Privacy Policy — Anoteo
Last updated: July 19, 2026
This policy covers the Anoteo app (iOS, iPadOS, macOS, watchOS) and the anoteo.com website (together, the "Service"), operated by Abed Alnkib ("we"). The guiding principle: everything is local. Anoteo is designed so that your personal data — meals, photos, weight, goals and profile — is stored and processed on your device only, and the AI analysis runs on-device. There are no user accounts, no usage analytics, no ads, and we do not sell or rent personal information to anyone — now or ever. This policy explains transparently what stays with you, what reaches us only with your consent, and what your rights are.
1. Data stored on your device only
Your meal log and photos, weight and water data, nutrition targets, personal profile (age, height, weight, activity level), allergen lists (yours and any family members you added), products and recipes you created, supplements, achievements and display preferences. This data is processed by the on-device AI engine; meal photos never leave the device for analysis. Deleting the app permanently deletes all of it.
2. iCloud sync (your account, not ours)
If you enable iCloud sync, data syncs between your devices through your private iCloud account using Apple's encrypted CloudKit infrastructure. We have no access to it — technically or legally. Your profile syncs via iCloud Key-Value Store so a second device does not require re-onboarding. You can turn sync off anytime in Settings.
3. Apple Health
Only with your explicit permission, the app reads and writes Health data (weight, water, dietary energy, sugar, sodium, caffeine, alcohol, and sleep/activity data for insights). This data stays in Health under your full control, is never sent to us, and the permission can be revoked anytime in system settings.
4. Data sent to us only on your explicit action
• Sharing a missing product: tapping "Send" uploads the product details (name, barcode, nutrition values, ingredients, country) and any photos you attached, for review and inclusion in the shared database. • Feedback: your text, screenshots you chose to attach, an email address if you chose to leave one, plus app version, device model, OS version and language — for diagnostics only. • Technical diagnostic reports: sent only if you explicitly enable them in Settings, and can be disabled anytime.
5. Website contact form and updates
When you contact us through the website's contact form, we store the details you provide (name if given, email if given, and the message) in a secured database (Convex), solely to respond to your inquiry and improve the Service. These details are not used for marketing and are not shared with third parties. Inquiries are deleted or anonymized no later than 24 months after being resolved, and you may request their deletion at any time.
6. Routine network traffic
• Downloading barcode packs, food-name packs and the "What's new" feed from our server: as with any internet request, your IP address is exposed to the server. We do not log or store app users' IP addresses. • AI models download directly from Hugging Face servers; Hugging Face's privacy policy applies to that download. • Product photos are never loaded from the internet — the app does not contact third-party image servers, so your scanning patterns are not exposed to anyone.
7. Recipe and challenge sharing — serverless
A recipe or family-challenge invite you share is encoded inside the link itself (in the URL's # fragment, which by web standards is never sent to a server). The content does not pass through us and is not stored by us. Note: anyone holding the link can read its content — share only with people you choose.
8. Anonymous install identifier and App Attest
To prevent abuse of the shared services (spam floods), product submissions and feedback include a random identifier created at installation. It is not linked to your identity, contains no personal detail, and resets on reinstall. We additionally use Apple's App Attest to verify requests come from a genuine copy of the app — a mechanism that does not reveal your identity.
9. Payments and subscriptions
Purchases and subscriptions are processed entirely by Apple through your App Store account. We never receive, see or store any payment details (card numbers, account details, etc.). Subscription status is verified locally on-device via StoreKit, with no intermediary server of ours.
10. Security
On-device data is protected by the operating system's encryption, and you can add an app lock (Face ID / Touch ID / passcode). Manual backups can be password-encrypted (AES-GCM). Communication with our servers is TLS-encrypted. Database admin operations are protected by access keys, and the amount of data that reaches us in the first place is minimal by design.
11. Retention and deletion
On-device data is kept until you delete it or the app; full export is available in Settings. Approved product submissions are merged into the shared database; feedback and inquiries are kept no longer than 24 months. To remove content you sent us (a product, feedback or an inquiry), write to us and we will remove it within 30 days.
12. Your rights
Under the Israeli Privacy Protection Law and comparable regulations (including the GDPR where applicable), you have the right to access data sent to us, correct it, delete it and receive a copy. Since almost all data lives only with you, most rights are exercised directly on the device: full export in Settings and complete deletion by removing the app. For anything else, write to us and we will respond within 30 days.
13. Children
The Service is not directed at children under 13 (or the applicable age of consent in your country) and we do not knowingly collect personal information from children. If we learn of such data, we will delete it immediately.
14. Changes to this policy
We will announce material changes in the app and on this page at least 14 days in advance. The last-updated date appears at the top of this document. Continued use after a change takes effect constitutes acceptance of the updated policy.
15. Contact
For any privacy question, request or complaint: abed3228@gmail.com, or via the website's contact form. This document is an integral part of the Terms of Use.