Privacy
Your log stays on your device. Photos are sent only to identify a meal, and we do not keep them. This page spells out exactly what that means, in the order you probably want to know it.
The short version
- Your meals, symptoms, and photos live in your browser's own storage on your device.
- Our server holds an account record: your email address, whether Pro is active, and a couple of counters.
- A meal photo is sent to identify the dish, and is not stored on our servers.
- We ask for no name, age, gender, weight, or onboarding quiz.
- Nothing syncs anywhere unless you switch a destination on yourself.
- You can export everything, free, and delete everything, without asking us.
- No advertising, no third-party analytics, no tracking cookies.
What stays on your device
The app keeps your timeline in IndexedDB, the browser's own on-device database. That is the source of truth: everything you see in the app is read from there, and every statistic is calculated there.
- Meals — the dish name, the ingredients and how confident the recognition was, and any note you write.
- Meal photos, as image files. Photos are only ever stored on your device.
- Symptoms and their severities, Bristol stool scores, and stress and sleep check-ins.
- Deletion markers, so an entry you delete on one device stays deleted on the others.
- A queue of entries still waiting to sync, if you have turned a sync destination on.
- Your sign-in token and your settings, in the browser's local storage.
Deleting the app's data in your browser, or removing the app from your device, removes all of it. That cuts both ways: browser storage can also be evicted when a device runs short of space, so your data is yours — keep a copy wherever you like. The export below is how.
What we keep on our servers
One record per account, and it is this short:
| Field | What it holds |
|---|---|
email |
The address you sign in with. The only personal detail we ask for. |
pro |
Whether Pro is switched on for the account. |
proUntil |
When Pro runs out, or empty for a lifetime purchase. |
freeAiUsed |
How many free AI actions you have used, so the trial can be counted. |
stripeCustomerId |
Stripe's reference for your payments, set only if you buy Pro. |
createdAt |
When the account was created. |
There is no field for your log, your photos, your symptoms, or a profile. Alongside that record, the server holds a few short-lived operational things:
- A one-time sign-in code, stored as a hash rather than the code itself, with an expiry ten minutes out and a count of wrong attempts. It is deleted the moment you use it.
- Rate-limit counters, keyed by your email address or by the network address a request arrived from, so the sign-in endpoint cannot be hammered. They expire with their time window.
- A tally of foods we could not illustrate, which tells us what to draw next. It records a food name and a count, and is not linked to an account.
If you buy Pro, the payment itself happens on Stripe's own checkout page. We never see or hold your card details — only the customer reference in the table above.
What is transmitted to recognise a meal
This is the one place your data leaves the device, so it is worth being precise about.
When you snap a meal, the photo is sent to our server, which passes it to Google's Vertex AI to identify the dish and its ingredients. The names come back, the app writes them into your on-device log, and the photo is not written to any database, bucket, or log file on our side. We keep the picture nowhere; the copy in your timeline is on your device.
The AI insight feature works from a summary your device calculates first — counts and associations, not your entries. Your raw log, your notes, and your photos are not sent to generate an insight.
Everything else the app does, including all of the pattern analysis and the food ranking, runs on your device and needs no network at all.
Where your log syncs, if you want it to
The default is local-only: no sync, no copies, nothing to opt out of. There are two destinations you can switch on, independently, in Settings. Both are part of Pro, and neither is ever on by default.
SnapGut Cloud
Our own sync, for keeping two devices in step and restoring after a reinstall. When you turn it on, this device uploads your structured entries — meals and ingredients, symptoms and severities, Bristol scores, stress and sleep values, and any note text — to our server storage, along with deletion markers so a delete travels between your devices. Meal photos are not part of it and stay on your device. The app shows you this before the first upload and will not start without your acknowledgement.
A Google Sheet you own
A readable mirror of your timeline in your own Google Drive. The app creates one spreadsheet and can only touch that spreadsheet. The rows carry the same columns as the CSV export, so no photo data goes into it. The sheet is yours: disconnecting leaves it in your Drive, and deleting it is between you and Google.
Exporting everything
Export is free on every account, is never behind Pro, and needs no network. From Settings:
- Backup writes a single JSON file with your whole timeline, photos included, which you can save wherever you keep files. The same screen restores from one.
- Export as CSV writes a spreadsheet of your timeline: date and time, entry type, dish, confident and possible ingredients, symptoms, Bristol score, stress, sleep, and your note.
Deleting everything
Three separate things can be deleted, and you control each of them without contacting us:
- The copy in SnapGut Cloud. Settings has a Delete cloud copy control that erases every entry and deletion marker we hold for you. Your on-device log is untouched, and it works even if Pro has lapsed, so a former subscriber can always remove their cloud copy.
- Your account. Deleting the account removes your cloud copy first and then the account record itself, including any pending sign-in code. If any part of that fails, we report it as incomplete and change nothing else, so you can simply repeat it rather than being left with data we can no longer reach.
- The data on your device. Delete individual entries in the app, or clear the site's data in your browser to remove the whole local store, photos and all. That is entirely local and does not involve us.
If you have connected a Google Sheet, that spreadsheet lives in your Drive and is deleted from there.
Email we send you
Sign-in codes, sent through Resend, our email provider. That is the only email the app sends: no marketing list, no notifications, nothing else.
Who else is involved
The service runs on Google Cloud: Cloud Run serves the app, Firestore holds the account record and any cloud sync data, Cloud Storage holds our food illustrations, and Vertex AI does the meal recognition. Stripe handles payments and Resend sends the sign-in codes. Cloudflare sits in front of the site.
These pages load no third-party scripts, embed nothing from another domain, and set no tracking cookies. There is no analytics product, no advertising network, and no SDK collecting anything in the background.
Changes to this page
When what the app does changes, this page changes with it — it describes the software as it actually behaves, and we would rather correct it than keep a comfortable sentence that is no longer true.