Privacy Policy.

01Who we are

Apart is operated by Calibra Technologies LLC, a Wyoming limited liability company at 1914 Thomes Ave, Ste 2, #3012, Cheyenne, WY 82001, United States ("Apart", "we", "us"). We decide how the information described here is used, which makes us its "controller". For anything in this policy — including a request to see, correct, or delete your information — write to support@eatapart.com. A person reads that inbox.

If you live in Washington, Nevada, or Connecticut, our Consumer Health Data Privacy Policy also applies and sets out your rights under those states' health-data laws.

02What Apart keeps about you

Apart keeps your program in a file inside the app's own private storage on your phone, where other apps cannot read it, and keeps a synced copy of the same file in your account (section 03). It holds:

• Your profile — your name and email address, an optional profile photo, your sex (if you give it), age, height, starting and goal weight, activity level, the symptom that bothers you most, and the date your program began.
• Your answers at setup — your answer to the health check ("none of these" or "a doctor manages a condition of mine"; the other answers end setup and are not stored), the date and version of the Terms you accepted, and, if you joined during the free launch, the date you became a founding member.
• What you eat — every food you log, the portion, the time, and any preparation you record; your meal plan, shopping list, fridge contents, saved and custom recipes.
• How you feel — weight entries, mood entries, symptoms and their severity, the days you mark as unusual, your water and morning-ritual record, and the trigger foods Apart works out from that evidence.
• Your conversation with Apart Coach, your progress through Apart School, and your settings.

Deleting the app removes the copy on that phone; the copy in your account stays until you delete your account. In the EEA, the UK and Switzerland there is no account copy: the file lives only on your phone, and deleting the app deletes it permanently unless it is in your own device backup (iCloud or Google backup, governed by Apple's and Google's privacy policies).

03Your account

Outside the EEA, the UK and Switzerland, using Apart means creating an account with your email address and a password, or with Sign in with Apple or Google. For your account we store:

• How you sign in — your email address and your password, stored only as a secure hash; or, if you use Apple or Google, the account identifier and email address they give us (Apple may give a private relay address instead of your real one) and the name they share.
• Your program — the file described in section 02, synced a few seconds after you change something, and again when you open the app, so every phone you log in on has the same data.
• Technical records — the times you signed in and, in our provider's logs, the IP address and time of requests, used to run and protect the service.

Your account is locked to you: the app can only read or change the account that is signed in, enforced by the database itself. People who operate Apart can technically reach the database to run it; we look at an account's contents only when you ask us to (for example, to help with a problem) or when the law requires it.

If you sign up with email, we send the emails your account needs — confirming your address and resetting your password. We never send marketing emails.

04What AI features send, and when

Apart's AI features run on our servers. Information is sent to them only when you actively use one, and only because you consented to it when you created your account:

• Asking Apart Coach a question — your messages in that conversation, plus a short context block: your program phase and day, how full your histamine bucket is and its capacity, the meals you logged today with their times, the foods Apart has flagged for you, your recent symptoms, and which eating window is open. Your name is never included.
• Photographing a plate, a receipt, or a menu — the photograph, plus the same context block.
• Generating a meal plan, running pattern analysis, or correcting a scanned food — the same context block, and for a correction the words you typed.
• With every one of the above — a random identifier created when you installed the app, a timestamp, a signature proving the request came from the real app, your signed purchase receipt from Apple or Google if you have one, and, for founding members, the date you joined.

Scanning a barcode sends nothing to us: your phone asks Open Food Facts directly, sending only the barcode number (and, as with any internet request, your IP address).

The random installation identifier is not your Apple or Google advertising identifier and is not linked to your name. It changes if you delete and reinstall the app, or use Settings → Delete all my data.

EEA, UK and Switzerland. If you got Apart from a storefront in these countries, none of the above happens: there is no online account, the AI features are switched off, the consent screen never appears, and nothing about you is sent to us, to our database provider or to Anthropic. We decide this from your App Store or Google Play storefront country (or your phone's region if there is no storefront).

05What we store on our servers

Your account and its synced program (section 03), and besides that very little:

• Usage counters — how many AI requests your installation identifier has made, to enforce fair-use limits. Deleted automatically within 24 hours.
• Membership dates — the date our server first saw your installation identifier claim a founding membership (kept for up to 3 years) or, on Android, a free trial (kept for up to 400 days). We keep these so a membership or trial can't be restarted by changing the date on a phone. They are keyed to the random identifier only.
• Spending totals — running totals of what the AI has cost us overall and per day, not linked to anyone.
• Short-lived purchase checks — the result of verifying an Apple or Google receipt, held in memory for a few hours.
• Server logs — our hosting provider records technical information about requests, including IP address and any errors, for operating and securing the service. We do not log the content of your requests.

A photo you scan for the AI is held in memory only for as long as it takes to analyse it, and is never written to a database or file store by us. A profile photo you choose is part of your synced program.

06Who else processes your information

We use a small number of providers. They act on our instructions and are bound by contract.

• Anthropic (United States) — provides the Claude AI models behind the coach, scanning, planning, and pattern analysis. Whatever section 04 lists for a feature is sent to Anthropic to produce the answer. Under Anthropic's commercial terms, it is not used to train their models.
• Supabase (United States) — hosts your account and its synced program (section 03), and sends account emails through the email provider connected to it.
• Vercel (United States) — hosts the server functions that pass your request to Anthropic.
• Netlify (United States) — hosts this website. Like any web host it keeps short-lived server logs, such as IP addresses, to run and protect the site; the site sets no cookies and loads nothing from other companies.
• Upstash — stores the counters, membership dates, and spending totals described in section 05, keyed to your installation identifier only.
• Apple and Google — distribute the app and, when paid plans exist, process payments. We never see your card number or billing address.

Open Food Facts, a non-profit open food database, receives barcode lookups directly from your phone (section 04); it is not our processor. Our website sets no cookies, runs no analytics, and loads no third-party fonts or scripts.

07What we never do

• We never sell or rent your information, to anyone, for any price.
• We never show advertising, and we share nothing with advertisers, insurers, employers, or data brokers.
• We never use your information to train AI models — ours or anyone else's.
• There is no analytics, attribution, or tracking software in the app, and it does not use your device's advertising identifier.

08Health information and your consent

Symptoms, weight, mood, and what you eat are health information. We rely on your explicit consent to store it in your account and to send it to our AI provider when you use an AI feature. You give that consent separately when you create your account: the sign-up screen has its own box — unticked until you tick it — saying that you consent to Apart storing your health information in your account and using it as this policy and our Consumer Health Data Privacy Policy describe. No account can be created until it is ticked. The app records the date.

Withdrawing consent. You can withdraw at any time in Settings → AI features & your data. Apart's program — the bucket, the coach, the trigger-food engine — runs on this information, so withdrawing consent deletes your account: its data is erased from our servers and from your phone, and your installation identifier is reset. You can start a new account at any time.

Where we process information for other reasons, our legal bases are: performing our agreement with you (providing the features and memberships you have), our legitimate interest in keeping the service secure and affordable (the identifier, counters, membership dates, spending totals and server logs), and complying with legal obligations.

09How long we keep things

• On your device — until you delete it in the app or delete the app.
• Your account and its synced program — until you delete your account. It is then erased from our database at once, and from our provider's backups within 7 days as they roll over.
• Usage counters — within 24 hours.
• Membership dates — up to 3 years (founding) or 400 days (Android trial).
• Purchase checks — a few hours.
• Server logs — a limited period set by our hosting provider, for security and troubleshooting.
• Anthropic — a limited period under its own terms for abuse monitoring, then deleted.
• Support email — as long as needed to deal with your request, and a reasonable period afterwards.

10Your rights

Depending on where you live, you have the right to access, correct, delete, or export your information, to restrict or object to processing, to withdraw consent, and to complain to a regulator. You can do most of this yourself, immediately, in the app:

• See and correct it — everything is visible and editable in the app.
• Delete it — Settings → Delete all my data erases your account and its data from our servers, everything on the device, your consent record, and the installation identifier. Withdrawing consent does the same. Deleting the app only removes the phone's copy; your account stays until you delete it.
• Ask us — for anything you can't do yourself, including what our servers hold about your account or an installation identifier, or a copy of your account's data, email support@eatapart.com or use eatapart.com/delete-account. We reply within 30 days (45 days where a US state law allows), and you can appeal a refusal by replying with "Appeal" in the subject.

US state privacy laws. We do not sell or "share" personal information for targeted advertising, and we do not use it for profiling that has legal or similarly significant effects. Residents of Washington, Nevada, and Connecticut have additional rights over consumer health data, described in our Consumer Health Data Privacy Policy. We will never charge you or treat you differently for exercising a right.

11Crash and bug reports

If Apart crashes, it writes a technical report on your device. It contains no food, symptom, weight, or message content, and it is only sent if you tap Send the report, which opens your own email app with the report attached — so you can read, edit, or cancel it first.

12International transfers

We and our providers are based in the United States, and your account is stored there. Apart does not send personal data from installations in the EEA, the UK, or Switzerland to our servers. If you use Apart from elsewhere, your account and the information you send are stored and processed in the United States.

13Children

Apart is for adults 18 and over. It is not directed at children, and we do not knowingly collect information from anyone under 18. If you believe a child has used Apart, email us and we will help remove anything we hold.

14Security

Everything travels over encrypted connections. Your account's data is encrypted at rest by our database provider, and the database itself only lets a signed-in person read or change their own account. Your sign-in is kept in your phone's secure keychain. Requests to our AI servers are signed and rejected if the signature is missing, altered, or more than a few minutes old. Information on your device is protected by your phone's app sandbox and device encryption. No system is perfect; if a breach ever affects your information, we will tell you and the authorities as the law requires.

15Changes to this policy

If we make a material change — particularly one that would send more of your information off your device or use it in a new way — we will say so in the app before it takes effect. The current version always lives at eatapart.com/privacy, with the date at the top.

16Contact

Calibra Technologies LLC — support@eatapart.com.
By post: 1914 Thomes Ave, Ste 2, #3012, Cheyenne, WY 82001, United States.