A little clarity.
About your information.

Your device diary

Your diary, profile, plans, habits and companion preferences are stored on your device. Meal photos can be part of that diary. Using the device diary does not enable account sync automatically.

Device storage and exported backups are not an app-level encryption guarantee. A backup can contain meal information and embedded photos; keep it somewhere private.

Accounts and optional sync

Creating an account supplies your display name, email address and password to the account service. Passwords are stored as password hashes. The service also holds sign-in sessions and account verification or recovery records.

If you enable account sync, the API stores your diary and meal photos in its MongoDB database. You choose how existing device and account diaries are brought together. Signing out returns you to the separate device diary; signing out is not account deletion.

The browser uses an HTTP-only refresh cookie to keep you signed in. Application state is also stored locally. The landing page uses self-hosted fonts and artwork and does not include advertising or analytics scripts.

Meal estimates and label scans

When the optional analysis service is enabled, confirming an estimate sends the selected meal photo and the description you enter to Nouri’s analysis service and OpenAI. Your whole diary and profile are not included in that request. You can use manual entry instead.

The analysis implementation does not save the submitted image or description and requests that the OpenAI response is not stored. That request is not a guarantee of zero provider retention: OpenAI’s processing and privacy terms still apply. Availability depends on service configuration.

English nutrition-label OCR runs locally in the browser using self-hosted Tesseract resources. Supported native builds use on-device OCR. Barcode searches query Open Food Facts and may load product images from its servers, which receive normal connection information.

Family spaces

Joining requires accepting a private invitation. Family members can see display names, shared goals and shared check-in days. They do not receive your personal food diary, meal photos, calories, weight or private nutrition targets.

Family views show up to 90 days of check-in history. Older stored check-ins are pruned when the space is next changed. Leaving the family or deleting your account removes your shared contributions. The 90-day view is not a promise that every backup has been erased.

Account email and service protection

When email delivery is configured, verification and password recovery messages are sent through Brevo to the email address you provided. Brevo processes the recipient address and message content, including the short-lived account code. Pending messages are held in an encrypted delivery queue with retry controls. Family invitation codes are shared by the person inviting you; the family feature does not email your contacts.

The backend uses request, account and service usage records to limit abuse and provider costs. Requests also expose normal network connection information to the hosting infrastructure. These controls do not require access to your address book.

Export, delete and manage access

Open Settings for diary sync, backup/export and local-data controls. Open Account → Data to find permanent account deletion. Full deletion steps are also available on the web. That action removes the active account, associated sessions, account diary, owned cloud meal photos and family membership/contributions.

Exported files, operating-system backups, other-device caches, infrastructure backups and provider records are separate copies. The operator’s final retention and erasure schedule for these copies is still pending. See Help for the available steps, or email info@nourigo.app with privacy questions.