Privacy Policy — Sunny Side Up

Last updated: 2026-08-13

Draft. Prepared for a capstone/master’s project. Before this is shown to anyone real, check it against Ukrainian data-protection law and the GDPR, and against a lawyer if one is available. The engineering claims in sections 5, 7 and 8 are true of the product as built; the legal framing is not reviewed.

1. Who we are

Sunny Side Up is a nutrition assistant: you photograph or describe a dish, the app recognises it and estimates the portion, and the nutrition numbers come from a verified food database. It is a student engineering capstone project, built and run by one person to demonstrate the idea and gather feedback — not a company, and not a production service with an operations team behind it.

This is a test application. Please do not enter real personal or health information. Use approximate or made-up numbers for your profile and meals if you want to try it out. The engineering around your data (consent, storage, deletion, export) is built and works as described below, but this project carries none of the operational guarantees — support staff, uptime commitments, an incident response process — that a real health-data product would need before it should hold anyone’s actual health information.

There is no formal data controller in the corporate sense, and no dedicated privacy contact channel: the controls described in section 6 — view, correct, export, delete — are self-serve in the app itself, and are the way to exercise every right this policy describes.

2. What we hold

We collect only what the app needs to work:

• Your identity. You sign in either with Google, or with a one-time code emailed to your address — both through our identity provider, Clerk. We store an identifier for your account and the profile details the sign-in method gives Clerk, such as your email address. We never see or store your Google password, and a one-time code is single-use and expires quickly.
• Your consent record. The version of this policy you agreed to and the moment you agreed. This is the first thing stored about you: no body measurement can be held until it exists.
• Your body profile. Sex, age, height, current and target weight, activity level. This is health data — a special category under the GDPR — and it is held only with your explicit consent.
• Your daily target. The calorie and macronutrient goal derived from that profile, and the goals you have set over time.
• Your meals. Descriptions of dishes, photographs you choose to upload, the nutrition figures attached to each entry, and when you ate.
• Your weight over time, for the charts.
• Technical data strictly needed to serve the application, such as the session identifier that keeps you signed in.

We do not collect anything unrelated to these functions, and we run no advertising or tracking of any kind.

3. Why we hold it, and on what basis

Health data is processed only on your explicit consent, given when you first sign in and withdrawable at any time.

4. Where the numbers come from, and what the model does

This matters enough to state plainly, because it is unusual:

• The model does recognition, not arithmetic. It identifies the dish and estimates the portion. Where a verified database carries the dish, the nutrition figures are the database’s and never the model’s. Where it carries nothing, or could not be reached, the model’s own figures may be shown — always behind an explicit mark that says so, and never saved without you confirming them.
• Nutrition figures come from verified databases — USDA FoodData Central (public domain, CC0) and Open Food Facts (ODbL; attributed as that licence requires) — or from a nutrition label you photograph.
• Every estimate is yours to confirm or correct before anything is saved. Nothing is stored silently.

To recognise a dish, the description or the photograph is sent to an external AI model, through OpenRouter, acting as a data processor on our behalf; OpenRouter in turn routes the request to whichever underlying model provider is configured. Photographs of food may incidentally contain more than food; send only what you are comfortable sending — and see the warning at the top of this policy about not sending real personal information in the first place.

If you describe a meal by speaking instead of typing, the recording is sent through OpenRouter to a third-party transcription service, which turns it into words. The recording itself is discarded once transcription completes — it is kept nowhere and attached to nothing; only the words it produced become part of the description you review and can edit before anything is saved.

A photograph you attach to a meal is also stored outside our own database, with Cloudflare, on its R2 object storage, which acts as a data processor on our behalf for that storage. Section 5 explains how a stored photograph is addressed and who can read it.

We do not sell your data, and we share it with no one beyond the processors named in this policy.

5. Storage, retention and deletion

• Your records live in a managed PostgreSQL database. Photographs live separately, in Cloudflare R2 object storage, each one addressed by a random token of at least 128 bits of cryptographic randomness, generated independently and never derived from the entry, from you, from a timestamp or from the photograph’s own bytes. Anyone holding that address can read the photograph directly — there is no session check and no other access check on a read. Confidentiality rests on the address being unguessable, not on the storage being private, so the address is treated as a credential: it is never written to a log line or to the development trace, and it reaches you only as part of your own session’s view of your own day.
• Data is encrypted in transit and at rest.
• We keep your data for as long as your account exists.
• Deletion is real deletion. When you delete your account, the row that represents you is removed, and everything owned by it — profile, goals, meals, photographs, weight history — is removed with it in the same operation. We do not keep a hidden copy marked as deleted.
  • Database records: our managed database provider keeps a short rolling change history (currently up to 6 hours) used for its own point-in-time recovery. A deleted row is technically reconstructable from that history within that window; after it, it is not.
  • Photographs: object storage keeps no version history and no separate backup at all. A deleted photograph is gone immediately, with no recovery window.
  • Neither of these is a dedicated, rehearsed off-site backup process — that has not been built for this project. This is one of the reasons real personal data does not belong in this project yet — see the warning at the top of this policy.

6. Your rights

Under the GDPR and Ukrainian data-protection law you may:

• see the data we hold about you;
• correct anything inaccurate;
• delete everything — the “right to be forgotten”;
• export your data in a machine-readable format;
• withdraw your consent to health-data processing, which does not affect the lawfulness of what was processed before you withdrew it;
• complain to a supervisory authority.

Withdrawing consent is as easy as giving it. To exercise any of these, use the controls in the app.

7. Cookies and on-device storage

The app is a Progressive Web App, so some of it is stored on your device. All of it is strictly necessary to deliver the service you asked for, which is why there is no cookie banner:

• a short-lived authentication token, so you stay signed in;
• a service-worker cache holding the application shell only — the code, styles and fonts that make the interface load;
• your interface preferences, such as theme.

Responses containing your data are deliberately not cached on the device. They are not written to Cache Storage, IndexedDB or local storage, so signing out or closing the browser does not leave your health data behind on a shared computer.

We use no third-party analytics, no advertising, and no tracking pixels.

8. Children

The app processes health data and is not intended for anyone under 18. We do not knowingly collect their data.

9. Changes to this policy

We may update this policy. Each version carries a date, and the version you agreed to is stored with your consent record and remains readable to you even after it is superseded. Material changes are announced in the app.

10. Contact

This project has no dedicated privacy contact channel. Use the controls in the app — view, correct, export, delete — to manage everything it holds about you, at any time.

Appendix — the consent text

Section 2 of the specification requires a short text shown beside the consent checkbox, not behind a link, and stored by version. This is that text. It is a summary of this policy, and the two are updated together; the version string is the YYYY-MM-DD date the wording changed.

Current version: 2026-08-26. The wording below is exactly what packages/shared’s CONSENT_TEXTS["2026-08-26"] stores and what the app shows. The prior version, 2026-08-13, disclosed no outbound hop for a recording, because there were no recordings; 2026-08-26 adds a third paragraph for the voice input feature and changes nothing else. Before that, 2026-07-28 claimed nutrition figures are “never invented by the model” — never true of the shipped product, which shows a marked model estimate when the registry carries nothing for a dish (section 4 above). 2026-08-13 corrected only that sentence. Everyone who agreed under an earlier version has that exact text preserved and readable, per section 9.

Sunny Side Up needs your permission to hold health data.

To work out your daily target, the app stores your sex, age, height and weight, the meals you log and the photographs you attach to them. These are health data, and they are held only if you say yes here.

If you describe a meal by speaking, the recording is sent to a third-party transcription service to be turned into words, and is then discarded. It is not stored, not attached to the entry and cannot be played back — only the words are kept, in the description you read and edit before anything is saved.

The app never sells your data, shows no advertising, and runs no third-party tracking. Nutrition figures come from verified food databases; where a dish is not in them, the app shows its own estimate and marks it as one. Nothing is saved until you confirm it.

You can see, correct, export and delete everything, and you can withdraw this permission at any time. Full detail is in the privacy policy.