Privacy Policy

Who we are

ACR20 ("we", "the app") helps you log meals from a photo and track your nutrition and weight. You can reach us at ac@diafanolabs.com.

What data we collect

• Account data: your email address, used for passwordless sign-in.
• Profile and health data: name, optional username, sex, age, height, weight and weigh-in history, activity level and goals.
• Meal data: photos of meals you choose to log and the nutrition estimates derived from them.
• Social data: the buddy connections and requests you create.
• How you feel: if you choose to log it, your daily energy, mood, hunger, sleep and notes.
• Goals and diet: your goal (for example lose weight or endurance training), your sport, training hours and race date if you add them, and the allergies, intolerances and diet you choose to tell us. We use them to calculate your targets and so the AI can warn you about allergens and avoid suggesting them. The AI cannot guarantee that a dish is free of an allergen.
• Professional data: if you register as a professional, your name, profession, registration number, professional body and city.
• Technical data: basic device and usage information needed to run and secure the app.

We do not sell your data.

How we use your data

• To estimate the calories and macros of your meals (meal photos and text are processed by our AI provider).
• To calculate your personalized targets and show your progress.
• To enable community features (buddies and your public @username profile).
• To send sign-in emails and essential service messages.
• We review conversations to detect errors and improve the service; only the ACR20 team sees them.

Providers that process data for us

• Supabase — database, authentication and file storage.
• OpenAI — AI analysis of meal photos and text.
• Resend — transactional sign-in emails.
• Vercel — web hosting.
• Stripe and the app stores — payment processing for subscriptions.

These providers process data on our behalf under their own terms.

Your choices and rights

Your profile is private by default; only buddies you accept can see your progress.

You can delete your account and all your data yourself from Profile → Settings → Delete account, or request deletion by contacting ac@diafanolabs.com.

You can revoke camera and photo permissions at any time in your device settings.

Sharing with your professional

If you choose to, you can share some of your health data with a nutrition, health or fitness professional (for example your dietitian, physiotherapist or trainer) from Profile → My professional. Sharing requires your explicit consent on a dedicated screen, where you choose exactly what to share: meals, meal photos, weight, goals and body data, or how you feel. Nothing is selected by default.

The professional only sees what you choose, from the date you choose, and never your chat with the AI, your email or your payments. We record your consent (what you agreed to, which version of the text and when) and every time the professional views your data or prints a report, and you can see that log in the app. If you sign up through a professional's invitation link, that professional sees, as a count, that someone joined through their link; they never see amounts or payment details.

You can change what you share or withdraw your consent at any time from the same screen; access ends immediately. If the professional stops following you or deletes their account, sharing ends automatically. The legal basis for this processing is your explicit consent (Article 9(2)(a) GDPR).

Professionals accept our Terms for professionals and must use your data only to care for you. Any copy they make outside ACR20, such as a printed report, is their responsibility as a professional. The recommendations they send you are stored with your account.

Data retention

We keep your data while your account is active. On a deletion request we remove your personal data within a reasonable period, except where we must keep it by law.

Full-size meal photos are deleted automatically 180 days after you log them; only a small thumbnail is kept so your diary still shows the meal. Usage events (which screens and features you use, your device type and browser, and the website or campaign you came from; never what you write) are kept while your account exists and are deleted when you delete it.

Your consent records and the professional access log are kept while your account exists, so you can review them and we can demonstrate your consent; they are deleted with your account.

Children

ACR20 is not directed at children under the age required by your country's law.

Changes

We may update this policy. We will post the new version at this URL with an updated date.