Privacy Policy

Last updated: July 18, 2026 · Version 1.2 · App version: 0.2.0

1. Who We Are

NutriSnap is developed by Charles Hartmann, an independent developer. If you have questions about this policy, you can reach me at nutrisnap@charleshartmann.com.

2. Scope

This privacy policy applies to the NutriSnap Android mobile application (the "App") and the NutriSnap website hosted at chartmann1590.github.io/nutrisnap (the "Site"). Both are operated by Charles Hartmann.

3. Data We Collect — App

NutriSnap is designed to be private by default. We collect the absolute minimum necessary for the app to function — and the vast majority of your data stays on your device. A limited set of anonymized diagnostic signals (crash reports, performance metrics, and anonymised usage events) is transmitted to Firebase (Google LLC) for app improvement purposes, and, for non-Premium users, standard ad-request signals are sent to Google AdMob to serve ads. See Section 5 and Section 6 for exactly what is and is not included.

3.1 Camera & Photo Data

When you use the AI food scan feature, the App accesses your device's camera or photo gallery to capture an image of your meal. That image is processed entirely on your device by the on-device Gemma 4 AI model (via LiteRT-LM). The image is held in memory only for the duration of the analysis and is then discarded. No photo is ever uploaded, saved to a server, or transmitted off your device.

3.2 Meal, Weight & Goal Data

Your meal history, weight entries, daily calorie goals, and preferences are stored locally on your device using Room (SQLite database) and DataStore (preferences). This data never leaves your phone. You can view, edit, or delete it at any time via the App's Settings screen.

3.3 Permissions

The App may request the following permissions:

CAMERA — Used solely for taking photos of food for AI analysis. No images are transmitted.
POST_NOTIFICATIONS — Used to show download progress when the AI model is being downloaded (one-time, optional).
INTERNET — Used for the optional one-time download of the Gemma 4 AI model from HuggingFace, for communicating with Firebase services (crash reporting, performance monitoring, analytics, remote config, and potential push notifications), and for requesting ads from Google AdMob.
ACCESS_NETWORK_STATE — Used to detect connectivity status for the model download, Firebase operations, and ad requests.
com.google.android.gms.permission.AD_ID — Added automatically by the Google Mobile Ads SDK on Android 13+ so the app may read the (user-resettable) Advertising ID for ad personalization and frequency capping, subject to your consent choice described in Section 6.

3.4 Barcode Scanning

The barcode scanner uses Google's ML Kit Barcode Scanning API, which runs entirely on-device. No barcode data is sent off the device.

3.5 Device Backup (allowBackup)

The App currently sets android:allowBackup="true", which means your local meal and weight data may be included in your device's Google Drive backup if you have Android backup enabled. We recommend reviewing your device backup settings. We plan to set allowBackup="false" in a future update to provide stronger privacy guarantees.

3.6 Diagnostic & Crash Reports (Firebase)

Starting with version 0.2.0, NutriSnap integrates with Google Firebase (Spark plan) to help improve app stability and performance. The following data is collected and transmitted to Firebase servers:

Crash & ANR reports (via Firebase Crashlytics) — stack traces, device model, OS version, app version, and a resettable Firebase Installation ID. No crash data is ever tied to your identity.
Performance metrics (via Firebase Performance Monitoring) — app startup time, screen rendering time, and network request timing. Aggregate, not personally identifying.
Analytics events (via Google Analytics for Firebase) — anonymised counts of feature usage (e.g., "scan started", "onboarding completed"). Not used for advertising or cross-app tracking.
Configuration fetches (via Firebase Remote Config) — an anonymous request to download in-app feature flags. Contains no personal data.

What is NOT sent to Firebase: Your food photos, meal entries, weight logs, calorie goals, barcode scans, or any other personal health information stays on your device. Gemma AI conversations remain on-device. Firebase receives only the diagnostic signals listed above.

You can disable crash, performance, and analytics collection at any time via Settings → Privacy & Diagnostics in the App, or by uninstalling.

4. Data We Collect — Website

The NutriSnap website (this site) is a static site hosted on GitHub Pages. We do not use cookies, analytics trackers, or third-party scripts. We self-host all fonts and assets to prevent third-party data leakage.

GitHub Pages may automatically collect standard server logs (IP address, browser type, timestamp, requested page) as part of normal HTTP operation. GitHub's own Privacy Statement governs that data. We do not have access to those logs.

5. Third-Party Services

NutriSnap uses the following third-party components, all of which operate on-device or are downloaded once:

Gemma 4 Model (Google LLC) — On-device AI model for food recognition. Downloaded from HuggingFace under the Gemma license. No data is sent to Google.
LiteRT-LM (Google AI Edge) — Runtime for running the Gemma model on-device. Apache 2.0 license.
ML Kit Barcode Scanning (Google LLC) — On-device barcode reader. No network calls.
HuggingFace — Hosts the Gemma 4 model file for download. The download is optional, one-time, and direct from HuggingFace's servers.
OkHttp (Square, Inc.) — HTTP client used for the model download. Apache 2.0 license.
Firebase (Google LLC) — Collection of cloud services used under the Spark (free) plan. Firebase acts as a sub-processor on Google Cloud infrastructure. The following Firebase products are integrated into NutriSnap:
- Crashlytics — Anonymized crash and ANR reports (stack traces, device model, OS version, app version, a resettable Firebase Installation ID).
- Performance Monitoring — Aggregate runtime metrics (startup time, screen rendering, network timing).
- Google Analytics for Firebase — Anonymized usage events for product improvement. Not used for advertising, remarketing, or cross-app tracking.
- Remote Config — Downloads feature-flag values from Firebase servers at app launch. Fetch contains no user content.
- Cloud Messaging (FCM) — If push notifications are ever enabled, a device registration token is generated to receive them. No health or food data is transmitted.
- In-App Messaging — Displays guidance overlays; impression data is reported back for campaign analytics. No personal data is involved.
- App Distribution — Pre-release builds are shared with designated testers. Tester email addresses are visible to the developer solely for distribution purposes.
Firebase uses a resettable Installation ID (not Android ID, IMEI, or Advertising ID) to correlate crash/analytics/performance data across sessions. You may reset this ID at any time in Settings → Privacy & Diagnostics.
Google AdMob / Google Mobile Ads SDK (Google LLC) — Serves banner and interstitial ads to non-Premium users. See Section 6 for what this involves and how to control it. Google's own Privacy Policy and AdMob data disclosure govern Google's handling of ad-related data.
Google User Messaging Platform (UMP) (Google LLC) — Presents the ad-consent dialog described in Section 6 and records your consent choice.

6. Advertising, Diagnostics, and Optional Premium

NutriSnap is ad-supported for non-Premium users. We show banner and interstitial ads via Google AdMob (Google Mobile Ads SDK) to keep the free tier sustainable. NutriSnap Premium (an optional Google Play subscription) removes ads entirely, in addition to unlocking unlimited AI scans.

6.1 What ads involve

Ad requests send Google information such as your device's Advertising ID (where permitted, see below), general (non-precise) location derived from IP address, device type, OS version, and app version, so Google can select and measure an ad to show.
Consent — On first launch, the App uses Google's User Messaging Platform (UMP) to determine whether your region requires a consent prompt (e.g., EEA, UK) and, if so, shows one before any ad request is made. You can change your choice at any time from Settings → Privacy & Diagnostics → Ad Consent.
Non-personalized ads — Where you decline personalization (or where required by your region/consent choice), Google may still show non-personalized ads based on contextual signals only.
Your device's ad controls — You can reset your Advertising ID or opt out of personalized advertising entirely at the OS level via Settings → Privacy → Ads on your device (Android's system-wide ad settings), independent of NutriSnap.

NutriSnap does not pass any food photo, meal entry, weight log, or other health data to AdMob — ad requests only ever include the standard device/ad-signal fields Google's SDK collects on its own.

6.2 Diagnostics

Separately from advertising, NutriSnap integrates Firebase Crashlytics, Performance Monitoring, and Google Analytics for Firebase to improve app stability and understand feature usage. These collect only the anonymized diagnostic signals described in Section 5, and are not combined with AdMob's advertising identifiers for ad targeting.

What remains true:

No sale of data — We do not sell, rent, or share any user data with third parties for monetary gain (serving ads through AdMob is not a sale of data under CCPA/CPRA — Google acts as a service provider for this purpose).
Food photos, meal entries, weight logs, and goal data — These never leave your device, and are never shared with AdMob, Crashlytics, Performance Monitoring, or Analytics.
Premium removes ads — Subscribing to NutriSnap Premium disables all ad requests.

Core tracking is free. NutriSnap Premium is an optional Google Play subscription that unlocks unlimited AI scans and removes ads. Purchase processing is handled by Google Play; NutriSnap does not collect or store your payment card details.

7. Data Retention & Deletion

Local data (food, weight, goals): All personal tracking data is stored locally on your device. To delete it:

Individual entries: Edit or delete meal entries from the Diary or Dashboard screens.
All data: Uninstall the App or go to Settings → Apps → NutriSnap → Clear Storage.
Export your data: Use the Settings → Export Data feature (available in-app) to save a copy before deleting.

Since we have no servers hosting your personal data, there is nothing for us to delete on our end. Uninstalling the App removes all locally stored data.

Firebase diagnostic data:

Crashlytics — Crash reports are retained for approximately 90 days, then automatically purged.
Performance Monitoring & Analytics — Retention defaults to approximately 14 months (Google's standard policy for non-advertising Google Analytics data).
Reset Installation ID: You can reset your Firebase Installation ID at any time from within the App (Settings → Privacy & Diagnostics) or by uninstalling and reinstalling the App. Resetting the ID disassociates future diagnostic data from past reports.
Request deletion: To request deletion of all past Firebase diagnostic data tied to your Installation ID, email nutrisnap@charleshartmann.com. I will action the request within 30 days via the Firebase console.

Advertising data: Data collected for ad requests (Advertising ID, approximate location, device signals) is retained and governed by Google's own retention policies as described in their Privacy Policy — NutriSnap does not separately store this data. Uninstalling the App, resetting your Advertising ID, or subscribing to Premium (which stops ad requests entirely) all limit further collection going forward.

8. Children's Privacy

NutriSnap is not directed at children under the age of 16 and is not designed or marketed for a child audience. We do not knowingly collect any personal information from children, and we do not knowingly serve personalized ads to children. If you are a parent or guardian and believe your child has provided us with personal information, contact us and we will advise you on removing it (though no such data exists on our servers).

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

10. Your Rights

Depending on your jurisdiction (e.g., under GDPR, CCPA, or similar laws), you may have the right to:

Access your data — Use the App's Export feature.
Delete your data — Uninstall the App or clear app storage.
Object to processing — Since all personal processing is on-device and opt-in (you choose when to scan), you control everything.
Opt out of crash/analytics collection — Toggle Crashlytics, Performance, and Analytics collection off in Settings → Privacy & Diagnostics, or uninstall the App.
Manage ad personalization — Change your ad-consent choice in Settings → Privacy & Diagnostics → Ad Consent, reset/opt out of your device's Advertising ID in your Android system settings, or subscribe to Premium to remove ads entirely.

To exercise these rights, contact nutrisnap@charleshartmann.com. We will respond within 30 days.

11. Open-Source Licenses

NutriSnap uses several open-source libraries. You can view the full list of licenses in the App by going to Settings → Open-source Licenses. A text version is also available at assets/licenses.txt.

12. Contact

For privacy-related inquiries:
Charles Hartmann
Email: nutrisnap@charleshartmann.com
GitHub: github.com/chartmann1590