1. What this policy covers
This policy describes how Proxa Limited handles personal information when you use Nomi's food diary, AI food analysis, progress tracking, subscriptions, and community groups. Apple, sign-in providers, and apps you choose to share with also handle information under their own policies.
2. Information we handle
- Account and profile: account identifiers, email address, authentication information for email sign-in, details supplied by your chosen sign-in provider, community name, username, profile photo or avatar, and character customization.
- Onboarding and wellness records: birthday, sex/gender selections, height, weight, goals, activity frequency, dietary preferences and other onboarding answers, food names and photos, timestamps, portion and nutrient values, AI estimates and explanations, scores, water intake, and manually entered energy expenditure. These records may reveal health-related information.
- Community activity: group details and images, memberships, invite tokens, captions and other posts, shared meal snapshots, photos, and likes.
- Purchases: subscription product, transaction identifiers, the Nomi account identifier associated with a purchase, subscription status, renewal and expiry information, and verification events. Apple handles billing; Nomi does not receive your full payment-card number.
- Support and technical information: emails and attachments you send us; security, request, error, and service logs that may include IP addresses, timestamps, app or device information, request identifiers, and API usage metadata.
- Local information: cached records, account session credentials protected using platform storage, saved preferences, pending synchronization changes, and whether you tapped the review invitation. Apple does not tell Nomi whether you actually submitted an App Store review.
We access the camera or selected photos through iOS permissions and pickers. Choosing one photo does not mean we upload your entire library. The current version does not read Apple Health/HealthKit data or collect precise GPS location through an app location permission.
3. Why we use it
We use information to authenticate your account; save and synchronize records; generate food estimates and tiers; display progress and goals; operate groups and sharing; verify subscriptions; answer support requests; prevent misuse; troubleshoot problems; and meet legal obligations.
Optional information can be omitted where the app allows it. Some information is needed for the related feature: for example, AI photo analysis needs the selected photo, and group participation needs an account and community profile. We do not treat optional dietary or health information as permission to use it for unrelated purposes.
4. Food analysis and OpenAI
Nomi uses OpenAI's API to analyze food and generate nutrition estimates, scores, and explanations. For a scan, we send the selected food photo via a temporary access link, the capture type, and any food description supplied for analysis. For completion of a saved food rating, the request may include that meal's photo, food name, and recorded nutrients. We do not intentionally include your name, email, or complete diary in the analysis prompt, but information visible in a photo or included in your description will be part of what is sent.
OpenAI processes API data under its applicable service and data policies, including retention for abuse monitoring where applicable. OpenAI states that API content is not used for model training by default unless the API customer opts in. We do not describe AI processing as having zero retention. See OpenAI’s data-use information.
Review photos before sending them, especially if they include people, identifying documents, or other private material. Taking or selecting a photo for a scan involves the AI processing described above. Camera access and third-party AI processing are distinct. You can choose not to use AI scanning; contact us if you have questions about processing a saved record or want to request deletion. This policy is not a substitute for any separate permission required by applicable law or platform rules.
5. Who can receive information
- Supabase: provides authentication, database, file storage, and backend services used for account and app data.
- OpenAI: processes the food-analysis and rating inputs described above.
- Apple and enabled sign-in providers: process purchases, sign-in, or other platform features you choose to use. The current app supports Apple and Google account sign-in.
- Email providers, including Resend: process support communications and delivery when you contact us. We may forward a support message to the mailbox used to answer it.
- Other group members and sharing destinations: receive information you make available through community features, as explained below.
- Authorized operational personnel or professional advisers: may access information where necessary for support, security, service operations, or legal duties.
- Legal recipients: where reasonably necessary to comply with applicable law, enforce rights, investigate misuse, or protect people. If the business is transferred, personal information may transfer with appropriate safeguards and notices required by law.
We do not sell personal information. The current app does not contain advertising SDKs or use wellness records for targeted advertising. If these practices change, we will update this policy and obtain any required consent before the new use.
6. Groups, leaderboards, and private meals
An unshared meal remains in your private diary. Joining a group does, however, make your community profile and membership available through the community features. Membership and profile information for public/featured communities may be visible to subscribers browsing those communities. Private groups are discoverable through membership or a valid invite.
Members who share a group with you can see your daily average score and tier, calculated from your rated private and shared meal records within the requested day. The leaderboard response includes the score and account identity; it does not include unshared food names, photos, individual nutrient values, or individual meal records. A score still conveys information about your logged food quality and is not anonymous.
When you explicitly share a meal, group members can see the shared food image, nutrition, tier, caption, and associated avatar. The shared post is a snapshot. Editing or deleting a private meal record or leaving a group does not automatically remove that snapshot. Contact support about removing shared content. Other people may retain screenshots or copies beyond our control. Invite links can be forwarded to other people; treat them as access links.
If you share an invitation through WhatsApp or another app, your selected destination receives the invitation text and link. Its handling is governed by that service's policy.
7. Storage, security, and international transfers
We use access controls and platform security measures designed to restrict access to personal information. Private files are served through authenticated requests or limited-duration signed links where applicable. No storage or transmission system can guarantee absolute security.
Our providers may process information outside your country of residence, including in the United States and other locations where they operate. We do not promise that all data remains in Hong Kong or in your home country.
8. Retention and deletion
Account records, diaries, AI results, stored photos, and community records are retained to operate the account and features you use. Transaction, security, or support records may need to be retained for legal, dispute-resolution, accounting, or security purposes. We limit retention to what is reasonably necessary for the stated purposes.
You can edit or remove records where the app provides that control. Deleting a diary entry does not necessarily delete a separately shared post or all associated stored analysis/photo copies. To request deletion of your account and associated information, contact the privacy email below from the account's email address, or provide enough information for us to verify the request. Do not send identity documents unless specifically requested through an appropriate process.
After verification, we will explain and carry out the applicable deletion process, including the treatment of shared posts and any records we must retain. Backup copies may persist until their normal retention period expires and will remain subject to appropriate restrictions. Uninstalling the app does not delete server records and does not cancel an Apple subscription.
9. Your choices and rights
You can change your profile and preferences, manage iOS camera/photo/notification permissions, choose whether to share a post, and leave groups. Leaving groups stops future leaderboard access through those memberships; it does not undo past views or copies, and membership in another shared group may still permit a member to see your score.
Contact us to request access, correction, account deletion, or information about our handling of your data. Depending on applicable law, you may also have rights to portability, restriction, objection, withdrawal of consent, or complaint to a privacy regulator. We may verify your identity and explain lawful limitations. Where consent is the basis for processing, withdrawal does not change the lawfulness of earlier processing. We will identify any feature that can no longer operate without the information.
10. Adults, changes, and contact
Nomi is intended for adults aged 18 and older. If you believe a child has supplied information, contact us so we can investigate and take appropriate action.
We will publish policy updates with a new effective date and provide additional notice or request permission when required for a material change.
11. This website
The Nomi website is hosted on Vercel. When you visit, Vercel processes technical request information such as your IP address, browser information, requested pages and timestamps to deliver and secure the site. See Vercel’s privacy notice.
This website does not include advertising trackers, third-party analytics scripts, a newsletter database or a web account sign-in form. Fonts and product images are served with the website. The language switch takes you to a different page and does not set a language-tracking cookie.
Early-access and contact links open your own email app. Information you send is handled through our email services for responding to your enquiry; clicking a link does not enrol you in a mailing list. External App Store or TestFlight links, when available, take you to Apple’s services.