This Privacy Policy explains how NCWB LTD ("we", "us", "our"), a company registered in England and Wales (company number 16587059), collects, uses, stores and protects your personal data when you use the Food Cheater app (the "App") and our website. We are the data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. How we handle your health information is also set out in our Health Data Policy.
1. Age Restrictions
You must be at least 18 years old to use Food Cheater. The App asks for your date of birth during sign-up; if you are under 18, sign-up stops, and what you entered is deleted from your phone without being sent to us. If we learn that someone under 18 has an account, we delete it.
2. Personal Data We Collect
A. Information you provide
- Account details: your name and email address, from Sign in with Apple, Sign in with Google, or the email address you enter to receive a sign-in code. If you use Apple's Hide My Email, we receive a private relay address instead.
- Profile and body details (needed to create your plan): first name, date of birth, sex, height, weight, goal weight, goal type and weight-loss pace, activity level, diet preference, and the calorie and nutrient targets worked out from them.
- Your logs: food and drink entries, water, weight entries, fasting sessions, activities you add, cravings you log, saved meals, foods you type in yourself, and Cheat Bank and Damage Control records.
- Your settings: units, reminder choices, your fasting preference and the craving triggers you chose.
- Support: your email address and what you tell us when you contact us.
B. Apple Health
If you turn on Apple Health in the App and allow it in iOS, we read your daily step count and walking and running distance. We store each day's step count and the calories it adds to your day, and back them up with the rest of your account so your history comes back on a new phone. We never write to Apple Health. Data from Apple Health is never used for advertising or marketing, never sold, never shared with data brokers, and never stored in iCloud. You can turn off access at any time in iPhone Settings › Health › Data Access & Devices › Food Cheater.
C. Sign in with Apple
If you sign in with Apple, Apple gives our server a token that lets us disconnect Food Cheater from your Apple ID when you delete your account, as Apple requires. We keep it encrypted, readable only by our server, and delete it with your account, or when you stop using Sign in with Apple for Food Cheater. Apple also tells our server when you stop using Sign in with Apple for Food Cheater or delete your Apple Account; what we do then is set out in section 7.
D. Information collected automatically
- Usage statistics: which screens you open and which steps you complete, with a random ID created on your phone and device details such as your device model, iOS version, App version, language and time zone. They are not linked to your name, email address or account, never include what you log or your body details, and do not include your IP address or location. You can turn them off in the App's Settings. See section 6.
- Server logs: your IP address and the requests the App makes when it talks to our servers, kept for a short time for security.
- Crash reports: only if you let your iPhone share them with app developers (iPhone Settings › Privacy & Security › Analytics & Improvements). Apple passes them to us without your name.
- Purchases: subscription status, product, dates and an account ID, through Apple and RevenueCat. We never see your card or bank details.
- No advertising tools. Food Cheater never reads your device's advertising identifier and does not track you across other companies' apps or websites.
E. AI features
When you use the AI features (Photo, Voice, Menu and the Craving Solver), we use:
- Photos of your meals and of menus that you take or choose, without their location data.
- The words of your voice logs, not the recording.
- The cravings you search, with your calorie target, diet preference, craving triggers and your country.
- For Menu, your diet preference and the calories you have left that day.
We use them only to recognise your food and give you estimates and suggestions, and we do not keep them. Anything you then log is kept like any other entry. We also keep a count of how many times a day you use each AI feature, for fair-use limits.
3. Who Receives Your Data
These companies process personal data only on our instructions, under data processing agreements, to run the App:
These receive limited data under their own terms when you use the feature that needs them:
We do not use advertising companies, and we never sell your personal data.
4. Legal Bases for Processing (UK GDPR)
5. Your Consent at Sign-up
When you create an account, you tick a box agreeing to our Terms & Conditions, this Privacy Policy and our Health Data Policy. We record when you ticked it and which versions you agreed to. You can withdraw your consent at any time by deleting your account in the App (Settings › About › Delete account). Because the App cannot work without storing this information, withdrawing your consent means your account and all its data are deleted.
Your consent at sign-up includes the AI features. You can turn them off at any time in the App's Settings, or by emailing team@foodcheaterapp.com. Turning them off costs you nothing else: the rest of the App, including your subscription's other features, works without them. We record when you turn AI features off or back on, and which policy versions applied.
6. Advertising, Tracking and Usage Statistics
Food Cheater does not use advertising or tracking tools, never reads your device's advertising identifier, and never asks to track you across other companies' apps. If that changes, we will update this policy first and ask for your permission before anything starts.
We use PostHog only to count how the App is used, for example which screens are opened and where people stop during sign-up, so we can improve it. These usage statistics:
- carry a random ID created on your phone, not your name, email address or account, and are never combined with information from other companies;
- never include your food, drink, weight, body details or anything else you log;
- do not include your IP address or location;
- are never used for advertising;
- are kept by PostHog for 12 months. The random ID is replaced when you sign out or delete your account.
Under the UK's Privacy and Electronic Communications Regulations, storing that random ID on your phone for statistics about how the App is used does not need your prior consent, but you can object at any time, free of charge: turn usage statistics off in the App's Settings, and nothing more is sent.
7. Data Storage, Retention and Deletion
- Where: on your phone, where Food Cheater's data is readable only while the phone is unlocked and is left out of iCloud backups, and backed up to our database hosted by Supabase in Ireland.
- How long: for as long as you have an account.
- Delete your account in the App: Settings › About › Delete account. Your account and every record are deleted from our live database straight away and from our backups within 30 days, your record at RevenueCat is deleted, and your phone is cleared. If you signed in with Apple, we also tell Apple to disconnect Food Cheater from your Apple ID; if that is not possible, the App shows you how to do it in iPhone Settings. You can also email team@foodcheaterapp.com with the subject "Data Deletion Request".
- If you stop using Sign in with Apple for Food Cheater (iPhone Settings › your name › Sign-In & Security › Sign in with Apple): Apple tells us, and we sign you out of Food Cheater on all your devices and delete Apple's token. Your data stays in your account: sign in with Apple again to get it back, or delete your account.
- If you delete your Apple Account: Apple tells us. If no one could sign in to your Food Cheater account any more (for example, you used Hide My Email and have no other way to sign in), we delete it, as if you had deleted it in the App. If you can still sign in another way, for example with an email code sent to the real email address you shared, we keep it, sign you out and delete Apple's token.
- Usage statistics are not linked to your account, so they cannot be found or deleted by account. PostHog deletes them after 12 months.
- AI features: we do not keep what you use them with, or their answers. Google keeps them for up to 55 days only to detect misuse, then deletes them. Our count of your AI uses is deleted after 35 days, and with your account.
- Kept after deletion: proof of your consent, for as long as the law requires us to be able to show it (up to six years). Apple keeps its own records of your subscription.
- Deleting your account does not cancel a subscription. Cancel it in iPhone Settings › your name › Subscriptions.
8. International Transfers
Your account and health information are stored in Ireland, and usage statistics in Germany. The UK recognises the EU as providing adequate protection. Supabase Pte. Ltd. is based in Singapore, and PostHog, RevenueCat, Resend and Google (for the AI features) are United States companies; Google may process AI requests in any country where it has facilities. Where one of them can access personal data from outside the UK and EU, we rely on the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, or the UK Extension to the EU-US Data Privacy Framework, as set out in its data processing agreement.
9. Security
Data is encrypted in transit and at rest. Our database lets each account read and change only its own records. On your iPhone, Food Cheater's data is readable only while the phone is unlocked and is left out of iCloud backups, and your sign-in session is encrypted with a key kept in the iOS Keychain. Apple's sign-in token is encrypted on our server with a key kept outside the database. Only our director can access the database, using two-factor sign-in. If a breach puts your data at risk, we will tell you and the authorities as the law requires.
10. Your Rights
Under the UK GDPR, you have the right to:
- Access your personal data and get a copy of it.
- Correct inaccurate or incomplete data. Most of it you can change yourself in the App.
- Delete your data ("right to be forgotten").
- Restrict or object to some processing. You can turn usage statistics and AI features off yourself in the App's Settings.
- Data portability: receive your data in a structured, machine-readable format.
- Withdraw consent at any time, without affecting processing that took place before.
You can delete everything yourself in the App. For anything else, email team@foodcheaterapp.com; we reply within one month.
You can also complain to the UK supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
Helpline: 0303 123 1113 | Website: ico.org.uk
11. Notice for US Residents
We do not sell your personal information and do not share it for cross-context behavioural advertising. The companies in section 3 that work for us use it only to provide their service to us. You can ask to access or delete your personal information by emailing team@foodcheaterapp.com.
Washington, Nevada and other states with consumer health data laws: what health information we collect, why, who receives it and your rights are set out in our separate Health Data Policy.
12. Changes to This Policy
We may update this Privacy Policy as the App changes. We publish every revision here with a new "Last Updated" date. If a change affects how we use your data in a significant way, we will tell you before it applies.
13. Contact
For questions about your data or to exercise your rights, contact:
NCWB LTD
Attention: Privacy
Registered in England and Wales, company number 16587059
Registered Office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: team@foodcheaterapp.com
Registered with the UK Information Commissioner's Office (ICO), reference ZC266656