On this page
AI & data
Nutreps is not yet released; this page describes the app at launch. Current web demos use fictional data and do not upload your photos, videos or health records. Some operating details remain unconfirmed.
Feature data map
| Feature | Processing location | What leaves your device | Intended retention |
|---|---|---|---|
| Meal photo | Nutreps backend → paid Gemini API | Photo and analysis request; no attached name/email | Scan session on save or up to 7 days; saved meal/photo until deletion; Google separately |
| Typed meal | Backend → paid Gemini API | Meal description | Same scan-session schedule |
| Kilo (Premium) | Backend → paid Gemini API | Message, selected profile/goal, calorie target, recent weights/workouts and conversation context | Nutreps messages up to 30 days; Google separately |
| Nutrition-label OCR | On-device | No label image for OCR; saved food facts may sync as your diary | Temporary OCR memory; saved records until deletion |
| Form check | On-device Google pose library | No video upload for analysis | Transient frames/pose; local recordings under your control |
| Equipment recognition | On-device after one-time model download | Download request; no equipment photo upload | Transient analysis; saved gym/equipment list may sync until deletion |
| Barcode lookup | Backend → Open Food Facts | Barcode number only | Personal lookup links until deletion; non-personal catalog facts may remain |
| Private diary and progress | Device → private Supabase storage/database when saved/synced | Records and photos you choose to save | Until deletion or health-consent withdrawal; cleanup targets below |
Cloud AI requires separate consent in addition to health consent where relevant. Optional scan feedback for improvement needs a separate choice; the target is at most 90 days and earlier deletion on withdrawal. Manual logging remains available without cloud AI.
Paid Gemini and retention
Launch AI is intended to use a Cloud project with active paid billing. Under Google’s paid-service terms, prompts and responses are not used for product improvement. Google’s abuse-monitoring policy currently specifies 55 days for prompts, context and outputs and restricted review of flagged content. This is different from Nutreps’ 7-day scan and 30-day chat periods. We cannot promise immediate removal from provider security logs. Free text and photos may identify you even without an attached email.
Providers and regions
| Provider | Responsibility | Region/status |
|---|---|---|
| Supabase | Auth, database, private file storage, server functions | Intended project region Frankfurt, Germany; verify each service and subprocessor |
| Google Gemini API | Paid cloud AI | May process internationally; not guaranteed EU-only |
| Apple / Google | Sign-in, device integrity, app distribution and store billing | Provider/global infrastructure; verify launch contracts and disclosures |
| Open Food Facts | Barcode product lookup | External service; exact processing/hosting region to confirm |
| Cloudflare | Website hosting/delivery, email routing, optional Web Analytics | Distributed network; region and email destination must be checked |
| Umami | Optional website traffic statistics | Code uses Umami Cloud when configured; actual account region/retention to confirm |
| Rewarded-ad provider | Optional rewards for free users; no health data | Not selected; must disclose SDK data and consent before enabling |
| Subscription manager | Premium entitlement support if used | Not selected; store billing is Apple/Google |
These services do not all have the same legal role. International transfers need the safeguards applicable to your market. See the privacy policy; request details from privacy@nutreps.com. We do not sell personal data.
Website cookies, storage and statistics
Website hosting receives connection information such as IP and access logs. Umami loads only if a public website ID is configured; Cloudflare Web Analytics can be enabled separately. Cookie-free measurement does not mean no personal-data processing. Meta and TikTok pixels are optional and load only after consent when configured.
The site keeps the cookie choice in local browser storage and campaign attribution in session storage. Use Cookie settings below the page when pixels are configured to change your choice. The website does not collect health records. Ad and analytics providers, purposes and retention must match the actual deployment; app health data must never be added to pixel events.
Your controls and cleanup
At launch: Settings → Your data provides export, health/AI consent withdrawal and account deletion. Anonymous unlinked accounts require an active app session for deletion; linked accounts can request deletion by email. After verification, operational targets are database 24 hours, files/caches 7 days and backups no more than 30 days if infrastructure supports it. Targets remain subject to validation and do not replace provider-specific schedules.
Read delete-account details, privacy and terms. Nutreps — privacy@nutreps.com · support@nutreps.com. Version 1.0, updated 2026-10-25.