ERASTHETIC PRIVACY NOTICE

1. Summary

2. Information we collect

2.1 Account information

• Email address and a password. The password is stored only as a salted hash by our authentication provider — we never see or store it in readable form.
• If you sign in with Google, we receive your Google account identifier, name and email address. We never receive your Google password.

2.2 Profile and onboarding answers

Name, sex, date of birth, height, current weight, target weight, activity level, weight goal, chosen pace, meal schedule and reminder preference, measurement units, how you heard about us, and prior calorie-tracking experience. These are what your calorie and macronutrient targets are calculated from.

Several of these answers, together with your logs, body measurements and photos, are health data. Before the App asks for any of them, it asks for your explicit consent to process health data, and we keep a record of when you gave it and which version of the text you agreed to (§7).

2.3 Nutrition logs

Foods and quantities you record, the meal and time they belong to, water intake, barcode scans, and food searches. Food searches may query the public Open Food Facts database.

2.4 Body and progress data

Weight history, body-fat percentage, daily check-ins, and progress photos you choose to upload.

2.5 Photographs

• Meal photos submitted for AI analysis. These are transmitted for analysis and are not stored on our servers — see §5.
• Progress photos, held in a private storage bucket readable only by your own account.
• An optional avatar image for your social profile.

Camera and photo-library access are requested only when you use a feature that needs them, and you may decline.

2.6 Health and fitness integrations (optional)

If you connect Apple Health (iOS) or Health Connect (Android), we read two things — your step count and the calories you have burned — in order to show your energy balance on your dashboard. This is read-only: we never write anything back. It is read on your device, is not transmitted to our servers, and is never sold, shared with anyone else, or used for advertising. The connection requires your explicit permission, and you can withdraw it at any time in Apple Health or Health Connect — we then stop reading it, and the App carries on showing the calories you have logged.

2.7 Social features (optional)

If you use friends or groups: your display name and social profile, friend connections, group memberships, messages you post in groups, and any meals or workout routines you choose to share. Anything you share or post is visible to the people you share it with — treat group messages as you would any other group chat.

2.8 Subscription information

Subscriptions are purchased through the Apple App Store or Google Play. We never receive your card details. We store only your entitlement status — whether a subscription is active, when it expires, and how many free AI scans you have used.

2.9 Technical information

App version, operating system, device type, crash and diagnostic information, and server logs that may include your IP address.

2.10 Moderation

If you report content, we store the report and the reported item so that we can act on it.

3. How we use your information

• To provide the App: calculating your targets, storing your logs, showing your progress.
• To operate the features you choose to use, including social features.
• To provide AI meal analysis (§5).
• To manage subscriptions and entitlements.
• To keep the service secure, prevent abuse, and moderate reported content.
• To diagnose crashes and improve reliability.
• To send notifications you have enabled, such as meal reminders. You control these in your device settings.
• To show ads to users on the free plan (§6.1).

We do not use your health or fitness data for advertising.

4. The website waitlist

If you give us your email address on erasthetic.com, we store that address, which form you used, and the date, so that we can tell you when Erasthetic launches. That is the only thing it is used for; we do not add it to any other list, and we do not share it. Ask us at support@erasthetic.com and we will remove it.

The form is protected by Cloudflare Turnstile, which checks that a person rather than a bot is submitting it. Turnstile processes your IP address and limited browser signals for that check alone; it does not track you across sites and does not use the data for advertising.

You do not need an account to join the waitlist, and joining does not create one.

4.1 The launch referral offer

While our launch referral offer runs (see the Referral Offer Terms), signing up on erasthetic.com works a little differently. We email you a link to confirm your address, and once you confirm we give you a personal referral code and link. For the offer we store, with your address: whether and when you confirmed it, your referral code, who invited you (if anyone), whether you unsubscribed from offer emails, and the rewards you earn.

Counting referrals. A friend counts as your referral only if they also create an Erasthetic account with the address they signed up with. To check that, we match confirmed offer addresses against the email addresses of Erasthetic accounts, inside our own database. The match tells us whether an account exists and when it was created; it does not share anything between you and your friends, and the people you invite are never shown your email address, only your code.

Fraud checks. We keep a one-way, salted hash of the IP address each signup came from, never the IP address itself, and use it only to spot referrals that look fake before rewards are sent. We delete these hashes 30 days after the offer ends.

Emails. Offer emails (confirmation, your link, the launch invitation, and your reward) are sent through Resend, our email provider. Every offer email has an unsubscribe link; unsubscribing stops offer emails but keeps your code and any reward you earned, which we will still send you. Rewards are delivered as App Store or Google Play codes.

We use this information only to run the offer. We process it because you asked to take part (and, for fraud checks, our legitimate interest in keeping the offer fair). To have your entry removed, write to support@erasthetic.com.

4.2 Website analytics

To understand how erasthetic.com is used, we count visits with Umami, an open-source analytics tool that we run ourselves, on our own server. It does not use cookies, does not collect your name or email address, and does not follow you across other websites. For each visit it records the page, the site that referred you, your browser, operating system, device type, screen size, language, and approximate location (country, region and city, worked out from your IP address, which is not stored). Visits are grouped using an identifier that cannot be traced back to you and that changes regularly. If your browser sends a Do Not Track signal, no visit is recorded, and pages reached through private links, such as your referral page and group invites, are not tracked at all.

We use this only to improve the website, never for advertising, and we process it on the basis of our legitimate interest in understanding how the website is used.

5. AI meal photo analysis

When you photograph a meal, the image is sent to Google's Gemini API so that the model can estimate the food and its nutritional content. The estimate is returned to the App and saved to your log; we do not retain the image after analysis. Google processes the image as our service provider under Google's applicable API terms.

Estimates are approximate. They are a convenience, not a measurement, and should not be relied on where accuracy matters medically.

6. Who we share information with

We do not sell your data. We share it only with providers who process it on our behalf:

We may also disclose information where required by law, to enforce our Terms, or to protect the rights and safety of our users.

6.1 Advertising (free accounts)

Free accounts see banner ads served by Google AdMob; Premium accounts see none. To choose, limit and measure ads, AdMob uses your device's advertising identifier, your IP address and approximate location, and information about your device and the App. We never give AdMob your health or fitness data, your logs or your photos.

• In the EEA, the UK and Switzerland, ads are personalised only if you agree in the consent message Google shows when you first open the App. If you do not, only non-personalised or limited ads are shown.
• On iPhone, the App asks your permission to track. If you decline, your advertising identifier is not shared with AdMob.
• In US states whose privacy laws treat personalised advertising as “selling” or “sharing” personal information (such as California), you can opt out at any time.

Wherever your law gives you a choice, you can change it at any time in the App under Profile → Ad Privacy Choices. You can also reset or limit your advertising identifier in your device settings.

7. Legal bases and consent

Where the law requires a legal basis for each use of your data — in the EEA, the UK and Switzerland (GDPR), Brazil (LGPD) and other countries with similar laws — these are ours:

Withdrawing consent. You can withdraw any consent at any time. Permissions can be withdrawn in your device settings and ad choices under Profile → Ad Privacy Choices. The App cannot work without your health data, so withdrawing that consent means deleting your account (Profile → Delete Account), which erases the data. Withdrawing consent does not affect what was done before.

What you have to provide. You need to give an email address and your health-data consent to use the App. Providing health data is your choice, but without it the App cannot calculate your plan. Everything else is optional.

Automated decisions. Your calorie and macronutrient targets are calculated by standard formulas from the figures you enter. We make no decisions about you by automated means that have legal or similarly significant effects.

8. International transfers

We are based in the United States, and your data is stored there by Supabase. Our other providers (§6) may process data in the United States and elsewhere. If you live outside the United States, your data is transferred there, and the App's consent screen tells you so before you agree.

We rely on the safeguards your law recognises: for the EEA, the UK and Switzerland, the EU–US Data Privacy Framework where a provider is certified under it, and otherwise the European Commission's Standard Contractual Clauses (with the UK addendum); for Brazil, the standard contractual clauses approved by the ANPD; and elsewhere, the contractual protections in our agreements with our providers, together with your consent where your law requires it.

9. Security

Access is restricted at the database level so that records are readable only by the account that owns them, except where you deliberately share them through social features. Progress photos are held in a private bucket. Traffic is encrypted in transit. No system is perfectly secure, and we cannot guarantee absolute security.

10. Retention and deletion

We keep your data for as long as your account exists.

• Your health-data consent record (when you agreed, and to which version of the text) is kept for as long as your account exists, as proof of your consent.
• Server and request logs are kept by our providers for a short time and deleted automatically, within 30 days at most.
• After you delete your account, its data may remain in our database provider's encrypted backups for up to 30 days, until they are overwritten.

A waitlist address is kept until the launch it was given for, or until you ask us to remove it — whichever comes first.

You may delete your account and its associated data at any time from within the App, or by writing to support@erasthetic.com from your registered email address. Deletion is actioned within 30 days, except where we must retain records to comply with law or to resolve a dispute.

Two things survive deletion of your account, and you should know about them: content you posted into a group may remain visible to that group, and subscription records held by Apple, Google or RevenueCat are governed by their own retention policies.

11. Your rights

11.1 Everyone

Wherever you live, you can ask us to tell you what data we hold about you and give you a copy, correct it, delete it, or send it to you in a portable format, and you can object to how we use it or withdraw a consent you gave. Much of this you can do yourself in the App: your details are editable in Profile, and Profile → Delete Account erases your account.

To make a request, write to support@erasthetic.com from the email address on your account, so that we can confirm it is you. Requests are free. We answer within the time your law sets — for example, one month in the EEA and UK, 15 days in Brazil, 20 business days in Mexico, and 10 days for access requests in Argentina — and we will tell you if we need longer and why, where the law allows it. We will not treat you differently for exercising your rights.

11.2 The EEA, the UK and Switzerland

You also have the right to restrict our processing, and to complain to the data protection authority where you live or work.

11.3 The United States

If you live in California or another state with a consumer privacy law, you have the right to know what personal information we collect, use and disclose; to delete and correct it; to opt out of its “sale” or “sharing” for advertising (Profile → Ad Privacy Choices, §6.1); and not to be discriminated against for using these rights. We use sensitive personal information, including health data, only to provide the App, so the right to limit its use does not arise. You can make a request through an authorised agent, and if we turn a request down you can appeal by replying to our answer. Washington residents should also read our Consumer Health Data Privacy Policy.

11.4 Brazil

Under the Lei Geral de Proteção de Dados (LGPD), you have the right to confirmation that we process your data; access to it; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of data that is unnecessary or processed unlawfully; portability; deletion of data processed with your consent; information about who we share it with; information about the consequences of refusing consent; and to revoke consent. You can also complain to the Autoridade Nacional de Proteção de Dados (ANPD). Our channel for data protection matters is support@erasthetic.com.

11.5 Mexico

Under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares, you have the rights of access, rectification, cancellation and opposition (ARCO), and you can revoke your consent or limit how we use or disclose your data. Send ARCO requests to support@erasthetic.com with your name, the email on your account, and the right you want to exercise. If you are not satisfied with our answer, you can go to the authority responsible for personal data protection.

11.6 Argentina

El titular de los datos personales tiene la facultad de ejercer el derecho de acceso a los mismos en forma gratuita a intervalos no inferiores a seis meses, salvo que se acredite un interés legítimo al efecto conforme lo establecido en el artículo 14, inciso 3 de la Ley Nº 25.326. La AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, en su carácter de Órgano de Control de la Ley Nº 25.326, tiene la atribución de atender las denuncias y reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento de las normas vigentes en materia de protección de datos personales.

In English: you can access your data free of charge at intervals of no less than six months, unless you show a legitimate interest in doing so sooner (Law 25,326, art. 14(3)), and the Agency for Access to Public Information, which enforces that law, handles complaints from anyone whose data protection rights have been breached.

11.7 Colombia

Under Law 1581 of 2012, you have the right to know, update and correct your data; to ask for proof of the authorisation you gave us; to be told how we use your data; to revoke your authorisation and ask us to delete your data; and to complain to the Superintendencia de Industria y Comercio once you have made your request to us. Answering questions about health data is optional, although the App cannot work without it.

11.8 Chile, Peru, Uruguay and other countries

If you live in another country with a data protection law, you have the rights that law gives you, which we honour through the same address. You can also complain to your national authority — for example, Peru's Autoridad Nacional de Protección de Datos Personales, Uruguay's Unidad Reguladora y de Control de Datos Personales, or, from December 1, 2026, Chile's Agencia de Protección de Datos Personales.

12. Children

The App is not directed to children under 18, and we do not knowingly collect their data. If you believe a child has provided us with data, contact support@erasthetic.com and we will delete it.

13. Changes

We may update this policy, and the "Last updated" date above will change when we do. We will tell you about material changes in the App or by email before they apply. If a change affects something you consented to, such as how we use your health data, we will ask for your consent again in the App rather than assume it.

14. Contact

Erasthetic is operated by DevKonnect IT Consulting LLC, which is the controller of your personal data:

DevKonnect IT Consulting LLC
426 Puma Loop
Groveland, FL 34736-3506
United States
support@erasthetic.com

For any privacy question or request, including under the GDPR and the LGPD, write to the same address.