Privacy Policy

Download / Save as PDF

Operator note: FitHelix is currently operated by its individual developer, Huibin Wu. This policy is maintained from the actual product and infrastructure behavior. It is not a claim of HIPAA compliance or legal-counsel review.

v4.6 release notice: This version describes first-day app navigation steps (section 2.10). For a new account, our servers keep up to five fixed steps that the iOS app reports during the first 24 hours after sign-up, such as opening Today or the camera, linked to your account, so we can see where new users get stuck. They contain no food, photos, search text, nutrition or health data, are not shared with advertisers or third-party analytics, are included in data export and are deleted with your account.

v4.5 release notice: This version describes two Apple Watch workout features: after you save a workout, the Watch reads it back from Apple Health to show its summary, and, if you allow it, the Watch reads your date of birth only to estimate heart-rate zones on the watch. The date of birth and the estimates derived from it stay on the watch. This version does not change what we collect on our servers or which providers process data.

v4.4 release notice: This version clarifies that FitHelix is operated by Huibin Wu and that AI Coach is the in-app name of Nour Chat. It does not change what we collect or which providers process it.

v4.3 release notice: This version describes the iOS 1.2.0 health permissions, workout recording, strength-detail sync, and Apple Health-only routes, and clarifies on-device iOS speech transcription and Sentry installation identifiers. Health sync and AI analysis remain separate choices. You can review these choices in Settings and manage health and location permissions in the system settings. Deleting your FitHelix account does not delete records saved in Apple Health.

v4.0 release notice: This version adds the optional private outdoor-workout route feature and its precise-location disclosure. The operator confirms there were no existing external users before v4.0 took effect. The current mobile build therefore does not present a versioned in-app update notice or send a notification email for this change; this public policy provides the release disclosure.

v4.1 release notice: This version replaces the backend cache processor (Google Cloud Memorystore → Upstash, Inc. on AWS us-east-1), in production since 2026-09-06. The processed data class is unchanged (short-TTL cache entries only), and Upstash's DPA, EU SCCs, and EU-U.S. Data Privacy Framework provide safeguards equivalent to the previous Google Cloud processing terms; this public policy provides the release disclosure.

v4.2 release notice: This version clarifies when Passkey credentials are collected and lists what is stored for each one. Besides a Passkey you add yourself, your device's password manager may now create one for your account automatically right after you sign in with your password, depending on your password manager and its settings. What we store for a Passkey has not changed, and signing in with a Passkey still requires device verification (such as Face ID, a fingerprint, or your device passcode) every time; this public policy provides the release disclosure.

English is the governing language. Any translation into another language is provided solely for convenience. In case of any discrepancy or conflict between the English version and any translation, the English version shall prevail and govern.

1. Overview

FitHelix ("we," "us," or "our") is an AI-powered food and nutrition tracking application operated by its developer, Huibin Wu. We are committed to the principle of data minimization — collecting only what is necessary to provide our services.

The in-app assistant is called AI Coach; its conversational persona is Nour, and this Policy also calls those conversations Nour Chat.

This Privacy Policy explains what information we collect, how we use that information, who we share it with, how we protect it, and what rights you have.

By using FitHelix, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, please do not use the App.

FitHelix is not a medical device. It does not provide medical diagnosis, treatment, or prescription advice. If you have diabetes, kidney disease, eating disorders, pregnancy-related nutritional needs, or other medical conditions, please consult a physician or registered dietitian.

2. Information We Collect

2.1 Account Information (Required)

• Email address — used for login, password recovery, and essential service notifications
• Password hash — stored using Argon2id; we never store plaintext passwords
• Display name — optional; used to personalize your experience
• Account creation timestamp and last login timestamp
• Authentication method (email/password, Apple Sign-In, Google Sign-In, or Passkey)
• Passkey credentials — the credential ID and public key, with sign-in metadata (signature counter, backup status, label, date added and date last used); collected if you add a Passkey, or if your device's password manager creates one for your account automatically right after you sign in with your password (whether it does depends on your password manager and its settings). You can view your Passkeys and remove them in the app's Account & Security settings, unless a Passkey is your only way to sign in
• Email verification status

2.2 Profile & Goals (Optional)

• Physiological data: height, weight, age, gender
• Activity level: sedentary, lightly active, moderately active, very active
• Health goal: lose weight, gain weight, maintain, build muscle
• Timezone — used for daily summary calculations

From this information, we calculate your BMR, TDEE, daily calorie budget, and macronutrient targets. You may update or delete this profile data at any time in the App.

2.3 Food & Nutrition Records

• Food name, weight in grams, meal type (breakfast, lunch, dinner, snack), and timestamp
• Nutritional data per entry: calories, carbohydrates, protein, fat, fiber, sugar, sodium
• Food photos — uploaded by you, stored in Google Cloud Storage
• Nutrition label photos — uploaded by you for OCR processing
• Weight source — how the weight was determined (visual estimate, 3D depth, reference object)
• Search queries, barcode scans, and manual entry inputs

2.4 AI Recognition, Voice & Conversational Data

Food Photos & Nutrition Labels

• Food photos are uploaded to our servers and forwarded to the recognition provider selected by the active reviewed configuration. The current primary is DeepSeek V4 Flash Vision Exp; Google Vertex AI / Gemini 3.8 Flash remains a controlled candidate. We do not send the same recognition request to multiple providers in parallel.
• Nutrition-label and package-front photos use DeepSeek V4 Flash Vision Exp as the primary OCR/extraction provider. Google Vertex AI / Gemini 3.8 Flash remains an operator-selected candidate. We do not send or replay the same image to both providers.
• Recognition results: candidate foods, confidence scores, estimated weights, and explanatory text

Voice Recordings

• Audio recorded via the "Speak to Log" feature, after you grant microphone permission
• iOS 26: Apple SpeechAnalyzer / SpeechTranscriber transcribes the recording on your device. Raw audio is not uploaded to FitHelix or an AI provider; the temporary local audio file is removed when transcription completes or fails.
• Android cloud transcription: audio is temporarily sent through our servers to Google Vertex AI / Gemini. Audio is deleted after processing, typically within seconds; transient retry retention must not exceed 24 hours.
• The audio itself is not sent to DeepSeek. Transcribed text you submit to Nour Chat follows the Chat provider path below, including when you ask it to record a meal.
• The transcript or parsed meal draft is retained in your food records or chat history when you submit or save it

AI Coach (Nour Chat) Conversations

• Messages you send to Nour and responses generated by Nour
• Conversation IDs for context continuity
• Long-term memory extracted from conversations (dietary preferences, allergies, goals)
• Weekly report context derived from your nutrition data and conversation history
• Authenticated Nour Chat currently uses DeepSeek V4 Pro as its primary provider. The intent-specific Google Vertex AI / Gemini 3.8 Flash model is used once as a sequential fallback only when a typed transient failure occurs before any DeepSeek output is received. The fallback is not a parallel copy and is not used after output starts.
• DeepSeek context is selected by Chat intent. Ordinary small talk and food-recording replies do not receive database-derived profile, memory, or daily-nutrition context. Nutrition-advice requests may include relevant profile/goals, saved dietary memories, and an aggregate daily nutrition summary. If you explicitly ask to review today's foods, the necessary daily context may include itemized food names, meal/time, grams, calories, and macronutrients. The prompt may also contain your current message and necessary recent user-authored messages. When a request can reach DeepSeek, we omit prior assistant replies and synthetic conversation summaries, and do not automatically attach your account email, internal user ID, cohort bucket, display_name, photo URL, or raw HealthKit / Health Connect sample. Text you choose to type in Chat may itself contain identifying information and is sent as part of that Chat message.
• For food recognition, nutrition-label OCR, and package-front extraction, DeepSeek receives only the current request's corresponding photo(s), recognition prompt/schema, and necessary capture metadata — not your account email, user/entry ID, storage pointer, historical photos, audio, or raw HealthKit / Health Connect samples.
• Registered DeepSeek text services receive only their bounded task input: a submitted meal transcript; a food name and target language for translation; food name, total weight, and meal type for a clearly labeled low-trust nutrition estimate; the persisted user/assistant turn pair for memory derivation, where facts may be extracted only from user text; the oldest bounded conversation window for background compaction; the current user-authored Chat turn for opt-in emotion classification; an existing pattern/evidence payload, display name, and locale for proactive wording; current/previous weekly aggregates, streak, high-confidence goal memories, locale, and opt-in emotion distribution for weekly-report generation; or a masked sender plus bounded inbound support-email recipient, subject, and body for classification and draft generation. Conversation or email text may itself contain identifying or health-related information.
• The DeepSeek Open Platform Terms confirms that the API model processes end-user Inputs and requires FitHelix to disclose delegated personal-information processing. Section 5.5 says the linked DeepSeek Privacy Policy does not cover processing rules for downstream end users. FitHelix therefore has not obtained provider-specific confirmation of the API input processing/storage location, training/improvement use, retention/deletion, processor-only handling, or sensitive-health-data acceptance.

Our commitments:

• Photos and audio are used only for your current logging session
• FitHelix does not use your content to train FitHelix-owned AI models. Current DeepSeek Open Platform evidence does not confirm whether downstream API Inputs, including recognition images, are used for provider model training or improvement.
• We do not share your content with other users
• High-trust nutrition values come from databases, product labels, controlled providers, or your explicit input. When no verified source matches and you request or review an AI Nutrition Estimate, DeepSeek may produce a clearly labeled low-trust estimate from food name, weight, and meal type. Server sanity checks apply, you must confirm it before saving, provenance is retained, and it never updates FitHelix's authoritative food tables.

2.5 Emotional Insights (Opt-In, Default: OFF)

Emotional Insights is disabled by default. If you enable it in Settings:

• FitHelix infers emotional states (joy, stress, fatigue, motivation, frustration, neutral) from your conversations with Nour
• Emotional signals are stored as high-level tags and numerical confidence scores, not as original biometric emotion templates or face/fingerprint recognition templates
• Purpose only: Personalized insights in your weekly reports and mood charts
• Not used for: advertising, push notifications, cross-user aggregation, or third-party sharing
• Retention: Controlled by you. Disabling stops new observations but does not delete historical data. You may hard-delete all emotional observations at any time via Settings or by calling DELETE /api/v1/users/me/emotions

2.6 Health Platform Data (HealthKit / Health Connect)

Health Sync is optional and disabled by default. System permissions and your choices in the App govern reading, server sync, writing, and use in AI analysis separately. Granting a system permission does not by itself enable server sync or AI analysis.

With read permission and the relevant feature enabled, Apple HealthKit and Android Health Connect may provide nutrition and hydration, steps, active energy, distance and workouts, sleep, weight, body fat, lean body mass, resting heart rate, and heart-rate variability. iOS additionally reads exercise time. Availability and the exact types depend on the platform and your permissions. These enabled health categories may be synced to our servers only with your separate sync consent; AI analysis requires its own consent.

On iPhone, workout recording and details may also read workout heart rate and cycling distance. Those two types are used on-device and are not included in health-context server sync. Resting heart rate and heart-rate variability are different recovery types and may be synced with recovery consent. A selected workout's route is read from Apple Health only for on-device display, as described below.

On Apple Watch, workout recording reads heart rate, active energy, and distance during the workout, and after you save the workout the Watch reads it back from Apple Health to show its summary. If you allow it, the Watch also reads your date of birth, only to estimate heart-rate zones on the watch. The date of birth is not stored; the estimated zones, the time in each zone, and live kilometer splits are kept only in the watch's memory for that workout. The date of birth, these estimates, and the saved-workout summary are not uploaded to our servers or included in Watch-to-iPhone messages. A saved workout reaches your iPhone through Apple Health, where the health sync described above applies only with your separate consent.

With write permission and the relevant write option enabled, we may write nutrition (energy, protein, carbohydrate, and fat) and water intake. On iPhone and Apple Watch, explicitly saving a workout writes the workout and samples actually captured by the recording device, which may include active energy, heart rate, and distance, plus an optional outdoor route. A manually entered workout does not fabricate sensor samples. The Watch requests its own system permission. During live recording, HealthKit may already persist sensor samples; discarding a workout does not guarantee those samples are removed. You can manage them in Apple Health.

Strength-training details are separate from Apple Health workouts: our servers may store your templates, session plans, exercise names, sets, repetitions, load, units, revisions, and linking anchors. These account-linked details are included in account export and deletion. The anchor does not contain the workout's time, duration, energy, heart rate, distance, or HealthKit identifier. GPS routes are not part of these server records.

You may turn off the separate sync, write, or AI options in Settings, and revoke system permission in Apple Health or Health Connect. These actions stop the corresponding future processing. Data already stored in a health platform is managed separately there. Deleting your account does not delete Apple Health workouts or routes. We do not request blood glucose, contacts, call logs, or messages through these health permissions.

2.7 Outdoor Workout Routes (Optional)

Outdoor route recording is optional for walking, running, and cycling. Precise location is collected when you start an outdoor workout on the recording iPhone or Apple Watch and grant location and Health route permission. If permission is already granted, GPS sampling starts automatically for that outdoor workout. Denying or revoking these permissions still allows a workout without GPS. A companion iPhone does not record a second route for a Watch workout.

During an active workout, the recording device may collect latitude, longitude, time, accuracy, and altitude, speed, or direction supplied by the system. We request When In Use location access, not Always access. An active workout may continue location updates with the screen locked or the App in the background, with the system location indicator. Pausing stops GPS sampling, although the background session and indicator may remain for resuming. Ending, discarding, or unbinding stops collection.

New routes are saved only to the workout's associated route in Apple Health. Coordinates exist in temporary capture memory and Apple Health; they are not saved to our recovery journal, sent between Watch and iPhone, uploaded to our servers, or included in logs, analytics, Sentry, URLs, advertising, or AI prompts. Workout heart rate, energy, and distance are also excluded from Watch-to-iPhone messages, as are account identifiers; workout state, commands, and strength-training details may be exchanged.

When you open a selected workout's route, the App reads it into temporary memory and clears it when you leave the detail screen. Apple MapKit and its regional map providers receive map-region requests to display the background map. We do not retain those map requests or coordinates. Current recording does not provide guided navigation or public route sharing.

Deleting your own workout in the App also attempts to delete its associated Apple Health route. If the platform or recording device does not allow deletion, use Apple Health or the recording device. Account deletion and account export do not delete or export Apple Health workouts or routes; manage or export those records in Apple Health.

Earlier versions could store private workouts and raw routes on our servers. Those historical server records remain included in account export and account deletion. Current versions do not provide separate deletion of those historical workouts or routes. Route-only deletion in earlier versions may have retained a coordinate-free summary and deletion tombstone. Historical encrypted route recovery files on the device are cleared on sign-out or account deletion. The current recorder creates no new server route records.

2.8 Subscription & Billing Data

• Subscription status, plan type, and platform (Apple App Store or Google Play)
• Purchase receipts and verification results
• Daily quota usage (recognition, chat, voice calls)
• Trial progress and billing dates

We do not store your payment card details. All payments are processed by Apple App Store or Google Play.

2.9 Diagnostics & Stability (Optional)

We use Sentry to collect crash reports and diagnostic information:

• Crash stack traces
• Device model, OS version, and App version
• Technical performance and session context, including a persistent SDK installation identifier for stability analysis and session correlation. The mobile apps do not set your FitHelix account user ID in Sentry. On iOS, network diagnostics pass through a field allowlist and scrubber.

Sentry is opt-out: You may disable crash reporting in Settings. If disabled, Sentry is not initialized on the next App launch.

We do NOT collect: your food records, chat messages, photos, or profile data in crash reports.

Current nourai-ios Sentry project evidence shows server-side data scrubbing enabled, default scrubbers enabled, IP address storage disabled, and additional sensitive field names configured for email, food_record, chat_content, audio_filename, HealthKit, and HealthConnect. The 2026-05-07 evidence also shows baseline Advanced Data Scrubbing rules for email addresses, IP addresses, user geo, extra.food_record, extra.HealthKit, stack-frame usernames, authorization headers, and auth-in-URL messages. Backend and Android projects require their own configuration evidence; this is not a claim of identical project settings.

Current Sentry evidence supports a signed Data Processing Amendment. Current evidence does not show a Sentry Business Associate Agreement. For this reason, FitHelix must keep Sentry free of PHI and sensitive user content.

2.10 First-Day App Navigation (Product Analytics)

To understand whether new users manage to log their first meal, the FitHelix iOS app reports a small set of navigation steps and our server keeps them only for new accounts:

• What: up to five fixed steps — Today viewed, camera opened (photo, barcode or label scan), food search started, recognition succeeded, and meal review opened — each with the time our server first received it
• When: only steps our server receives within the first 24 hours after the account is created are stored, each at most once; later reports are discarded
• Where: our own backend only, linked to your FitHelix account; which step you reached is not sent to Sentry, advertisers, or any third-party analytics service, and not used for tracking
• Not included: food, photos, search text, nutrition values, Apple Health or Health Connect data, or advertising identifiers
• Use: aggregate counts of how many new accounts reach each step and save a first meal; individual steps are not used to make decisions about you
• Your control: the steps are included in your data export and deleted when you delete your account

Whether you saved a first meal is determined from your saved records, not from these steps.

2.11 What We Do NOT Collect

• Contacts, calendar, or photo gallery (except photos you explicitly upload)
• Call logs, SMS, or other App data
• Third-party advertising tracking (no Facebook Pixel, no Google Analytics for Firebase Ads, no AppsFlyer, no Branch.io)
• Biometric data

We do not sell your personal data.

FitHelix does not collect, share, or sell consumer health data, including consumer health data that may be covered by Washington's My Health My Data Act, except as reasonably necessary to provide features requested by you, comply with law, protect security, or otherwise as described in this Policy.

3. How We Use Your Information

We use your data solely for the following purposes:

• Core functionality: Food and water logging, nutrition calculation, workout recording, optional private outdoor routes, history, trends, achievements
• AI assistance: Food recognition, OCR, voice parsing, Nour chat responses, weekly reports
• Nutrition matching: Querying our nutrition database (USDA + Open Food Facts)
• Personalization: TDEE, calorie budget, and macronutrient targets based on your profile
• Subscription management: Access control, quota enforcement, purchase verification, restoration
• Health sync: Reading/writing health platform data (with your authorization)
• Diagnostics: Fixing bugs and improving stability (via Sentry)
• Onboarding improvement: Aggregate counts of first-day app navigation steps (section 2.10)
• Account security: Email verification, Passkey management, password resets
• Legal compliance: Responding to data subject requests, fraud prevention, legal obligations

Nutrition data trust boundaries: High-trust nutrition values come from our nutrition database, product labels, controlled providers, or your explicit input. When no verified source matches and you request or review an AI Nutrition Estimate, DeepSeek may produce a clearly labeled low-trust estimate from the food name, weight, and meal type. Server sanity checks apply, you must confirm it before saving, provenance is retained, and it never updates FitHelix's authoritative food tables.

4. Legal Basis for Processing (GDPR)

5. Third-Party Services & Processors

We engage the following service providers. DPAs or standard contractual clauses (SCCs) apply where available and verified; the table and notes disclose known exceptions.

Data Residency for Vertex AI: We use Google Vertex AI's global endpoint region. Your data may be processed in Google Cloud data centers worldwide.

DeepSeek vision / Chat / registered text / Insight processing: The Open Platform Terms confirms processing of end-user Inputs but says the consumer DeepSeek Privacy Policy does not cover downstream end-user processing rules. Current evidence does not confirm the API processing/storage location and does not include a FitHelix-specific DeepSeek DPA, fixed deletion SLA, processor-only instruction, training-use commitment, or sensitive-health-data acceptance.

5.1 Open Database License (ODbL) Notice

FitHelix uses nutritional data from Open Food Facts, which is licensed under ODbL v1.0. Any derivative nutritional database based on FitHelix remains subject to ODbL. Attribution to original contributors is available at openfoodfacts.org.

5.2 USDA Public Domain Notice

USDA FoodData Central data is a U.S. Government work in the public domain, free of copyright restrictions.

6. Data Storage & Security

6.1 Local Storage

• iOS: Authentication tokens stored in Apple Keychain (kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly); local cache uses SwiftData; historical route recovery files use AES-GCM and owner isolation; current GPS coordinates are not saved to local recovery files
• Android: Authentication tokens stored in EncryptedSharedPreferences (AES-256-GCM); local cache uses Room

6.2 Cloud Infrastructure

• Database: PostgreSQL (with pgvector extension), hosted on Google Cloud SQL in us-east4
• Cache & sessions: Upstash Redis on AWS us-east-1, TLS-enabled, in production since 2026-09-06; the previous Memorystore instance in us-east4-b is retained inactive during the post-cutover observation window and then decommissioned
• Object storage: Google Cloud Storage bucket nourai-photos in US-EAST4
• Application hosting: Google Cloud Run in us-east4
• Google AI processing: Google Vertex AI (global endpoint) for the recognition candidate and other disclosed capabilities
• DeepSeek AI processing: V4 Flash / V4 Flash Vision Exp / V4 Pro for recognition, Chat, registered text services, proactive reports, and insight (API processing/storage location not confirmed by the Open Platform Terms)
• Diagnostics: Sentry (United States)

Encryption in Transit: All client-server communication uses HTTPS with TLS 1.3.

6.3 Security Measures

• Passwords: Argon2id hashing with random salts
• Authentication: Short-lived JWT access tokens + refresh token rotation
• Refresh tokens: Stored as SHA-256 hashes in our database
• API security: Rate limiting, JWT authentication, parameterized SQL queries
• Image security: EXIF metadata is stripped from uploaded photos
• Least privilege: Service accounts granted only necessary permissions

No system is 100% secure. Please keep your account password confidential.

7. Data Retention

Account Deletion

You may delete your account at any time in the app via Profile → Settings → Account & security → Delete account, or by emailing [email protected] (see Delete Account).

Upon deletion request:

1. We immediately remove the active account and user-facing production records such as the profile, entries, historical server workouts and raw routes, photo records, chat history, achievements, and memories. The deleted account and its photos or routes cannot be accessed through FitHelix after this point.
2. A separate deletion queue may retain only the minimum technical records needed to finish cleanup, such as a former-account identifier, storage-object address, cache-namespace identifier, or encrypted provider-revocation credential. These records cannot restore account or photo access.
3. We retry storage deletion and provider revocation until acknowledgement. Storage or provider outages can keep the minimum cleanup record for longer than 30 days; raw storage pointers and revocation credentials are removed after acknowledgement. Google Cloud Storage soft-delete protection may retain an already deleted object for up to 7 additional days.
4. Backups: Deleted data remains in automated backups for up to 90 days, after which it is overwritten by backup rotation
5. Legal holds: Certain minimal data may be retained longer if required by law, fraud prevention, or accounting obligations

8. Your Rights

8.1 GDPR Rights (EEA & UK Residents)

Response Time: We will respond to verified requests within 30 days. We may extend this period by 60 days for complex requests, in which case we will notify you.

8.2 CCPA Rights (California Residents)

If you are a California resident, you have the following rights under CCPA / CPRA:

• Right to Know: Request disclosure of categories and specific pieces of personal information collected
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising
• Right to Limit Use of Sensitive Personal Information: Disable Health Sync and Emotional Insights
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise CCPA rights, email [email protected].

Do Not Sell or Share My Personal Information: FitHelix does not sell personal information and does not share personal information for cross-context behavioral advertising. If you still want to submit a "Do Not Sell or Share My Personal Information" request, email [email protected] with that phrase in the subject line.

8.3 Other Jurisdictions

If you are located in a jurisdiction with additional privacy rights (e.g., Brazil LGPD, Canada PIPEDA, South Korea PIPA, China PIPL), please contact [email protected].

For Canadian users, FitHelix aims to provide meaningful consent by describing optional AI photo, label, voice, Health Sync, and Emotional Insights processing before or at the time you choose those features. You can decline optional features and still use core manual logging features.

9. Children's Privacy

FitHelix is not directed to children under 13. We do not knowingly collect personal information from children under 13.

Age Gate: During registration, users must confirm they are 13 years of age or older. If we learn that we have inadvertently collected personal information from a child under 13, we will delete that information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected].

10. Tracking, Advertising & Data Sales

• No Cookies (App): The FitHelix mobile App does not use cookies.
• No Advertising Trackers: We do not use Facebook Pixel, Google Analytics for Firebase Ads, AppsFlyer, Branch.io, or any other cross-app advertising tracking SDK.
• No Data Sales: We do not sell your personal information to third parties. We do not share your personal information for cross-context behavioral advertising.
• AppTrackingTransparency: We do not use Apple's AppTrackingTransparency framework.

Our website (nourai.app) may use essential cookies for functionality. We do not use third-party analytics cookies on our website.

11. International Data Transfers

• Primary Processing: Our backend, database, and object storage are hosted on Google Cloud in us-east4 / US-EAST4.
• Google AI Processing: Google Vertex AI uses the global endpoint for the registered recognition candidate and other disclosed capabilities; your data may be processed in data centers worldwide.
• DeepSeek Recognition / Chat / Registered Text / Insight Processing: DeepSeek is the current food-recognition, authenticated Nour Chat, registered text-service, proactive-report, and insight primary. The Open Platform Terms does not confirm the API processing/storage location and says the consumer Privacy Policy does not cover downstream end-user processing rules; FitHelix has not verified provider-specific SCCs or a DPA for these paths.
• Diagnostics: Sentry processes data in the United States.
• Cache: Short-TTL cache entries are processed by Upstash, Inc. on AWS in us-east-1 (United States) under its Data Processing Addendum, with EU SCCs and the EU-U.S. Data Privacy Framework as transfer safeguards.
• Cross-Border Safeguards: We rely on Standard Contractual Clauses (SCCs) and Google's GDPR-compliant data processing terms.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes may be communicated through:

• A versioned in-App notification banner
• The current public policy and the "Last Reviewed" date at the top of this document
• Additional channels, including email, when required by law

Because there were no existing external users before v4.0 took effect, the current build does not present a versioned in-app update notice or send a notification email for this private-route disclosure.

Your continued use of FitHelix after any changes constitutes acceptance of the updated Policy.

13. Contact Us