Plainr

Privacy Policy

Last updated: 23 October 2026

1. What we collect

Account data. Your email address. If you sign in with Google, we also receive the identifier Google gives your account. Your password is handled by our authentication provider (Supabase); the app never stores it.

Profile. The username you choose and, only if you add one, a profile photo (see section 3).

Body and goal data (optional). If you agree, we store your year of birth, sex, height, weight, activity level and goal (for example "lose weight"), and any weigh-ins you log. During sign-up the app asks for your birthday, but only the year is stored, and only if you agree. You can use Plainr without giving this data: you can set your own targets, or none, and weight tracking stays off.

Nutrition goals. Your daily calorie, protein and carbohydrate targets, whether the app calculated them or you set them yourself. You can change them at any time in Settings > Nutrition goals.

Food diary and water. The products and meals you log, their portions and their calories, protein and carbohydrates; the water you log; and your daily water goal.

Scans and activity. The products you scan (barcode, name and score) and when, and a record of the actions that move your streak, XP, daily quests, badges and weekly league.

AI usage records. Each time the app asks Google Gemini for something, our server records which feature it was for, when, whether it succeeded, how long it took and how much it used. These records contain no photos, no ingredient text and no results. To enforce usage limits, our server also keeps hourly and daily counters of how many requests you made for each feature. The records and the counters are linked to your account.

Request counters. To prevent abuse, our server also counts, per hour and per day, how often your account saves product records, adds a product, reports a barcode that was not found, reports unrecognised additives, starts a search for a simpler option and records a completed quest. These counters are linked to your account and contain nothing else.

Onboarding answers. How you heard about Plainr.

Consent records. When you agree to these terms, or give or withdraw consent for your body data, we record what you agreed to, the version of the document, and when.

Time zone. Your device's time zone, stored with each action and on your account, so that each action is counted on the right local day. We do not collect GPS or any precise location.

Reminders. Reminder notifications are scheduled on your device. We do not receive a push token and do not send notifications from our servers.

Purchase data. If you subscribe, Google Play takes the payment; we never receive your card or bank details. RevenueCat, the service that manages subscriptions for us, receives from Google Play the details of your purchase (the plan, price and currency, purchase, renewal and expiry dates, the purchase token, and whether the subscription is active, in a trial or cancelled) and links them to your Plainr account identifier. It also receives your device's IP address and basic technical information (operating system and app version, store country).

2. Why we use your data, and on what legal basis

  • Providing your account and keeping it in step across your devices (account data, profile, all data you add): performance of our contract with you (Art. 6(1)(b) GDPR).
  • Calculating your calorie and protein targets and showing your progress (body and goal data): your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR).
  • Scoring products, reading labels and estimating meals (scans, photos, ingredient text): performance of our contract with you (Art. 6(1)(b) GDPR).
  • Your food diary, water log, streak, quests, badges and league (food diary, water, scans and activity, time zone): performance of our contract with you (Art. 6(1)(b) GDPR).
  • Keeping a shared record of products so scanning is faster and more accurate (product records, see section 5): our legitimate interest in running an accurate and efficient service (Art. 6(1)(f) GDPR).
  • Keeping the service secure and preventing abuse (account data, technical logs): our legitimate interest in protecting the service and its users (Art. 6(1)(f) GDPR).
  • Keeping the service within its limits and preventing abuse (AI usage records, request counters): our legitimate interest in protecting the service (Art. 6(1)(f) GDPR).
  • Keeping a record of what you agreed to (consent records): our legal obligation to be able to show consent (Art. 6(1)(c) and Art. 7(1) GDPR).
  • Selling and managing your subscription, and restoring it on a new device (purchase data, account identifier): performance of our contract with you (Art. 6(1)(b) GDPR).
  • Keeping records of payments as tax and accounting law requires (purchase data): our legal obligation (Art. 6(1)(c) GDPR).

3. Photos

Ingredient label photos. When you photograph a label, the photo is sent to Google's Gemini service to read the text and, where needed, translate it. We do not store the photo on our servers. A copy is kept on your device with the scan result until you log out or delete your account. This is also true when you photograph a label to add a product (section 5): the text read from the label is shared, the photo is not.

Meal photos. When you estimate a meal from a photo, the photo is sent to Google's Gemini service in the same way. It is not stored on our servers or saved on your device: it is held only in the app's memory while you use it. What is saved is the result you confirm (the foods, their estimated portions and nutrition), on your device.

Before you take a label or meal photo, the camera says in a line under the shutter that the photo is sent to Google's Gemini service and is not stored on our servers.

Profile photos. A profile photo is cropped and resized on your device and uploaded to our file storage as a single file belonging to your account. Anyone who has the file's exact web address can open it. The address contains your account identifier, the storage cannot be browsed or listed, and the app never shows your photo to other users, but the photo is not private, so do not use one you would not want seen. You can delete it at any time in Settings > Delete profile photo, and it is deleted with your account.

4. Who receives your data

  • Supabase (database, authentication, file storage) hosts your account and everything linked to it, on servers in the European Union (Ireland). It receives all account data described in section 1.
  • Google, Gemini service reads label photos, estimates meals from photos, translates ingredient text and helps rate how processed a product is. Requests go through our own server and use Google's paid Gemini API service. It receives the photo, or the product name and ingredient text.
  • Google Sign-In (only if you choose it) lets you sign in with your Google account. Google knows that you signed in to Plainr.
  • Resend sends account emails, such as sign-up confirmation and password reset. It receives your email address.
  • RevenueCat manages subscriptions: it checks with Google Play whether your account has an active subscription and keeps the record of your purchases. It receives your Plainr account identifier (a random code, not your name or email address) and the purchase data described in section 1.
  • Google Play takes the payment for a subscription under its own terms and privacy policy. Google knows that you subscribed to Plainr.
  • Vercel hosts the website https://www.plainr.app. It receives the technical details of each visit, including your IP address.
  • Open Food Facts (public product database) looks up products by barcode. It receives the barcode, and your device's IP address.
  • USDA FoodData Central (public product database) looks up US products by barcode. It receives the barcode, and your device's IP address.

Your email address, username and account identifier are not sent to Google Gemini, Open Food Facts or USDA FoodData Central. Your email address and username are not sent to RevenueCat either. Each of these services handles what it receives under its own terms.

5. Product records shared between users

To make scanning faster for everyone, the app keeps a shared record of each product that has been scanned: its barcode, name, ingredients, nutrition values and score. A product record your scan creates is stored with your account identifier and is visible only to you until another user's scan of the same product gives the same result; only then is it shared with other users, and the identifier of the user who confirmed it is stored with it too. When you scan a label with a photo, the text read from that label (the product name, ingredients and nutrition values, but not the photo itself) is stored as a product record that stays visible only to you.

Adding a product. When a barcode is not found in Open Food Facts or USDA FoodData Central, or is found there without an ingredient list, you can add the product by photographing its label. The product name and ingredients you confirm, with the nutrition values and score worked out from the label, are stored under that barcode and are visible to every Plainr user who scans it. The photo itself is not stored by us (section 3). We store the identifier of the account that added the product with it; other users are not shown who added it. Do not put personal information in a product's name or ingredients. When Open Food Facts or USDA FoodData Central later have the product with an ingredient list, the app replaces the product you added with that database's record.

Some product data comes from Open Food Facts, a community-edited database, and some products are added by Plainr users from label photos. This data isn’t independently verified and may contain errors.

Product records do not include your name or email address. They are kept indefinitely. When you delete your account, your account identifier is removed from them, but the product information, including a product you added, is not deleted, because it describes products rather than people. Do not photograph anything other than a product label.

6. How long we keep your data

  • Your account and everything linked to it are kept until you delete your account. We do not currently delete inactive accounts automatically. Consent records are kept for as long as your account exists and are deleted with it.
  • Body and goal data are kept until you withdraw your consent or delete your account. Withdrawing consent (Settings > Your data > Health data) deletes your year of birth, sex, height, weight, activity level, goal and all your weigh-ins.
  • AI usage records are deleted automatically after 90 days, and earlier if you delete your account. The hourly usage counters are deleted after 2 days and the daily usage counters after 90 days; both are deleted earlier if you delete your account.
  • Request counters are deleted after 2 days, and earlier if you delete your account.
  • Deleting your account (Settings > Delete Account) takes effect immediately: your profile photo is removed from storage first, then your account and all data linked to it on our servers.
  • On your device: logging out removes your account data from the device: the product records stored there (including the copies of your label photos), your diary, history, logs, meal estimates and the settings of that account. Before you log out, the app tries to send anything not yet saved to our servers, and tells you if something could not be sent. The calories and nutrients of meals estimated from a photo are kept only on the device, so logging out deletes them. Device settings, such as reminder times, stay. Deleting your account removes all of it from the device you delete it on.
  • Product records (section 5) are kept indefinitely.
  • Purchase records at RevenueCat are kept for as long as your account exists. When you delete your account, we ask RevenueCat to delete its record of your purchases. If RevenueCat does not answer, your account is deleted anyway and we repeat the request later; until it succeeds, we keep the random identifier of your account, and nothing else, in a list of pending requests, and we delete that entry once RevenueCat has deleted the record. This does not cancel your subscription in Google Play, which you must do yourself. Google Play keeps its own payment records under its own policy, and we may have to keep some payment records longer where tax and accounting law requires.
  • Technical logs kept by our providers: server logs at Supabase for 1 day (API and database logs) and 1 hour (authentication audit logs), email delivery logs at Resend for 30 days, and website request logs at Vercel for 1 hour.
  • Backups: we do not currently keep backups of the database. If we start to, this policy will say how long they are kept.

7. What other people can see

Nothing you do in Plainr is shown to other users. There is no leaderboard, friends list, public profile or sharing. The weekly league is a level you move up and down on your own; it is not a table of other people. The exceptions are the profile photo (section 3) and the product records (section 5).

8. International transfers

Your account data is stored in the European Union. Google and Resend may process the data they receive outside the European Economic Area, including in the United States. For the Gemini API paid service, Google relies on the EU-U.S. Data Privacy Framework and, where that is not available, the European Commission's Standard Contractual Clauses. Resend relies on the European Commission's Standard Contractual Clauses and is certified under the EU-U.S. Data Privacy Framework. The website https://www.plainr.app is hosted by Vercel, which may process the technical details of each visit, including your IP address, outside the European Economic Area. Open Food Facts and USDA FoodData Central receive only a barcode and the network address of your device. RevenueCat processes purchase data in the United States.

9. Your rights

You have the right to:

  • access your personal data and receive a copy of it;
  • correct data that is inaccurate (most of it you can change yourself in Settings);
  • delete your data (you can delete your whole account in Settings > Delete Account);
  • restrict how we use your data in certain cases;
  • object to processing based on our legitimate interests;
  • data portability: receive the data you gave us in a structured, machine-readable format;
  • withdraw your consent to the use of your body data at any time, in Settings > Your data > Health data. Withdrawing does not affect anything we did with your consent before you withdrew it.

To use any of these rights, email support@plainr.app from the address linked to your account. We will reply within one month.

You also have the right to lodge a complaint with a data protection authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, www.uodo.gov.pl). If you live in another EU country, you can also complain to the authority there.

10. Age

Plainr is for adults. You must be 18 or older to use it. We ask for your date of birth during sign-up and do not let anyone younger continue; if someone under 18 tries, we do not keep the answers they gave. If we learn that someone under 18 has an account, we delete it. If you believe this has happened, contact support@plainr.app.

11. Security

Connections between the app and our servers are encrypted, and our database is set up so that each account can read and change only its own account data. No system is completely secure, so we cannot guarantee absolute security.

12. Changes to this policy

We may update this policy. The date at the top shows when it last changed. If we make a significant change, the app will ask you to review it before you continue.

13. Who we are and contact

The controller of your personal data is Tomasz Ciszewski, Płouszowice Kolonia 136A, 21-008, Polska ("we", "us"). For any question about your data, or to exercise your rights, email support@plainr.app.

Plainr contains no advertising and no analytics or tracking software. We do not sell your data and do not use it to profile you for advertising.