Privacy policy

The short version

• Your food log lives on your phone and stays there. It never syncs to us. Pieces of it leave your device only when you use a feature that needs it: smarter estimates (meal text, a meal photo, or a menu photo you scan goes to Anthropic), or a barcode scan (the number is looked up on Open Food Facts). Voice notes are transcribed by your phone itself; the audio never leaves it.
• With your permission, we use your location to spot when you arrive at a restaurant so the app can suggest right-size picks in the moment. Finding restaurants you have not visited yet sends your coordinates to Apple Maps through our backend, and checking which ones are open sends a rounded area about a kilometer across to OpenStreetMap.
• Adding friends and sharing a meal is optional and off until you turn it on. When you do share, only friends who have accepted your request can see it, and that is enforced by our database, not just by the app.
• We never sell your data. There are no ads and no third-party ad trackers in the app.

What we store on your phone

Most of Yumi runs entirely on your device. The following stays in local app storage and is removed if you reset the app or uninstall it:

• Your meals and food log, daily totals, and your recent day history.
• Your good-pick count and your buddy’s growth progress.
• Your preferences, GLP-1 mode, nudge and notification settings, and your onboarding answers.
• If you add your own Claude API key for smarter estimates, it is kept in your device’s secure storage (the iOS Keychain). It is never sent to us.

Health and dietary information you give us

During setup and in Settings you can share things like your calorie and protein goals, your general goal (for example gaining muscle or losing fat), whether you use a GLP-1 medication, your sugar preferences, foods you avoid, dietary restrictions, and allergies. Some of this is health-adjacent information, so we treat it carefully.

We use it only to tailor the app’s coaching and suggestions to you, never to sell, never for ads. It is stored on your phone. None of it is written to our database, including whether you use a GLP-1 medication, which never leaves your device at all. Your allergies, the foods you avoid, your goal and your targets do travel with an AI estimate request, so Yumi can steer around them; that path is described under "Food data and AI estimates" below. You choose what to share, and you can edit or clear any of it in Settings at any time. Sharing allergy or dietary details helps the app try to steer around them, but it never guarantees a food is safe for you (see the "not medical advice" and allergy sections of the terms).

Your account (if you sign in)

Signing in is optional. If you sign in with Google or Apple, we receive your name, email address, and a unique account identifier from that provider. We use these to create your Yumi account.

Your food log does not sync. Meals, totals, progress and your nudge settings stay on your phone, in encrypted storage, whether or not you are signed in. There is no copy of them on our servers, so signing in on a second device starts that device fresh.

What an account does hold is the social side: your email and account id, the handle you go by, your buddy and points, the friendships you accept, and any meal card you explicitly tap to share with a friend. Our database is hosted on Supabase and protected with row-level security: your signed-in session is the only thing that can read or write your rows, and a shared card is readable only by a friend you have accepted.

Subscription status, if you ever purchase one, is also stored with your account and is read-only from the app.

Location

Yumi uses your location to help you at the exact moment a food decision happens: when you arrive at a restaurant we recognize, the app can surface right-size picks for that spot.

Location is only used with your permission, and you can revoke it any time in system settings. While you use the app, your position is checked on your device against a list of supported restaurant locations. When the app needs to find restaurants near you that are not already on that list, your coordinates (latitude and longitude, and nothing else about you) are sent to our backend using your signed-in session, so that lookup reaches our server identified to your account. Our backend passes the coordinates, and only the coordinates, on to Apple’s Maps Server API to look up what is nearby, then returns the results to your device.

If you turn on arrival alerts, the app uses geofencing, which means the system can wake the app briefly in the background when you enter a mapped restaurant area. For a few minutes after that, the app reads your location on your phone to tell which spot you actually stopped at, then stops. It also checks those readings against a map of subway stations built into the app, so a train platform under a block is not mistaken for the restaurants above it. Those readings and that check stay on your phone and are never uploaded. We use this to send you a helpful nudge at the door. When the app looks up nearby restaurants, it may briefly cache those results on your device, keyed to a coarse area around you, for up to a day so it does not repeat the lookup. That cache clears itself and stays on your phone.

To show only the spots that are open right now, the map and Yumi’s “what’s good near me” answers ask OpenStreetMap’s public map servers (Overpass) which places to eat near you list their opening hours. That request carries only a rounded area about a kilometer across, never your exact position, your account, or anything else about you. The hours that come back are cached on your phone for up to a day, keyed to that rounded area, and stay on your phone. Opening hours and the subway station map are from OpenStreetMap, © OpenStreetMap contributors, available under the Open Database License.

So you can see why an arrival alert did or did not come, the app keeps a short log of what arrival alerts did in the last day, under When you arrive in Settings: times and what happened, never a place, a name or a position. It stays on your phone, keeps at most 40 lines, each gone after a day, and turning arrival alerts off deletes it.

So it can name the spot you walk into, the app also keeps one list of the restaurants around you right now: their names, map locations, and the kind of food they serve. That list is encrypted on your phone, replaced each time the app looks again rather than added to, never records when you were near any of them, and expires within a day. Turning arrival alerts off deletes it right away.

We do not build or keep a history of your movements on our servers, and your location is not sold or shared with advertisers.

Barcode scanning

You can scan a packaged food’s barcode from Track chat. The camera runs only while the scan sheet is open, and no photos are ever captured or saved.

When a barcode is read, the app sends the barcode number, and nothing else, to Open Food Facts, a nonprofit public food database, to look up the product’s name and nutrition. The request is not tied to your name or your account.

Camera permission is optional. You can always type the meal instead.

Food data and AI estimates

When smarter estimates are on, the meal text you type in Track, and any meal photo you choose to log, is sent to Anthropic’s Claude API to estimate calories and macros, using the configured API key.

When you scan a restaurant menu, that photo goes the same way, along with your food goal and the allergies and foods you skip, so the estimates and picks fit you. Picking from a menu logs nothing until you tap a dish.

That request carries more than the one message. If you have set them, your allergy list, the foods you avoid, your general body goal (like gaining muscle or losing fat), your daily calorie and protein targets, and whether you are watching added sugar are included too, so Yumi can steer around what you cannot eat and tune any recipe idea to your numbers. It also includes recent messages from that Track conversation, roughly your last 12 lines combined (what you typed and what Yumi replied), so Yumi keeps the thread. Because Yumi answers anything you type in Track, not only meal descriptions, that recent history can include non-food chat as well as food, whatever you actually typed.

Voice logging never leaves your phone. Your phone’s own speech engine turns what you said into text on the device, the audio is not recorded to a file or uploaded anywhere, and only the resulting text is then estimated like a typed meal, carrying the same profile and conversation context described above. Earlier versions sent the audio to a transcription service; that is gone.

We store the resulting estimates in your food log like any other entry. Anthropic’s API terms apply to the processing of the estimate requests; API inputs are not used to train their models by default.

If these features are off, none of it leaves your phone: not the meal text, not your profile details, and not your chat history. The only other outside lookup is the barcode scan described above.

Notifications

Meal-time nudges and arrival alerts are scheduled locally on your phone. Notification permission is optional, and turning it off never affects your food log or your buddy’s progress.

Friends and sharing

Friends are an optional layer on top of Yumi: you can add people by username, post a meal you are proud of, cheer each other on, and see a small leaderboard together. Everything here is opt-in and off by default. Nothing about your food goes to another person until you turn a setting on, and then choose, meal by meal, to post it.

A share you post can include the meal’s title, the food names and quantities from that entry, and Yumi’s short reply about it. Calories and protein ride along only when your macros toggle was on at the moment you posted, never on their own, and there are no photos in a share, even one logged from a photo.

Only friends who have accepted your request, and you, can see something you share, and that is enforced by the database itself, not only by what the app chooses to show, so it holds even against a modified app. If a friendship ever ends, that access is removed immediately for everything shared, before and after, because the database checks who is currently an accepted friend every time a share is read, not once at post time.

Friends who can see a share can react to it with one of four positive icons, cheer, love it, proud of you, or fresh pick, never a dislike and never free text. You are told who reacted to your own shares; the counts on a friend’s share are visible to anyone else who can also see that share. A quiet check-in is a separate, private "thinking of you" nudge to one friend at a time: it is visible only to the friend who receives it, never to your other friends, and it is not shown back to you afterward either, once sent it belongs to the recipient alone.

The leaderboard always shows your accepted friends’ buddies and their current growth stage, that is not gated by any toggle. Point totals are different and stay off by default: turning on "Show my points to friends" in Settings is what puts your number on the shared board for your friends to see, and leaving it off keeps your buddy visible with your number private.

What we don’t do

• We don’t sell or rent your data to anyone.
• We don’t run ads or share your data with ad networks or data brokers.
• We don’t use third-party analytics trackers in the app today.

Deleting your data

Because your food log lives only on your phone, deleting the app deletes it. There is no copy for us to hold.

If you created an account, you can delete it, along with everything stored under it, directly in Settings → Delete account. It takes effect immediately.

You can also email support@yumihq.com from the address you signed in with and we will delete your account for you.

Children

Yumi is not directed at children under 13, and we do not knowingly collect data from them.

Changes and contact

If we change what the app collects or how it is used, we will update this policy and its effective date before the change ships.

Yumi is published by Babbar Sher LLC, a New Jersey limited liability company, which is responsible for your data under this policy.

Questions or requests: support@yumihq.com.