Privacy Policy — Anoteo
Last updated: October 15, 2026
This policy covers the Anoteo app (iOS, iPadOS, macOS, watchOS, Android and Wear OS) and the anoteo.com website (together, the "Service"), operated by Abed Alnkib ("we"), who is the controller responsible for the personal data described here. The guiding principle is that your health and nutrition data is local: your meals, photos, weight, goals, profile, allergens and anything the app reads from Apple Health or Health Connect stay on your device, and the app does not sync them to any cloud. By default, meal analysis runs on an AI model on your device. Apart from routine downloads and the anti-abuse check described in section 10, data leaves your device only when you choose to send it — for example by creating a care-circle link, sending a product report or feedback, or connecting a cloud AI with your own key. There are no user accounts and no ads, we do not sell or rent personal information, and health data is never used for advertising or profiling. This policy explains what stays with you, what is sent and to whom, how long it is kept, and what your rights are.
1. Data stored on your device
Your meal log and meal photos, weight entries and progress photos, water and other daily counters, nutrition targets, personal profile (a name if you enter one, date of birth, sex, height, weight, activity level, goals, diet style, and pregnancy or breastfeeding details if you add them), allergen lists for you and the family members you add, your foods, recipes and products, supplements, fasting settings, meal plans and health programs, your chat history with the AI, the Shabbat, holiday, Ramadan and kosher settings if you turn them on, permissions and consents are kept in the app's storage on your device, together with values the app derives from Apple Health or Health Connect (such as your daily-score history and weekly insights). Your Apple Watch or Wear OS watch and your widgets get what they display directly from your phone, with no server in between. Optional automatic backups (off by default) also stay only on the device — on Apple devices as files in the app's storage that are left out of iCloud and computer backups and protected by the device's data protection while it is locked (they are not password-encrypted; an exported backup can be — section 14), on Android encrypted with a key kept in the Android Keystore. On Android you can also choose a folder (for example Documents, a memory card or a folder another app syncs) to which a copy of each automatic backup is also written, encrypted with a password you set. The app does not keep the password itself and never uploads the copies, and they stay in that folder after you delete or reset the app; what happens in the folder itself is up to you and the app that manages it. On Apple devices, if you use iCloud Backup or back up to a computer, the operating system includes the app's other data in your device backup, under your own account; on Android the app is excluded from Android backup, so nothing is copied to Google. Meal photos are never uploaded automatically.
2. iCloud (Apple devices only)
Meal sync through iCloud is not available in this release: the app does not store your meals, photos, weight, profile, goals, allergens or any Apple Health data in iCloud (your device's own iCloud Backup is described in section 1). If you turn on preference sync — off by default — only display preferences (language, appearance and theme, units, the choice and order of dashboard tiles and menus, and similar settings) and the list of achievement badges you have unlocked are kept in your iCloud account through Apple's iCloud Key-Value Storage, so they follow you to your other Apple devices; no values such as water, meals or weight are included. You can stop the sync, and remove the synced display preferences from iCloud, in Settings; resetting the app removes all synced values. The Android app has no cloud sync.
3. Apple Health, Health Connect and your watch
Health access is off until you turn on a connection in the app and grant the matching system permission, and you can revoke it at any time in the Health app (Apple) or in Health Connect's settings (Android). • Apple Health (iPhone): with separate switches, the app can read active energy, steps, walking and running distance, workouts and activity rings; heart rate, resting heart rate, heart-rate variability and VO2 max; weight, body-fat percentage and lean body mass; sleep; blood glucose; and menstrual flow — and it can import your weight into the weight log. If you turn on writing, it saves dietary energy, protein, carbohydrates, fat, fiber, sugar, sodium, water, caffeine, alcoholic drinks and weight to Apple Health. • Apple Watch: during a workout you start, the watch app reads heart rate and active energy and saves the workout to Apple Health. • Health Connect (Android): the app can read steps, active calories, sleep, heart rate, heart-rate variability, VO2 max and exercise sessions; menstrual periods and blood glucose each have their own switch; and, if you turn on weight import, it reads your weight into the weight log. With write access, it saves your meals (calories and the meal's name), water, and workouts with their active calories. • Wear OS: during a workout you start, the watch reads heart rate and calories from its own sensors and sends only the workout's duration, calories and type to your phone. This data is used only inside the app, on your device — for your log, trends, day score, insights and reminders (a local notification may mention an insight based on your sleep or cycle). It is never sold, never used for advertising, marketing, profiling or credit decisions, never used to train AI models, and never uploaded to our servers, with one exception that you control: weight values you choose to include in a care-circle share (section 4), which can include weights imported from Apple Health or Health Connect. On Apple devices, your latest weight and its recent change can also be part of an "Ask AI" request to a cloud AI you connected, only after you approve that request (section 5). The app does not sync Apple Health data to iCloud. Data the app wrote to Apple Health or Health Connect stays there until you delete it in those apps. Anoteo's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.
4. Care circle — sharing with a dietitian, partner, caregiver or doctor
Nothing is shared until you create a care-circle link. When you do, the app uploads to our server a summary of the last 28 days containing only the items selected on the sharing screen: daily calories and protein, the number of meals logged, your weight on the days you logged it (which can include weights imported from Apple Health or Health Connect), your calorie and protein targets, a note you write (up to 500 characters) and your weekly meal plan (dish names by day and meal). The summary never includes your name, email address, photos, or the names and descriptions of the meals in your log, and it is not linked to your install identifier. On Apple devices you can preview exactly what will be sent. The summary is encrypted end to end: before uploading, the app encrypts it on your device (AES-256-GCM) with a key that exists only in the link itself, in the part after "#", which browsers never send to a server. Our server therefore stores it in a form that neither we nor anyone who gains access to our database can read; the page decrypts it in the browser of the person you share it with. Links created before this encryption (in app versions earlier than 0.7.5) remain readable on our server until they expire, at most 30 days; creating a new link encrypts it. • Who can see it: anyone who has the full link (anoteo.com/s/…, including the part after "#"), until it expires or you revoke it. The page is excluded from search engines — share it only with the person you choose. • Updates: on Apple devices the app also refreshes the summary automatically each time it starts, at most every 6 hours, while the link is active; on Android it is updated only when you tap to update it. If your Pro subscription ends, no new data is uploaded to the link, and you can still revoke it. • Expiry and revocation: you choose how long the link stays valid, up to 30 days. Revoking it deletes the shared summary from our server as soon as the request reaches it — if you are offline, the app keeps the link and retries until our server confirms. Expired and revoked links are erased completely within about two days. Resetting the app also revokes an active link; deleting the app does not — revoke the link first, or it stays viewable until it expires. • Suggestions back: the person you share with can send you a suggested weekly meal plan from the page. It is encrypted with the same key and stored with the link, and the app shows it as a proposal that changes your plan only if you accept it.
5. Cloud AI with your own API key (optional)
Cloud AI is off by default: meal analysis and "Ask AI" run on the model on your device. If you connect a cloud provider — OpenAI, Google (Gemini), Anthropic (Claude) or an OpenAI-compatible server you specify — with your own API key, the app sends requests directly from your device to that provider. They never pass through our servers, and we never see their content, your key or the answers. • Apple devices: every cloud request needs your approval first. A meal-analysis request contains your description, the items and quantities, and the on-device result; the meal photo is included only if you separately allowed photo uploads, and it is re-encoded without its metadata. An "Ask AI" request contains your question and relevant context from your log — such as the meal you are asking about, the last 14 days' calories, protein and meal counts, your calorie target, matching past meals, recent averages, and your latest weight and its recent change — as text only. Your profile, allergens, label photos and voice recordings are never sent. • Android: cloud AI is used only in the AI chat, when you select it, and a request contains only the question you type. • Your key is kept in the device's secure storage (the Keychain on Apple devices; encrypted with an Android Keystore key on Android) and is sent only to the provider you chose. Resetting the app deletes it. • The provider handles each request under its own terms and privacy policy, as part of your own account with it — including how long it keeps requests. You can switch back to the on-device model or remove the key at any time.
6. Data you choose to send us
• Missing product: if you turn on sharing when you save a product, the app sends its details — barcode, name, brand, package size, ingredients, nutrition values per 100 g and country — and the label or package photos you took, for review and inclusion in the shared databases. A quick report sends only the barcode and country. On Apple devices these include an App Attest proof (section 10). • Restaurant menu ("Send for review"): the restaurant's name, the type of request and what you add — location, a source link, details, up to 3 photos or screenshots, and an email address if you choose to leave one — for review before anything is added to the downloadable menus. • Feedback: your message, an email address if you choose to leave one, on Apple devices up to 3 screenshots you attach to a bug report, and technical details: app version, platform (such as iOS, iPadOS, macOS or Android), operating-system version and the app's language. If you report an AI answer ("Report this answer"), the report goes through the same channel and contains the reported answer (up to 1,500 characters), the reason you chose, an optional note and which engine produced it (the on-device model or the name of the cloud AI provider you connected) — never your question or an API key. • Crash and diagnostic reports: stored on your device and sent only when you tap Send, or automatically if you turn that on (off by default). They contain technical data only — on Apple devices, a summary of crash and hang counts with a short signature for each crash; on Android, the time, the error type and the code locations involved — never meal content, photos or health data. Everything in this section also carries your app version, your language setting and the install identifier (section 10). Photos and screenshots are re-encoded on your device before upload, without their metadata (such as where a photo was taken).
7. The anoteo.com website
The website has no accounts, analytics, advertising or tracking cookies. It is hosted on Amazon Web Services and served through Cloudflare, which process standard request data (such as your IP address, browser type and the page requested) to deliver the pages and protect them from abuse. When your browser's language isn't supported, the site uses the country that the host derives from your IP address only to choose a language, and a single functional cookie (NEXT_LOCALE) remembers a language you pick. The calorie calculator and the recipe and challenge pages work entirely in your browser. • Contact form: we store what you provide — your name and email if you give them, your message and the page language — in our database, solely to answer you and improve the Service. It is never used for marketing and never shared with third parties. • Care-circle pages (anoteo.com/s/…) load the encrypted summary from our server only while the link is valid, decrypt it in your browser with the key in the link, and are excluded from search engines. A suggested weekly plan sent from such a page is encrypted with the same key and stored with that link (section 4).
8. Routine network traffic and device features
• From our server the app downloads the AI-model catalog, barcode, food, food-name and restaurant packs and their updates, the "What's new" feed and, on Apple devices, the current legal texts. These requests carry no personal data (a pack update names only the country and the version you have); as with any internet request, the server sees your IP address, which we do not store in our database. Some downloads start automatically, such as the AI model during setup (over Wi-Fi by default) and, on Apple devices, the food pack for your region. The app may also check for app notices, such as a required update; such a request carries only the platform, app version and language. • The AI-model and pack files themselves are stored with Cloudflare (R2 object storage): the app fetches each file through a short-lived signed link that our server issues, so Cloudflare sees your IP address and standard request data (such as the time and the file requested); nothing else about you is sent. • Weather (Apple devices, optional): if you turn on hot-day water reminders, once a day the app sends your approximate location (reduced accuracy) to Apple's WeatherKit to get the local forecast. The location is not stored and is not sent to us. Travel mode's location check sends your approximate location to Apple Maps only to find which country you are in. • Calendar (Apple devices, optional): when you ask, the app adds workout or supplement events to your calendar, and for busy-day planning or travel dates it reads your events on the device only; event details are neither stored by the app nor sent anywhere. • Text and barcode recognition happen on your device — with Apple's frameworks on Apple devices and with Google ML Kit on Android. ML Kit may send Google technical information about its operation (such as device model, OS and app versions, an installation identifier, performance metrics and error codes), but not your images or the recognized text. • Voice input: on Apple devices, speech is recognized on the device only. On Android, voice input uses your device's speech-recognition service (usually Google's), which may process the audio under that service's own privacy policy. • Importing a recipe from a web address downloads that page directly from the site you entered. • Product photos are never loaded from the internet — the app does not contact third-party image servers, so your scanning patterns are not exposed to anyone.
9. Recipe and challenge sharing — serverless
A recipe or family-challenge invite you share is encoded inside the link itself (in the part after "#", which by web standards is never sent to a server), and a recipe QR code carries it inside an app link; a challenge invite includes the group name you chose. The content does not pass through us and is not stored by us. Note: anyone holding the link can read its content — share it only with people you choose.
10. Anonymous install identifier and App Attest
To protect the shared services from abuse (such as spam floods), the app creates a random identifier the first time it needs one. It is attached to product reports and submissions, restaurant-menu submissions, feedback and diagnostic reports, requests to upload photos and requests to create a care-circle link, so we can enforce per-installation limits and block abusive installations. For care-circle links it serves only the hourly limit on creating them: it is kept for 2 days in a separate record, is never stored with the link itself and is not sent when the summary is uploaded or viewed. It is not derived from your device, Apple ID or Google account, is not linked to your identity and is never used for tracking; it is not included in care-circle summaries, downloads or cloud AI requests. Resetting the app keeps it; reinstalling creates a new one. On Apple devices, after setup the app also registers an App Attest key — a hardware-backed key from Apple that proves requests come from a genuine copy of the app — sending the key's identifier, Apple's attestation and the install identifier; product reports and submissions carry a signature from that key. App Attest does not reveal your identity.
11. Payments and subscriptions
Purchases and subscriptions are processed entirely by the store where you buy — Apple through your App Store account, or Google through your Google Play account. We never receive, see or store any payment details (card numbers, account details, etc.). The app checks your subscription status on the device with StoreKit (on Apple devices) or Google Play Billing (on Android); our servers receive nothing about your purchases.
12. Service providers and international transfers
We use a small number of providers, each receiving only what its function needs: • Amazon Web Services (Amazon Web Services EMEA SARL) hosts our backend — the database for everything described in sections 4, 6, 7 and 10 — and the anoteo.com website, on servers in Frankfurt, Germany. It processes this data on our behalf under its data-processing terms. • Cloudflare (Cloudflare, Inc.) stores the AI-model and pack files and the files the app uploads, delivers them to the app over its global network (section 8) and fronts the anoteo.com website, processing the request data on our behalf under its data-processing terms. Cloudflare participates in the EU–U.S. Data Privacy Framework and its UK and Swiss extensions. • Apple and Google provide services you use directly — the App Store and Google Play, App Attest, iCloud, WeatherKit and Apple Maps, Apple Health and Health Connect, ML Kit and the Android speech service — under their own privacy policies. • A cloud AI provider you connect (section 5) receives your requests directly, under your own agreement with it. This means your personal data may be processed outside your country, including in the United States. For users in the European Economic Area, the United Kingdom and Switzerland, transfers to our providers rely on safeguards recognized by law, such as the European Commission's Standard Contractual Clauses or the EU–U.S. Data Privacy Framework. We do not sell, rent or trade personal information, and we do not share it for advertising.
13. Legal bases for processing
Where the EU or UK GDPR or similar laws apply, we process personal data on these bases: • Providing the features you ask for (Art. 6(1)(b)) — delivering downloads, creating and serving a care-circle link, handling a submission you send, and answering your feedback or messages. • Our legitimate interests (Art. 6(1)(f)) — keeping the shared services secure and free of abuse (install identifier, App Attest and rate limits), fixing problems reported to us, and improving the shared product and restaurant databases. • Your consent (Art. 6(1)(a)) — for optional features such as automatic diagnostic reports, which you can turn off at any time. • Health data is a special category of data (and, under Israeli law, information of special sensitivity). The app processes it on your device on your instructions, and any health data that leaves the device — a care-circle share, or a request you choose to send to your own cloud AI provider — is sent only on the basis of your explicit consent (Art. 9(2)(a)), given when you create the share or send the request. You are under no legal obligation to give us any information: everything you send is voluntary, and the only consequence of not sending it is that the related feature (a reply, a share or a submission) is unavailable. You can withdraw consent at any time — by revoking a link, turning a feature off or removing a permission — without affecting what was done before.
14. Security
On-device data is protected by the operating system's encryption, and you can add an app lock (biometrics, your device passcode or an in-app PIN). Manual exports can be protected with a password (AES-GCM encryption with a key derived from it); an export without a password is a readable file, so keep it somewhere safe. Backup copies kept on Android in a folder you chose are always password-encrypted. Automatic backups on Apple devices are not password-encrypted, but they stay on the device, are left out of iCloud and computer backups and are protected by the device's data protection while it is locked. Communication with our servers and with cloud AI providers is encrypted in transit (TLS), except a server you configure yourself over plain HTTP. API keys are kept in the system's secure storage. Care-circle links use random codes, are encrypted end to end with a key that only the link holds, expire when you choose and can be revoked instantly. Access to our database is limited to us and protected by secret credentials, and changes made with our admin key are logged. No system is perfectly secure; if a breach affecting your personal data occurs, we will act as the law requires, including notifying the competent authority and, where possible, you.
15. Retention and deletion
• On your device: until you delete it. Deleting the app removes its data from the device, except data it wrote to Apple Health or Health Connect, files you exported yourself, backup copies in a folder you chose on Android and your device backups (on Apple devices, a cloud AI key kept in the system Keychain may also remain — remove it in the app first). The reset option in the app's settings erases the app's data from the device without uninstalling it — including meals, photos, profile, targets, weight history, plans, chat history, local backups and the AI key — and revokes an active care-circle link; downloaded AI models and food packs are kept. On Apple devices it also removes the preferences synced to iCloud and the widget and search data. • Care-circle links: until the expiry you chose (up to 30 days) or until you revoke the link; revoking deletes the shared summary as soon as our server receives it, and expired or revoked links are erased completely within about two days. • Product, barcode and restaurant-menu submissions and their photos: deleted automatically 24 months after we receive them; product facts we accept become part of the shared databases, which are published under the ODbL license. • Feedback (with any screenshots), diagnostic reports and contact-form messages: deleted automatically 24 months after we receive them. • Upload-limit records (install identifier and time of the request): 2 days. App Attest registrations: deleted automatically 24 months after registration. Records of installations blocked for abuse: as long as needed to prevent abuse. • Preferences synced to iCloud stay in your iCloud account until you delete them or reset the app (section 2). To have something you sent us deleted sooner, write to us (section 19); we will delete it within 30 days.
16. Your rights
Depending on where you live — including under Israel's Privacy Protection Law, 5741-1981 (as amended by Amendment 13) and, where it applies, the GDPR — you have the right to access the personal data we hold about you, to have it corrected or deleted, to receive it in a portable format, to object to or restrict processing based on our legitimate interests, and to withdraw consent at any time. Because most of your data is only on your device, you exercise most of these rights in the app itself: a full export to a file in Settings, correcting or deleting entries directly (or everything, with the reset option), revoking a care-circle link on its screen, and turning off Health permissions, cloud AI or diagnostics whenever you like. For data you sent us, write to us (section 19). Because there are no accounts, tell us the email address you used, or describe what you sent and when (for example, a barcode), so we can find it; we will reply within 30 days. You may also lodge a complaint with a data-protection authority — in Israel, the Privacy Protection Authority; in the EU or UK, the authority where you live.
17. Children
The Service is not directed at children under 13 (or the minimum age in your country), and we do not knowingly collect personal information from children. Allergen profiles you create for family members, including children, stay on your device. If we learn that a child has sent us personal information, we will delete it.
18. Changes to this policy
We will announce material changes in the app and on this page at least 14 days in advance. The last-updated date appears at the top of this document. Continued use after a change takes effect constitutes acceptance of the updated policy.
19. Contact
The Service is operated by Abed Alnkib, who is responsible for your personal data. For any privacy question, request or complaint: [email protected], or via the website's contact form. This document is an integral part of the Terms of Use.