Privacy Policy

Last updated: 15 October 2026

Your food diary is health data, and we treat it that way. This policy explains what Portiva collects, how we use it, where it is stored, who helps us process it, how long we keep it and how you stay in control. It covers the Portiva app for iPhone and Apple Watch, its widgets and this website, wherever you live.

The short version

Portiva works without an account. Your diary is stored on your iPhone.
If you create an account, your diary is backed up in our cloud in the European Union (Frankfurt, Germany).
AI features run only after you give explicit consent. Photos, camera frames and text are then sent for analysis to our third-party AI service provider in the United States, which doesn’t use them to train AI models. We don’t store them unless you separately choose to share your scans to help improve food recognition.
No ads, no tracking, and we never sell or share your personal information. This website uses no cookies and no analytics.
You can export or delete your data from the app at any time. Deleting your account deletes your cloud data.

1. Who we are

Portiva (“Portiva”, “we”, “us”) makes the Portiva app for iPhone and Apple Watch. We decide how and why the personal data described in this policy is processed, which makes us its controller.

For anything about privacy, email privacy@portiva.app. For everything else, support@portiva.app. Some countries and regions give you additional rights; they are explained in Regional information.

2. What we collect

What we process depends on the features you use. Much of it never leaves your devices: if you don’t create an account, we never receive your diary. We get data from what you enter in the app, from Apple Health and your sign-in provider if you connect them, from the App Store and RevenueCat when you buy a subscription, and from the emails you send us.

Account (optional)

When you sign in with Apple or Google: a user ID created by Firebase Authentication, your email address (with Sign in with Apple, this can be a private relay address), your name if you or the provider share it, and which sign-in method you used. Apple or Google confirm who you are; we never see your password.

Profile and goals

The name you enter (optional), sex, birth year, height, starting, current and goal weight, activity level, goal and weekly pace, water goal, the modes you turn on (Ramadan, GLP-1, weekly budget), your calorie and macro targets and their history, and when you gave or withdrew each consent. If you let Ramadan mode use your location: an approximate location (about 1 km) and the city name Apple derives from it. Prayer times are calculated on your device, and you can pick a city by hand instead.

Health and fitness data

Food and drink logs (names, portions, nutrients, meal, time and, for photo logs, a small thumbnail of the photo), recipes, saved meals and custom foods, weight, water, fasting sessions, GLP-1 medications, doses and symptoms, workouts, daily steps, walking distance and active energy, achievements, coach chats, and progress photo records (date, pose, weight, waist, note).

Apple Health, only if you connect it and only the types you allow. Portiva reads weight, steps, active and resting energy, walking, running and cycling distance, workouts, and nutrition and water entries. It writes your meals (energy, protein, carbs, fat, fiber, sugar, sodium), water, weight, and workouts with their active energy. What Portiva reads from Apple Health stays on your device, except daily totals of steps, distance and active energy and the workouts you import. Those become part of your diary, are included in your backup if you have an account, and today’s steps and active energy can be part of the context sent to the AI coach.

Photos

Meal photos. When you log a meal with a photo, the photo is sent for AI analysis (see AI processing) and a small thumbnail is kept with the entry in your diary. If you have an account, the thumbnail is part of your backup.
Progress photos. Body photos you take or import, with location and camera metadata removed. They stay on your device by default and are never sent for AI analysis. If you have an account and turn on progress photo backup (off by default), they are also uploaded to our cloud storage in Frankfurt, where only your account can read them.

Community product database (optional, account needed)

When you add a packaged product and leave “Share this product with everyone” on, we store the barcode, product name, brand, nutrition values per 100 g, serving sizes, whether you read them from a label photo, and the dates. Your entry is stored under a pseudonymous key (a salted hash of your account ID), not your name or email address. Other people see only the combined product values, never who contributed.

Barcode lookups

When you scan a barcode, Portiva checks its built-in catalog first, then our community product database, then Open Food Facts. Our server receives the barcode with your account or device identifier for rate limiting and does not log the barcode. Open Food Facts receives only the barcode, along with the IP address that every internet request carries.

Purchases

Apple handles payment; we never see your card details. The app receives the signed App Store transaction (product, purchase and expiry dates, transaction IDs) to unlock your plan, and sends it with AI requests so our server can check your plan. RevenueCat, our subscription service, receives an app user ID (a random ID for this installation, or your account ID if you are signed in), your purchase and subscription history, and basic device and app information such as IP address, country, device model and iOS and app version.

Device identifier

A random identifier the app creates and keeps in your iPhone’s keychain. It isn’t derived from your hardware or Apple Account, and it isn’t an advertising identifier. The app sends it with its requests to our server. When you aren’t signed in, our server uses it to apply the free daily AI limit and rate limits, and stores only a salted hash of it (or of your account ID when you are signed in) in short-lived daily counters.

Technical logs

Our AI server writes one log line per request: route, status, duration, plan, AI model, token and item counts, image size and whether you were signed in. It never logs your content, account ID, device ID, IP address or purchase data. Google, our cloud provider, may also keep standard request logs that include your IP address and user agent.

Other things you might do

Email us. We receive your email address and your message.
Tips and offers emails. If you opt in, we record that choice and its date.
Share a recipe. The app puts the shared-pot recipe and your display name into a link that you send with the iPhone share sheet. It doesn’t pass through our servers.
Reminders. Fasting, dose and trial reminders are scheduled on your device. We don’t run a push notification server.
Visit this website. Firebase Hosting serves the pages and processes your IP address to deliver them. We use no cookies, browser storage, analytics, or third-party scripts or fonts.

3. How we use it

We use personal data only to run Portiva for you:

to keep your diary, calculate calories and nutrients, set and adapt your targets and show your progress;
to run the features and modes you choose, such as Ramadan, fasting, GLP-1, reminders, achievements and Apple Watch;
to recognize meals, read labels, answer your questions and build meal plans, when you have consented to AI processing;
to measure and improve food recognition with the scans you choose to share (optional, see Sharing scans);
to create your account and back up and restore your diary;
to sell and manage subscriptions, restore purchases and apply free-plan limits;
to build an accurate community product database;
to keep Portiva secure, prevent abuse and fraud, fix errors and manage costs;
to answer your messages and, if you opt in, send occasional emails about new features, nutrition tips and offers;
to meet our legal obligations, such as accounting, tax and lawful requests from authorities.

What we never do.

We don’t show ads, include advertising SDKs, or track you across other companies’ apps and websites.
We don’t sell or rent personal data, and we don’t share it for targeted advertising. We don’t use health data for marketing.
We don’t use analytics or crash-reporting SDKs. If you choose to share analytics with app developers in your iPhone settings, Apple may give us anonymous crash reports and usage statistics.
We don’t make decisions about you that have legal or similarly significant effects by automated means alone. Your targets are calculated from general formulas and your own logs, and you can always change them.

4. Legal bases

Where the law requires a legal basis for processing, these are ours. The Regional information section links them to the articles of the laws that apply where you live.

Contract: Account, backup and restore, syncing between your devices, subscriptions and purchase restore, barcode lookups, and the everyday features of the app. We need this data to provide the service you asked for.
Explicit consent: Health and fitness data, including health-related profile details and progress photos: you give this consent when you set up the app, and Portiva can’t work without it. AI processing, including the transfer to our AI provider in the United States: a separate, optional consent. Sharing your scans to improve food recognition: another separate, optional consent. Tips and offers emails: optional consent. You can withdraw consent at any time; this doesn’t affect processing that happened before.
Legitimate interests: Security, abuse prevention, free-plan limits, technical logs, the community product database (together with your choice to share), and answering your messages. We only rely on this where our interests don’t override your rights.
Legal obligation: Accounting and tax records, and responding to lawful requests from courts and authorities.

5. AI processing

AI features work only after you give your explicit consent to “AI analysis”, during setup or later in Profile › Privacy and permissions. Without it, AI features stay off and search, barcode and manual logging work as usual. When it is on, Portiva sends:

Meal photos, resized to at most 1024 pixels, with location and other metadata removed.
Live meal scan frames: small camera images (at most 512 pixels), about one per second while a scan runs, at most 25 frames or 3 minutes per scan. They are analyzed and discarded; nothing is recorded, except the sharpest frame of a scan if you share scans (below).
Nutrition label photos, when you photograph a label to add a product.
Text you type or dictate. Dictation is turned into text by Apple’s speech recognition, on your device where supported; we receive only the text, never audio.
Context with each meal request: app language, which meal it is, local time and time zone, the names of up to 30 foods you log often, and whether Ramadan or GLP-1 mode is on.
AI coach and meal plans (Pro): your messages and the conversation so far, plus your goal, targets, what you have eaten today, weight trend and weekly change, today’s steps and active energy, recent meal names, Ramadan or GLP-1 mode, protein floor, iftar time, and the preferences you type for a plan.

Your name, email address and account ID are not sent to our AI service provider. Requests travel encrypted from the app to our AI server in Frankfurt, which checks your plan and daily limit, forwards the request to our AI service provider in the United States and returns the answer. Our server handles requests in memory and doesn’t store or log their content, unless you turn on scan sharing (below).

Under its terms with us, our AI service provider does not use this data to train its models, and we have not opted in to any such use. It deletes the requests and answers within 30 days; content flagged as violating its usage policy may be kept for up to 2 years, and longer where the law requires. The result you choose to save (the foods you logged, the coach’s replies, a plan) is stored in your diary like any other entry.

AI results are estimates. You review and can change every item before it is saved.

Sharing scans to improve recognition (optional)

You can let us keep your meal scans to make food recognition better. This is off by default. The app asks once, after a photo scan, and you can turn it on or off at any time in Profile › Privacy and permissions › Use my scans to improve recognition. Without it, nothing changes in how the app works.

What we keep. For each scan you log or discard after turning it on: the meal photo (at most 1024 pixels, with location and other metadata removed) or, for a live scan, its sharpest frame (at most 512 pixels); the AI’s first estimate; what you saved, or that you discarded it; the app language and region, the meal, the app version, the AI model that made the estimate, and when you gave your consent.
What we don’t keep. Your name, email address, account ID or device ID. Samples are filed under a salted hash, which lets us delete them when you ask but doesn’t identify you. Please try not to include people in meal photos.
Why. To measure how well Portiva recognizes food and estimates portions, to compare AI models, and to build test and training sets that improve Portiva’s recognition, including training our own recognition models. To compare models, we may send samples to AI service providers under terms that don’t let them keep the samples or train their models on them.
Where. Google Cloud Storage in Frankfurt, Germany. Only Portiva can access them; the app can’t read them back.
How long. Up to 12 months, then they are deleted automatically.
Stopping. Turning the switch off deletes every scan you shared from this account and device. Deleting your account deletes them too.

6. Where data is stored and international transfers

On your devices. Everything you log is stored on your iPhone and synced directly between your iPhone, your Apple Watch and the widgets.
In the European Union. Your account backup, progress photo backups (if you turn them on), scans you choose to share, the community product database, AI limit counters and our AI server run on Google Cloud in the europe-west3 region (Frankfurt, Germany).
In the United States. Your sign-in account (Firebase Authentication, which Google runs from the United States), AI processing (our AI service provider) and subscription management (RevenueCat).
Apple and Google operate their own services, such as the App Store, Sign in with Apple and Sign in with Google, from their global infrastructure. This website is served by Firebase Hosting through Google’s global network.
Open Food Facts (France) receives barcodes for lookups.

This means your data may be processed outside the country where you live, including in countries whose data protection laws differ from yours. Where the law requires it, we protect these transfers with appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, the UK and Swiss equivalents, certification under the EU–US Data Privacy Framework where a provider has it, and the standard contracts required in Turkey. For AI processing, we also ask for your explicit consent. You can ask us about these safeguards at privacy@portiva.app.

We share personal data only with the service providers (processors) that help us run Portiva, under contracts that limit what they may do with it, and only as much as each one needs.

Google (Firebase and Google Cloud): Account sign-in (Firebase Authentication, United States); diary backup, community product database and AI limit counters (Cloud Firestore, Frankfurt); AI server (Cloud Functions, Frankfurt); progress photo backups and shared scans (Cloud Storage, Frankfurt); logs (Cloud Logging); this website (Firebase Hosting). If you choose Sign in with Google, Google also confirms your identity.
AI service provider (United States): AI analysis of photos, camera frames, labels, text and coach messages. Not used to train models. Only with your consent. If you share scans, samples may also be sent to AI service providers to compare how well their models recognize food, under the same terms.
RevenueCat (United States): Subscription management and purchase restore.
Apple: App Store and payments, Sign in with Apple, Apple Health on your device, speech recognition for dictation, and converting your location into a city name. Apple acts as an independent controller for its own services.
Open Food Facts (France): Barcode lookups. Receives only the barcode.

We may also disclose data when the law requires it, for example to a court or a public authority with the legal power to ask for it, and only as much as required. If Portiva is ever involved in a merger or acquisition, we will tell you before your data becomes subject to a different privacy policy.

8. Retention and deletion

We keep personal data only as long as we need it for the purposes in this policy:

On your device: until you delete it, use Delete all my data, or remove the app.
Account and backup (Firebase Authentication, Cloud Firestore, Cloud Storage): until you delete the data or your account.
AI content: not stored by us. Our AI service provider deletes it within 30 days (up to 2 years if flagged for a usage-policy violation).
Shared scans (only if you turn on scan sharing): up to 12 months, or until you turn sharing off or delete your account.
AI limit counters: about 48 hours.
Live scan session records (frame counts and times only): 24 hours.
Community product entries: until you delete your account.
Technical logs: up to 30 days.
Support emails: as long as needed to resolve your request, and as the law requires.
Purchase records: kept by Apple and RevenueCat under their policies and as accounting and tax laws require.

When a retention period ends or the reason for processing no longer applies, we delete the data.

Deleting your data

Delete your account in the app: Profile › Account › Delete account. In one step this deletes your backup in Cloud Firestore, your progress photo backups in Cloud Storage, your community product entries (each product’s public values are recalculated from the remaining contributors, or the product is removed if you were the only one), the scans you shared, your AI limit counters and your sign-in account in Firebase Authentication. Portiva also asks Apple or Google to revoke its sign-in access, and deletes the data on that iPhone.
No account? Use Profile › Your data › Delete all my data. It deletes your diary from the device and, if you are signed in, from your backup.
Not deleted by the app: data in Apple Health (delete it in the Health app), your subscription (cancel it in your Apple Account settings), purchase records held by Apple and RevenueCat, and live scan and AI limit records that can’t be linked back to you and expire on their own within 48 hours.
Can’t open the app? See Delete your account for how to ask us by email.

9. Your rights and choices

Wherever you live, you can:

access your data and get a copy of it: Profile › Your data › Export my data creates a JSON file of all your records;
correct it: edit any entry, your profile and your targets in the app;
delete it: see Deleting your data;
withdraw consent: turn off AI analysis, scan sharing (this deletes the scans you shared) or tips and offers emails in Profile › Privacy and permissions; to withdraw consent to health data processing, delete your data or your account;
object to processing based on legitimate interests, or ask us to restrict it;
take your data elsewhere (portability), using the export above or by asking us;
complain to a data protection authority.

How to ask. Much of your data exists only on your device, where you control it directly and we can’t access it. For anything else, email privacy@portiva.app, if possible from the email address linked to your account. We may need to confirm your identity first. We answer free of charge, within one month or sooner where your local law requires. We won’t treat you differently for using your rights.

10. Children

Portiva is for people aged 16 and over. We don’t knowingly collect personal data from anyone under 16. If you are under 18, use Portiva only with a parent’s or guardian’s permission, and talk to a doctor before changing your diet. If you believe a child under 16 is using Portiva, contact us and we will delete their data.

11. Security

All connections between the app, our server and our providers are encrypted in transit (HTTPS/TLS).
Our providers encrypt stored data at rest.
Security rules let only your signed-in account read or write your backup and your progress photos. Our own server records use salted hashes instead of account or device IDs.
On your iPhone, data is protected by iOS data protection. Photos are stripped of location data before they leave your device.

No system is perfectly secure. If a breach affects your data, we will inform you and the authorities as the law requires.

12. Changes to this policy

We update this policy when Portiva or the law changes. The date at the top shows the current version. Before an important change takes effect, we will tell you in the app and, where the law requires it, ask for your consent again.

13. Contact

Portiva — privacy@portiva.app, support@portiva.app

Use privacy@portiva.app for privacy questions and requests, and support@portiva.app for everything else.

14. Regional information

This section adds the details that specific laws ask for. It supplements the rest of this policy.

European Economic Area, United Kingdom and Switzerland

The General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection apply to you. Portiva is the controller (see Who we are).

Legal bases: contract (GDPR Art. 6(1)(b)); explicit consent for health data, AI processing and scan sharing (Art. 9(2)(a), together with Art. 6(1)(a)); consent for tips and offers emails (Art. 6(1)(a)); legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)).
Transfers: transfers outside the EEA, the UK or Switzerland, for example to the United States, rely on the Standard Contractual Clauses (with the UK and Swiss addenda), the EU–US Data Privacy Framework and its UK and Swiss extensions where a provider is certified, or another mechanism under Chapter V of the GDPR.
Your rights: access, rectification, erasure, restriction, objection, data portability, withdrawal of consent at any time, and not being subject to decisions based solely on automated processing that significantly affect you. We answer within one month.
Complaints: you can complain to the data protection authority where you live or work, in the UK to the Information Commissioner’s Office (ICO), and in Switzerland to the Federal Data Protection and Information Commissioner (FDPIC). We would appreciate the chance to address your concern first.

United States

This section applies to residents of California (under the California Consumer Privacy Act as amended by the CPRA) and of other US states with comprehensive privacy or consumer health data laws.

We don’t sell or share personal information, as those terms are defined in California law, and we haven’t done so in the past 12 months. We don’t use personal information for targeted advertising or cross-context behavioral advertising, and we don’t sell the personal information of anyone under 16. Because we don’t sell or share, there is nothing a Global Privacy Control signal needs to switch off.

Categories of personal information we collect, their sources and purposes are described in sections 2 and 3:

Identifiers: Account user ID, email address, random device identifier, app user ID for subscriptions, IP address (processed by our providers).
Customer records: Name (if you provide it) and email address.
Commercial information: Subscription and purchase history.
Internet or network activity: Technical request logs.
Approximate location: An approximate location (about 1 km) and city name, only if you let Ramadan mode use your location.
Audio, electronic and visual information: Meal and label photos, live scan frames, progress photos and the scans you choose to share. We never receive audio.
Sensitive personal information: Health information, such as your diary, weight, medications and fitness data.

We disclose these categories only to the service providers in section 7, for the business purposes in section 3. We use sensitive personal information only to provide the services you request and keep them secure, as the law permits, and not to infer characteristics about you.

Consumer health data. Some states, such as Washington and Nevada, have specific laws for consumer health data. We collect your health data only with your consent, use it only to provide Portiva, share it only with the service providers that process it for us, and never sell it. You can access and delete it, and withdraw your consent, as described in section 9.

Your rights: to know what personal information we collect, use and disclose, and to access it; to delete it; to correct it; to opt out of sale, sharing and targeted advertising (we don’t do these); and not to be discriminated against for using these rights. Email privacy@portiva.app. We verify requests by matching them to your account, usually by email address. You can use an authorized agent, who must show your signed permission. If we decline your request, you can appeal by replying to our answer; if we deny the appeal, you can contact your state attorney general.

Turkey

The Personal Data Protection Law No. 6698 (KVKK) applies to you, and Portiva is the data controller (veri sorumlusu). Our legal bases are: performance of a contract (KVKK Art. 5(2)(c)); your explicit consent for health data (Art. 6), for sharing scans to improve recognition (Art. 5(1) and 6) and for tips and offers emails (Art. 5(1)); legitimate interests (Art. 5(2)(f)); and legal obligations (Art. 5(2)(ç)). Transfers abroad rely on the safeguards in KVKK Art. 9, in particular standard contracts notified to the Personal Data Protection Authority, and, for AI processing, also on your explicit consent. You have the rights listed in KVKK Art. 11, we answer applications within 30 days, and you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) after applying to us.

The full Turkish privacy notice, with the application methods and the explicit consent texts the app asks for, is on the KVKK Aydınlatma Metni page.

Other countries

Wherever you live, you have the rights and choices in section 9. If the law where you live gives you additional rights, we respect them. Contact us at privacy@portiva.app; if you aren’t satisfied with our answer, you can also contact your local data protection authority.