Privacy Policy
Last updated 31 August 2026Pandy analyses a photo of your meal to estimate its calories. To do that, the app processes certain data. Here is what, why, and what you can demand at any time.
The essentials, in three points:
- Your photos are never stored on our servers.
- Your food diary and your weight stay on your phone and in your iCloud — we have no access to them.
- Nothing is sold, rented, or passed on to advertisers.
1What Pandy processes
| Data | Why | Legal basis |
|---|---|---|
| Meal photos | Estimate calories and macronutrients | Performance of the contract |
| Sex, age, height, weight, goal, activity level | Calculate your personalised calorie target | Explicit consent |
| Meals, weigh-ins, hydration, fasting | Track your progress over time | Explicit consent |
| Account identifier and Apple relay e-mail | Recognise your account, attach your subscription to it, and verify your entitlement | Performance of the contract |
| Number of analyses per account | Enforce the limit of 20 analyses per day | Legitimate interest |
| Screens viewed and actions taken in the app | Understand where the app is hard to use, and improve it | Legitimate interest |
2What happens to a photo
When you photograph a meal, the image is downscaled on your phone, then transmitted over an encrypted connection to our server, which submits it to OpenAI's analysis service. Only the result comes back to the app: food name, calories, macronutrients.
The image is not stored anywhere — not by us, not in any database. It is processed and discarded. The only copy that remains is the one in your camera roll, under your control.
OpenAI contractually undertakes not to use content submitted through its business interface to train its models.
Avoid photographing people. If a photo contains an identifiable third party, you are responsible for it: make sure you have their agreement. The app only needs the plate.
3Where your data lives
Your profile, your meals and your weigh-ins are stored on your device, then synchronised through your own iCloud account. That synchronisation is handled by Apple, inside your personal space: we have no access to it and hold no copy of it.
Our servers keep only two things, and neither of them is health data:
- Your account — a unique identifier and the relay e-mail provided by Apple, hosted by Supabase in Ireland. This is what allows us to verify, server-side, that you have an active subscription before each analysis.
- Your analysis count — your account identifier and a timestamp, solely to enforce the limit of 20 analyses per day.
Usage measurement (which screens, which actions) is handled separately by PostHog, on its European infrastructure, and contains no health data.
4Processors
- Apple — authentication, iCloud synchronisation, subscription payments
- Supabase — hosting of your account and of the analysis service — European Union (Ireland)
- PostHog — app usage measurement, with no health data — European Union
- OpenAI — meal photo analysis — United States
- RevenueCat — technical management of subscriptions — United States
Transfers to providers located outside the European Union rely on the standard contractual clauses adopted by the European Commission.
5Retention periods
| Meal photos | Not retained |
| Analysis count | 30 days, then deleted automatically every night |
| User account | Until you delete it — immediate, from within the app |
| Usage measurement | 12 months |
| Billing data | Retained by Apple under its own rules |
6Your rights
You have the right of access, rectification, erasure, portability, objection and restriction. To exercise them, write to contact.pandy.app@gmail.com — we reply within one month.
Erase everything, immediately, without going through us
In the app: Settings → Delete my account. This single action erases:
- your account on our servers, together with your analysis count;
- your profile, your meals and your weigh-ins on the device;
- the copy synchronised in your iCloud.
Erasure is immediate and permanent. Settings → Reset app remains available if you want a clean slate while keeping your account.
Your subscription is cancelled separately, from Settings → your name → Subscriptions on your iPhone: Apple is its sole manager.
If you believe your rights are not being respected, you may lodge a complaint with the CNIL, the French data protection authority — cnil.fr — or with the supervisory authority of your country of residence.
7Security and incidents
Exchanges between the app and our servers are encrypted. The access keys to the analysis services are never embedded in the app: they stay server-side, out of reach.
No system is infallible. In the event of a data breach likely to result in a risk to your rights, we will notify the CNIL within 72 hours and inform you directly if the risk is high, in accordance with Articles 33 and 34 of the GDPR.
8Advertising and tracking
Pandy displays no advertising, embeds no advertising tracker, does not follow your activity outside the app, and does not request Apple's tracking permission. No data is passed to a data broker.
9Minimum age
Pandy is restricted to people aged 18 or over. We do not knowingly collect data concerning anyone younger. If we become aware of such a case, the account and its associated data are deleted.
If you are a parent and believe your child is using the app, write to us: we will delete the account unconditionally.
10Changes to this document
This policy may be amended. The date at the top of the page prevails, and any significant change will be signalled in the app.
11Who is responsible
Julien Souquie — sole trader
SIRET 105 203 525 00016
Merville, France
Contact: contact.pandy.app@gmail.com