Privacy Policy
This policy explains what Crumblio does with your data, in plain language. Crumblio is a food diary: most of what you enter stays on your phone, and the parts that leave it are listed here one by one.
1. Who we are
Crumblio is operated by Federica Mariani, an individual established at Via Rio de Janeiro, Torino, Italy. For any question about this policy or your data, write to privacy@crumblio.com.
We have not appointed a Data Protection Officer, because we are not required to. Support requests can be sent to support@crumblio.com.
2. At a glance
- No account, no email address, no password.
- Your profile, diary, pantry, coach messages and saved photos stay on your device.
- A photo, a pantry text or a voice correction leaves your device only when you ask for an AI feature.
- No advertising, no tracking across apps, no analytics SDK, no sale of personal data.
- You can delete everything from the app, or by uninstalling it.
3. Data that stays on your device
The following data is stored in the app’s private storage on your phone. We do not receive it, cannot read it, and do not back it up.
| Data | What it contains | Deleted by |
|---|---|---|
| Profile | Name you choose, age, sex, height, weight, activity level, goal, language and units. | In-app reset or uninstall. |
| Diary | Meals, foods, portions, calories, nutrients, dates and notes. | Deleting the meal, reset or uninstall. |
| Pantry | Items, quantities, categories and storage location. | Deleting the item, reset or uninstall. |
| Coach | Your messages and the replies generated on the device. | Clearing the conversation, reset or uninstall. |
| Photos | Meal photos you choose to save, in the app’s document directory. Temporary analysis photos are deleted on save, cancel or error. | Deleting the meal, reset or uninstall. |
| Legal acceptance | The version of the Terms and Privacy Policy you accepted and the date. | In-app reset. It survives deleting a single meal. |
Your operating system may include app data in device backups (iCloud or Google) according to your settings. Those backups are governed by the platform, not by us.
4. Data we actually receive
These are the only flows that leave your device. Each one happens because you asked for a feature, except for the security metadata described in the last row.
| When | What is sent | Who receives it | Why |
|---|---|---|---|
| You analyse a meal photo | The photo (resized, JPEG, location metadata removed), language, meal slot, a random request ID and a random install ID. | Cloudflare, Inc. (proxy) and Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (AI model) | Recognise the dish and estimate portions. |
| You correct a meal by voice | The current rows (food names, quantities, calories), the transcript, the meal photo, language, request ID and install ID. | Cloudflare and DeepSeek | Apply your correction to the draft. |
| You ask for a recipe | Pantry item names and quantities, meal slot, calorie budget, remaining calories, request ID and install ID. No photo, no profile, no diary. | Cloudflare and DeepSeek | Generate a recipe from what you have. |
| You add pantry items by text | The text you type, language, request ID and install ID. | Cloudflare and DeepSeek | Extract food names and quantities into editable rows. |
| Any request | IP address, user agent, timestamp, latency, model name, token counts, validation result and status. No image content and no transcript is written to our logs. | Cloudflare, Inc. | Rate limiting, abuse prevention, cost control and diagnostics. |
| You subscribe to Crumblio Pro | An anonymous app user ID, device and OS information, purchase receipt and entitlement status. | Apple and RevenueCat, Inc. | Process the purchase, restore it and unlock Pro. |
| You write to support | Your email address and the content of the message. | Our email provider | Answer you and keep a record of the request. |
Recognition and correction requests never include your name, age, sex, height, weight, goal, diary entries, full pantry, precise location, contacts or advertising identifier. Recipe requests include pantry names and quantities, but still no profile and no diary.
The install ID is a random identifier created on your device. It is not your Apple ID, not your advertising ID, and not linked to your identity. It exists so that a single installation cannot exceed the daily scan limit.
5. What we do not do
- We do not require an account and we do not ask for your email, phone number or password to use the app.
- We do not show advertising, use the advertising identifier, or ask for App Tracking Transparency permission.
- We do not use analytics or crash-reporting SDKs in the app.
- We do not sell, rent or trade personal data.
- We do not build behavioural profiles, and we do not make automated decisions with legal or similarly significant effects.
- We do not collect precise location, contacts, health data from the system Health app, or your photo library beyond the image you select.
- We do not use your data to train our own models.
6. Why we process data, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Providing the diary, estimates, recipes and pantry features you request. | Performance of a contract (Art. 6(1)(b) GDPR). |
| Sending a photo or pantry text to the AI provider when you tap the feature. | Performance of a contract at your request; consent where the law requires it. |
| Rate limiting, abuse prevention, security and cost control. | Legitimate interest in keeping the service available and safe (Art. 6(1)(f) GDPR). |
| Answering support requests and complying with legal obligations. | Legitimate interest and legal obligation (Art. 6(1)(c) and (f) GDPR). |
Where we rely on consent, you can withdraw it at any time from the app settings, without affecting processing that already took place. You can always use manual entry instead of photo analysis.
7. AI processing and international transfers
Photo analysis, voice correction, recipe generation and pantry parsing are performed by DeepSeek, through a Cloudflare Worker that holds the API key and enforces limits. The Worker does not store your image: it processes the request in memory and returns the result.
DeepSeek is established in China. Its published policy states that inputs may be used to improve and develop its services and to train and improve its technology, and that data is retained for as long as necessary. We do not control that retention. If you do not want a photo or a pantry text processed this way, use manual entry: the app works without the AI features.
Transfers outside the European Economic Area rely on the provider’s terms and, where required, on Standard Contractual Clauses or another lawful transfer mechanism. You can write to privacy@crumblio.com for the current details.
RevenueCat and Apple may process purchase data in the United States and other countries under their own transfer mechanisms. Cloudflare operates a global edge network; its processing locations are described in its own privacy policy.
8. How long we keep data
| Data | Retention |
|---|---|
| Diary, profile, pantry, coach messages, saved photos, legal acceptance | On your device until you delete them, reset the app or uninstall it. |
| Temporary analysis photo | Deleted when you save, cancel or the analysis fails. |
| Image and text sent to the AI provider | Not stored by us. Retained by DeepSeek according to its own policy, which currently states “as long as necessary”. |
| Worker logs | Metadata only, short-lived and currently no longer than 7 days. |
| Support emails | Until the request is resolved, then as long as required for legal or accounting obligations. |
| Purchase records | Held by Apple and RevenueCat according to their policies, typically for the duration of the subscription relationship and applicable tax periods. |
9. Security
Requests travel over TLS. The AI provider key is stored as a server-side secret and never shipped in the app. Images are resized and stripped of EXIF metadata on the device before upload, and are not written to our logs. The Worker validates request size and type, and enforces per-installation limits.
No system is perfectly secure. If you believe your data has been compromised, write to privacy@crumblio.com and we will investigate.
10. Your rights
Under the GDPR you can request access to your personal data, rectification, erasure, restriction of processing, portability, and you can object to processing based on legitimate interest. You can also withdraw consent at any time.
Because the diary, profile and pantry live on your device, you can exercise most of these rights directly in the app: edit or delete a meal, clear the pantry, reset the app. For data we actually hold, write to privacy@crumblio.com. We answer within one month.
You have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority of your country of residence.
11. Children
Crumblio is intended for adults. You must be at least 18 years old, or the age of majority in your country, to use the app. We do not knowingly collect data from children. If you believe a child has used the app, write to privacy@crumblio.com and we will help remove the data.
13. Changes and contact
This is version 1.0-draft, updated on 8 November 2026. We publish a new version when the processing, the providers or the subscription terms change materially. The app asks you to accept the new version before you continue.
Questions about this policy: privacy@crumblio.com. General support: support@crumblio.com.