Privacy Policy

Simmerlo · Effective November 1, 2026

Simmerlo estimates the calories in a meal from a photo you take. This page explains what we store, what we send to a third party, and how to get rid of all of it.

1. Who we are

Simmerlo is published by Dalian Zhiliaoshengsheng Culture Communication Co., Ltd., a limited liability company registered in Wafangdian, Dalian, China. For any question about this policy or your data, write to [email protected].

2. What we collect

• Email address. Used only to sign you in. You can sign in with a one-time email code, or with Google or Apple Sign In — we never see or set a password for you.
• Meal entries you create or confirm. Dish name, calories, macronutrients, portion notes, and the date and time of the meal.
• The photos you choose to analyze. See section 3 — they are transient.
• Voice recordings, if you choose to report a meal by voice. See section 3 — they are transient too.
• Your goal settings. Daily calorie target, and the age, height, weight, sex and activity level you optionally provide to calculate it.
• Coach records. If you use the coach: weight entries, ten-second daily check-ins (hunger, energy, sleep, stress), your food preferences, remembered restaurant orders, experiments and the coach conversation. These live in the app's local storage on your device; when you are signed in, they are also synced to our database so they survive losing or changing your phone. Only your account can read them, and you can delete them from the app at any time. See section 4.
• IP address. Used for two things only: counting an anonymous scan against the free daily allowance, and stopping abuse of the API. It is never attached to your account. To keep that allowance counting across server restarts, the API stores a one-way keyed hash of the address — salted with the UTC day and computed with a server-only secret — rather than the address itself; the hash cannot be turned back into an address without the secret, and it is deleted the next day.

We do not collect your name, phone number, contacts, location, advertising identifier, or a list of other apps on your device. The app contains no advertising SDK. We embed Sentry for crash reporting and PostHog for anonymous product analytics — neither tracks you across other apps, and neither is used for advertising or data brokering. Crash reports are filtered on the device before they leave: access tokens, sign-in codes, recording transcripts and email addresses are removed.

3. How photos and voice recordings are handled

If you save a meal, the photo you took stays in the app's local storage on your own device so the entry can show a thumbnail. That copy never leaves your device except as part of your device's own backup, which is controlled by your operating system, not by us.

Voice reporting is a separate path — the photo model does not read it. When you log a meal by speaking, a short recording rests only in your device's own cache directory, is transmitted over HTTPS to our server once, and is deleted from your device immediately after it leaves. On the server the recording is held in memory only: it is decoded and passed to the transcoder as a stream, so no copy is written to a file. It is then forwarded once to the transcription provider — Groq's Whisper model, with Google's Gemini as the backup when Groq cannot answer (and as the first choice when the app is set to Chinese, because Gemini hears Mandarin more accurately). The words that come back are turned into the same meal entries a photo would produce, and the audio is discarded: we do not store your recordings, not in a database and not on disk.

4. Coach and health data

The coach is designed to keep the detailed record on your side:

• Where your records live: on your device, and — while you are signed in — a synced copy in our database, so a new phone picks up where the old one left off. Access is restricted to your account. Clearing the coach's data in the app deletes both copies; your meal diary is never touched by that clear.
• What leaves your device when you use the coach: a small, aggregated summary — your latest weight and 7/28-day trend, protein and calorie averages, check-in averages, logging streaks and the status of an active experiment — plus the text you type in a coach chat, the short statements you explicitly told the coach (for example a routine or an allergy) and the habits it has learned from your log (usual foods by meal slot, weekday/weekend averages and a portion factor). Raw meal photos and the full meal diary are never sent.
• Long-term memory recall, optional and off by default: when you turn it on in the app's memory page, the server turns a short text into a list of numbers called an embedding using Google's embedding service, and keeps those numbers in your account's memory index so the coach can find an older statement that is relevant to your question. Only the statements you explicitly chose to remember are indexed — never your meal diary, meal notes or chat history. A photo is never sent for this. The embedding is derived data, not a copy of your words: it is hard to read back, but we still treat it as your data and store it in the same database as the rest of your coach records. Turning the switch off stops new indexing and recall; clearing the coach's data deletes the index and turns the switch off; deleting your account erases it.
• The coach is software, not a person. Its suggestions are generated from your own logged data, are labelled with the evidence behind them, and can always be dismissed. It is not a medical service, it does not diagnose, and it never suggests medication changes — for GLP-1 or any other treatment, contact your prescriber.

5. Who processes data on our behalf

• Supabase — authentication and database, hosted in the United States (us-east-1). Stores your email address, your meal entries and your goal settings.
• Google — the Gemini model that reads the photo. A photo is only ever sent to Google: no other provider on this list receives one. Google also phrases the coach's wording when Groq cannot answer, and — for signed-in accounts only — provides the embedding service that turns coach text into numbers for long-term memory recall (see section 4). Gemini is also the backup voice transcriber: when Groq cannot answer, or when the app is set to Chinese, the recording goes to Gemini instead. The image or recording plus a short instruction, the aggregated coach summary described in section 4, or the text to embed, are sent per request; Google's API terms govern that processing. We use the free tier of that API, under which Google may use submitted content to improve its products; the paid tier opts out of that use.
• Groq — the main voice transcriber, and the model that writes the coach's wording. A voice report is sent here first: the Whisper model turns the recording into text, and a further text model turns that text into the same entries a photo would produce. The coach's answer is generated here first too, from the small aggregated summary described in section 4 — weight, trend and averages, never a photo and never your full diary. No photo is ever sent to Groq: its text model would have to invent a dish from a file it cannot see, so the photo route excludes it in code rather than by convention. Google is the coach's backup when Groq cannot answer. Groq is operated in the United States and its published terms state that API inputs are not used to train models.
• Render — the hosting provider that runs our API server, located in the United States.
• RevenueCat — subscription infrastructure. It associates your purchase with a random app-user id (your Supabase user id) so your Premium status can be restored on a new device. Payment card data never reaches us or RevenueCat's servers in identifiable form — purchases are billed by Apple on iOS and by Google Play on Android.

These providers process data on our instructions and are not permitted to use it for their own advertising. The one exception is the Gemini free tier described above, which may use submitted content to improve Google's products. We do not sell your personal information, we do not share it with data brokers, and we do not use it for cross-app tracking.

6. Legal bases (EEA and UK visitors)

Where the GDPR applies, we rely on performance of a contract to provide the service you signed up for, and on legitimate interests to keep the service working and prevent abuse. You may object to processing based on legitimate interests at any time.

7. How long we keep it

Your account data is kept until you delete your account. When you delete a single meal, we mark it as deleted rather than erasing the row immediately, so a multi-device sync cannot bring it back; those marks are removed together with the rest of your records when you delete your account. Deleting your account removes your account row, your profile and every meal entry.

Daily counters. Per-day counters keyed to your account or to the requesting IP address (anonymous) live in the API server's memory and are discarded when the UTC day rolls over. So a restart cannot reset them — which would let a runaway loop spend the model budget unnoticed — the API also persists, per UTC day, the number of scans, coach replies and voice takes, and each caller's own count. Callers are stored only as one-way keyed hashes salted with the day, never as a user id or an IP address, and those rows are deleted the next day. From the same calls it also keeps a per-day total of tokens, audio seconds and estimated cost, kept for 30 days; that figure carries no per-person detail. Our hosting provider keeps standard HTTP request logs, which include the requesting IP address and a timestamp, for a short operational window; those logs contain no photo or audio content.

8. Your rights

• Delete everything — open the app, go to Profile → Delete account. This removes your account and all associated records. If you no longer have the app installed, follow the instructions on our account deletion page; you can also email us and we will do it for you.
• Access and portability — email us and we will send you a machine-readable export of your entries.
• Correction — meal entries can be edited or deleted inside the app at any time. The coach's beliefs about you can be viewed and corrected on the "What Simmerlo remembers" page, and clearing the coach's memory never deletes your meal diary.
• Withdraw consent — sign out to stop syncing; the app keeps working locally without an account.

If you are a California resident, you have the right to know what we collect, to delete it, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined by the CCPA/CPRA. We will not discriminate against you for exercising any of these rights.

Consumer health data (Washington and similar state laws)

Your meal entries and goal settings can qualify as consumer health data under the Washington My Health My Data Act and comparable state laws. For that data specifically:

• We collect it only because you ask the app to keep a food log — not for advertising, profiling, or any purpose other than providing the service.
• We never sell consumer health data.
• This includes your meal entries, your goal settings, your weight entries and your check-ins. We share it only with the processors listed in section 5, and only to store it for you or to produce the estimate or coaching wording you requested.
• You can withdraw consent at any time by signing out, or have it deleted entirely via Profile → Delete account.

9. Children

Simmerlo is not directed to children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, email us and we will delete it.

10. Health disclaimer

Calorie estimates are approximations produced by a vision model. They can be wrong, particularly for oil, sauces, hidden ingredients and true portion size. The same applies to every coach suggestion: it is general guidance generated from your own entries, not medical advice, diagnosis or treatment. The coach does not provide medication guidance of any kind, including GLP-1 dosing; it may only suggest protein, hydration and portion habits, and it will tell you to contact your prescriber for anything else. Consult a qualified professional before changing your diet for a medical condition. Do not rely on this app to manage diabetes, an eating disorder, an allergy, or any other health condition.

11. Security and breach notice

Data is transmitted over TLS. Database access is protected by row-level security, so one account cannot read another account's records. Our API server holds the model credentials and never exposes them to the app. No system is perfectly secure, but we keep the surface small: we never see or set account passwords, and no photos rest on our side.

If a breach of your data ever occurs, we will notify affected users without unreasonable delay and within 60 days of discovering it, describing what happened and what data was involved.

12. International transfers

Our processors are all located in the United States: the database, the API server and the models used for photo analysis, voice transcription and coaching. If you use the app from another country, your data will be transferred to and processed in the United States. No meal photo, voice recording, entry or account detail is sent to a processor outside the United States.

13. Changes

If this policy changes in a way that affects what we collect, we will update this page and change the effective date above. Material changes will be announced in the app before they take effect.