Suvi · Effective date: September 17, 2026 · Last updated: September 17, 2026
We collect only the information needed to provide the App, and we tie each piece to a specific purpose:
| Data | Why we collect it |
|---|---|
| Email address | Create and secure your account; sign-in; password-reset codes; important service messages. |
| Password | Stored only as a salted one-way hash so we can verify sign-in. We never see your actual password. |
| Date of birth | Confirm you are 18+ and calculate your metabolic rate. |
| Sex, height, current weight, goal weight, target pace (health & fitness information) | Calculate your daily calorie target, energy needs, BMI, and projected progress. |
| Food/meal logs, calories, macros, weight entries, notes (health & fitness information) | Track your intake and weight over time and show your history and trends. |
| Meal photos | Analyzed to estimate the food and its nutrition (see Section 3). Photos are discarded after processing. |
| Account identifier | A unique ID that links your data to your account inside our systems. |
We consider your weight, body metrics, and nutrition logs to be health and fitness information and protect them accordingly.
We use your information solely to operate and improve the App: to create and secure your account, calculate your targets and progress, analyze the meals you log, and show your history and statistics.
Suvi shows no ads, uses no third-party analytics or advertising SDKs, does not track you across other apps or websites, and never sells your personal data. We use your inputs only to provide the features you requested — we do not repurpose your photos, logs, or notes for anything else.
When you photograph a meal or type a description, Suvi sends that image and/or text to OpenAI, our AI processing provider, solely to estimate the food's nutritional content.
We share data only with service providers who process it on our behalf under written agreements that require them to protect your information to a standard equal to or greater than this policy, to use it only to provide their service to Suvi, and not for their own purposes. We do not sell your data and do not share it for advertising or cross-app tracking.
| Provider | Role | Data it touches |
|---|---|---|
| OpenAI (US) | AI nutrition estimation | Meal photos + text descriptions (transient) |
| MongoDB Atlas (US) | Database hosting | Account, profile, logs, notes |
| Railway (US) | Backend / app hosting | Data passing through the App |
| Resend (US) | Transactional email | Email address |
We may add or change service providers as Suvi evolves. We will keep this list current and post material changes here.
If you are in the European Economic Area or the United Kingdom, we process your personal data under these legal bases:
We keep your account and logged data for as long as your account is active. When you delete your account (Settings → Delete Account), we remove your personal data from our active database right away, and in any case within 30 days. Meal photos are never retained — they are discarded immediately after AI processing. We do not maintain separate long-term backups of your personal data, so once your data is deleted it is not recoverable from a backup. We may retain minimal records where required by law, and anonymized or aggregated data that can no longer identify you may be kept longer.
We use industry-standard measures: encrypted connections (TLS/HTTPS) for data in transit, encryption at rest provided by our database host, strong one-way hashing of passwords, and access controls that limit who can reach your data. No system is completely secure, but we work to protect your information.
Data breaches. If a security breach affects your personal data and creates a real risk of significant harm, we will notify you and the relevant authorities as required by law — in Canada, the Office of the Privacy Commissioner; in the EEA/UK, the competent supervisory authority within 72 hours where required — and explain what happened and what you can do.
Depending on where you live, you have the right to: access the personal data we hold about you; correct inaccurate data; delete your data; export/port your data; restrict or object to certain processing; and withdraw consent at any time.
You can view and correct most data directly in the App, and delete your account and data from Settings → Delete Account. For any other request, email support@getsuvi.net. We will verify your identity and respond within 30 days (or the shorter period your local law requires, such as 45 days for California residents). Exercising these rights is free, and we will not discriminate against you for doing so.
Complaints. If we haven't resolved a concern, you can contact a regulator: in Canada, the Office of the Privacy Commissioner of Canada (priv.gc.ca); in the EEA/UK, your local data protection authority (in the UK, the ICO at ico.org.uk); in California, the California Privacy Protection Agency or Attorney General.
Suvi is operated from Canada and our providers are located in Canada and the United States, so your data will be processed outside your home country. For users in the EEA/UK, transfers outside your region are protected by appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission (and the UK Addendum), which our providers are contractually bound by. You can request more information at support@getsuvi.net.
We do not sell or share your personal information as defined under the California Consumer Privacy Act, and we do not use it for cross-context behavioral advertising. Suvi is a small, free app and we do not believe we meet the CCPA's applicability thresholds, but we voluntarily honor its core rights: you may request to know, delete, or correct your personal information, and we will not discriminate against you for exercising them. To make a request, email support@getsuvi.net. The categories of information we collect and our purposes are described in Sections 1–2.
Some information you provide — such as weight, body measurements, and food logs — may be considered "consumer health data" under U.S. state laws such as Washington's My Health My Data Act. We collect it only to provide the tracking features you use, we do not sell it, and we do not share it except with the service providers listed in Section 4 who help us operate Suvi. To access or delete this data, use in-app account deletion or contact support@getsuvi.net.
The weight, body, and nutrition information you enter is used only to provide the App's tracking and estimate features. Nutrition figures from photos and text are AI-generated estimates and may be inaccurate. Suvi's calorie, TDEE, BMI, and body-fat outputs are estimates, not medical measurements, diagnosis, or medical advice. Suvi is a general-wellness tool, not a medical device. Always consult a qualified professional before making health or dietary decisions, and do not rely on Suvi if you have an eating disorder or medical condition without professional guidance.
Suvi is intended for users 18 years of age or older, and we confirm age with a date-of-birth check at sign-up. We do not knowingly collect personal information from anyone under 18. If we learn that a minor has created an account, we will delete it. If you believe a minor has provided us with personal information, contact us and we will remove it.
We do not collect your precise location, your contacts, your browsing activity in other apps or sites, advertising identifiers, payment or card details, or any biometric data beyond the measurements you choose to enter.
We may update this policy. If we make material changes, we will notify you in the App or by email before the change takes effect, and we will update the "Last updated" date above. We review this policy at least once a year.