Privacy Policy

Frulo is made by Alessandro Bortoluzzi, an independent developer based in Italy, who is the data controller for the processing described below and can be reached at support@frulo.app.

Frulo needs an account. Your journal syncs to our servers so it survives a lost phone and follows you to a new one, which means there is a copy of what you log outside your device. This policy explains exactly what that copy contains, what the AI features send to OpenAI, and what our analytics sees.

Your account

You sign in with an email address and password, or with Sign in with Apple. Authentication is handled by Supabase Auth, which stores your email address, a hashed password when you set one, and the account identifier every row of your data is keyed on. We never see your password in readable form.

Sign in with Apple gives us whatever address you chose to share — your own, or Apple's private relay address — and, on the very first authorization only, the name you allowed Apple to pass along, which is saved with the account. Apple also returns a single-use code that our server exchanges for a refresh token. That token is stored in a table only our server can read, and exists for one reason: so deleting your account can also revoke Frulo's Sign in with Apple session, as Apple requires.

What Frulo stores about you

Your data lives in two places: a database on your device, and your own rows in our Postgres database at Supabase, which the app keeps in sync. Row-level security means only your signed-in session can read or write those rows.

Kept in both places:

• Your profile — the name you gave the app, gender, year of birth, height, activity level, your goal (lose, maintain, or gain), target weight and weekly pace, and your daily targets for calories, protein, carbohydrates, fat, and water.
• Meals — every food you log: its name, calories, protein, carbohydrates and fat, and where they are known sugars, fibre, saturated fat and salt; the portion; which meal it belongs to; the barcode of the scanned product when there was one; and when you logged it.
• Water — each amount and the time you drank it.
• Weight — each weigh-in and its date.
• Coach memories — short facts the AI coach saved at your prompting, such as dietary preferences, allergies, intolerances, and dislikes. You can read and delete them in Settings.
• Saved recipes — recipes you kept or described, with their ingredients, steps, and per-serving nutrition.

Some things never leave your device. Your conversation with the coach is held in memory only: it is not written to disk, not synced, and gone when the app closes. So are the coach's tone setting and your onboarding progress.

Meal photos are never stored. A photo you take or pick is downscaled, sent for analysis, and discarded as soon as the estimate comes back. It is not saved in the app, not saved on our servers, and not sent to our analytics.

Apple Health

If you allow it, Frulo writes what you log into Apple Health — energy, protein, carbohydrates, fat, sugar, fibre, saturated fat, sodium, water, and body weight — and reads back your active energy and body weight, so your daily calorie budget can follow how much you actually moved.

Health data stays on your device, under Apple's control. Nothing Frulo reads from Apple Health is sent to our servers, to OpenAI, or to our analytics; the active-energy figure is used on your device to adjust that day's numbers and nowhere else. We do not use health data for advertising or marketing, we do not sell it, and we do not disclose it to any third party without your consent. You can grant or withdraw each permission at any time in the iOS Health app, and Frulo keeps working without them.

The AI features

Three parts of Frulo use OpenAI: the scan that turns a meal photo or description into calories and macros, the AI coach, and the nutrition estimate for a recipe you describe. Before the first of them ever runs, Frulo shows a data-sharing notice you have to accept. If you decline, nothing is sent and the barcode scanner and product search keep working.

None of these calls go from your phone to OpenAI directly. They go to our own server functions at Supabase, which hold the API key and add the model settings, and those functions call OpenAI. No AI provider credential ships inside the app.

What leaves your device:

• For a meal scan — the photo, or the description you typed. Nothing else: not your profile, not your journal.
• For a described recipe — the description you typed.
• For the coach — your message and any photos you attached; one summary line carrying your name, gender, age, height, goal, pace, target weight and daily targets; your saved coach memories; and, when the coach needs them to answer, the results of the tools it calls, which include entries from your journal, your statistics, product lookups, and your recipes.

OpenAI processes this as our processor under its API data processing terms and does not use it to train its models. Meal scans and recipe estimates are sent with storage switched off, so OpenAI does not keep them after the request. Coach conversations are stored, because each turn refers back to the one before it; they are kept on OpenAI's servers for around 30 days before deletion, alongside the abuse-monitoring logs OpenAI keeps for up to 30 days.

Because you decide what to type, please do not put anything into a coach message that you would not want handled this way: medical diagnoses, other people's details, or contact information.

Speech dictated to the coach is transcribed entirely on your device by Apple's on-device speech recognition. The audio never leaves your phone; only the text you then choose to send does.

Analytics

Frulo uses PostHog for product analytics, on PostHog's EU Cloud. PostHog acts as our processor and only processes this data on our instructions. We use it to understand how the app is used, to find broken flows, and to run the feature flags that let us switch a feature off remotely.

PostHog processes:

• Your identifier. Once you sign in, your PostHog person is identified by your account id — the same id your rows are keyed on. Before sign-in, events belong to a random identifier generated on your device. It is not your Apple ID and not an advertising identifier.
• Product events — onboarding steps viewed and answered, a meal logged (which meal, how it was logged, how many calories), a recipe saved, coach prompts and cards tapped, and the review prompt being requested.
• Onboarding answers, bucketed before they leave your device. Age, height, weight and target weight are converted into ranges (for example "70–79 kg", "35–44") and the date of an event you are preparing for becomes a horizon ("1–3 months"). Your exact numbers are never reported, and the name you typed is never reported at all.
• AI events, including their content. Every model call is recorded with its model, token counts, latency, and which tools ran — and with the text involved: the message you sent the coach, the coach's reply, the tool calls and their results, and the description you typed for a meal scan. Photos are not sent to analytics: an attached image is recorded only as the marker "image attached", and a scanned meal photo as "food photo". A thumbs up or down you give an answer is recorded against the same conversation. We read these back to improve the coach and the scanner.
• Errors the app has already shown you an alert for, captured with their context.
• Session replays. PostHog's mobile session replay is on. It records a wireframe of the screen, not a video: with PostHog's default masking, which we have not changed, text is masked and every image — food photos included — is replaced by a placeholder. Network timing is captured with it; console logs are not.
• Technical metadata — app version, operating system version, device model, language, time zone, and your IP address, which PostHog uses to derive an approximate location (country and region) and not to build an advertising profile.

PostHog also delivers in-app surveys. If we ever run one, the answers you choose to give go to PostHog.

Purchases

Frulo's subscription is managed with RevenueCat, which handles purchase validation, entitlements, restoring purchases, and refund-related processing. RevenueCat processes an app user id — your account id once you are signed in, an anonymous one before that — along with purchase and subscription history, transaction information, and related technical metadata. Your PostHog identifier is attached to the RevenueCat customer so subscription events can be joined onto product analytics.

Payment is taken by Apple. We never receive your card details.

By using Frulo and making in-app purchases, you consent to our sharing of data regarding your usage and consumption of purchased content with Apple, as necessary to help Apple make informed decisions regarding refund requests, in compliance with Apple's policies.

Permissions Frulo asks for

• Camera — to photograph a meal or scan a barcode.
• Microphone — to dictate a message to the coach, transcribed on your device.
• Photos — picking an existing photo runs through the iOS photo picker, which hands Frulo only the picture you chose. Frulo has no access to the rest of your library.
• Notifications — asked during the trial step, so we can remind you before a free trial ends.
• Apple Health — as described above.

Every one of them is optional, and every one can be revoked in iOS Settings.

Legal bases

We are established in Italy, so the GDPR applies. We process your personal data on these bases:

• Creating and running your account, and syncing your journal to it — performance of our contract with you, Art. 6(1)(b).
• Health and nutrition data — see the note below.
• Sending meals, photos, and coach messages to OpenAI — your explicit consent, given through the in-app data-sharing notice before any AI feature runs. You can withdraw it at any time by not using those features and by writing to us.
• Product analytics and feature flags — our legitimate interest in understanding and improving Frulo, Art. 6(1)(f). You can object at any time.
• The content of AI requests recorded in analytics — your explicit consent, given through the same data-sharing notice; it is withdrawable and, when withdrawn, we delete the events recorded for your account.
• Purchases, subscriptions, and refunds — performance of our contract with you, and our legitimate interest in preventing abuse of trials and refunds.
• Security, debugging, and preventing misuse — our legitimate interest in keeping Frulo working and safe.
• Notifications — your consent, given in the iOS permission prompt.

A note on health data. What you record about your body and your eating — weight, height, age, calories, macronutrients, allergies and intolerances saved as coach memories — is data concerning health, a special category under Art. 9 GDPR. We rely on your explicit consent under Art. 9(2)(a) for all of it. You give that consent when you set up your profile and start logging, and again through the data-sharing notice before any AI feature runs. You may withdraw it at any time by deleting your account, which erases the data from our servers; withdrawal does not affect processing carried out before it.

Who your data reaches

We use these processors, and no others:

• Supabase — the database that holds your rows, the authentication that runs your account, and the server functions that call OpenAI.
• OpenAI — the model behind meal analysis, the coach, and recipe estimates.
• PostHog — product analytics, error tracking, session replay, feature flags, and surveys.
• RevenueCat — subscription and purchase management.
• Apple — the App Store and in-app purchases, Sign in with Apple, Apple Health, and on-device speech recognition.

The packaged-food database Frulo searches comes from Open Food Facts under the ODbL licence, but it is a copy held on our own servers: Open Food Facts never sees what you scan or search for.

We do not sell your data, we do not share it for advertising, and we do not track you across other companies' apps and websites. Frulo contains no advertising SDK and requests no tracking permission.

International transfers

PostHog processes our analytics on its EU Cloud, inside the European Union.

Supabase and OpenAI are United States companies, and RevenueCat is too, so using them involves transferring personal data outside the EEA and the UK. Those transfers are made under the European Commission's standard contractual clauses, which are incorporated into each provider's data processing agreement, together with the supplementary measures those agreements describe. Apple's transfers are governed by Apple's own privacy policy and its data transfer arrangements.

How long we keep things

The copy on your device stays until you delete it, delete the app, or sign in with a different account, which clears the previous account's local data.

Your rows on our servers stay until you delete your account, which removes them immediately. An entry you delete inside the app leaves a tombstone so the deletion can propagate to your other devices; those tombstones are purged automatically 90 days later.

Data held by OpenAI, PostHog, RevenueCat, and Apple follows those providers' own retention rules, described above where we know them. Analytics events and replays are kept for as long as they remain useful for understanding how Frulo is used, and are deleted when they no longer are, or when you ask us to delete them.

Security

Everything travels over TLS. Your rows are protected by row-level security, so one account's session cannot read another's. Passwords are hashed by Supabase Auth and never stored or transmitted in readable form. The Apple refresh token kept for account deletion sits in a table with no access policies at all, reachable only by our server functions. No AI provider key ships inside the app. On your device, the database lives in the app's sandbox and is protected by iOS file encryption.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach ever affects your data and is likely to put your rights at risk, we will notify you and the supervisory authority as the GDPR requires.

Your rights

Under the GDPR you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw any consent you have given.

Much of this you can do without asking us. Your profile and targets are editable in Settings. Coach memories have their own page where you can read and delete each one. Any meal, water, or weight entry can be deleted from the journal. And Settings → Account → Delete Account erases everything at once.

For anything else — a copy of your data, an objection to analytics, the deletion of the analytics events recorded for your account — write to us at support@frulo.app from the address your account uses, and we will answer within one month.

You also have the right to lodge a complaint with a supervisory authority. Ours is the Italian Garante per la protezione dei dati personali (garanteprivacy.it); you may also complain to the authority where you live or work.

California privacy rights

If you live in California, the CCPA as amended by the CPRA gives you the right to know what personal information we collect and why, to request a copy of it, to have it corrected or deleted, and not to be discriminated against for exercising any of these rights.

The categories we collect are described throughout this policy: identifiers (your account id and email address), internet and app activity, and health and nutrition information you enter yourself, which California treats as sensitive personal information. We use sensitive personal information only to provide the features you asked for and to improve them — never to infer characteristics about you.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done so, including for consumers under 16. Because we do not sell or share, there is nothing to opt out of, and we run no financial incentive programme. To exercise any of these rights, or to have an authorised agent do it for you, write to support@frulo.app.

Children's privacy

Frulo is not directed at children. We do not knowingly collect personal data from anyone under 13, or under the higher age of digital consent that applies where they live — 14 in Italy, and up to 16 elsewhere in the EEA. If you believe a child has given us their data, write to support@frulo.app and we will delete the account and everything attached to it.

Deleting your account and your data

Open Settings, tap Account, then Delete Account and confirm. This calls our server, which revokes your Sign in with Apple session where one exists, deletes your account, and cascades that deletion through every table: your profile, meals, water, weights, coach memories, saved recipes, and the stored Apple token. It cannot be undone.

The copy on your device is not removed by that step; delete the app to remove it. Anything Frulo wrote into Apple Health stays in Health, where you can delete it from the Health app. Analytics events are not deleted automatically — write to us and we will delete the ones recorded for your account.

Changes to this policy

We may update this Privacy Policy from time to time by posting a new version here with an updated effective date. If a change materially affects how we handle your data, we will say so in the app before it takes effect.

Contact

Alessandro Bortoluzzi support@frulo.app

Effective date: August 31, 2026