Spikewise privacy policy
Spikewise is made by Backslash d.o.o., Zagreb, Croatia (“we”). This policy explains what the app does with your information. The short version: there are no accounts, your food log stays on your phone, and photos are only sent for analysis when you choose a photo feature and have agreed to it.
Who to contact
Backslash d.o.o. is responsible for your information. Email hrvoje.grdic1@gmail.com with any question or request about your data.
What stays on your phone
The meals you log or plan, your recipes, your saved and hidden meal ideas and your dietary preferences are stored only on your device. They are never sent to us. Deleting the app deletes them.
Your app id
On first launch the app creates a random id. It is not linked to your name, email, phone number or Apple or Google account. The app uses it to know whether you have a subscription and how many AI features you have used, and it is the id under which our payment provider records your purchases (see below).
What the app sends to our server
Food information comes from our server, so the app sends it what it needs to answer you:
- what you type into search, and barcodes you scan or enter;
- the foods and portions in a plate or recipe, to calculate its estimate and suggestions;
- the foods you avoid, so meal ideas can leave them out;
- your app id, when you use an AI feature or the app checks how many you have left.
Our server does not save searches, plates or recipes. For each app id it keeps, per day, how many AI features were used and what they cost us to run, and whether the id has a subscription, so the limits described in the app can be applied. To stop one network from drawing unlimited free AI uses, it also counts free uses per IP address for the current day; it stores a one way hash of the address and the date, never the address itself, and deletes those counts after two days.
Our hosting provider, Cloudflare, keeps technical logs of requests for a limited time. They include your IP address, the time and the address requested, which for a search or barcode includes the search term or barcode. We use them only to keep the service running, fix faults and prevent abuse.
Photos and AI features
These features use Claude, an AI model made by Anthropic:
- Photograph a plate
- Read a menu
- Add a product from its nutrition label
- What can I make? (a photo of your fridge)
- Explain this estimate (sends the foods and portions on your plate)
Before any of them is used for the first time, the app asks your permission. If you decline, the rest of the app keeps working, and you can change your answer in the app’s Guide tab.
When you use one, the photo or plate goes through our server to Anthropic to be analysed, and the result comes back to your phone. We do not store your photos. Anthropic processes them as our service provider under its commercial terms and privacy policy. Please avoid photographing people, documents or anything else personal.
Food data shared with everyone
When a nutrition label is read, or a plate photo shows a dish our food list does not have yet, the product or dish name, its barcode where there is one, and its estimated nutrition are added to the shared food list so everyone can use them. The photo is never kept, and nothing added links back to you.
Subscriptions
Spikewise Premium is bought through the App Store or Google Play. Apple or Google handle the payment; we never see your card details or your Apple or Google account. RevenueCat, our subscription provider, receives your app id, your purchase and renewal history and basic device information (such as the operating system and the store country) so it can confirm your subscription to the app and to our server. RevenueCat processes this as our service provider under its privacy policy.
Crash reports
If the app crashes or hits an error, it sends a report to Sentry so we can fix it. A report contains technical details only: the error, the app version, the device model and operating system version. It contains no app id, no IP address we keep, and nothing you entered. Sentry processes these reports as our service provider under its privacy policy.
Usage statistics
The app sends anonymous usage events to PostHog, hosted in the European Union, so we can see which features are used and where people get stuck: for example that a screen was opened, a plate photo was taken or the subscription page was shown. Events carry a random identifier created by PostHog, not your app id, and never contain what you eat, search for or photograph. We do not use them for advertising and do not combine them with other data. PostHog processes them as our service provider under its privacy policy.
What we do not do
We do not use accounts or advertising, and we do not track you across other apps or websites. We do not sell or share your information for marketing. The app does not read Apple Health, Google Health Connect or glucose monitor data.
Camera and photo library
The app asks for camera access to scan barcodes and take photos, and for photo library access when you choose an existing photo. Only the photo you pick is used, and only as described above.
Legal basis
If you are in the European Union or the United Kingdom, we rely on your consent to send photos and plates to the AI features, on the contract with you to provide a subscription you buy, and on our legitimate interest in providing a working, secure and fairly limited service for the other processing described above, including crash reports and anonymous usage statistics. Because a meal can say something about your health, we only send it to the AI features with your explicit consent, which you can withdraw at any time in the app.
Where your information is processed
Cloudflare, Anthropic, RevenueCat and Sentry may process information in the United States and other countries. They do so under data processing terms that include the safeguards required for international transfers, such as the European Commission’s standard contractual clauses.
How long information is kept
Photos and plates sent to the AI features are not stored by us. Daily AI usage counts are kept for as long as they are needed to apply the limits, and per IP counts for two days. Cloudflare’s request logs are deleted automatically after a short period. Crash reports and usage events are deleted after at most 90 days and one year respectively. RevenueCat keeps purchase records as long as needed for the subscription and for legal accounting duties. Anthropic keeps what it receives for the period set out in its own terms. Information on your phone stays until you delete it or the app.
Your rights
You can ask to access, correct or delete personal information we hold about you, object to how we use it, or withdraw consent. Because there are no accounts, we usually hold nothing that identifies you, but we will help with any request sent to the email above; your app id is shown on the app’s Guide tab if you want us to find or delete what is linked to it. You can also complain to your data protection authority. In Croatia that is the Personal Data Protection Agency (AZOP), azop.hr.
Children
Spikewise is not intended for children under 16.
Health information
Spikewise gives general guidance about food. It is not a medical device, it is not medical advice and it does not replace your doctor, nurse or dietitian.
Changes
If this policy changes, the date at the top will change, and the app will ask you to review it where the change affects what you agreed to.