Privacy Policy

In short

• Your food diary, photos, weight and goals stay on your phone and, if you use iCloud, in your iCloud account, which we cannot access.
• The app reads from Apple Health with your permission and writes only the weight you update in the app. Apple Health data is not sent to our server, except today’s steps and calories burned, and only if you turn on “Show steps and calories burned” in Friends.
• Photos and text sent for AI analysis are not stored on our server.
• The social features (profile, Feed, Messages) are optional: the server only keeps what you choose to post or send.
• Your profile is private unless you choose otherwise. As on Instagram, anyone using the app can find you in search and see your name, username, avatar and a lock, and can then ask to follow you. Only if you make it public (16+) do your approved posts become visible to anyone, and anyone can follow you without your approval.
• An account with email, Apple or Google is optional: it lets you use the same profile on another phone. We keep your password only as a hash.
• No ads, no tracking, and we never sell your data.

What stays on your phone only

Your food diary (foods, calories, macros), meal photos, profile (age, height, weight, goals) and settings are stored on your iPhone. If iCloud is on, they sync to your iCloud account (the app’s private database) so you have them on another iPhone too; only you can access them, not us. You can turn sync off in Profile → iCloud Sync. If you allow it, the app reads Apple Health data (active calories, steps, weight, height, sex, birth date) and writes only your weight there, when you update it in the app. This data stays on your phone, is never sent to the AI and is never used for advertising; only today’s steps and calories burned reach our server and your friends (people you follow each other with), and only if you turn on “Show steps and calories burned”.

AI photo analysis

When you take a photo of a meal, the photo and a text instruction are sent through the FixGram server to an external AI model provider (directly or through an intermediary) to recognise the foods and estimate the calories. Our server does not store the photo, the text or the answer. Where possible, we ask providers not to use the data for training; they may keep requests temporarily under their own policies, for example to prevent abuse.

Text works the same way: when you type or dictate what you ate (“Say what you ate”) or write a correction, the text is sent the same route, without a photo. To take your past corrections into account, a request may also include a few short facts learned from them (for example your usual portion of a food); these are kept only on your phone (and in your iCloud), and you can view and delete them in Profile → AI Analysis. Dictation uses Apple speech recognition, on the device when possible; FixGram only receives the text and keeps no audio recordings.

For daily limits and statistics, the server keeps for 90 days: the date and time of the analysis, a pseudonymous phone code (a hash that cannot be turned back into the real identifier), the model used, the result, token counts, cost and duration. Your IP address is never stored in clear text: we only keep a keyed code (HMAC) of your network, for the current day’s limit (erased the next day), to protect the admin panel (at most 24 hours) and, in the social features, for the limits on new profiles and on invite codes of older app versions (at most 2 days).

Social features (optional)

If you create a profile (you accept the Terms and community rules when you create your account), the server keeps:

• your display name, avatar (a colour and, if you choose one, a profile photo), your profile bio, if you write one, and your invite code (used by older versions of the app);
• your friends list (people you follow each other with), the friend and follow requests you sent and received (until they are approved or declined: at most 14 days for friend requests, 30 days for follow requests) and the list of people you blocked;
• your username (@name), if you choose one (seen by those who see your name), whether your profile is public or private, and when you confirmed you are at least 16 (required for a public profile);
• who you follow and who follows you (with the date), your personal link (valid for 7 days; the server keeps only a hash of it) and the people you chose not to be suggested again (“Not interested”, 90 days);
• the daily summary, seen only by your friends (people you follow each other with): calories eaten and your goal, the percentage of your protein goal reached, the number of meals and, only if you turn it on, today’s steps and calories burned (no weight and no protein grams), kept for 60 days;
• the posts you choose to publish, kept until you delete them (or your profile) or moderation removes them: meals (the photo, caption, meal type, total calories and, if “Food details” is on, the list of foods), recipes and other photos of yours (for example from the gym, a run or your progress: the photo and caption, no calories); if you pin a post to your profile, also when you pinned it;
• the recipes you post (a post with a recipe): the title, number of servings, preparation time, tags (such as “breakfast”), ingredients with their grams, calories and macronutrients, and the steps. A recipe is kept together with its post and is deleted with it;
• comments you write on posts (the text and time), kept as long as the post they belong to;
• the direct messages you send (the text, the shared post or photo, and the time) and the state of your conversations (how far each person has read, message requests accepted or deleted, whether you accept requests from anyone). Messages are stored on our server and are not end-to-end encrypted: only the two people in the conversation see them, and a moderator sees a message (and its photo) only if its recipient reports it (the reported text is then kept with the report). Photos in messages (at most 1080 px, without location or other EXIF data, which the app removes before sending) are shown through links that expire within two hours; in a message request, the recipient sees the photo only after accepting the request;
• reactions to posts, posts you hid and reports you sent;
• a pseudonymous phone code (so there is one profile per phone) and your profile’s secret key, stored only as a hash;
• the last day you used the social features, moderation warnings and, if it happened, a ban of your profile (date and reason);
• counters for limits (invite codes and usernames tried, new profiles, today’s posts and comments, follows and searches), some with the network code, for at most 2 days.

We never ask for your phone number or real name; you give us an email and password only if you create an account (see “Account”). Friends (people you follow each other with) see your display name, avatar, bio, daily summary, how many friends you have and your approved posts (in the feed and on your profile, for as long as they are kept). Followers you approved see your profile and approved posts, but not your daily summary. While your profile is private, people who do not follow you do not see your bio, posts, counts (followers, posts) or daily summary; they only see your name, username, avatar and a lock (in search, on your profile page in the app, in a follow request or next to a comment), and a comment you write on someone’s post is seen by everyone who sees that post. Only your friends see your reactions by name; others only see how many reactions a post has. When you send someone a request (by username, from their profile or personal link or, in older versions of the app, with their invite code), that person sees your name and avatar; you follow them only if they approve it (a public profile right away), and when you follow each other, you are friends.

Account (optional): email, Apple or Google

Your profile also works without an account: the phone keeps a secret key in its Keychain. To use the same profile on another phone (Android included), you can link it to an email address with a password, to Sign in with Apple or to your Google account. The server then also keeps:

• your email address (in lower case) and whether you confirmed it, and your password only as a hash (PBKDF2-SHA256 with a random salt per account), never in plain text;
• for Sign in with Apple or Google: the identifier of your Apple or Google account and the email address they share with us (with Apple, this may be a private relay address); we never receive your Apple or Google password and ask them for nothing else;
• your signed-in devices: for each one, a secret key (stored only as a hash), a pseudonymous phone code, the model the app sends (for example “iPhone 15”), the system, the app version, the sign-in method, when it signed in and when it was last used;
• the 6-digit codes sent by email (confirming your address: 60 minutes; a forgotten password: 15 minutes), only as hashes, and counters for limits (sign-in attempts, emails sent), some with a code (HMAC) of the email address or of the network, for at most 2 days.

We send the emails with codes through an email delivery service, which receives only your address, your language and the text of the message (with the code) and may keep them for a short time under its own policy. We send no ads or newsletters and do not track whether emails are opened.

In the app you can see your signed-in devices and sign any of them out; when you change or reset your password, the other devices are signed out. Nobody else in the app sees your email address, neither friends nor followers.

Public profile (optional)

By default, your profile is private: only your friends and the followers you approved see your posts and bio. As on Instagram, a private profile still appears in search, but only with your name, username, avatar and a lock. Anyone can ask to follow you (from search, by your username, your personal link or your profile); you approve or decline each request. You can make it public in the app only if you have a username and confirm that you are at least 16.

A public profile can be opened by any user of the app who has a profile, except people with a block between you (either way) and profiles banned by moderation. They see:

• your display name, username, avatar and bio (where a public profile may include one https:// link);
• when your profile was created and how many posts, friends, followers and followed profiles you have (only the numbers, not the lists);
• your approved posts, if you share meal photos: the photo, caption, meal type, total calories and, if “Food details” is on, the foods with their grams and calories; posts still being checked are not shown;
• the comments on these posts and how many reactions they have.

They do not see your daily summary, steps, weight, or your friends and followers lists: your daily summary is only for your friends (people you follow each other with), not for followers.

The web page of a public profile (fixgram.app/ followed by your username, the address you can share) can be opened by anyone, even without the app: it shows only your display name, username, avatar, bio and number of posts, without the photos. For a private, banned or unknown profile, the page is the same and shows only the username typed in the address and a button that opens the app, without saying whether the profile exists or is private.

Anyone can follow a public profile without your approval and then also sees your approved posts in their feed. Only you see your followers list (their names, usernames and avatars); others only see the number. You can remove a follower at any time (they are not notified and can follow again while your profile is public) or block them: blocking deletes the follows in both directions and hides you from each other in search. Likewise, when you follow a public profile, its owner sees your name, username and avatar in their followers list, even if your profile is private.

Search in the app finds any profile, public or private, by the start of the username or of a word in the display name (so profiles without a username too), except profiles banned by moderation and people you have a block with (set by you or by them). A private profile appears in the results and opens with only the display name, username, avatar and a lock, without bio, posts or counts; from there someone can send you a follow request, which you approve or decline. Your name, username and avatar may also appear in “Discover people” for people you follow and for people who follow at least two accounts that follow you, without your bio, posts or counts.

Any user who sees the posts of a public profile can comment on them. A comment, together with its author’s name, username and avatar, is seen by everyone who sees the post, including people who are not your friends. Comments are not checked automatically; reported comments are reviewed by a person within 24 hours, and the author of a post can delete any comment on it.

You can make your profile private again at any time in the app. It then disappears from the web page and stays in search with only your name, username, avatar and a lock; anyone who wants to follow you from then on sends a request that you approve or decline. Existing followers stay approved and keep seeing your posts; you can remove them at any time (they are not notified). When you make the profile public again, pending follow requests are approved. We cannot take back what others saw or saved while your profile was public.

Public posts are kept like all others: until you delete them (or your profile) or moderation removes them, together with their photo, comments and reactions. Anyone who sees a public profile, its posts or comments can report them, and reports are reviewed by a person within 24 hours. A public profile banned for breaking the rules disappears for everyone (from search, the web page, feeds and profiles), and its follows in both directions are deleted permanently.

Content moderation

Photos are not checked automatically: they appear right away to the people who can see your posts. Reported posts are reviewed by a person within 24 hours, and photos that break the rules are deleted. Profiles that seriously break the rules are banned; to stop a new profile from being created right away on the same phone, we keep the pseudonymous phone code of a banned profile for up to one year.

Comments are not checked automatically: they appear right away. Reported comments are reviewed by a person within 24 hours and deleted if they break the rules, and the author of a post can delete any comment on it.

Your profile bio is not checked automatically; a reported or inappropriate bio can be removed by a moderator.

Who we share data with

• our cloud hosting provider, which hosts the server and the database;
• AI model providers (and, where applicable, their intermediaries), only for photos and text sent for analysis and, for checking, photos and comments published in the app;
• an email delivery service, only your email address, language and the message with the code, when you ask for a code;
• Apple or Google, only if you choose to sign in with them: they confirm who you are; we send them no FixGram data;
• Apple, which distributes the app under its own policy.

We do not sell or rent data, and we use no advertising, analytics SDKs or cross-app and cross-site tracking.

How long we keep data

• posts (public ones included: meals, recipes and other photos), with their photos, reactions and comments: until you delete them or your profile; they are not deleted automatically after some time;
• a post removed by moderation: its photo, reactions and comments are deleted immediately, and the rest (the caption, as moderation history) 90 days after it was posted;
• direct messages: until you unsend them (within 24 hours) or delete your profile; photos in messages are deleted from the server as soon as you unsend the message, delete your profile, or a moderator removes the message or bans your account, and photos uploaded but never sent after one day (if you delete a conversation only for yourself, the other person keeps their copy); reports about messages, with the reported text: 90 days;
• daily summaries: 60 days;
• follows: until the follower unfollows or is removed, one of you blocks the other, a profile is banned by moderation or either profile is deleted;
• username: until you change it or delete your profile; age confirmation: until you delete your profile;
• reports: 90 days (reports about a deleted profile: 30 days, anonymised);
• AI analysis statistics: 90 days;
• network code: until the next day for the analysis limit, at most 24 hours for admin sign-in and at most 2 days for the social features limits;
• friend requests: until they are accepted or declined, at most 14 days;
• phone code of a banned profile: up to one year;
• email, password (as a hash) and Apple or Google links: until you delete your profile (an email left unconfirmed for 7 days can be taken by another account that confirms it);
• signed-in devices: until you sign them out, change or reset your password or delete your profile, at most 12 months unused;
• codes sent by email: 60 minutes (confirming your address) or 15 minutes (forgotten password);
• profile, follows, friends and blocks: until you delete your profile; a profile not used for 12 months is deleted automatically.

Deleting your data

You can delete your profile at any time in the app: Profile → Settings (☰) → Account → “Delete account” (or Settings → Friends and privacy → “Delete account”). Deletion is immediate and permanent: your profile (including your username, bio and personal link), friends, friend and follow requests, blocks, follows (yours and those of your followers), daily summaries, posts (with their recipes), photos, your direct messages and the photos in them (the other person sees “Deleted account”, without them), comments (yours and those on your posts), reactions, the reports you sent, your email and password, your Apple and Google links and your signed-in devices are removed from the server (Apple is not notified automatically: you can also remove FixGram in your Apple ID settings). Reports that other people sent about you are kept for 30 days without any link to you, as moderation history. Data on your phone is deleted together with the app. You can also request deletion by email at support@fixgram.app (tell us your display name and username or, in older versions of the app, your invite code), and a profile not used for 12 months is deleted automatically.

Your rights

We process this data to provide the features you use and, for limits, security and moderation, in our legitimate interest of protecting the service and the community. You have the right to know what data we hold about you, to correct or delete it, to restrict or object to its processing and to receive a copy. Write to support@fixgram.app. You can also complain to a data protection authority (in the Republic of Moldova, the National Center for Personal Data Protection).

Children

FixGram is not intended for people under 16, and they may not use its social features. To make your profile public, you must confirm in the app that you are at least 16; we keep the time of this confirmation until you delete your profile.

Security

All connections use HTTPS. Passwords (PBKDF2-SHA256 with a random salt), profile keys and the keys of signed-in devices are stored only as hashes, and posted photos can only be opened through signed links that expire after a few hours and are created separately for each person allowed to see them.

Changes and contact

If we change this policy, we update the date at the top and, for important changes, let you know in the app. Questions: support@fixgram.app.