PocketPlate Privacy Policy

1. Who This Policy Covers

This Policy applies to users of the PocketPlate iOS and Android apps and the pocketplate.app website. Additional rights for EEA/UK/Switzerland users are in Section 12. Additional rights for U.S. state residents are in Section 11. This Service is not directed to children under 13 — see Section 10.

2. Personal Information We Collect

Directly from you:

• Account and profile: name, email, date of birth (age verification), gender (optional), profile photo (optional), country
• Health and nutrition data (voluntarily provided): foods, beverages, and supplements logged via photo, voice, text, barcode, or USDA search; calorie and macronutrient targets; micronutrient data (23 nutrients tracked); body measurements (optional); physical activity levels and goals; supplement names, dosages, schedules; dietary restrictions; health conditions you choose to share; progress photos (optional). Health data — including data that may reveal or allow inference of a health condition — is treated as sensitive personal information.
• Communications: support requests, feedback, survey responses
• Payment: All in-app purchases are processed by Apple App Store or Google Play Store. Web purchases are processed by Stripe. We do not store payment card numbers.

Automatically collected:

• Device identifiers: IP address, device ID, advertising identifier (IDFA/AAID), OS, device model
• Usage data: features accessed, screens viewed, frequency and duration of use
• Log data: timestamps, error logs, crash reports
• General location inferred from IP address (not precise GPS unless granted)

From third parties:

• Apple Sign In / Google Sign In: name and email from identity provider if you use social login
• Apple HealthKit / Google Health Connect: fitness and nutrition data with your explicit permission. We do not use HealthKit data for advertising or sell it.
• USDA FoodData Central API: nutritional data for food searches (no personal data sent to USDA)
• NIH Dietary Supplements Database: supplement information (no personal data sent to NIH)

3. AI Disclosure

PocketPlate uses artificial intelligence to identify foods from photos and voice input and to estimate caloric and nutritional content. All AI-generated results are approximations. Before any AI-generated food entry is saved to your log, you are shown the AI's confidence score and must confirm or edit it. Nothing is saved without your explicit action. We do not use individually identifiable health data to train third-party AI models without your consent.

4. How We Use Your Information

5. How We Share Your Information

We do not sell your personal information. We do not share identifiable health data with advertisers.

We may share with: (a) Service Providers — third-party vendors processing data on our behalf under contractual data protection agreements, including cloud infrastructure, analytics, payment processing, customer support, email delivery, and crash reporting; (b) Platform Partners — Apple App Store and Google Play Store, solely as required to deliver the app and process purchases; (c) Legal Requirements — when required by law, court order, or to protect rights and safety; (d) Business Transfers — if PocketPlate is acquired or merged, with prior notice to you; (e) With Your Consent — for any sharing not described above.

6. Third-Party SDKs and Service Providers (Privacy Nutrition Label)

[DEVELOPER: Audit this list against your actual integrations before publishing. Remove placeholder rows and add any missing services.]

7. Cookies and Tracking Technologies

Our website uses cookies. Categories: Strictly Necessary (always on — required for login, security); Functional/Analytics (off by default, enabled with consent); Advertising/Targeted (not currently used — if added, we will update this Policy and seek consent).

You can manage cookies in your browser settings or our cookie preference center. Disabling functional cookies may affect some site features.

8. Data Retention

• Account data: retained while active, deleted within 30 days of verified deletion request.
• Health and nutrition logs: deleted on account deletion.
• Payment records: 7 years per tax/financial requirements.
• Support communications: 3 years.
• Anonymized/aggregated analytics: may be retained indefinitely.

To request deletion, email support@pocketplate.app with subject "Data Deletion Request."

9. Data Security and Breach Notification

We use industry-standard security including TLS encryption in transit and at rest, access controls, and regular security assessments. In the event of a data breach creating risk to your rights, we will notify affected users and applicable regulators within required timeframes (30–72 hours GDPR; 30–45 days U.S. state laws) via email and/or in-app notice.

10. Children's Privacy (COPPA)

PocketPlate is not directed to children under 13. We do not knowingly collect data from children under 13. We collect date of birth at signup to verify minimum age. If we learn a child under 13 has registered, we will delete their data and close their account. To report a potential under-13 account: support@pocketplate.app. Users aged 13–17 may use the Services only with parental consent and supervision.

11. Your U.S. Privacy Rights

California (CCPA/CPRA):

You have the right to know, delete, correct, opt out of sale/sharing, limit use of sensitive data, and non-discrimination. We do not sell personal information. Submit requests to support@pocketplate.app — subject "California Privacy Request." We respond within 45 days.

Colorado (CPA), Virginia (VCDPA), Connecticut (CTDPA), and Other States:

You may have rights to access, correct, delete, portability, and opt out of targeted advertising, sale, and significant-decision profiling. Contact: support@pocketplate.app.

Do Not Sell or Share:

We do not sell or share personal information for targeted advertising. We honor the Global Privacy Control (GPC) browser signal where required. See our Do Not Sell or Share My Info page.

12. GDPR — EEA, Switzerland, and UK Users

Data Controller: [POCKETPLATE LLC], [ADDRESS]. Contact: support@pocketplate.app. EU Representative (if required): [INSERT].

Lawful bases for processing are listed in Section 4. Consent may be withdrawn at any time without affecting prior lawful processing.

Your GDPR rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), protection from solely automated decisions (Art. 22). Contact support@pocketplate.app to exercise rights; we respond within 30 days. You may lodge complaints with your local supervisory authority.

Data transfers from the EEA to third countries use Standard Contractual Clauses (SCCs) or other appropriate safeguards. We have signed Data Processing Agreements (DPAs) with all processors handling EEA personal data.

13. Washington My Health MY Data Act

For Washington State residents — see our dedicated Washington Health Data Privacy Policy at pocketplate.app/washington-health-data. We do not sell consumer health data. To exercise MHMD Act rights: support@pocketplate.app — subject "Washington Health Data Request."

14. Changes to This Policy

We will notify you of material changes via email and/or in-app notice at least 14 days before they take effect. Continued use after the effective date constitutes acceptance.

15. Contact Us