Privacy Policy

ProtUp ("we", "us", "app") is an app for tracking your daily protein intake. It works without a user account, and your meal diary lives on your devices and in your private iCloud. Only when you use AI logging is the content you send for it transferred to our server and from there to OpenAI (see section 4). This policy describes what data the app creates, where it goes and how long it is kept.

The controller is smapplications. Full details are in the imprint. Contact: info@smapplications.de.

ProtUp does not require you to sign up. We ask for neither an email address nor a password and create no user profile.

ProtUp stores the following on your device:

• your meal diary: meals with time, foods, amounts and nutrition values
• your own foods and products
• your settings, such as daily goal, units and appearance

If an iCloud account is signed in on your device and iCloud is allowed for ProtUp, your diary and your own foods are synced between your devices through the private database of your iCloud account (Apple CloudKit). This data is kept in your iCloud storage at Apple; we cannot access it, and Apple's terms apply. You can turn syncing off in your device settings under your name, "iCloud" and ProtUp. Your settings stay on each device.

This data is not synced with our server. We do not run a database of your meals. It may also be part of a device backup that you create via iCloud or your computer.

When you describe a meal in the AI chat, take a photo or record your voice, the app sends the following encrypted to our server:

• the messages of the current conversation and the current meal draft
• a photo, but only in the step in which you take or select it
• a voice recording, which is converted to text
• the app language and your chosen unit system

Our server forwards this content to the OpenAI API for analysis and returns the result to your app. Our server stores neither messages nor photos or recordings. Request storage is turned off at OpenAI; under OpenAI's terms, API content is not used for training and may be retained for up to 30 days for abuse monitoring. Processing may take place in the USA.

You only use AI logging after explicitly agreeing in the app (Art. 6(1)(a) GDPR; where your information allows conclusions about your health, Art. 9(2)(a) GDPR). You can also use ProtUp entirely without AI and log meals manually. Please do not send anything in the chat you do not want to share, such as names or faces in photos.

When you search for foods, your search term is sent to our server. After you save a meal, the app reports the foods used (name, brand, barcode and nutrition values per 100 g) to the shared food database. This produces usage counts and suggestions for new entries, which are reviewed before being added. These reports contain neither your diary nor the times or amounts of your meals and are not linked to any person. Foods you create manually stay on your devices and in your iCloud.

To ensure only the genuine app can access our server, ProtUp uses Apple's App Attest service. A key is created on your device; our server stores its public part, a random device identifier and short-lived access credentials (refresh tokens only as a hash). None of this contains information about you. To limit abuse and costs, we count AI requests per device and day and briefly process your IP address to rate-limit requests (Art. 6(1)(f) GDPR).

The base of the food database comes from the German Nutrient Database (Bundeslebensmittelschlüssel, BLS) 4.0 by the Max Rubner-Institut, licensed under CC BY 4.0. We selected and rounded the data.

To understand which screens and features are used, ProtUp uses Google Firebase Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We send events such as "meal saved" or "paywall opened", counts only in ranges, plus device type, OS version, approximate region and a random identifier of the app installation. Meals, foods, amounts and chat messages are never included. ProtUp does not use an advertising identifier and does not track you across apps and websites. Data may be transferred to Google in the USA; Google is certified under the EU-US Data Privacy Framework.

Statistics are on by default and can be turned off at any time in Settings under "Share usage statistics" (Art. 6(1)(f) GDPR). Turning them off deletes the identifier, and no further data is sent.

If you have agreed on your device to share analytics with developers, Apple additionally provides us with aggregated, anonymous crash figures.

AI logging is part of ProtUp Premium, a subscription you purchase through the App Store. Apple handles payment and billing; we do not receive payment details. To manage subscriptions we use RevenueCat (RevenueCat, Inc., USA). RevenueCat processes a random identifier with no link to your person and the purchase status provided by Apple (Art. 6(1)(b) GDPR). You can cancel at any time in your device settings under your name and "Subscriptions".

You delete meals and your own foods directly in the app. When you remove the app, all locally stored data is deleted. We do not store conversation content, so there is nothing to delete.

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time. You can also lodge a complaint with a data protection authority. Since we do not store data that we can link to you, we usually cannot answer requests about individuals. Feel free to write to us anyway.

We update this privacy policy when the app changes. The current version is always available on this page.