Privacy notice

What this covers

This notice covers both the Protein Buddy app and this website. They are different systems that collect different things, so each has its own section below. Where a rule applies to both, it says so.

The controller for both is Melloway, Inc. If you want the short version: the app keeps your food log on your device, the website has no accounts at all, and neither asks for more than it needs.

The app

Your food log lives on your device. Logging works offline, and creating an account is optional. If you never sign in, your log stays local and we do not receive it.

If you do sign in with Apple or Google, we store your log on our servers so it can be backed up and synced across your devices. We receive the account identifier the sign-in provider gives us, which for Sign in with Apple can be a relay address rather than your real one.

AI photo and voice analysis. When you use these, only the item being analysed is sent, never your whole log or photo library. Voice is transcribed on your device, so no audio is uploaded. Analysed photos are stored afterwards, which is covered in detail under How the AI analysis works.

Health app sync is off until you turn it on. When enabled, protein and body weight sync two ways with Apple Health or Health Connect. That data moves between the app and the platform health store on your device under permissions you grant and can revoke in the operating system at any time.

Purchases. Subscriptions and one-off purchases are processed by Apple or Google. We receive confirmation of what was bought and its status so we can unlock the right features. We never see your card details.

Diagnostics, usage and advertising identifiers. The app collects crash diagnostics and usage data to find bugs and see which features get used. It also uses advertising identifiers, and those identifiers may be used to track you across apps and websites owned by other companies, which is how we measure whether our app install campaigns work. On iOS this requires the App Tracking Transparency prompt, so if you chose Ask App Not to Track the tracking identifier is not used. You can reset or limit the identifier in your device settings at any time.

The categories above are the ones we declare as privacy labels on the App Store listing: health and fitness, purchases, identifiers, usage data and diagnostics, plus identifiers used for tracking. Where this page and those labels ever disagree, treat this page as the fuller description and tell us, because one of the two needs correcting.

How the AI analysis works

When you use photo or voice logging, the meal you are analysing is sent to our own server, which passes it to a large language model to be turned into an estimate. We use Anthropic's Claude models for this: Sonnet for meal photos and for Protein Scout, and Haiku for voice. If Anthropic is unavailable we may fail over to an equivalent model so the feature keeps working, and we only route to providers whose terms match what this notice promises.

Those model calls do not go straight to Anthropic. They pass through an AI gateway we run ourselves, which holds the provider credentials and forwards the request. The practical effect is that the provider sees the meal being analysed, but not your account, your email or your log.

Voice never leaves your device as audio. Speech-to-text runs on your phone, and only the resulting text is sent for analysis. We never receive a recording of your voice, because none is ever uploaded.

Meal photos are kept after analysis. This is the part people do not expect, so it is stated plainly. When you analyse a meal by photo, we store that original image in our own storage in the European Union (Ireland) so we can check and improve how accurately the app judges portion sizes. It is deleted automatically 90 days after the analysis. It is stored under a random analysis identifier, not under your name or email. It is not used to advertise to you, it is not sold, and it is not shared with data brokers. If you would rather we did not keep your photos at all, email us and we will delete what we hold and tell you how to avoid photo analysis while still logging by barcode, voice or grams.

We look at analyses to fix the app. Each analysis produces a technical trace: which model ran, how long it took, how many tokens it used, and the answer it returned. For voice, the trace also contains the transcribed text you spoke. For photos, the trace holds a pointer to the stored image rather than the image itself. Traces are tied to a random per-install identifier, not to your name or email, and they exist so we can find bugs and bad estimates. Crash reports go to our own self-hosted Sentry.

Your meals are not used to train AI models. We do not train models of our own, and we use Anthropic through their commercial API, under which the content we send is not used to train their models either. There is no setting to opt out of, because there is nothing to opt out of.

The website

This site uses Google Tag Manager to load its measurement tags, which count page views and a small set of interactions, including article reads, internal links, and App Store or Google Play button clicks. Those tags set a first-party Google Analytics cookie in your browser, described under Cookies, so that repeat visits from the same browser are counted as one visitor rather than several. Advertising storage stays denied: no advertising cookie is set, we do not use this data to build advertising audiences, and there is no website account.

The protein calculator works in your browser. Your answers, current question and result are saved in this browser for 30 days so you can continue after a refresh. You can remove them sooner by clearing this site's browser data. When you start, the calculator also creates a random session identifier and sends Protein Buddy the steps you reach, their order, the acquisition campaign, your browser language and the time of each step. This lets us measure where people leave the quiz. These progress records do not include your answers, email, calculated target, health information or body measurements. After the plan is built, the calculator asks for your email before showing the result. If you continue, your email, calculated target, campaign, browser language and a complete snapshot of the quiz are sent to Protein Buddy and saved with your consent. That snapshot stores every question shown to you, its order and wording, and the answer you chose. Each completed run is a separate submission, even when the same email is used again. Your email is not saved in browser storage or sent to website analytics.

If you choose to see paid tracking options, the site opens a RevenueCat-hosted checkout with only the acquisition campaign that brought you here. RevenueCat may then ask for the account, contact and payment details needed to complete a purchase and make it redeemable in the app. Apple Pay, Google Pay and card details are handled by the checkout and its payment provider, not by this website. Your calculator answers and the email entered in the calculator are not placed in the checkout URL.

The support form stores your email address, your name if you provide it, the topic and platform you select, your message, your browser language, and the time you sent it. We use these details only to understand your request and reply to you. Please do not include health records, payment card details, passwords, or other sensitive information in your message.

A note on the health-related answers

Whether you take a GLP-1 medication is health information, and we treat it as the sensitive category it is. The calculator uses that answer in your browser because it materially changes the target. If you submit the email form, that answer is saved by Protein Buddy with the complete quiz snapshot described above. It is not sent to analytics, placed in a URL, or passed to the RevenueCat checkout. It is never used for advertising, sold, or shared with advertisers or data brokers.

Why we are allowed to hold it

Checkout and subscription details are processed to take the steps you ask us to take and to perform the purchase contract. Support-form details are processed to answer the request you send and for our legitimate interest in answering product and account questions. Calculator email, result and quiz answers are saved on the consent you give on the result form. You can withdraw that consent through the unsubscribe link in an email or by contacting us. Anonymous calculator progress and site measurement are used for our legitimate interest in understanding whether these pages work, where the calculator becomes difficult and whether people can reach the correct app store. If you would rather not be counted, the Cookies section explains how to refuse the cookie it uses.

In the app, we process your log and account data to perform the contract you enter into by using it, health app sync and AI analysis run on the permission you grant and can revoke, and advertising identifiers are used only on your consent through the platform tracking prompt. Crash diagnostics rest on our legitimate interest in the app not being broken.

How long we keep it

Calculator results and email. A calculator submission is kept until you ask us to delete it, or for two years after your last interaction with us, whichever comes first. Anonymous calculator progress follows the same two-year limit.

App data. A log that never leaves your device is kept until you delete it or remove the app, and we cannot delete it for you because we never had it. If you signed in, deleting your account removes the synced copy from our servers.

Meal photos. Deleted automatically 90 days after the analysis. You can have them deleted sooner by emailing us.

Analysis traces. Short-lived operational records covering which model ran and what it answered, kept only as long as they are useful for debugging.

Who else sees it

Nobody buys any of it, because none of it is for sale.

RevenueCat and the configured payment processor handle the hosted web checkout, subscription state and payment. They receive only what is needed for that purchase, not the answers you gave the calculator.

For the app, these are the parties involved and what each one gets:

• Anthropic — the meal you are analysing, as a photo or as transcribed text, to produce the estimate. Reached through our own gateway, so it does not receive your account or your log.
• Amazon Web Services — hosting, and the storage in Ireland that holds analysed meal photos.
• Apple and Google — optional sign-in, mobile storefront purchases, and wallet payments when you choose Apple Pay or Google Pay on the web.
• RevenueCat and its configured payment processor — subscription checkout, entitlement state, billing and purchase redemption across web and app.
• Our analytics and error tooling — Langfuse for analysis traces and a self-hosted Sentry for crash reports, both keyed to a random install identifier.
• Attribution and ad partners — advertising identifiers for install measurement, as described under The app. This is the one place data is shared with advertisers, and it is why the App Store labels list identifiers as used for tracking.

Health data from Apple Health or Health Connect is never sent to advertisers, never sold, and never shared with data brokers.

Google processes the website measurement events described above as our analytics provider. We see aggregate reports, not a website user account or a raw list of people who visited.

Your rights

If you are in the UK, EU, or another jurisdiction with equivalent law, you have the right to ask for a copy of what we hold about you, to have it corrected, to have it deleted, to withdraw consent, and to complain to your data protection authority.

To exercise any of these, email hello@heyproteinbuddy.app. We will action deletion requests within 30 days, and usually a lot sooner. You do not have to give a reason.

Some of these you can action yourself without asking us, which is usually faster. In the app, deleting your account removes the synced copy of your log from our servers. Revoking the health permission stops sync in the operating system. Turning off tracking, or resetting the advertising identifier, is done in your device settings.

Cookies

This website sets one kind of cookie: the first-party Google Analytics cookies named _ga and _ga_ followed by a measurement id. They hold a randomly generated number that lets us tell a returning browser from a new one, they last up to two years, and they are readable only by this site. They are not used for advertising and are never shared with advertisers or data brokers.

This website sets no advertising cookies. Advertising storage is denied on the page before Tag Manager loads. What any individual tag does is configured inside the container rather than here, so if that configuration changes, this notice must change with it.

You can refuse the analytics cookie by blocking cookies for this site in your browser, or by using its private browsing mode. Nothing on this site stops working without it.

The app does not use cookies, because it is not a browser, but it does use device and advertising identifiers as described under The app. What this website does with cookies says nothing about what the app does with identifiers, so read both.

Changes

If this notice changes in a way that affects what we do with information already collected, we will contact the people it affects rather than quietly updating the date at the top.

Contact

hello@heyproteinbuddy.app. A person reads it.