生效日期：2026 年 10 月 22 日
一句話版本
不登入的話，你的飲食紀錄、身體資料和目標都只存在你的裝置上。只有在你把這一餐的照片送去辨識、跟 AI 說哪裡不對、按下「AI 總結」，或在「找食物」輸入文字時，那些照片、那一天或那一週的餐點紀錄，或那段文字才會送到我們的伺服器，轉交 AI 服務處理，處理完就不留。如果你選擇用 Apple 或 Google 登入，餐點、照片和目標會備份到我們的伺服器，只有你的帳號看得到，隨時可以在 app 內刪除帳號連同全部雲端資料；登入後，AI 從營養標示讀到的產品名稱和數字會用來建立共享營養標示，不含照片，別人也看不到是誰拍的（見「共享營養標示」）。你怎麼修正辨識結果，會以匿名統計回報，用來改進辨識準確度（見「使用統計與當機報告」）。App 裡沒有廣告；為了知道我們投放的廣告有沒有效，會用 AppsFlyer 統計 app 是從哪個廣告或管道安裝的（見「安裝來源統計」），iPhone 版另外用 Meta 的 Facebook SDK 衡量我們在 Meta 投放的廣告（見「Meta 廣告成效統計」），除此之外不追蹤你。
存在你裝置上的資料
Feastie 不需要登入就能完整使用。沒有登入時，下面這些資料全部儲存在你自己的裝置上，不會上傳到任何伺服器，我們看不到：
- 每一餐的紀錄：食物、分量、營養數值、補充說明，以及辨識時用的照片
- 還沒辨識的一餐：用「多張」拍好、還沒送去辨識的照片、說明與幾個人吃（登入後也只留在手機上）
- 你在「認識一下你」或「我的」填的身高、體重、生日（舊版填的是年齡）、性別、活動量、第一次打開時選的使用目的，以及由此估算的每日熱量與營養素目標
- 語言、每日提醒、Feastie Pro 狀態等 app 設定
刪除 app，這些資料就跟著刪除了；登入備份到雲端的部分除外，見下面「帳號與雲端備份」。
相機與相簿權限
相機只用來拍餐點照片。相簿權限用來在拍照畫面角落顯示你最新的一張照片，讓你可以直接用別的 app 拍好的餐點照片；app 不會掃描或上傳你相簿裡的其他照片。加入照片的權限只用在兩個地方：你開著「同時存到相簿」時，把用相機拍的照片另存一份到相簿；以及你選擇把「分享這一天」或「分享這一餐」的圖片存到相簿時。這些權限都可以拒絕，拒絕後仍然可以手動輸入或用「找食物」記錄。
帳號與雲端備份（選用）
登入是選用的：不登入，app 的每個功能都照常運作。你可以在「我的」分頁最上方進入「帳號」，用 Sign in with Apple 或 Google 帳戶登入，之後餐點、照片和目標會備份到我們的伺服器，換手機或重新安裝後登入就能拿回來，同一個帳號也可以在多台裝置上使用。
登入時我們拿到什麼。登入提供者（Apple 或 Google）會給我們一個只用來認出你帳號的識別碼，以及你同意提供的 Email 與姓名。姓名只在帳號頁顯示，Email 用來在帳號頁顯示與辨認帳號；Apple 的「隱藏我的電子郵件」一樣可以用。我們不會拿 Email 去比對別的帳號，也不會寄行銷信。Apple 登入時，app 還會把 Apple 給的一次性授權碼交給伺服器換成一組憑證，只用於你刪除帳號時向 Apple 撤銷授權。
備份什麼。每一餐的紀錄（食物、分量、營養數值、補充說明）、餐點照片與補充照片、你的目標與身體資料（包括生日）、AI 推估或你修正過的食物，以及每日提醒的設定（總開關，和早餐、午餐、晚餐、宵夜各自的開關與時間）。不備份：語言等裝置設定。為了讓多台裝置的紀錄合併，每筆紀錄會帶著一個隨機的裝置識別碼和修改時間。
訂閱。登入後，若你在 App Store 或 Google Play 訂閱了 Feastie Pro，我們會在你的帳號下記錄這筆訂閱的交易編號（Google Play 則為購買憑證）、方案與到期日，讓同一個帳號的其他裝置也能使用；不含任何付款資料。登入後每天的 AI 辨識次數也以帳號計算。刪除帳號時這筆記錄會一併刪除，但訂閱本身不會取消，需到購買時的商店取消。
存在哪裡、誰看得到。備份存在我們位於 Cloudflare 的伺服器：紀錄在 D1 資料庫，照片在 R2 儲存空間，依帳號隔離，傳輸全程加密。每個帳號免費有 1 GB 照片空間，Feastie Pro 訂閱者有 5 GB。只有你登入的裝置能讀取；我們不查看、不分析、不分享，伺服器也不會把備份的紀錄或照片交給任何 AI 服務——AI 辨識仍然只在你送出辨識時，送出那一餐的照片。
手機上保留多久。登入後，手機只保留最近 30 天的照片檔案，更早的照片需要顯示時才從雲端載入，並暫存在裝置的快取裡。紀錄本身一直留在手機上。
登出與刪除帳號。登出後，手機上的紀錄保留，雲端的備份也保留，直到你刪除帳號。在 app 內「我的 → 帳號 → 刪除帳號」會立即讓帳號失效並撤銷 Apple／Google 的登入授權，伺服器上的紀錄、照片與帳號資料會在幾分鐘內清除完畢；手機上的紀錄保留，但只在雲端的舊照片就拿不回來了。
共享營養標示（登入後）
登入後，如果你拍的包裝食品照片裡有清楚的營養標示和條碼，AI 從標示上讀到的產品名稱和數字（每 100 公克的熱量與營養素），會在你儲存這一餐時，以你的帳號記在這個條碼底下。至少兩個帳號讀到一致的數字後，這組數字會成為共享營養標示，提供給之後拍到同一個條碼的所有使用者；別人看到的只有產品名稱、營養數字，以及有幾個帳號讀過，不會知道是誰拍的。
為了在你儲存時對得上 AI 讀到的內容，伺服器會把那一次辨識從標示上讀到的產品名稱與數字暫存最多一天，不含照片、補充說明或其他菜色；有寫補充說明的那一次不暫存，沒登入時也不暫存。刪除帳號時，你貢獻的紀錄會一併刪除。免費方案每天第一次貢獻，會多送 1 次 AI 辨識。
會離開裝置的資料
除了上面說的雲端備份（只在你登入後發生），以及後面「使用統計與當機報告」和「安裝來源統計」說明的統計資料，只有下面五種情況，資料會從你的裝置送出，而且每一種都要你主動做一個動作才會發生。
1. AI 辨識餐點照片。你在「確認照片」送出辨識後，這一餐的照片（免費方案最多 4 張，Feastie Pro 最多 8 張）、你寫的說明，以及開了「多人合菜」時有幾個人吃，會送到我們的伺服器（Cloudflare Workers），再由伺服器轉交 AI 服務（Google Gemini 的模型；暫時無法使用時，改由 Anthropic Claude 的模型處理）辨識食物與估算分量。你在辨識結果跟 AI 說哪裡不對時，會再送一次同一餐的照片和說明，加上畫面上的菜色清單（包括你改過的名稱與分量）和你寫的那句話。我們的伺服器不儲存照片，也不記錄請求內容；AI 服務依其 API 資料政策處理，可能為了濫用偵測短暫保存，但不用於訓練模型。請求裡只有上面這些和固定的指令，沒有你其他的紀錄、身體資料或目標。如果照片裡拍到商品條碼，app 會在你的裝置上讀出條碼號碼，另外用這個號碼向我們的伺服器查詢是否已有共享營養標示（見「共享營養標示」）；查詢只帶條碼號碼，不帶任何能認出你的資訊。
2. 找食物。你在「找食物」輸入的文字先在 app 內建的資料庫（衛福部食品營養成分資料庫與 USDA 常見食物；日文與韓文介面另含日本食品標準成分表與韓國食藥處的食品營養資料）比對。只有當內建資料庫的結果不到五筆、而且輸入看起來像食物名稱時，那段文字才會送到我們的伺服器：非英文會先請 AI 服務翻成英文名稱，再以英文向美國農業部的 FoodData Central（api.data.gov）查詢。FoodData Central 會保留自己的請求紀錄，這不在我們控制範圍內。如果內建資料庫和線上查詢都找不到，畫面會提供「讓 AI 用這段文字推估熱量」，只有你點了，那段文字才會送給 AI 服務推估。
3. Feastie Pro 訂閱驗證。購買由 Apple（iPhone）或 Google Play（Android）處理，我們拿不到你的付款資料。訂閱後，app 會把商店簽發的購買證明（App Store 的交易簽章，或 Google Play 的購買憑證）送到我們的伺服器驗證；Google Play 的購買憑證由伺服器向 Google Play 查詢是否有效。伺服器只記住這筆交易的識別碼、訂閱是否有效，以及已用掉的 AI 辨識次數；購買證明裡沒有任何能認出你是誰的資訊。iPhone 版會產生一個隨機識別碼附在購買紀錄上，只有 Apple 留存，我們不拿它和 Feastie 帳號做任何比對。
4. 分享這一天、分享這一餐。你在首頁按「分享」時，做好的圖片和一段文字（當天的熱量與三大營養素；iPhone 版另附 feastie.ai 網址）會交給手機系統的分享選單。在營養標示右上角或首頁長按一筆選「分享這一餐」時，交出去的是做好的圖片（選「一張張」樣式時還有這一餐的照片本身）和一段文字（吃了哪些菜、熱量與三大營養素；iPhone 版另附 feastie.ai 網址）。兩者都由你選的 app 送出，不經過我們的伺服器，我們也不知道你分享給誰。
5. AI 總結。你在首頁或「營養趨勢」按右上角的「AI 總結」時，這一天的餐點（或這一週有紀錄的每一天的餐點）會送到我們的伺服器，再由伺服器轉交 AI 服務（OpenAI 的模型）寫一段總結和建議。送出的內容是：每一餐的時間與餐別、每道菜在 app 上顯示的名稱、份量、熱量、三大營養素和其他六種營養素（膳食纖維、糖、鈉、鈣、鐵、維生素 C），當天的合計或這一週的每日平均（一週的還附上前一週的平均），以及你的熱量與三大營養素目標。不送照片、補充說明、生日或身體資料，也不帶帳號或任何裝置識別碼。我們的伺服器不儲存也不記錄這些內容；AI 服務依其 API 資料政策處理，可能為了濫用偵測短暫保存，但不用於訓練模型。寫好的總結只存在你的裝置上，不會備份到雲端。
如果你打開「每日提醒」，app 會把推播用的裝置 token、你開著的用餐時段（早餐、午餐、晚餐、宵夜）與各自的時間，以及時區、語言交給伺服器，只用來在每個時段的時間送一則提醒。提醒的文字由 AI 服務提前幾天替每種語言、每一餐各寫一則，所有人共用，不含任何關於你的資料；推播經由 Apple（iPhone）或 Google 的 Firebase Cloud Messaging（Android）送達。關掉提醒就會刪除。為了提供服務與防止濫用，我們的伺服器會短暫處理標準的連線紀錄（例如 IP 位址）以限制請求頻率，僅用於此目的。
使用統計與當機報告
為了知道 app 有沒有正常運作、AI 辨識準不準，我們使用 Google Firebase（Analytics、Crashlytics、Performance）收集匿名的使用統計、當機報告與效能數據。
會收的：裝置型號、系統版本、由 IP 推算的大概地區、一個匿名的安裝識別碼、這份 app 是商店的正式版、測試版還是開發中的版本、當機紀錄、app 啟動與網路請求的耗時，以及「介面發生了什麼」的事件——例如完成了一次辨識（來源是相機或相簿、結果是成功或失敗）、存了一餐（來自相機或找食物）、看到了付費牆、要求了文字推估、辨識結果被存下時每一道菜的修改類型、你存下的熱量與 AI 估的熱量之間的比例、第一次打開時選的使用目的（例如「維持現在的樣子」）、分享這一天或這一餐選的樣式、AI 總結有沒有寫成（一天或一週）與你按的有沒有幫助，以及登入是否完成（用的是 Apple 還是 Google）、同步是否成功。
不會收的：你吃了什麼、任何食物名稱、搜尋文字、照片、營養數值、身體資料或目標。使用統計裡沒有你的 Feastie 帳號、Email 或姓名，也沒有任何能對應到帳號的識別碼；不使用廣告識別碼（IDFA），不用於跨 app 或網站追蹤。
這些資料只用來改善 app。Google 如何處理這些資料，請見 Google 隱私權政策。
官網 feastie.ai。我們的官網使用 Google Analytics 了解有多少人造訪、看了哪些段落、有沒有點下載連結。它會收到瀏覽的頁面、捲動與點擊外部連結等事件、瀏覽器與裝置類型、由 IP 推算的大概地區，並在你的瀏覽器存放 Google Analytics 的 cookie（名稱以 _ga 開頭）。歐洲經濟區、英國與瑞士的訪客預設不存放 cookie，只送出不帶 cookie 的統計訊號。官網不放廣告，這些資料也不用於廣告。網站所在的 Cloudflare 另外會以不使用 cookie 的方式統計造訪次數與載入速度。你可以在瀏覽器封鎖 cookie，或安裝 Google Analytics 停用外掛（tools.google.com/dlpage/gaoptout）。
安裝來源統計（AppsFlyer）
我們會在網路上投放 Feastie 的廣告。為了知道是哪個廣告或管道帶來了安裝、這些安裝之後有沒有使用 Feastie、有沒有開始試用或訂閱，app 使用 AppsFlyer 做安裝來源統計（也稱為歸因）。AppsFlyer 會把歸因結果——某次安裝或下面的某個事件來自哪一則廣告——回報給刊登那則廣告的廣告平台（例如 Apple Ads、Google、Meta、TikTok），讓它們計算廣告成效。
會送給 AppsFlyer 的：每次打開 app 時的裝置型號、系統版本、語言、app 版本、安裝時間與 IP 位址，以及一個裝置識別碼——iPhone 是 Apple 的供應商識別碼（IDFV，只在同一個開發者的 app 之間相同），Android 是 Google 廣告 ID（手機有提供時；可以在系統設定裡重設或刪除）。為了判斷安裝來源，iPhone 版會送一次 Apple Ads 的歸因 token，Android 版會讀取 Google Play 提供的安裝來源資訊。事件只有三種：成功完成一次 AI 辨識、開始免費試用（含方案）、開始付費訂閱（含方案、價格與幣別）。iPhone 版另外透過 Apple 的 SKAdNetwork 回報安裝，那是 Apple 彙整、不含個人資料的匿名統計。
不會送的：你的 Feastie 帳號、Email 或姓名，你吃了什麼、照片、搜尋文字、身體資料或目標。iPhone 版不使用廣告識別碼（IDFA），所以不會詢問追蹤權限。這些資料只用來衡量廣告成效，不用來在 app 裡顯示廣告（app 沒有廣告），也不販售。AppsFlyer 如何處理這些資料，請見 AppsFlyer 隱私權政策。
Meta 廣告成效統計（iPhone 版）
iPhone 版另外內建 Meta 的 Facebook SDK，只用來衡量我們在 Meta（Facebook、Instagram）投放的 iPhone 廣告：哪一則廣告帶來了安裝，這些安裝之後有沒有使用 Feastie、有沒有開始試用或訂閱。這個 SDK 只做統計，沒有 Facebook 登入或分享功能；它預設會自動收集的項目——自動事件、廣告識別碼、畫面內容與診斷資料——我們都關掉了。Android 版沒有這個 SDK。
會送給 Meta 的：SDK 在你裝置上產生的匿名安裝識別碼，app 與 SDK 版本、裝置型號、系統版本、語言、時區、電信業者與 IP 位址；安裝時送一次，之後每次打開 app 送一次，附上上次使用的時間長度；事件和 AppsFlyer 相同，只有三種：成功完成一次 AI 辨識、開始免費試用（含方案）、開始付費訂閱（含方案、價格與幣別）。如果你是點 Meta 的廣告打開 app，也會送出那則廣告帶的活動資訊。
不會送的：你的 Feastie 帳號、Email、電話或姓名，你吃了什麼、照片、搜尋文字、身體資料或目標，也不送廣告識別碼（IDFA），所以 app 不會詢問追蹤權限。這些資料只用來衡量廣告成效，不用來在 app 裡顯示廣告，也不販售。Meta 如何處理這些資料，請見 Meta 隱私政策。
第三方服務
- Cloudflare：我們的伺服器所在，以及雲端備份的資料庫（D1）與照片儲存空間（R2）
- Google Gemini：照片辨識、名稱翻譯與文字推估
- Anthropic（Claude）：Google Gemini 暫時無法使用時，照片辨識、名稱翻譯與文字推估的備援
- OpenAI：AI 總結、每日提醒的文字，以及舊版 app 的照片辨識
- USDA FoodData Central（經 api.data.gov）：線上食物查詢
- Apple：App Store 購買與訂閱、Sign in with Apple、iPhone 的推播通知
- Google：Google 帳戶登入、Google Play 購買與訂閱、Android 的推播通知（Firebase Cloud Messaging），以及 Firebase 的使用統計、當機報告與效能數據
- AppsFlyer：安裝來源統計（衡量廣告成效）
- Meta：iPhone 版的廣告成效統計（Facebook SDK）
我們不做的事
- 不強制註冊：不登入也能完整使用
- 沒有廣告
- 不追蹤你在其他 app 或網站的行為；例外只有上面的安裝來源統計與 Meta 廣告成效統計，只用來判斷 app 是從哪個廣告安裝的
- 不販售任何資料；除了共享營養標示上的數字（不含你是誰），以及安裝來源統計回報給廣告平台的歸因結果、iPhone 版送給 Meta 的廣告成效統計，不分享任何資料
- 沒登入時，不會把你的飲食紀錄、照片或身體資料傳到任何伺服器保存；登入後的備份只有你的帳號看得到
- 不會查看或分析你備份的紀錄和照片，也不拿它們訓練任何模型
兒童
Feastie 不是為 13 歲以下兒童設計的，我們也不會刻意收集兒童的資料。
刪除資料與你的權利
沒登入的話，刪除 app，你的紀錄、照片、身體資料與設定就跟著刪除了。登入過的話，在 app 內刪除帳號就會清除伺服器上屬於你的全部資料。除此之外我們的伺服器沒有保存任何能對應到你的資料：辨識用的照片與文字、AI 總結用的餐點紀錄處理完即丟，訂閱驗證的紀錄只對應到 App Store 或 Google Play 的交易識別碼並會自動過期，使用統計是匿名的；安裝來源統計存在 AppsFlyer，iPhone 版的廣告成效統計存在 Meta，都不含你的帳號、Email 或姓名。依《個人資料保護法》你有查詢、更正、刪除等權利；如果你認為我們持有你的個人資料，寫信給我們，我們會處理。
政策變更
如果這份政策有變更，我們會更新這個頁面並修改生效日期。重大變更會在 app 內提示。
聯絡我們
有任何問題，寫信給我們：[email protected]
Privacy Policy (English)
Effective date: October 22, 2026
The short version: Unless you sign in, your meals, body data and goals stay on your device. Only when you send a meal’s photos for recognition, tell the AI what it got wrong, tap AI summary, or type into Find food do those photos, that day’s or week’s meal records, or that piece of text go to our server, which passes them to an AI service and keeps nothing. If you choose to sign in with Apple or Google, your meals, photos and goals are backed up to our server, visible to your account alone, and you can delete the account with everything in the cloud from inside the app at any time; once you are signed in, the product name and numbers the AI reads off a nutrition label help build the shared nutrition labels, with no photo and without anyone else seeing who took it (see Shared nutrition labels). How you correct a result is reported as anonymous statistics, used to improve recognition accuracy (see Usage stats and crash reports). There are no ads in the app; to learn whether our ads work, AppsFlyer counts which ad or channel an installation came from (see Install attribution), the iPhone app also uses Meta’s Facebook SDK to measure the ads we run with Meta (see Ad measurement on iPhone), and apart from that there is no tracking.
Data that stays on your device. Feastie works in full without signing in. While you are not signed in, every meal you log (foods, portions, nutrition values, notes and the photos it was recognised from), a meal you have shot but not yet sent for recognition (its photos, note and how many shared the table, kept on the phone even once you sign in), the height, weight, birthday (age, on older versions), sex and activity level you enter, the reason for using the app you picked when you first opened it, the daily calorie and macro targets estimated from them, and your app settings are stored only on your device. They are never uploaded to any server and we cannot see them. Delete the app and they are gone — except what you backed up by signing in, described under Account and cloud backup.
Camera and photo library. The camera is used only to photograph meals. Photo library access is used only to show your most recent picture on the camera screen, so a meal photographed in another app is one tap away; the app does not scan or upload other pictures in your library. Permission to add photos is used in two places only: to save a copy of a camera shot to your library while Also save to Photos is on, and to save a Share this day or Share this meal picture when you choose to. All of these permissions can be declined, and manual entry and Find food keep working without them.
Account and cloud backup (optional). Signing in is optional; without it every feature works as before. Account, at the top of the Profile tab, offers Sign in with Apple and Google sign-in. Once signed in, your meals, photos and goals are backed up to our server, a new phone or a reinstall gets them back the moment you sign in, and one account can be used on several devices.
What we receive when you sign in. The provider (Apple or Google) gives us an identifier used only to recognise your account, plus the email address and name you agree to share. The name is shown on the account screen only; the email is shown there and used to recognise the account; Apple’s Hide My Email works too. We never match the email against other accounts and never send marketing mail. With Apple, the app also hands Apple’s one-time authorisation code to our server, which exchanges it for a credential used only to revoke the authorisation when you delete the account.
What is backed up. Each meal (foods, portions, nutrition values, notes), the meal photos and extra photos, your goals and body data (birthday included), the foods the AI estimated or you corrected, and the daily reminder’s settings (the main switch, and each meal’s switch and time for breakfast, lunch, dinner and late night). Not backed up: device settings such as the language. So that records from several devices can be merged, each record carries a random device identifier and its modification time.
The subscription. When you sign in, if you subscribe to Feastie Pro on the App Store or Google Play, we keep the subscription’s transaction ID (for Google Play, its purchase token), plan and expiry under your account so the account’s other devices can use it; no payment details. Once signed in, the day’s AI recognitions are counted per account too. Deleting the account deletes this record, but does not cancel the subscription itself, which is cancelled in the store it was bought from.
Where it lives and who can see it. Backups are stored on our servers at Cloudflare — records in a D1 database, photos in R2 storage — separated by account and encrypted in transit. Each account has 1 GB of photo space, free, and 5 GB with Feastie Pro. Only the devices signed in to your account can read it; we do not look at, analyse or share it, and the server never hands backed-up records or photos to any AI service — recognition still sends only the meal’s own photos, when you send them.
How long the phone keeps photos. Once signed in, the phone keeps only the last 30 days of photo files; older photos are loaded from the cloud when shown and held in the device’s cache. The records themselves always stay on the phone.
Signing out and deleting the account. Signing out keeps the records on your phone and the backup in the cloud until you delete the account. Profile → Account → Delete Account makes the account unusable at once, revokes the Apple or Google authorisation, and clears your records, photos and account data from our server within minutes; the records on the phone stay, but photos that lived only in the cloud cannot be brought back.
Shared nutrition labels (signed in). Once signed in, if a photo of a packaged food shows a legible nutrition label and its barcode, the product name and the numbers the AI read off the label (calories and nutrients per 100 g) are recorded under that barcode with your account when you save the meal. Once at least two accounts have read matching numbers, they become a shared nutrition label, offered to everyone who later photographs the same barcode; others see only the product name, the numbers and how many accounts read them, never who did.
So that saving can be matched to what the AI read, our server keeps the product names and numbers read off the label in that recognition for up to a day — no photo, no note, no other dish; nothing is kept for a recognition with a note, or while you are not signed in. Deleting the account deletes the readings you gave. On the free plan, the first reading you give each day earns one more AI recognition.
Data that leaves your device. Apart from the cloud backup above, which happens only after you sign in, and the statistics described under Usage stats and crash reports and Install attribution below, data is sent from your device in exactly five situations, and each one needs an action from you.
1. AI meal recognition. When you send a meal for recognition from the confirmation screen, its photos (up to 4 on the free plan, 8 with Feastie Pro), the note you write and, with Shared table on, how many people shared it are sent to our server (Cloudflare Workers), which forwards them to an AI service (a Google Gemini model; when it is temporarily unavailable, an Anthropic Claude model takes the request) to identify the foods and estimate portions. When you tell the AI what it got wrong on the results screen, the same photos and note are sent again with the list of dishes on screen (your edits to names and portions included) and the words you wrote. Our server stores no photos and logs no request bodies. The AI service handles the request under its API data policy: it may be retained briefly for abuse monitoring and is not used to train models. The request contains only these and a fixed instruction, never your other records, body data or goals. If a photo shows a product barcode, the app reads the barcode number on your device and also asks our server whether a shared nutrition label exists for it (see Shared nutrition labels); the lookup carries only the barcode number, nothing that identifies you.
2. Find food. Text you type into Find food is first matched against the database bundled with the app (Taiwan FDA nutrition data and common USDA foods, plus Japan’s Standard Tables of Food Composition and Korea’s MFDS food composition data in Japanese and Korean). Only when the bundled database returns fewer than five hits and the text looks like a food name is it sent to our server: text that is not English is first translated into an English food name by the AI service, and that English name is then looked up in the U.S. Department of Agriculture’s FoodData Central (api.data.gov). FoodData Central keeps its own request logs, which are outside our control. When neither source has the food, the screen offers to let AI estimate calories from your text; only if you tap that is the text sent to the AI service for an estimate.
3. Feastie Pro subscription verification. Purchases are handled by Apple (on iPhone) or Google Play (on Android); we never receive your payment details. After you subscribe, the app sends the store’s proof of purchase (the App Store’s transaction signature, or the Google Play purchase token) to our server for verification; a Google Play token is checked with Google Play by our server. The server keeps only the transaction identifier, whether the subscription is active, and how many AI recognitions have been used; nothing in the proof identifies you. The iPhone app attaches a random identifier to the purchase, which only Apple retains and which we never match against a Feastie account.
4. Share this day and Share this meal. When you tap Share on Home, the picture and a line of text (the day’s calories and macros, plus the feastie.ai address on iPhone) are handed to your phone’s share sheet. When you choose Share this meal, from the top right of Nutrition Facts or a Home entry’s long-press menu, the picture is handed over — with the One by one style, the meal’s own photos as well — with a line of text (the dishes, their calories and macros, plus the feastie.ai address on iPhone). Either way they are sent by the app you pick; they never pass through our server, and we do not learn whom you shared with.
5. AI summary. When you tap AI summary at the top right of Home or Trends, the day’s meals (or the meals of each logged day of the week) are sent to our server, which forwards them to an AI service (an OpenAI model) to write a summary and suggestions. What is sent: each meal’s time and slot, each dish’s name as the app shows it, its portion, calories, macros and six other nutrients (fiber, sugar, sodium, calcium, iron and vitamin C), the day’s totals or the week’s daily averages (with the week before’s averages for a week), and your calorie and macro goals. No photos, notes, birthday or body data, and no account or device identifier. Our server stores and logs none of it. The AI service handles the request under its API data policy: it may be retained briefly for abuse monitoring and is not used to train models. The summary that comes back is kept on your device only and is not backed up to the cloud.
If you turn on the daily reminder, the app gives our server the device’s push token, the meals you turned it on for (breakfast, lunch, dinner, late night) and the time of each, and your time zone and language, used only to send one reminder at each of those times. The reminder’s wording is written by the AI service a few days ahead, one for each language and meal, and is the same for everyone, with nothing about you in it; it is delivered through Apple’s push service on iPhone or Google’s Firebase Cloud Messaging on Android. Turning the reminder off deletes them. To provide the service and prevent abuse, our server transiently processes standard connection data (such as IP addresses) for rate limiting, and for nothing else.
Usage stats and crash reports. To know whether the app is working properly and how accurate the recognition is, we use Google Firebase (Analytics, Crashlytics and Performance) to collect anonymous usage statistics, crash reports and performance data.
What we collect: device model, OS version, an approximate region derived from your IP address, an anonymous installation identifier, whether the app is a store release, a test build or a development build, crash logs, app start and network request timings, and events describing what the interface did, for example: a recognition completed (from the camera or the library; success or failure), a meal was saved (from the camera or Find food), the paywall was shown, a text estimate was requested, the kind of change made to each dish when a recognition result is saved, the ratio between the calories you saved and the calories the AI estimated, the reason for using the app picked when it was first opened (for example, keep things as they are), the style chosen for Share this day or Share this meal, whether an AI summary was written (for a day or a week) and whether you rated it helpful, whether a sign-in completed (with Apple or with Google) and whether a sync succeeded.
What we don’t collect: what you ate, any food name, search text, photo, nutrition value, body data or goal. Usage statistics carry no Feastie account, email or name and no identifier that maps to an account; the advertising identifier (IDFA) is not used, and nothing is used to track you across other apps or websites.
This data is used only to improve the app. See the Google Privacy Policy for how Google handles it.
The website, feastie.ai. Our website uses Google Analytics to learn how many people visit, which sections they read and whether they follow the download link. It receives the pages viewed, events such as scrolling and clicks on outside links, the browser and device type, and an approximate region derived from your IP address, and it stores Google Analytics cookies (named starting with _ga) in your browser. For visitors in the European Economic Area, the UK and Switzerland no cookie is stored by default and only cookieless pings are sent. The website shows no ads, and none of this is used for advertising. Cloudflare, which hosts the site, also counts visits and load times without cookies. You can block cookies in your browser or install the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout).
Install attribution (AppsFlyer). We advertise Feastie online. To learn which ad or channel brought an installation, and whether those installations went on to use Feastie, start the free trial or subscribe, the app uses AppsFlyer for install attribution. AppsFlyer reports the result — which ad an installation or one of the events below came from — to the ad network that ran that ad (such as Apple Ads, Google, Meta or TikTok), so that it can measure the ad.
What goes to AppsFlyer: each time the app opens, the device model, OS version, language, app version, install time and IP address, plus one device identifier — on iPhone, Apple’s identifier for vendor (IDFV), which is the same only across one developer’s apps; on Android, the Google advertising ID when the phone provides one (you can reset or delete it in the system settings). To tell where an installation came from, the iPhone app sends Apple Ads’ attribution token once and the Android app reads the install referrer Google Play provides. Three events only: an AI recognition completed, a free trial started (with the plan), and a paid subscription started (with the plan, price and currency). The iPhone app also reports installs through Apple’s SKAdNetwork, which Apple aggregates and which carries no personal data.
What doesn’t: your Feastie account, email or name, what you ate, photos, search text, body data or goals. The iPhone app does not use the advertising identifier (IDFA) and so never asks for permission to track. This data is used only to measure our advertising — not to show ads in the app, which has none — and is never sold. See the AppsFlyer Privacy Policy for how AppsFlyer handles it.
Ad measurement on iPhone (Meta). The iPhone app also includes Meta’s Facebook SDK, used only to measure the iPhone ads we run with Meta (on Facebook and Instagram): which ad brought an installation, and whether those installations went on to use Feastie, start the free trial or subscribe. The SDK does measurement alone — no Facebook login, no sharing — and everything it would collect by itself (automatic events, the advertising identifier, what is on screen, diagnostics) is turned off. The Android app does not include it.
What goes to Meta: an anonymous installation identifier the SDK creates on your device, the app and SDK version, device model, OS version, language, time zone, carrier and IP address; the installation once, then each time the app opens, with how long the previous session lasted; and the same three events AppsFlyer gets: an AI recognition completed, a free trial started (with the plan) and a paid subscription started (with the plan, price and currency). If you opened the app from one of Meta’s ads, the campaign information that ad carries goes too.
What doesn’t: your Feastie account, email, phone number or name, what you ate, photos, search text, body data or goals, or the advertising identifier (IDFA), so the app never asks for permission to track. This data is used only to measure our advertising — not to show ads in the app — and is never sold. See the Meta Privacy Policy for how Meta handles it.
Third-party services: Cloudflare (hosts our server, and the cloud backup’s database, D1, and photo storage, R2), Google Gemini (photo recognition, name translation and text estimates), Anthropic (a fallback for photo recognition, name translation and text estimates when Google Gemini is unavailable), OpenAI (AI summaries, the daily reminder’s wording, and photo recognition in older versions of the app), USDA FoodData Central via api.data.gov (online food search), Apple (App Store purchases and subscriptions, Sign in with Apple, push notifications on iPhone), Google (Google sign-in, Google Play purchases and subscriptions, push notifications on Android through Firebase Cloud Messaging, and Firebase for usage statistics, crash reports and performance data), AppsFlyer (install attribution, to measure our advertising), and Meta (measuring our ads on iPhone, through the Facebook SDK).
What we don’t do: no mandatory account (everything works without signing in), no ads, no tracking across other apps or websites beyond the install attribution and the Meta ad measurement above, which only tell which ad an installation came from, no selling of data, and no sharing of it apart from the numbers on a shared nutrition label, which never say who read them, and the attribution results reported to ad networks and the ad measurement the iPhone app sends Meta, no storing of your meals, photos or body data on any server while you are not signed in — and once you are, the backup is visible to your account alone, never looked at, analysed or used to train any model.
Children. Feastie is not designed for children under 13, and we do not knowingly collect data from them.
Deleting your data and your rights. Without an account, delete the app and your records, photos, body data and settings go with it. If you signed in, deleting the account inside the app clears everything of yours from our server. Beyond that our server holds nothing that maps back to you: photos and text sent for recognition, and the meal records sent for an AI summary, are discarded once processed, subscription records refer only to an App Store or Google Play transaction identifier and expire on their own, usage statistics are anonymous, and install attribution, held by AppsFlyer, and the iPhone app’s ad measurement, held by Meta, carry no account, email or name. Under Taiwan’s Personal Data Protection Act you have the right to access, correct and delete your personal data; if you believe we hold any, write to us and we will act on it.
Changes. If this policy changes, we will update this page and its effective date. Significant changes will be announced in the app.
Contact: [email protected]