ate privacy policy

Effective October 12, 2026 · Consent scope version 3 · Relay diagnostics update

ate is operated by David Bondarescu. For support, privacy questions or a deletion request, contact localplateapp@gmail.com. This policy explains the app's local storage and optional online features.

Your choices

Photos you attach in chat are sent the same way so the AI can answer questions about them. The AI is tailored to your meals and workouts. Using ate requires agreeing to online AI. AI features are intended for adults aged 18 or older. Choosing I agree confirms you are 18+ and permits meal estimates and personalized chat/workout sharing described here. Apple Health summaries are not shared by this agreement; connecting Health keeps them local. Direct requests using your own Groq key require separate permission. You can turn sharing off in Settings. This stops online AI and clears local AI history while keeping your saved records.

What stays on your device

Meals, selected photos and leftover photos, goals, profile entries, weight records, routines, workout logs, conversations, attached chat photos and starter-question caches are saved in the app's local storage. Your optional personal Groq key is stored in iOS Keychain using device-only, when-unlocked access, not in the app's ordinary settings or relay. The app does not run an account-based cloud archive. Device backups and device security are controlled by your Apple/iOS settings.

Optional meal AI

When meal AI is on, a selected meal photo or description, a requested correction, and for leftover estimates the before/after photos are sent to the Cloudflare-hosted ate relay. The relay tries Groq, then Cloudflare Workers AI if needed. It does not send this content to Gemini or OpenRouter. Photos are resized and re-encoded as JPEG before sending. This does not remove faces, backgrounds or other personal details in the image. Crop out anything you do not want to share.

Optional personalized AI

Selected chat photos are resized and re-encoded as JPEG, and sent with the current question to the same relay and providers. Earlier chat images stay local and are not automatically resent. Images may contain people, surroundings or private details; crop those out before sharing. When personalized AI is on, your question and recent conversation, relevant profile entries (age, sex, height, weight, fitness goal and experience), nutrition goals, recent meals/nutrition, saved routine and workout logs may be sent through the same relay and provider route. Routine design and edits send the exercise description and needed draft or routine details. Starter questions may be prepared automatically only after you permit personalized AI. Request size limits can shorten optional context; the app does not send its entire local archive.

Apple Health

Apple Health access is optional and read only. ate requests no permission to write or change Apple Health data. Connecting Health permits local summaries of weight, age, sex and recent workouts. The current one-tap AI agreement does not permit sending Health-derived weight, age, sex or workout summaries to AI. Any future online Health sharing requires a separate permission. Values you enter yourself are personal profile data covered by the personalized AI agreement. We do not use Health data for advertising, marketing or data sales.

Your own Groq key

With an optional personal key, permitted requests go directly from the app to Groq, not through the ate relay. Your key is sent only to Groq for authentication. Saving a key requires explicit direct-request consent and a small nonpersonal test request. Your Groq account's plan, retention settings and quotas apply. Free quota is not guaranteed; different keys in one organization do not create separate quota pools. Paid accounts can incur provider charges. The app cannot verify your plan, remaining balance or zero-data-retention setting.

Shared relay fallback is off by default. If you enable it, a failed direct request can send the same permitted content through the Cloudflare relay to Groq or Workers AI. Removing a key cancels in-flight app requests and clears chat/starter caches. It does not delete your Groq account or revoke the key at Groq; revoke it in your Groq account if needed.

Barcode lookup

Scanning or entering a barcode sends the barcode directly to Open Food Facts for a product/nutrition lookup, independent of the AI permission. Open Food Facts receives the network request and associated technical data, such as your IP address. See its privacy policy. Product data can be incomplete or inaccurate.

Open Food Facts

Barcode product and nutrition data shown in ate comes from Open Food Facts. The database is available under the Open Database License (ODbL); individual database contents are available under the Database Contents License. See the Open Food Facts terms of use.

Providers and retention

Groq states that it does not train on customer data unless the customer opts in. Inference content is not retained by default, but inputs/outputs may be logged for system reliability or abuse monitoring for up to 30 days, or longer if legally required. Usage metadata is retained. Groq offers zero-data-retention controls, but ate does not promise that any account or request has verified zero retention. See Groq's data policy and data controls.

Cloudflare states that Workers AI content is not used to train AI models or improve its or third-party services without explicit consent, and is not made available to other Cloudflare customers. Its policies govern processing and technical metadata; this policy is not a promise of zero provider retention. See Workers AI data usage and Cloudflare privacy policy.

Relay safety records

The relay processes your source IP for abuse limits and the app's installation ID for daily scan and chat limits. It hashes each with a private salt and the UTC day to create separate rotating pseudonyms. These pseudonyms are not account or person identities. A daily budget record stores those pseudonyms, request counters and aggregate provider/route usage, not raw identifiers, request prompts, photos or replies. The record is reset daily and scheduled for deletion at midnight UTC. Redacted provider-failure records (provider, status/category and time, not content) expire after 24 hours. Separate anonymous technical error counts by hour are retained on the relay for 30 days. We send category-only relay error events to PostHog (US) for an owner dashboard: endpoint, provider, status/category and timestamp, never prompts, photos, replies, raw IPs, installation IDs or personal profiles. All events use a constant service label, not a user identifier; IP/geolocation enrichment is disabled. PostHog free-plan event metadata is retained for up to one year under its policy. This relay-only integration does not record app screens, sessions or device crashes. See PostHog privacy and retention and pricing. Cooldown flags are also temporary. Persisted Workers invocation logs are disabled in the current configuration; earlier operational logs may remain under their former retention, up to three days. Cloudflare may separately process technical/security data under its own policy.

Withdrawal and deletion

In Settings, review permissions, turn off AI sharing, remove your key or reset local AI history. Turning off sharing cancels app-side requests, clears chats and starter caches, and removes the personal key. It keeps your meals, photos, goals and routine. You can delete individual meals and associated photos in the app. Removing the app removes its local app data, subject to your device/backup settings; device-only Keychain items should be removed using the in-app remove-key control before uninstalling.

Withdrawal cannot recall content already sent to a provider or delete provider-controlled logs instantly. For a privacy request, email the contact above and describe the data and approximate request time without including an API key or sensitive health information. The relay has no user account or content archive and its rotating pseudonyms may prevent identifying a past request. We will explain what we can delete and any provider-controlled or legal limits.

No ads or tracking

ate does not include advertising or cross-app tracking, sell personal data, or use Health data for ads. The services named here receive only data needed for the requested feature and their technical operation.

International processing and changes

Cloudflare and Groq may process data outside your country, including in the United States. Groq describes retained customer data as stored in U.S. Google Cloud buckets. Provider terms and applicable transfer protections govern that processing. We will update this policy when the app's practices change and request new permission before expanding the AI sharing scope. Contact us with questions about privacy rights or these choices.