Privacy Policy

Last updated: 3 September 2026

Carbsai is operated by Lumy Labs. This policy explains what the app collects, where it goes, and what you can do about it. It describes what the app actually does — if something here is not true of the app you are using, tell us at lumylabsco@gmail.com.

1. What we collect

• Account: your email address and display name. Your password is handled by Firebase Authentication and is never visible to us.

• About you: age, sex, height, weight, activity level, goal and what brought you to the app, from the questions asked when you sign up. They are used to calculate your calorie target, and — if you build a meal plan — your targets, goal and diet preference are sent with that request to our AI provider so the plan fits them. Every question is skippable.

• Your taste, if you use the plan builder: which dishes you tapped, the this-or-that answers, the foods you asked to leave out, how much time you have to cook, and anything you typed in the notes box. These are sent to our AI provider to write the plan. Foods you exclude are a health-adjacent choice, so we keep them under your account, never share them with advertisers, and never use them for ad targeting.

• Your diary: the meals you log, the foods and portions in them, when you ate, and any photograph you take.

• Your weight, if you record it.

• Scan records: for each AI scan, which model ran, how many tokens it used, what it cost, what the model said, and the note or description you typed with it. This is how we keep the service affordable and improve accuracy. It is stored under your account and is not readable by the app.

• Plan records: for each meal plan, which model ran, what it cost, and a summary of the answers as counts and categories — how many dishes you tapped, which exclusions you chose, which cook time. What you typed in the notes box is never written to this record.

• Adverts: if you are not a Premium subscriber, Google AdMob may collect your device’s advertising identifier and technical information to show and cap adverts. On iOS you are asked first, and on Android and in the EEA and UK a consent form runs before any advert is requested. Premium accounts never initialise the advertising SDK at all.

We do not use a third-party analytics or crash-reporting SDK, and we do not collect your location or your contacts.

2. Where your data goes

• Google Firebase (Authentication and Cloud Firestore) stores your account and everything in it.

• Cloudflare Workers runs our server: every AI request passes through it, and it holds the daily cost counters. Meal photographs are kept on your phone; they are not uploaded to us.

• Our AI provider (currently OpenRouter, routing to OpenAI) receives the photograph or written description of your meal and any note you add, in order to estimate its nutrition; and, when you build a meal plan, your calorie and macro targets, your goal, your diet preference and your answers in the plan builder. It does not receive your name, your email or your account identifier. This is the most significant thing the app does with your data, and it happens only when you scan a meal, describe one, or build a plan.

• The USDA FoodData Central database and Open Food Facts receive your search terms and scanned barcodes — the words or numbers only, with nothing that identifies you.

• Google AdMob, for adverts, as described above.

These providers process data on our behalf, or independently in the case of advertising. This means your data may be processed outside your country, including in the United States. We do not sell your personal data, and we do not use it to train AI models.

3. Why we are allowed to

Where the UK or EU GDPR applies: we process your account and diary to perform our contract with you; we use adverts and store scan records on the basis of our legitimate interest in running a sustainable free tier and improving accuracy; and personalised advertising runs only with your consent, which you can withdraw.

4. How long we keep it

Your data is kept while your account exists. Delete your account and it goes with it — the diary, the photographs, the scan records, the plan records, the subscription record and the account itself. Deletion runs immediately and is not reversible. Some records we are legally required to keep, such as proof of a transaction, are kept for as long as the law requires.

5. Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or ask us to restrict it. Write to lumylabsco@gmail.com and we will reply within one month. You can also complain to your data protection regulator.

You can delete everything yourself, at any time, from Settings → More → Delete Account. You do not have to ask us.

6. Security

Data is encrypted in transit. Our servers reach your data with per-account rules that prevent one account from reading another’s. No system is perfectly secure, but we do not hold payment card details at any point — the stores handle payment.

7. Children

Carbsai is not for children under 13. If you believe a child has given us personal data, write to lumylabsco@gmail.com and we will delete it.

8. Changes

If we change this policy we will update the date above and, for a material change, tell you in the app before it takes effect.

9. Contact

lumylabsco@gmail.com