in the UK, EU, or another jurisdiction with equivalent law, you have the right to ask for a copy of what we hold about you, to have it corrected, to have it deleted, to withdraw consent, and to complain to your data protection authority.

To exercise any of these, email hello@heyproteinbuddy.app. We will action deletion requests within 30 days, and usually a lot sooner. You do not have to give a reason.

Some of these you can action yourself without asking us, which is usually faster. In the app, Delete account in Sync and backup removes the backed-up copy of your data from our servers, even if you never signed in. Revoking the health permission stops sync in the operating system. Turning off tracking, or resetting the advertising identifier, is done in your device settings.

Cookies

CookieYes records and applies your measurement choice. Before consent, analytics and advertising storage are denied. If you accept, the Google tags configured in Tag Manager may create measurement or advertising cookies. You can change your choice through the CookieYes settings control.

Your browser may also contain older_ga, _ga_, _gcl_aw or _gcl_gscookies, or an older _gcl_ls browser storage entry. You can remove them by clearing this site's browser data.

The app does not use cookies, because it is not a browser, but it does use device and advertising identifiers as described under The app. What this website does with cookies says nothing about what the app does with identifiers, so read both.

Changes

If this notice changes in a way that affects what we do with information already collected, we will contact the people it affects rather than quietly updating the date at the top.

Contact

hello@heyproteinbuddy.app. A person reads it.