中文版 · Effective: · Operator (data controller): · Contact:
PlateGoal (the "App") collects as little data as possible: no account is required and your food log stays on your phone. This policy explains what we process, why, how, for how long, and your rights. When you first open the App we ask you to read and accept this policy; if you decline, you can still use the offline manual logging features. If this English version and the Chinese version differ, the Chinese version prevails.
| Data | When / why | Where and how long |
|---|---|---|
| Menu or plate photos you take or pick | Only after you tap "Scan menu" / "Scan plate" and give separate consent, for that single calorie estimate | Not stored: discarded by the server after processing and never written to logs; the phone keeps only the result, not the photo |
| Food log, goals, body data (sex, age, height, weight, activity — all optional), weight entries | To calculate your daily goal, remaining calories and trends | On your phone only; deleting the App deletes all of it. We cannot access it |
| Install ID (random UUID stored in the system Keychain) | To count free daily scans, link verified subscriptions and prevent abuse of the free tier | The server stores "ID + date + count" and subscription link; counts are kept 30 days; never linked to your name or phone number |
| IP address | Abuse rate limiting (daily cap per network) | Daily counters; access logs are deleted automatically after at most 7 days |
| App Store transaction info (transaction ID, product, expiry) | When you buy or restore Pro, the Apple-signed transaction is verified on our server | Kept until 1 year after the subscription ends (refunds, disputes); we never see your payment details |
| Anonymous usage events (e.g. "app opened", "scan succeeded", "paywall shown") | To learn whether features work well (daily totals per event) | Event name only, with no identifier or content; aggregated per day |
| Crash and performance diagnostics (Apple MetricKit) | To fix crashes and slowness | App/OS version and stack summaries only, no personal content; kept 90 days |
To recognize food, the photo (downscaled to about 1024 px on the long side and compressed) is sent over an encrypted connection (HTTPS) to our recognition service, which forwards it to the model provider for a calorie estimate:
Before your first scan the App shows a separate consent prompt and uploads nothing unless you tap "Agree". Without consent you can still log food manually (built-in food database, free and unlimited). You can withdraw consent at any time under "Me → Privacy & AI" by turning off "Allow AI photo recognition"; withdrawal does not affect processing done before.
Recognition results are generated by AI, are estimates for reference only, and can be edited at any time.
The recognition service runs in . Our server is located in Hong Kong, China; when you scan, your photo is sent to DeepSeek in mainland China for processing and is not stored. Access logs record only request time, IP, endpoint and result status — never image content, tokens or keys — and are deleted automatically after at most 7 days.
Subscriptions are handled by Apple; we never receive your card details. To manage or cancel: in the App "Me → Manage subscription", or Settings → Apple ID → Subscriptions.
The App is not directed to children under 14 (or the minimum age in your country); minors should use it under guardian supervision. Goal calculations are not suitable during pregnancy or breastfeeding, for minors, or for people with medical conditions.
Calorie and nutrition values are AI estimates or estimates based on food composition tables, for reference only, and are not medical or dietary advice.
When this policy changes we update the effective date; material changes to purposes, methods or data types will ask for your consent again in the App.