Privacy Policy
On this page
This policy explains what personal data the Doratify app and website process, why, and the choices you have. We wrote it to be read, not skimmed past. If something is unclear, write to privacy@doratify.com.
The short version. Your food photos are analyzed and discarded; they are never stored. We do not show ads, sell data, or use tracking or analytics tools. Body and training data are saved only with your explicit consent. You can delete your account and all your data at any time from the app.
Who we are
The data controller is CorpNexus LLC (30 N Gould St #52779, Sheridan, WY 82801, United States; “Doratify”, “we”). Contact for any privacy matter: privacy@doratify.com.
What we collect and why
Account data
When you sign in with Apple or Google we receive a unique account identifier and your email address (with Apple you may choose a private relay address). We use it to create and secure your account. We do not receive your Apple or Google password.
Health and body data (only with explicit consent)
To calculate your calorie and macro targets we ask for your birth year, sex, height, weight, activity level outside of sport, goal and whether you are pregnant or breastfeeding. Your target is calculated from these with published formulas. Later weigh-ins are stored to show your trend and, if you use it, to suggest an adaptive target.
We save this data only after you give explicit consent on a separate screen. The consent, its version and time are recorded. You can withdraw it at any time in Settings → Privacy & data; your body data, weigh-ins, plans and workouts are then deleted.
Food logs
When you save a meal we store its name, meal type, time, each item’s name and portion, and the calories, protein, carbohydrate and fat values, plus whether it came from a photo, text or a repeated meal. We never store the photo itself.
Food photos and text descriptions
When you scan a meal, the photo is resized on your phone (at most 1024 px, about 300 KB) and sent over an encrypted connection to our server function. The function forwards it to our AI provider for analysis and returns the result. The photo exists only in memory during this request; it is not written to our database, file storage or logs, and the temporary file on your phone is deleted. Text descriptions you type are processed the same way. Before your first scan we ask for your permission on a dedicated screen. Details: AI & Photo Processing.
Training data (only with explicit consent)
If you use workouts we store your training profile (where you train, equipment, experience, goal, days per week, session length and areas to be careful with), the result of the PAR-Q+ health questions (cleared or light mode only; your individual answers are not stored), and your workouts: date, duration, exercises, sets, repetitions, weights, how hard the last set felt, how the session felt and estimated calories burned.
Usage limits
To apply daily limits we count your photo scans and text analyses per day. These counters contain no content.
Subscriptions
If you subscribe, the purchase is handled by Apple or Google. We receive your subscription status (product, period, renewal and expiry) through our subscription service so we can unlock Premium. We never receive your card details.
Technical logs
Our server functions log technical events without content: time, status, duration, error codes and the number of AI tokens used. They never contain photos, the text you typed, AI responses or request bodies.
Data that stays on your phone
Your sign-in session (in the phone’s secure storage), language, voice coach setting and workout reminder schedule are stored only on your device.
What we do not collect
We do not collect your location, contacts, photo library or advertising identifier. We do not use cookies, ad networks, analytics or crash-reporting SDKs. The app does not track you across other companies’ apps or websites.
Legal bases
- Contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)): your account, food logs, workouts, limits and subscription, which are needed to provide the service you asked for.
- Explicit consent (GDPR Art. 9(2)(a); KVKK Art. 6): health, body and training data, and AI analysis of your photos and text. You can withdraw consent at any time; this does not affect processing before withdrawal.
- Legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)): security, abuse prevention and content-free technical logs.
- Legal obligation (GDPR Art. 6(1)(c)): where the law requires us to keep or disclose data.
Who processes data for us
We use a small number of service providers (“processors”) who may process data only on our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, sign-in and server functions | European Union (Frankfurt, Germany) |
| Anthropic | AI analysis of food photos and text (Claude) | United States |
| Apple, Google | Sign-in; purchases and subscription billing | Their own terms apply |
| RevenueCat | Subscription status (when Premium launches) | United States |
| Cloudflare | Hosting of this website and forwarding of emails sent to us (no cookies, no analytics) | Global network |
| GitHub (Microsoft) | Storage of our weekly encrypted database backups for 30 days; the decryption key is held only by us | United States |
Anthropic processes photos and text under its commercial terms: inputs and outputs are not used to train its models and are deleted from its systems within 30 days at most, unless retention is needed to enforce its usage policy or required by law.
We do not sell personal data, share it for advertising, or give it to data brokers.
International transfers
Your account and logs are stored in the European Union. When data is processed in the United States (AI analysis, subscription status, encrypted backups), the transfer is protected by the European Commission’s Standard Contractual Clauses or an adequacy decision such as the EU-U.S. Data Privacy Framework, and, for users in Türkiye, by the safeguards required under KVKK Art. 9.
How long we keep data
| Data | Retention |
|---|---|
| Food photos | Not stored; discarded right after analysis |
| Account, food logs, workouts | Until you delete them or your account |
| Health and body data | Until you withdraw consent or delete your account |
| Daily usage counters | Until you delete your account (they contain no content) |
| Technical logs | Up to 7 days at our hosting provider |
| Backups | Encrypted, overwritten within 30 days |
When you delete your account, your data is deleted from our live database immediately and disappears from backups within 30 days.
Your rights
Depending on where you live (including under the GDPR and Türkiye’s KVKK Art. 11) you have the right to:
- access your data and receive a copy in a portable format (in the app: Settings → Privacy & data → Download my data);
- correct inaccurate data (most of it is editable in the app);
- delete your data (how to delete your account);
- restrict or object to processing;
- withdraw consent at any time, in the app (Settings → Privacy & data) or by email;
- lodge a complaint with a supervisory authority, such as Türkiye’s Personal Data Protection Authority (KVKK) or the authority in your EU country.
Write to privacy@doratify.com from the email address of your account. We answer within 30 days, free of charge.
Children
Doratify is intended for adults. We do not calculate a calorie target for users under 18 and do not knowingly collect data from children under 16. If you believe a child has given us data, contact us and we will delete it.
Health information disclaimer
Doratify provides estimates for general wellness. It is not a medical device and does not diagnose, treat or prevent any condition. See the Terms of Use.
Security
Data is encrypted in transit (TLS) and at rest. Every table is protected by row-level security, so one account can never read another’s data. Secret keys exist only on our servers, never in the app. Access to production systems is limited to the people who operate the service.
Changes
If we change this policy in a way that matters, we will tell you in the app before the change takes effect. The effective date at the top always shows the current version.
Contact
CorpNexus LLC · privacy@doratify.com