Gramwise — Privacy Policy

Last updated: October 1, 2026

The short version

Gramwise has no account or login. Your food diary, profile, weight history and Health Connect imports stay on your phone, apart from copies you explicitly export and earlier Android system backups described below. Advanced AI sends only the photo, hint or description you choose for that action, not your stored diary or Health Connect records. The core tracker works without a network: the diary, the bundled food search, describing a meal in words, saved foods and manual entry. Gramwise runs one recognition service: an Advanced meal scan sends the whole meal photo and any optional hint you type or dictate, a label scan sends the label photo, and Advanced Describe sends the words you typed or dictated, never the audio. We keep none of those submissions and no diary — Google's own retention is described below. What we do keep is a shared cache of food facts and records that are not linked to your name: scan allowances, subscription checks and abuse protection. There is no on-device recognition, so a photo scan always sends the photo and cannot run without an internet connection. Advanced AI requires the paid Pro subscription; there is no free Advanced-AI allowance. Google Play Billing checks your subscription when you open the app, and for Free users only, Google's consent and ad tools may start after that check.

Who is responsible

Gramwise is provided by the business whose details appear in the developer details on the Gramwise Google Play listing ("we", "us"). For data-protection law, we are the controller of the processing this policy describes — the business responsible for it. Privacy questions and requests can be sent to hollownett@gmail.com or through that listing. The app moved to this business when the earlier individual developer transferred it; that transfer changed who is responsible for your data, not what this policy describes — the same information is processed the same ways for the same reasons, and your rights are unaffected. We are responsible for the data handled through the App and the recognition service we run — even though most diary and health information stays on your phone and never reaches us.

What stays on your device

Your profile (date of birth, height, sex, activity level, goals and targets), your food diary and meal notes, your weight and body-measurement history, your saved foods and templates, the meal photos you attach, and any data imported from Health Connect are stored only in the app's private storage on your phone. The one exception you control is the optional gallery album described under "Photos, meal scans and label scans". Food and nutrition values come from a read-only database bundled inside the app, so a food lookup needs no internet. A backup you create is written to a file and handed to your phone's share sheet, where you decide where it goes; it includes photos only if you turn on "Include food & meal photos". Gramwise never uploads an exported backup itself. This version excludes private app data from Android system backup and transfer; older system backups and gallery backups are described below. Local notifications and reminders are scheduled on your phone; any text shown on the lock screen is subject to your notification settings.

What leaves your device, and why

Some requests happen automatically. Any network request shows the recipient your IP address and basic connection details. Cloudflare, which runs our recognition service, sees your IP address to block abuse. When you open the app — and when you come back to it — it asks Google Play Billing whether your Gramwise Pro subscription is active. For Free users only, Google's consent and AdMob tools may then start — showing Google's consent form where the law requires it and loading the single Today banner (see "Advertising and analytics"). If you have Pro, the app may also check your remaining scan allowance with our service, using your Google Play purchase token. Every other request waits until you act. A scanned barcode is looked up first in the bundled barcode pack on your phone and sends nothing when it is found there; when it is not, the app automatically sends the barcode number to Open Food Facts, and "Search online" likewise sends a typed search term. An Advanced AI request sends the meal photo, label photo or meal description you chose to submit, together with your Google Play purchase token and the language the app is set to (a tag such as en or ru — never your location or a device identifier); if you added an optional meal hint on the approval screen, the app sends that hint with the photo. Our service verifies the token with Google Play, keeps a brief record of the result and a count of scans, keyed by a one-way hash, and returns a food name, brand where available, an estimated portion, calories and nutrients — all marked unverified for your review. When nutrition for a named branded or chain product is missing, the service may send only that food's name to Google Search for published facts; your image, hint, description and identifiers are not part of that search, and names produced by a scan with a hint are neither searched nor added to the shared cache. The service keeps a shared cache of food names and their nutrition — never linked to a person. Advanced Describe sends the text you type or dictate: words, not a picture, and no audio. When Advanced is selected, finishing voice input automatically sends the complete text shown in the field after Advanced-AI consent; nothing is sent while recognition is active, and if your phone ends recognition without marking the last words final, the last text it displayed is included. Selecting Lite keeps the parse on your phone and sends no description; Lite parses entirely on the phone, reading the bundled database. Turning speech into text is done by your phone's own speech service, the same one your keyboard's voice typing uses; depending on the phone and its settings that service may process the audio on its provider's servers, and Gramwise never receives, stores, or logs your audio. To help it hear food words, Gramwise gives it a short fixed list of commonly misheard foods that is the same for everyone and contains nothing from your diary. Aside from an Advanced AI submission you choose and a backup you choose to share, Gramwise does not send your diary, profile, meal-photo library, weight or Health Connect data off the device.

Photos, meal scans and label scans

Photos you take or pick are saved in the app's private storage so they can appear next to your diary entries. Naming the food in a photo needs the recognition service: there is no on-device recognition, nothing is sent unless you start a scan, and with no connection a photo scan cannot run at all: it needs an internet connection, and nothing is queued or sent later. Advanced AI sends nothing until you accept the shared disclosure, shown from Settings → AI & recognition or your first Advanced action, and a scan also needs the Pro subscription. When you tap Scan, your whole meal photo is sent, uncropped, together with any optional meal hint you typed or dictated on the approval screen, so the AI can find the foods in it. It sees whatever you photographed, including the plate, the table and anything else in frame; point the camera at your meal, not at anything you would rather not send. You can dictate the hint with the mic beside it: your phone's own speech service turns your voice into text and Gramwise never receives, stores or logs the audio; only the words shown in the field are sent, and only when you tap Scan. The AI finds the foods in the whole frame on its own: there is no way to mark, crop or box a food as input to a scan. Post-scan box adjustments change local thumbnails only and are not submitted for recognition. The request also carries a few technical details about the scan; the hosting provider sees your IP address as with any network request. Portions and nutrition from a meal photo are AI estimates and can be wrong; the app asks you to check or correct them before logging. If a kitchen scale's display is in the picture, the AI reads the grams straight off it, but reading a display is still AI transcription and can misread the number or units; check it against the actual scale; there is nothing to switch on, a photo without a scale simply comes back without a reading, and if the food sits in a bowl on the scale the app says so because the reading may include the bowl's weight unless you tared it. A nutrition-facts label is a second photo mode: the label photo is sent to the same service to read the nutrition facts and transcribe the product name, serving size, calories and nutrients printed on it; transcription can be wrong, so you check it before logging. Both modes need an internet connection and count against the Pro allowance stated in the app; there is no free Advanced-AI allowance. Each Advanced request carries your Google Play purchase token, which the service verifies with Google Play; the same token proves an active paid subscription. Gramwise does not send a Play Integrity token or hashed Android ID and keeps no record of your device. Our service retains no submitted image, meal hint, description or diary; Google's own retention is described under Retention; it keeps only the shared cache and the pseudonymous records described above. Photos leave your phone in one other way that you control: Settings → Data & backup → "Save meal photos to Gramwise" copies your meal photos into a Gramwise album in your phone's gallery. It is OFF unless you turn it on, Android asks for permission first, and nothing is sent off your phone by it; but a photo in your gallery is visible to other apps you have given photo access, and a photo-backup service such as Google Photos may upload it under your own account settings. Turning the switch off stops new copies; photos already in the gallery stay there for you to keep or delete.

Health Connect

If you choose Connect in Settings → Integrations and grant Android Health Connect permissions, Gramwise reads the weight, step and exercise-session data you permit. Sessions are reduced on your phone to a daily workout count and duration; no routes, heart rate, distance or workout calories are requested. Access is read-only: nothing is written back or sent to our recognition service, AI providers or advertisers. Imported weights support your weight history and local plan calculations; steps and workouts provide activity context and do not add calorie credit. Manual sync is available; Pro can sync automatically when you return to the app while connected. Disconnect stops future sync but does not delete imported records or revoke Android permissions. You can revoke each permission in Health Connect and use Remove imported data in Gramwise to delete imported records without deleting your manual entries; disconnect first to prevent reimport. Data held by other health apps or Health Connect is managed there separately. Health Connect data is not used for advertising, sold, or used to train AI models.

Advertising and analytics

Gramwise uses no analytics, attribution or crash-reporting tools; local diagnostic counts stay on your phone and exclude images, diary entries and personal details. For Free users, Google AdMob can read the advertising ID, IP address and general device information to serve, cap and measure ads and, with your consent, personalise them. One banner can appear on Today and nowhere else. Where Google requires it, its consent form appears before personalised ads, and Gramwise Settings offers Google's privacy-options form when Google says it is required. Pro subscribers do not start the AdMob or consent tools. Gramwise does not send your diary, profile, photos, weight or Health Connect data through the ad tools or to advertisers; Advanced AI submissions go to Google separately as disclosed above; Google's handling of AdMob and Play Billing data follows Google's privacy policy.

Legal bases

Where the GDPR applies, this is why we may process your information: to provide what you asked for — the core tracker and purchase verification (performance of the contract, Article 6(1)(b)); because you said yes — Advanced AI and Health Connect, including the health information involved (consent, Article 6(1)(a), and explicit consent under Article 9(2)(a)); because we have a legitimate reason — preventing abuse, enforcing scan allowances, blocking replayed requests, keeping the service secure and responding to support requests (Article 6(1)(f)), which you may object to; and to meet legal duties, such as handling statutory requests (Article 6(1)(c)). The AI disclosure explains the recipients and the processing before you enable it; starting a scan or choosing Advanced Describe then selects the material to send. For Health Connect, choosing Connect and granting the specific Android permissions selects the health records to import and process locally. These choices are optional and separate from accepting the Terms. Turning Advanced AI off or disconnecting Health Connect withdraws permission for future processing through that feature; it does not recall a completed request, delete existing imports or cancel a subscription. You can still use the core tracker without these integrations. For advertising, consent covers personalisation and any device storage or access where required; basic ad delivery, security and fraud prevention rely on legitimate interests only where the law and your consent or objection choices allow. Google's form sets out the applicable vendors, purposes and legal bases; limited or non-personalised ads still involve some personal-data processing. You can withdraw consent or object through the privacy options where Google offers them, and manage advertising identifiers in Android settings. We keep identifiers and retention to a minimum for these purposes, and you may object. Health information that stays on your phone is used only for the tracking and plan features you choose; it is not made available to us for unrelated purposes.

Recipients and international transfers

Opening the hosted legal pages contacts GitHub Pages, which receives the usual IP address and browser request metadata to serve them under GitHub's privacy statement. Cloudflare runs our recognition service, its shared cache and the records described above, and sees IP addresses and connection data to deliver and protect requests. Google receives purchase information through Play Billing and, for Free users as their choices allow, advertising information through AdMob. Advanced AI submissions are processed by Google's Gemini models through Google Cloud Vertex AI; to fill in missing nutrition, a food name may be sent to Google Search. Open Food Facts receives your chosen online lookup. Your speech provider handles dictation under your phone's settings, and a shared backup goes to the destination you choose. See Google's privacy policy, Google Cloud's data-processing terms, Cloudflare's data-processing terms and Open Food Facts' privacy policy. Hosting, support and provider processing may occur outside the EEA, including in the United States. Our service providers' contracts include the required safeguards for sending data abroad, including standard contractual clauses; an adequacy decision such as the EU-US Data Privacy Framework applies only to a recipient certified under it. Contact us for information about the safeguards that apply to your data, or a copy of the relevant clauses. We do not sell personal data or use a data broker.

Retention

Local records remain until you delete them, clear app storage or uninstall. Our service does not store submitted images, hints, descriptions or diary content. Its records are pseudonymous, not anonymous: they can tell requests from the same subscription apart without containing your name. A subscription check stays valid for 15 minutes (60 seconds if the denial can be retried) and is kept for a further 24 hours so a brief Google outage cannot break billing: at most 24 hours 15 minutes (24 hours 1 minute for a retryable denial) after each write. A stored "Google was unreachable" result lasts 45 seconds. Daily counters expire 48 hours after their last write; weekly counters and the records that block request replay expire after 9 days. Shared food facts expire 90 days after their last write, not last read. We limit requests in 60-second windows on our side; that says nothing about Cloudflare's own security retention, which follows its policy. Google Vertex AI may keep inputs and outputs in memory for up to 24 hours and retain flagged prompts for abuse monitoring for up to 30 days, under its standard settings and terms; we cannot claim a project-level retention exemption. When a name is sent to Google Search, Google keeps that request, its context and the result for 30 days. Google states that Vertex AI customer data is not used to train its models without permission. See Google's retention documentation. Other providers retain their data under the linked policies. Support correspondence is kept as long as needed to resolve your request and meet legal duties or defend claims, then deleted. We have no remote copy of your diary to restore.

Security

The App uses Android's private storage and HTTPS for its own network requests. Android platform backup and device-transfer rules in this version exclude the App's private data; backups are created through the export and share controls you choose. Earlier versions enabled Android system backup, so a copy made under your device's backup settings may still exist in your Google account or on another device; an app update cannot erase those copies. Use your Android or Google backup controls to manage them. Private storage is protected by your device's access controls but is not a promise of separate app-level encryption or immunity to a compromised device. Our service receives your purchase token to verify it with Google, then keeps only a one-way hash — a scrambled value that cannot be turned back into the token — as the key for its records. The App keeps a local purchase credential for billing; do not include it in support requests. Exported backup files are not encrypted by Gramwise. Protect the file, the destination and the recipients; no storage or transmission is completely secure.

Your rights

Where the GDPR applies, you may request access, rectification, erasure, restriction and portability, object to processing based on legitimate interests, and withdraw consent without affecting earlier lawful processing. We respond without undue delay and normally within one month; if a lawful extension is needed, we explain it within that month. You may complain to UODO in Poland or your local supervisory authority without contacting us first. You can edit and delete local records and export the backup available in Settings → Data & backup without Pro. That backup includes diary, profile, weight history, saved foods, optional photos and a short Adaptive plan diagnostics summary (counts of logged and confirmed days, weigh-ins and plan changes, no weights or calories), but does not include imported daily step and workout summaries; manage or obtain the underlying activity records through Health Connect and the originating apps. Clearing app storage or uninstalling removes the App's local data, but not exported backups, gallery copies, earlier system backups, Health Connect's records or information held by providers. Manage those copies with their holders. Disconnect Health Connect and remove imported data to stop sync and remove its local copies. The service has no account directory, but its hashed records remain pseudonymous and are not automatically exempt from your rights. Contact us; we may need proportionate identifying information and will explain if we cannot locate a record. Do not send a raw purchase token or a copy of your health diary. Plan calculations and access checks happen automatically, but only to run the features described in the Terms: you can edit or switch off the plan, and if an access check ever gets it wrong, ask us to review it. We do not use health data for advertising profiles.

Children

Gramwise is intended for adults: the Terms of Use require users to be 18 or older, and the app enforces this at the date-of-birth entry. It is not directed at children and does not knowingly collect data from them; ads are requested as not child-directed with a maximum content rating of PG.

What is live now

Advertising and the Pro subscription are live: a Free user may see the Today banner, and Google Play processes the Pro subscription. The recognition service described above is live, and an Advanced meal scan sends the whole meal photo. Advanced AI is opt-in and requires a paid Pro subscription. Any new use that sends diary, profile or Health Connect data off the phone would require a new disclosure and any legally required consent before processing, as well as updated Play Store declarations.

Support and correspondence

If you contact us or make a privacy or purchase request, we receive the contact details and information you send, such as an issue description or order reference. Our email provider and, when necessary, Google Play support process that correspondence to help resolve your request. Send only what is needed; do not attach your diary, health data, payment-card details or purchase token. This correspondence is separate from our service's records and follows the retention criteria above.

Changes to this policy

If this policy changes, the "Last updated" date changes with it; the new version ships with the next app update and is posted at the policy's public URL. Where a change materially affects how your data is used, we will draw attention to it in the app before it takes effect.