Privacy Policy

1. Introduction

This Privacy Policy explains how the Arori mobile application (the "App"), operated by Apeka Group Limited (registered in England and Wales, company no: 17105369), collects, uses, stores and protects your personal data.

Arori contains no advertising; your data is never used for advertising, sold to third parties, or shared with advertising networks.

By using the App you accept this policy. If you do not accept it, please do not use the App.

2. Data We Collect

2.1 Data You Provide

• Account information: Email address, password (stored only in hashed form). If you use Sign in with Apple or Sign in with Google, the name and email shared by your identity provider (with Apple you may choose to hide your email)
• Profile information: First name, last name, username, profile photo, date of birth, gender
• Health and body data (special category under GDPR Article 9): Height, weight and, when a weight log feature is offered, the historical weight entries you record; your daily calorie target, which we derive from your body data; health conditions (e.g. diabetes, hypertension), food allergies, physical injuries or limitations. When a body measurements feature is offered, the body measurements you record (waist, hip, chest, arm, thigh and neck circumference), body fat percentage and lean body mass, together with any optional notes you add to them. When a fasting feature is offered, your fasting settings (the protocol, eating window and fasting days you choose and, for Ramadan mode, the city you choose for prayer times). Because choosing Ramadan mode may reveal your religious belief, which is also special category data (GDPR Article 9), these settings are processed under the same explicit consent as your health data. When modes sensitive to medication use (e.g. appetite suppressant support) are offered, your medication support settings; sharing that information is entirely optional. When Apple Health integration is offered, the readings we save from the Health app (see Section 2.5). When a progress photos feature is offered, the progress photos you add, with the pose (front, side or back), the date and the optional caption you give them, and the weight from your weight log on that date or up to 7 days before it. Achievements we calculate from your logs, such as whether you met your protein, water or calorie goal on a given day or reached your goal weight, are stored in your account and shown only to you, except that a report you choose to share with your weight included shows the days on which you met your calorie target (see Section 2.8). We collect health and body data only after you give explicit consent in the App (during sign-up, at first launch or later under Profile > Privacy); you can decline and use the App with default targets. Sending the health data listed in Section 4 under "Health data in AI features" to our AI provider requires a second, separate consent for AI features, which is optional; the calorie target we derive from your body data, however, is used in AI features under your health data consent (see Section 4). Progress photos and their AI analysis are not covered by the health consent; they require only their own separate consent (see Section 9). Only the weight stored with a progress photo is health data covered by the health consent, and it is removed when you withdraw the health consent
• Nutrition data: Meal logs (food name, calories, protein, fat, carbohydrates, portion), water intake, barcode scan history, favourite foods and, when offered, the meal photos saved with the meals you log from food photo analysis (see Section 2.3)
• Lifestyle data: Activity level, nutrition goal (lose weight, stay healthy or gain muscle) and the personal challenges you select (for example a busy schedule or lack of consistency) are lifestyle preferences we process to run the service (contract, KVKK Art. 5/2-c, GDPR Art. 6(1)(b)); we also process your household size, monthly food budget and currency, eating out frequency and whether you cook for yourself or your family on the same basis
• AI content: Your AI chat and nutrition coach messages, corrections you make to AI results, the weekly nutrition and fitness plans you generate and, when offered, the progress photo analyses you request
• Community content (when community features are offered): Posts, comments, likes and foods you contribute to the community food database
• Referral program data (when the referral program is offered): Your personal invite code, the invite code you applied and the account that invited you, the accounts you invited, and the status and dates of invitations and rewards
• Bug reports: The report title, description and any screenshots you attach

2.2 Data Collected Automatically

• Device information: Device model, operating system, app version
• Installation identifier hash (when the referral program is offered): To prevent abuse of referral rewards, the App creates a random identifier for its installation on your device and keeps it in the device's secure storage, where it may remain even if you delete and reinstall the App. When you apply an invite code, this identifier is sent to our server, which stores only an irreversible summary (hash) of it and uses it solely to prevent more than one account on the same device from applying an invite code. This identifier is not the advertising identifier (IDFA); the stored hash is kept in a separate record that contains no direct reference to your account and cannot be matched to any account once your account is deleted. Similarly, to prevent the same store transaction (for example the same trial subscription) from rewarding more than one invitation, an irreversible summary (hash) derived from the product and the time of the first purchase is stored without any link to an account
• Usage data: In-app interactions, feature usage frequency, screen views, streak data and your progress on badges for first steps and milestones in the App (such as your first logged meal or the number of food photos you have analysed)
• Notification data: Push notification token, time zone, notification and reminder preferences
• Country: A country code derived from your device's language and region settings. Arori does not request location permission and does not collect GPS or location data
• Crash and error logs: Technical crash reports if the App crashes (see Section 5, Sentry)

2.3 Camera and Photos

Your camera is accessed only while you actively use a feature: food photo analysis, barcode and nutrition label scanning, recipe suggestions from ingredients, taking a profile photo and, when offered, taking progress photos. There is no background or continuous camera access; the microphone is not used and no audio is recorded.

• Food, label and ingredient photos: Sent to our AI provider for analysis (see Section 4). Label and ingredient photos are never stored on our servers, and a food photo is stored only when it is saved as a meal photo (see below)
• Meal photos (when offered): When "Save meal photos" is on, the photo of a meal you save from food photo analysis is stored privately with that meal in your account (see Section 5) and is visible only to you, unless you include it in a report you share (see Section 2.8). The setting is on by default: the App tells you about it on the analysis result screen before you save your first such meal and lets you choose not to save meal photos there, and you can change it at any time in the App under Profile > Meal photos. Our server re-processes every photo before storing it, stores it in reduced size and removes location (GPS) and other metadata. The App shows your photos through short-lived links, and your device may keep the images you view in its temporary cache. If you are offline, the App keeps the photo on your device for up to 7 days and uploads it when you are back online; if it cannot be uploaded within that time, it is deleted from your device and the meal stays saved without it. We use meal photos only to show them to you and, if you choose, to include small copies of them in reports you share (see Sections 2.8 and 3). You can delete a single photo, a meal together with its photo, or all your meal photos at any time (see Section 7)
• Profile photo and bug report screenshots: Stored securely and linked to your account
• Progress photos (when offered): The photos you take or choose from your library for progress tracking are stored privately in your account (see Section 5) and are visible only to you. Our server re-processes every photo before storing it and removes location (GPS) and other metadata. The App shows your photos through short-lived links, and your device may keep the images you view in its temporary cache. You are asked for separate explicit consent before you add your first progress photo, the feature is available only to users aged 18 or over, and you can delete any photo at any time. When App Lock is turned on, the gallery is also protected by it. If you choose to share a before and after image, it is created on our server, sent to your device and not stored; your weight change appears on it only if you choose to show it, and you decide where to share it
• Favourite food photos: Kept only on your device, never uploaded

When a voice logging feature is offered, your voice recording will be sent to our AI provider to be converted into food entries; that feature also runs only when you actively use it.

2.4 Data That Stays on Your Device

• App Lock PIN: Stored only on your device, in hashed form, inside the operating system's secure storage. Face ID / fingerprint verification is performed by the operating system; your biometric data never reaches the App or our servers
• Session keys: Stored encrypted in the device's secure storage (iOS Keychain)
• Preferences: Language, theme and similar app preferences

2.5 Apple Health (When Offered)

When Apple Health integration is offered it will be entirely optional. If you grant permission, we read your step count, active energy, weight, body fat percentage, lean body mass and waist circumference from the Health app, and write your meal calories, water intake and weight to the Health app. The weight, body fat percentage, lean body mass and waist circumference values we read are saved to your Arori account so the App can show them to you (for example in your weight chart and body measurements). Data obtained from the Health app is never used for advertising or marketing. With your health data consent, the weight read from the Health app becomes your profile weight; if you also give the separate consent for AI features, it may be sent to our AI provider like a weight you enter yourself (see Section 4). The body fat, lean mass and waist values read from the Health app are not sent to the AI provider. Apart from the service providers that run the App for us (see Section 5) and reports you choose to share with your weight included (see Section 2.8), data from the Health app is not shared with anyone; when connected AI apps are offered, the weight read from the Health app can, like a weight you enter yourself, be read by the AI assistant you connect when you ask it to (see Section 2.9). You can revoke this access at any time in your iOS Health settings.

2.6 Community Visibility (When Community Features Are Offered)

When community features are enabled, your username, profile photo and posts become visible to other users. Your email address, health data and private information are never shared with other users. Reports you choose to share yourself are described in Section 2.8.

2.7 Referral Program (When Offered)

When the referral program is offered, the user who invited you sees only the number, status (e.g. pending or rewarded) and dates of their invitations. Your name, username, email address, health data and other private information are not shown to the inviter. A "rewarded" status may indirectly indicate that the invited user started a trial or made a purchase. The same rules apply to the users you invite.

2.8 Report Sharing (When Offered)

When report sharing is offered, you can share a report of the last 7 or 30 completed days of your logs with a person you choose, for example your dietitian. A report contains, for each meal, its time, meal slot, name, amount, calories, protein, carbohydrates and fat; your daily calorie and macro totals, daily water intake and number of meals; and the averages, macro split and summary by meal time for the period calculated from these. Only if you choose to include your weight does it also contain the weight entries you logged in that period (which may come from Apple Health), your daily calorie and macro targets calculated from your body data (without applying your fasting or medication support settings) and the days on which you met your calorie target; these are included so that your dietitian or another health or fitness professional you choose can support your nutrition. Small copies of the meal photos saved with those meals (at most 60) are included only if you choose. The time a report was created or opened, and when its link closes, are shown with their GMT offset (for example GMT+3); meal times are shown in your local time. A report never contains your name, email address, date of birth, height, body measurements, health conditions, allergies, injuries, fasting or medication support settings, progress photos or step and energy data from Apple Health; it contains your calorie and macro targets and whether you met your calorie target only if you include your weight.

• PDF: The App asks our server to prepare the report and creates the PDF on your device; we do not store it, and the App deletes its temporary copy after sharing. You decide where to send it; once sent, we cannot recall or delete it.
• Time-limited link: Before each link is created, the App shows you what will be shared and asks for your explicit consent for that link. Anyone who has the link can open the report in a web browser, so share it only with someone you trust. Each time the report is opened, our server creates it from your current logs (and, if you included your weight, your current targets) for the chosen dates: entries you add later appear, entries and photos you delete disappear, and your weight and targets are no longer shown if you withdraw your health data consent. A link stops working 7 days after it is created, or earlier if you close it in the App or by writing to privacy@arori.app; closing it does not undo views that already happened.
• Who receives it: The person who opens a report may be in any country, including one whose data protection rules are weaker than in Türkiye or the UK. What they view, save, print or forward is their own responsibility, and we cannot delete their copies.
• View record: When someone opens a report you shared by tapping "View report", we record only the time of that view and show it to you in the App (at most 200 view times are kept for each link); we do not write their IP address or device details to this record. This record is based on our legitimate interest in showing you when your report was opened (UK and EU GDPR Art. 6(1)(f); KVKK Art. 5/2-f). Like any website, our hosting providers keep technical connection logs (such as IP address and browser type) for at most 30 days for security and operation.
• Where it is processed: The report is prepared on our application server (Railway, USA) from our database (Supabase, United Kingdom) and sent from there directly to the browser of the person who opens it. The page with the "View report" button is served by our website host Vercel (USA, global network) and contains no report data.

2.9 Connected AI Apps (When Offered)

When offered, you can connect your own AI assistant account, such as Claude (Anthropic) or ChatGPT (OpenAI), to your Arori account and use Arori through that assistant: for example asking what you ate today, logging a meal or your weight, or asking for a weekly plan. You start the connection in the assistant, sign in to Arori in your web browser on our connection page and approve the request; the assistant's provider then receives an access key for your Arori account that lets it call Arori on your behalf until you remove the connection. The connection page shows you the name of the app asking for access and the account details it requests (for example your email address). We do not receive your assistant account credentials, and the assistant's provider does not receive your Arori password. Arori Pro is required to use Arori tools through an assistant.

• What leaves Arori and when: Your data leaves Arori only when you ask your connected assistant to do something that needs it. The assistant then requests the relevant data from our server, which sends it to the assistant's provider as part of your conversation with the assistant. Depending on what you ask, this can include your meal, water and weight logs, your recent and favourite foods, your profile (such as your goal, activity level, calorie and water targets and, if you have given the health data consent, your height, weight, health conditions, allergies, injuries and fasting or medication support settings), your daily targets, weekly plans, coach context and the history of your Arori chats. Your email address and sign-in details are not returned by Arori tools. At your request your assistant can also add, change or delete entries (meals, water, weight, favourites, plans, profile fields and settings).
• Your assistant's provider: Anthropic (Claude) and OpenAI (ChatGPT) are not our service providers. We send them nothing on our own: data goes to them only on your instruction, to your own assistant account, and we do not control how they process, store or use what your assistant receives. Their own terms and privacy policies apply to your conversation with your assistant, including anything about Arori that appears in it. The separate consent for AI features (Section 4) does not apply here, because your assistant is not our AI provider but a recipient you choose.
• AI features used through an assistant: Food estimates from text, analysis of a food photo or nutrition label from a link, recipe suggestions and weekly plan generation requested through your assistant are produced by our AI provider under Section 4 and count towards your account's AI usage limit. A photo link you give your assistant is downloaded by our server only for that analysis and is not stored.
• Legal basis and transfer: Sending your data to your assistant's provider is based on your request: the explicit consent you give when you approve the connection and your instruction each time you ask your assistant to use Arori (UK and EU GDPR Art. 6(1)(a) and, for health data, Art. 9(2)(a); KVKK Art. 5/1 and Art. 6). The data is sent from our application server (USA) directly to the assistant's provider, which processes it in the USA and in other countries (see Section 12).
• Removing a connection: You can remove a connection at any time in the App under Profile > Connected AI apps or on the assistant's side (in Claude or ChatGPT); from then on the assistant can no longer access your Arori data. Data your assistant's provider already received stays subject to its own policies. For each connection we keep the app's identity, the permissions you granted and the date until you remove it or your account is deleted.

3. How We Use Your Data

• To create and manage your account
• To calculate your daily calorie and macro targets and provide nutrition tracking
• To run and personalise the AI-powered analysis, chat, recipe and plan features
• To show you the meal photos you save with your meals (when offered) and, if you choose, to include small copies of them in reports you share (when offered). We use meal photos only for these purposes: we do not review them, and we do not use them to evaluate or improve our AI analysis or to train any AI model. Any such use in the future would require your separate, opt-in consent
• To create the reports you choose to share, as a PDF on your device or as a time-limited link, to show a shared report to the people who open its link and to show you when it was viewed (when offered)
• To let the AI assistant you connect read and change your Arori data on your instruction (when offered, see Section 2.9)
• To send meal reminders and the notifications you choose
• To manage your subscription and verify purchases
• To run the referral program (invite codes, granting rewards) and prevent its abuse (when the referral program is offered)
• To respond to your support requests and bug reports
• To keep the App secure, stable and performant
• To improve the product: usage statistics and the corrections you make to AI results may be used to improve analysis accuracy
• To comply with our legal obligations

4. Artificial Intelligence and Data Processing

Arori's AI features (food analysis, label reading, recipe suggestions, chat, coach, plan generation, plan translation and, when offered, the optional progress photo comparison for users aged 18 or over) are powered by Google Gemini models.

• Photos: Food, label and ingredient photos are sent to the Google Gemini API for analysis. Label and ingredient photos are not stored on our servers after the analysis completes, and a food photo is stored only when it is saved as a meal photo (when offered, see Section 2.3); saved meal photos are not sent to the AI provider again. Google may keep requests and responses for up to 55 days to detect misuse and for legally required disclosures, and authorised Google staff may review them for that purpose (see "Provider retention and model training" below)
• Chat and plans: In chat we send your message, the earlier messages of that chat and an automatic summary of its older part (the summary is written by our AI provider and may keep details mentioned in the chat, such as your weight, targets or allergies), your goal, your calorie target and, when you follow a plan, how closely you followed it this week (for example the share of planned meals eaten and the meal you skip most). Anything you type in chat, including health information, is processed too. For plan generation we send your request and the plan options you choose (such as diet type, cuisine, budget, foods you dislike or training equipment), your first and last name, your age (calculated from your date of birth), your gender, goal, activity level and calorie target. When you view a plan in a language other than the one it was created in (for example after you change the App's language), we send that plan (its text and values, including its calorie target) to our AI provider to translate it; the plan may reflect the data used to create it, such as your allergies or fasting mode. The data in this item is sent so that the features work, whether or not you give the health data consent. If you have given the health data consent, your calorie target is calculated from your body data and is used in AI features under that consent, even if you have not given the separate consent for AI features
• Health data in AI features (separate consent): Only if you have given both the health data consent and the separate consent for AI features, we also send: your weight (including weight read from Apple Health) and, for diet plans, the target weight calculated from it, your height, the weekly weight change used by your smart goal, your fasting mode (including Ramadan mode and the city you choose for it), your medication support mode (GLP-1 Support: that you use an appetite-reducing GLP-1 medication, your dose frequency and dose day, and your protein-first targets, namely your daily protein target and your daily minimum calorie threshold) and the waist, hip, body fat and lean mass values you enter manually (the notes you add to your measurements are not sent); for plan generation also your allergies, health conditions and injuries; and, when medication support mode is on, a note in food photo analysis to estimate smaller portions. Without the AI consent none of this is sent, and creating a diet plan, which needs your weight, asks for it. Your calorie target is not covered by this consent: if you have given the health data consent, it is calculated from your body data and used in AI features under that consent (see "Chat and plans" above). The AI consent is optional: you can give it when you give the health data consent or later, and withdraw it at any time, in the App under Profile > Privacy or by writing to privacy@arori.app. Withdrawing it deletes no data and your health data consent stays: from then on, the health data listed in this item is no longer added to requests to our AI provider, while your calorie target is still sent under your health data consent; if you continue an earlier chat, its earlier messages and summary are sent to our AI provider again, and if you view a plan in another language, that plan is sent to our AI provider again for translation. Withdrawing the health data consent also ends the AI consent
• Progress photo analysis (optional, when offered): Runs only when you tap to analyse two of your progress photos, only after you give separate explicit consent, and only for users aged 18 or over. We send Google Gemini the two selected photos in reduced size, their poses, the number of days between them, your goal, when available a summary of your logged meals (such as your average calories and protein compared with your goals) and the changes in the body measurements you entered manually. We do not send your weight, your photo captions, the dates of the photos, your name, email address or date of birth, your health conditions or any data from Apple Health. Google handles these requests as described under "Provider retention and model training" below. The result is stored in your account until you delete it or withdraw your consent; withdrawing your consent deletes all your analyses. The analysis describes visible differences only, can be affected by light, angle and clothing, and is not medical advice
• Connected AI apps (when offered): When you use Arori through your own AI assistant (Claude or ChatGPT), that assistant is not our AI provider: its provider receives the data your assistant requests from Arori on your instruction, as described in Section 2.9, and we do not send any data to Anthropic or OpenAI ourselves. AI features you trigger through your assistant (food estimates from text, photo and label analysis from links, recipe suggestions, weekly plans) still run on Google Gemini under this Section and count towards your AI usage limit
• Never sent: Your email address, your date of birth itself and your identity credentials are not sent to the AI provider (when you create a plan we send your age, calculated from your date of birth)
• Provider retention and model training: We use the paid Gemini API. Under Google's Gemini API terms, Google does not use your requests or its responses to improve its products. Google may keep requests and responses for up to 55 days to detect and prevent misuse and for legally required disclosures, authorised Google staff may review them for that purpose, and this data may be used only to train the models Google uses to detect misuse. The data may be processed in the USA or in other countries where Google has facilities
• Accuracy: AI outputs are estimates; nutritional values may differ from actual values

5. Third Party Service Providers

Your data is shared with the following service providers only to the extent necessary to operate the App. None of your data is ever sold or shared with third parties for advertising or marketing. When you share a report, it is also disclosed to the person you choose (see Section 2.8). When you connect your own AI assistant (when offered), the data it requests on your instruction is also disclosed to its provider (see Section 2.9).

Provider	Purpose	Location
Supabase	Database, authentication, file storage	United Kingdom (London)
Google Gemini	AI analysis (photos, chat, plans)	USA and other countries where Google has facilities
Railway	Backend server hosting	USA
RevenueCat	Subscription status management and referral rewards (promotional access)	USA
Apple App Store	Payments and subscriptions	Regional
Resend	Transactional email (verification codes, account notices)	USA
Expo / Apple Push	Push notification delivery	USA
PostHog	Product analytics (see Section 10)	EU (Frankfurt)
Sentry	Crash and error reporting	EU/USA
OpenFoodFacts	Barcode lookup (only the barcode number is sent)	EU (France)
Notion	Internal tracking of bug reports	USA
Vercel	Website hosting, including the report link page and the connection page for AI apps (connection data of visitors)	USA (global network)
Anthropic (Claude)	Not our service provider: only if you connect your Claude account, it receives the data your assistant requests from Arori on your instruction (Section 2.9); Arori sends it nothing on its own and does not process data on its side	USA (see Anthropic's privacy policy)
OpenAI (ChatGPT)	Not our service provider: only if you connect your ChatGPT account, it receives the data your assistant requests from Arori on your instruction (Section 2.9); Arori sends it nothing on its own and does not process data on its side	USA (see OpenAI's privacy policy)

Barcode lookups are made directly from your device to OpenFoodFacts; no personal information is included in the query, only the barcode number.

6. Data Security

• All data transmission is encrypted with TLS; the mobile app additionally uses server certificate pinning
• Passwords are stored only in hashed form
• Row level security (RLS) and authenticated API access (JWT) are enforced in the database
• Report links (when offered) contain a random key that cannot be guessed. Our server creates the key, gives it once to your App and keeps only an irreversible summary (hash) of it, deleted when the link is closed and within a day after it expires. The key comes after a "#" sign, which browsers do not send to servers, so it reaches our server again only when someone opens the report. Report pages are excluded from search engines and load no analytics or third-party content
• Session keys are kept in the device's secure storage (iOS Keychain)
• Server side rate limiting, input validation and redaction of personal data from logs are applied
• In the event of a data breach, the relevant authorities and affected users are notified within the legally required timeframes

7. Data Retention and Account Deletion

• Your data is retained for as long as your account is active
• Label and ingredient photos sent for AI analysis are never stored on our servers; a food photo is kept only if it is saved as a meal photo (see below)
• Your AI chat history and plans are retained until you delete them or your account is deleted
• Meal photos (when offered): Each meal photo is kept until you delete it, delete the meal it belongs to, delete all your meal photos (under Profile > Meal photos) or your account is deleted. Deleting a photo or its meal deletes the photo's files. Turning off "Save meal photos" stops new photos from being saved; photos already saved are kept unless you choose to delete them. When you turn the setting off under Profile > Meal photos, the App asks whether to keep or delete them, and you can always delete them one by one from their meals or all at once under Profile > Meal photos. A monthly limit applies to the number of meal photos saved per account; once it is reached, meals are saved without a photo
• Progress photos and analyses (when offered): Your progress photos are kept until you delete them or your account is deleted. Deleting a photo deletes its files and any AI analyses that use it; changing the date or pose of a photo also deletes the analyses that use it. AI analyses are kept until you delete them or withdraw your consent for progress photo analysis, which deletes all of them. Withdrawing your consent for progress photos deletes all your progress photos and analyses and also ends your consent for their analysis. Records of the consents you give, decline or withdraw (the type of consent, the policy version, the dates, the app version and, where recorded, the language of the text you were shown and your confirmation that you are 18 or over) are kept as proof of consent while your account exists
• Badges: Your badge progress is kept until your account is deleted, even if you delete the logs it was calculated from. Withdrawing your consent for health data (see Section 8) deletes your badges based on your protein, water, calorie and weight goals, and these badges are not calculated while you have not given that consent
• Referral program data (when offered): Your invite code and referral records are kept while your account is active and are deleted when your account is deleted; in the records of users you invited, the link to you is removed. After your account is deleted, the installation identifier hash and the store transaction hash are kept for abuse prevention without being linked to any account, for as long as the referral program runs, and are deleted when the program ends
• Report links (when offered): We do not store the content of a report; it is created each time it is opened. For each link we keep a record of your choices and your consent (the dates of the period, whether weight and photos were included, your time zone and the report language, the version and language of the consent text you were shown, your confirmation that you read the notice, the app version, and when the link was created, expired or was closed and by whom) as proof of consent while your account exists. The link key is kept only as an irreversible summary (hash), deleted when you close the link and within a day after it expires. The times at which a report was viewed are deleted 30 days after the link ends; the total number of views stays with the link record
• Connected AI apps (when offered): For each AI app you connect we keep its identity, the permissions you granted and the date of the connection until you remove the connection or your account is deleted; removing a connection also ends the access keys issued to that app
• Account deletion: You can delete your account from the Profile screen in the App. A 30 day grace period applies after the request; logging in again during that period cancels the deletion. When you request deletion, your report links are closed at once. When the period ends, your profile, meal and water logs, meal photos, body measurements, progress photos and their AI analyses, badges, consent records, report link records and their view times, plans, chats, favourites, scan history, bug reports and uploaded files are permanently deleted. Deleted data may remain in our database provider's backups for up to 7 days, until those backups are overwritten
• Deletion is propagated to third parties: your RevenueCat subscriber record and PostHog analytics data are deleted, and Notion bug report entries are archived
• Before deleting, you can download a copy of your data as JSON from within the App (see Section 8)

8. Your Rights

Under the UK GDPR, EU GDPR and Turkish KVKK you have the right to:

• Access: Obtain the data we hold about you
• Rectification: Have inaccurate or incomplete data corrected (you can also update your profile in the App)
• Erasure: Have your data deleted (including in-app account deletion)
• Portability: Receive your data in a structured format. The Download My Data option on the Delete Account screen exports all your data as a JSON file (progress photos and meal photos, when offered, are included as download links that work for 24 hours; your report link records and their view times are included too)
• Objection and restriction: Object to certain processing activities
• Withdraw consent: Withdraw consent for consent-based processing (for analytics see Section 10). You can withdraw your consent for health data at any time in the App under Profile > Privacy. Withdrawing it deletes your weight, height, health conditions, allergies, injuries, body measurements and weight history (including the weight stored with your progress photos), resets your calorie target to the default, turns off the fasting and medication support modes, stops Apple Health sync, deletes your badges based on your goals and ends your consent for AI features; what the App already wrote to Apple Health stays there, and your chat history (including its automatic summary) and plans remain and you can delete them separately (see Section 7). You can also withdraw only your consent for AI features under Profile > Privacy; this deletes no data and your health data consent stays: from then on, the health data listed in Section 4 under "Health data in AI features" is no longer added to requests to the AI provider, while your calorie target, which is calculated from your body data, is still sent under your health data consent. After either withdrawal, if you continue an earlier chat, its earlier messages and summary are sent to the AI provider again, and if you view a plan in another language, that plan is sent to the AI provider again for translation. When progress photos are offered, you can withdraw your consent for progress photos, or only for their AI analysis, at any time in the App on the progress photos screen opened from Profile; withdrawing deletes the related photos or analyses (see Section 7). When report links are offered, closing a link in the App (Profile > Share with dietitian, or Profile > Privacy > Report links) ends your consent for that link at once; views that already happened are not affected. You can also withdraw any of these consents by writing to privacy@arori.app. When connected AI apps are offered, removing a connection in the App under Profile > Connected AI apps (or on the assistant's side) withdraws the consent you gave for that app and ends its access at once (see Section 2.9)

Send requests to privacy@arori.app; they are answered free of charge within 30 days at the latest. You also have the right to complain to the ICO (Information Commissioner's Office) in the UK, to the Personal Data Protection Authority in Turkey, or, if you live in the EU, to the data protection authority of your country.

9. Turkish KVKK Notice

For users in Turkey, the data controller under Law No. 6698 on the Protection of Personal Data ("KVKK") is Apeka Group Limited, registered in England and Wales (company no: 17105369). Data categories, processing purposes and transfers are as described in this policy. Processing is based on the establishment and performance of a contract (Art. 5/2-c), legitimate interest (Art. 5/2-f) and, for special category health data (including, if you use Ramadan mode, data that may reveal your religious belief), the explicit consent (Art. 6) you give in the App during sign-up, at first launch or later under Profile > Privacy, which you may withdraw at any time in the App under Profile > Privacy, by deleting your account or by writing to privacy@arori.app; withdrawing deletes the health data listed in Section 8. Sending your health data to our AI provider is based on your separate explicit consent for AI features (Art. 6), except for the calorie target calculated from your body data, which is used in AI features on the basis of your health data consent; you can give and withdraw the AI consent in the same ways as the health data consent, and withdrawing it deletes no data. Your data is collected electronically through the App and, if you allow it, from Apple Health; when report sharing is offered and someone opens a report you shared, the time of opening is collected electronically through the report page; when connected AI apps are offered, your sign-in and approval on our connection page are collected electronically through your web browser. Your activity level, nutrition goal and personal challenges are lifestyle preferences processed for the performance of the contract (Art. 5/2-c). When offered, meal photos are processed for the performance of the contract (Art. 5/2-c) so that we can show them to you with your meals; including them in a report link you share is based on the explicit consent you give for that link; any future use of them to evaluate or train AI would require your separate explicit consent. When offered, progress photos (special category health data) and their AI analysis are each processed on the basis of the separate explicit consent you give for them (Art. 6); you can withdraw each consent at any time in the App or by writing to privacy@arori.app, and withdrawing deletes the related photos or analyses. When the referral program is offered, referral and reward records are processed for the performance of the program terms (Art. 5/2-c), and the installation identifier hash on the basis of our legitimate interest in preventing abuse (Art. 5/2-f). When report sharing is offered, disclosing a report through a link to the person you choose is based on the explicit consent you give for each link (Art. 5/1 and Art. 6), which you withdraw by closing the link; recording when a report is viewed is based on our legitimate interest in showing you when your report was opened (Art. 5/2-f). Your data is transferred abroad to the providers listed in Section 5, in the locations given there and in Section 12; for questions about the transfer mechanisms and for copies, write to privacy@arori.app. When you share a report link, the report is sent from our application server (USA) directly to the person who opens it, wherever they are; before each link is created the App tells you this and asks for your explicit consent (see Section 2.8). When connected AI apps are offered, sending your data to the provider of the AI assistant you connect is based on your request and explicit consent (Art. 5/1 and Art. 6), given when you approve the connection on our connection page and renewed each time you instruct your assistant to use Arori; you withdraw it by removing the connection in the App or on the assistant's side (see Section 2.9), and the data is sent from our application server (USA) to that provider (USA and other countries). You may exercise your rights under Art. 11 (access, information, rectification, erasure, notification of recipients, objection to automated analysis and compensation) by writing to privacy@arori.app.

10. Analytics and Tracking

10.1 App Analytics

We use first-party product analytics on PostHog (EU, Frankfurt) to improve the App. We collect: screen views, feature usage, the badges you earn (only the badge type and how many badges you have earned; badges based on your protein, water, calorie or weight goals are not sent and are not included in that count), device model and operating system, app version, language, country derived from device settings, session durations and subscription status. This data is associated with your account, and your email address, first name, goal and activity level are stored as properties of your analytics profile. Events about meals you log include the calories of that meal (and, when you correct an AI result, the calories before and after your correction), water events include the amount you logged, and the weekly summary event includes your average daily calories. We do not send your calorie target or your weight, height or measurement values; about your health data, analytics records only events without the values, such as that you logged a weight or a measurement or turned fasting or medication support mode on or off. When you share a report, only its format (PDF or link), the length of the period and whether weight or photos were included are recorded; never its content or the link. When connected AI apps are offered, our server records which Arori tool your assistant called, whether it succeeded, how long it took and the kind of assistant (Claude, ChatGPT or other); the content of your requests and of the results is not recorded.

10.2 What We Do Not Collect

• No advertising identifier (IDFA/GAID) is used, and no "tracking" as defined by Apple's App Tracking Transparency takes place
• No in-app session recording (session replay) is used
• The content of your food photos and meal photos, your health questionnaire answers and your AI chat messages are not sent to the analytics tool
• Your progress photos, their captions and the weights shown with them, and the content of progress photo analyses are never sent to the analytics tool
• No GPS or location data is collected

10.3 Opting Out

Product analytics is on by default. You can turn it off at any time in the App under Profile > "Share usage data". Collection stops immediately on that device and your choice is kept until you turn it back on. Events our server records (for example sending reminders or weekly summaries, and subscription, referral and smart goal events) are not affected by this switch. To have the data already collected deleted, write to privacy@arori.app; deleting your account also deletes it.

10.4 Website

The arori.app website uses Google Analytics (GA4). Analytics cookies are activated only with your consent via the cookie notice; the default state is denied. No advertising cookies are used on the website. On pages opened from an invite link, the invite code is not sent to Google Analytics; the page address is recorded with the code removed. The report link page on arori.app and the report pages it opens use no Google Analytics, cookies, local storage or Google Fonts. The connection page for AI apps on arori.app (when offered) uses no Google Analytics, cookies or Google Fonts; it keeps your sign-in only in your browser's session storage for that tab and clears it as soon as you allow or deny the connection.

11. Children's Privacy

Arori is not directed at children under 13. We do not knowingly collect personal data from individuals under 13. If we discover that a child under 13 has provided data, we delete it immediately.

Progress photos and their AI analysis (when offered) are available only to users aged 18 or over. If the date of birth in your profile shows that you are under 18, these features are not available to you; if your profile has no date of birth, you are asked to confirm that you are 18 or over before you can use them.

If you believe your child has provided data to Arori, please contact privacy@arori.app.

12. International Data Transfers

Our primary database and file storage are hosted by Supabase in the United Kingdom (London); for users outside the UK, including users in Turkey, this is itself a transfer abroad. Our application server (Railway), through which most requests from the App pass, including those with health data, is in the USA. Google Gemini may process data in the USA or in other countries where Google has facilities. RevenueCat, Expo, Resend and Notion process data in the USA, Sentry in the EU or the USA and PostHog in the EU (see Section 5). For questions about the transfer mechanisms we use and to request copies of them, write to privacy@arori.app. If you share a report link, the report is sent from our application server in the USA (Railway) to the browser of the person who opens it, who may be in any country (see Section 2.8). Our website, including the page that opens a report link, is hosted by Vercel in the USA and on its global network. If you connect your own AI assistant (when offered), the data your assistant requests on your instruction is sent from our application server in the USA (Railway) directly to the assistant's provider, Anthropic or OpenAI, which processes it in the USA and in other countries where it operates (see Section 2.9). The connection page on which you sign in and approve a connection is served by Vercel (USA, global network); your sign-in on it goes directly to our authentication provider Supabase (United Kingdom).

13. Changes to This Policy

We may update this Privacy Policy from time to time. New features (e.g. Apple Health integration, voice logging, community features, the referral program, report sharing, connected AI apps) will operate under the terms of this policy when they launch; for material changes we will notify you in the App or by email. The current policy is always available on this page.

14. Contact