Privacy Policy.

Effective 1 October 2026

This Privacy Policy explains what information the Triffin app and its online service (together, the "App") collect, how it is collected and used, who it is shared with, how long it is kept, and the choices you have. Triffin F.Z.E ("we", "us", "our") is responsible for this information.

In short: we keep your account, your profile and your food diary on our server so the App can work across devices. The App's AI features send your meal photos, what you type, your profile and your diary numbers to outside AI services (Google's Gemini and Anthropic's Claude models, reached through OpenRouter, and Perplexity search), but only after you allow AI processing, and you can withdraw that at any time in Settings → AI processing. Photos you share publicly or use as your profile picture are always checked by an AI moderation model before others see them. If you link Apple Health, WHOOP or Strava, the activity the App reads from them is stored on our server to set your calorie budget, and is shared with an AI model only for daily tips, while they are on. We do not sell your information, show ads, or use third-party analytics or advertising tracking tools. The App is for people aged 18 and over.

Who we are

The App is operated by Triffin F.Z.E, B.C. 1309418, Ajman Free Zone, United Arab Emirates. For any privacy question or request, email support@triffin.app, or use Contact support in the App's Settings.

Information we collect

We collect the following information, either from you directly as you use the App, from the services you choose to connect, or from the sign-in provider you choose:

Account information: when you sign in with Google or with Sign in with Apple, we receive and store your email address and, if the provider shares them, your name and a link to your profile picture. If you use Sign in with Apple and choose to hide your email, we receive a private relay address from Apple instead. We also store Google's or Apple's identifier for your account, which is how we recognise your account when you sign in again, even if your email address has changed. With Sign in with Apple we also store an Apple refresh token (encrypted), which we use only to revoke the App's access to your Apple ID when you delete your account. If you sign in with your email address instead, we store that address and a one-way hash of your password, never the password itself. Before a password is set, whether on a new account, in place of a forgotten one, or on an account that already signs in with Google or Apple, we email a 6-digit code to the address to confirm that it is yours. We also create an account ID and record when your account was created.
Sign-in sessions: when you sign in, we create a session token. Our server stores only a one-way hash of it, with its expiry time; your device keeps the token in the secure storage provided by the operating system (or in the browser's local storage on the web), so that you stay signed in.
Your age: the App asks for your birth year at the start of onboarding, before any profile question, and our server refuses a birth year that makes you younger than 18. On iPhone the App also asks Apple, through its Declared Age Range feature, whether you are at least 18. Apple's answer is used only on your device to decide whether the App can be used, and it is not sent to us.
Your profile, from onboarding and Settings, stored on our server: your goal, sex (for the calorie calculation), birth year, height, weight, target weight if you give one and the weekly pace you choose towards it, activity level, training sessions per week, eating patterns, allergies, foods you dislike, a note on how you eat, cuisines you like, habits you want to keep an eye on, the tone you want from the coach, and your language and region. We also keep your sex, age, height, weight and your calorie, protein, carbohydrate, fat and fibre targets with your account settings, where the daily calculations read them.
Health details, only if you give them and tick the consent box: the health conditions you choose, a free-text health note, and whether you are pregnant or breastfeeding.
Body-fat values: the percentage you enter or accept, whether it came from a measurement or from a photo estimate, the range if it was estimated, and when it was last changed.
Weigh-ins: for each day you weigh in on Today, the date, your weight and, if you have a body-fat value, your body-fat percentage. Saving a weigh-in also updates the weight and body fat in your profile. Unless you typed your own numbers under Settings → Daily targets, it also works your daily calorie and nutrient targets out again from the average of your weigh-ins over the last 7 days. The weight you give during onboarding is kept as your first weigh-in, dated the day you created your account. The Week page draws your weigh-ins as a chart, with your target weight and the date your recent pace would reach it.
Body photos, if you use the optional body-fat estimate: the photo is sent to our server and on to our AI provider for a single request, and is held only in memory while that request runs. We never write it to our database, it is never added to your meal log, your profile or anything other people can see, and no copy of it remains with us once the request ends. You can type your body-fat percentage instead, or skip the question.
Meal photos and meal logs: photos you take with the camera or choose from your photo library are uploaded to our server. If you save the meal, the photo is stored with your meal log. For each meal you save we store the dish name, estimated weight, calories, protein, fat, carbohydrates and fibre (when the estimate gives one), the vitamins and minerals (estimated, or worked out from the recipe for a meal logged from Cook), whether the meal included tea or coffee and whether it included meat or fish, the list of ingredients, the AI's confidence score and short health note, any note you add (up to 140 characters), and the date and time you ate it. If you do not save the meal, we do not store the photo.
Corrections, weekly pages and week reviews: the corrections you make to an estimate (used to make your later estimates more accurate), the weekly summary page written about your week, and the headline and tips written for your week review.
Menus and recipes: menu photos you take and the restaurants you pick, with the menu reading produced from them; recipes you import from a photo, ask the App to write, save or edit; and your weekly cooking plans: the cuisines, kinds of dish, cook days, household size and food budget you choose, the country the plan is priced for, the lunches, dinners, cook sessions and shopping list planned from them, including the dishes you swap in, the items you tick off and the meals you mark as eaten, and the foods and nutrients you add to a week's plan from the Week page.
Next-meal suggestions on Today (Pro): the recipes you mark "Not for me", each with its name and when you marked it, so that later suggestions leave it out. The suggestions themselves are not stored; a meal you log from one is saved in your diary like any other.
Activity you log by hand: the sport, how many minutes it lasted, how hard it felt, the calories you enter from a watch or machine if you choose to, the calories we work out, and the date. If you add a note on how the session felt, it is stored in encrypted form together with the one-line explanation of the estimate written from it.
Activity from Apple Health, WHOOP and Strava, if you link them: described in their own sections below. We also keep the calorie budget calculated for each day from your targets and your activity.
Daily tips, while they are on: the tips written for you and the pattern each one was written from, whether you opened, saved or marked each one as not useful, and a record of each day's attempt. If a tip is rejected by our checks, the model's reply is kept in encrypted form for 30 days so we can see what went wrong.
Social activity: the handle and profile audience setting that new accounts choose during onboarding, and your display name, which is your handle until you set one; and, if you use the community features, the location you type on your profile, your profile photo, the meals and recipes you share, their public captions, your comments and the accounts you mention in them, reposts, likes of meals and of comments, saved meals, follows, follow requests, blocks, the posts you hide from your feed, the reports you file, strikes and bans against your account, the moderation decisions about you that the App shows you (what we decided, the reason, what led to it and when), and the notifications about these actions. Your private diary note is not copied into a public caption.
Your choices: when you allowed AI processing, when daily tips were turned on and whether you turned them off, when you agreed to the community rules, whether social notifications are on, whether meal reminders are on (they include the reminder if you stop logging), whether you turned on offers and news by notification and when you did, and your daily tip settings.
Credits and purchases: how many credits your account has used in each period, your top-up balance, the identifier and date of each top-up purchase, whether you were shown the introductory offer and what you chose, and your subscription status as RevenueCat reports it: whether Pro is active and until when, whether the current period is a free trial, whether it is set to renew, whether a payment did not go through, and which store it was bought from. We never receive your payment card details.
Referrals: your referral code and, if you used one, the code you signed up with.
Notifications, time zone and country: if you allow notifications, the push token Expo issues for your device; your device's time zone, so that days and tips follow your local time; the two-letter code of the country your device's time zone or region setting points to (for example AE), worked out on your device, so that the App can adapt to your country; the last time the App was opened on one of your devices, which it tells our server when it sends your time zone; and a record of each notification our server sends you: its kind and when it was sent.
Device identifier: the App creates a random identifier on your device, combined with your device's operating system type, and sends it with its requests to our server. It is stored with your meal logs and lets the App move logs made on that device before you signed in into your account. It is not your device's advertising identifier or serial number.
App Store notifications: Apple can send our server notifications about the App, for example that a parent or guardian has withdrawn consent (RESCIND_CONSENT). We store each notification's type, date, environment and the transaction identifiers it carries, and the account it concerns if we can match one.
Usage events: when you reach certain steps in the App, it records which step and when: the sign-in screen shown, a sign-in started, completed or failed, an onboarding page shown, onboarding finished, your answer to AI processing, the camera opened, an estimate received (and how long it took) or failed, a meal saved (and whether it was your first), the plans screen shown or closed, a plan chosen, a purchase started, completed or failed, a reminder scheduled (with its time), a notification opened, your answer when the App asks to send you notifications, a notification setting turned on or off, the reason you give, if you choose one, for turning off renewal of Pro, a daily tip opened (and whether from its notification, the card on Today or your saved tips), a link on a week review tip opened (and which one), and the App Store's rating sheet asked for. An event carries a few details about its step, such as which plan, whether a free trial applied, whether you signed in with Apple, Google or your email address, or a short code for why a step failed, never what you typed, photographed or ate, and never your email address. Events are stored on our own server with your account, or with the device identifier before you sign in.
Crash reports: when the App or our server crashes or hits an error, a report goes to Sentry, the service we use to find and fix errors: what went wrong and where in the code, the App version, and technical details of the device, such as its model, operating system version, free memory and language and time zone settings. Sentry adds identifiers for the App on that phone, one it creates at random and one derived from the identifier iOS gives the App, so that repeated crashes on one phone are counted once; they are not linked to your account. Before a report is sent we remove the contents of requests, email addresses and account identifiers, and a report never carries a photo or a screenshot.
Request log: see How long we keep information.

Some information stays only on your device and is not sent to us: your reminder settings (apart from the time of a reminder the App schedules, which a usage event records, and whether meal reminders are on, described above), the calendar events and reminders the App adds for your cooking plan and your choices for them, whether Apple Health sync is on, the list of samples the App has written to Apple Health (so it can update or remove them), your onboarding answers until you finish onboarding, and Apple's Declared Age Range answer. Ramadan mode is kept on your device too. While it is on, the App asks our server to count each day's meals from 06:00 to 06:00, and names the meal Suhoor or Iftar to our server when it picks your next meal and to the AI model that picks from a menu; our server does not store the setting, and keeps the names Suhoor and Iftar only in the text the menu model writes for a menu read, which we keep for 30 days. The App also works out on your device which of its own reminders to schedule and when, from your diary, your settings and your plan; for example, the time you usually have lunch is worked out on your device and is not sent to us.

How we use your information

to create and maintain your account and keep you signed in;
to check that you are at least 18, and to act on a withdrawal of consent Apple tells us about;
to estimate the nutrition of your meals, suggest dishes from a menu, write and import recipes, and cost your workouts, with AI models, when you allow it;
to calculate your calorie and nutrient targets and each day's calorie budget, including the calories you earn from activity;
to estimate your body fat from a photo, if you choose that option, and to set your protein target from the result;
to store and show your meal history, your daily and weekly totals, your weekly pages and your week reviews;
to work out the vitamins and minerals of your week on the Week page (Pro), against targets set from your sex, age, calorie target, the days you logged a workout and, if you told us, pregnancy or breastfeeding, and to suggest foods for the week ahead from them; this is done on our server with fixed rules, without an AI model;
to suggest up to three next meals on Today (Pro), picked from our recipe catalogue for the calories left in your day and the protein or fibre you are furthest behind on, leaving out recipes that conflict with your eating patterns, allergies, dislikes or health conditions, and favouring the cuisines you like, the cuisines common in the country you are in and dishes like the ones you logged in the last 30 days; this is done on our server with fixed rules, without an AI model;
to write daily tips, coaching tips, week review tips and share captions, when you allow it;
to find restaurants when you search for one, or that serve a dish suggested to you;
to run the community features: showing what you share to the people allowed to see it, likes, comments, reposts, follows and notifications;
to keep the community safe: filtering words, checking shared photos, handling reports, and removing content and banning accounts that break the Community rules;
to send the notifications you allow;
to send a short reminder if you stop logging meals, 8, 15 and 30 days after your last saved meal, at 18:00 your time, worked out on our server from when you last saved a meal and your time zone: only while notifications are allowed on your device, only once the App has not been opened for 7 days (until then the reminders the App schedules itself are still running), never on a day we have already sent you such a reminder or an offer, never after the third until you save a meal again, and not at all if you turn off Meal reminders in Settings → Notifications; its wording depends on whether you have, had or never had Pro, but it says nothing about what you ate, and during Ramadan it is not sent to accounts in the Gulf;
to tell you by notification when a payment for Pro did not go through, when we learn of it and again 3 and 10 days later while it lasts, and when a Pro plan you set not to renew is about to end, within its last 2 days, never for a free trial; we work these out from your subscription status, and they are sent while notifications are allowed on your device;
to send you offers about Pro by notification, such as a lower price to come back after your subscription ended, only if you turned on Offers and news in Settings → Notifications: at 18:00 your time, no sooner than 14 days after a subscription bought on the App Store ended, at most once every 30 days and 3 times after each subscription ends, never on a day we have already sent you a reminder to log or another offer, and not while the App has been opened in the last 7 days; you can turn this off at any time;
to measure whether our notifications help: one in 10 accounts created after a date we choose is put, from its account ID alone, in a group that gets only the notifications about the account, the reminders it set up itself (the dinner reminder at the time it chose and Cook's reminders), daily tips and social notifications, so that we can compare how often people keep logging with and without the others;
to check your subscription, count your credits and credit your top-ups;
to move logs created on your device before you signed in into your account, when you choose to;
to respond to your questions and requests;
to see where people stop between installing the App and subscribing, from the usage events described above, counted on our own server, so that we can improve those steps;
to keep the App secure, fix problems and comply with legal obligations.

We do not use your information for advertising, and we do not sell or rent it.

AI processing

The App's estimates, menu picks, recipes, captions, coaching, week review tips and daily tips come from AI models run by other companies. The App asks for your permission (AI processing) before any of your information is sent to them, and you can withdraw it at any time in Settings → AI processing. Allowing it also turns on daily tips, as described under Daily tips below, and withdrawing it turns them off. Without it you can still use the App by typing your meals' numbers yourself. Your health conditions, pregnancy and health note are never sent to an AI model without your permission, whichever version of the App you use.

Who receives it:

OpenRouter, an AI routing service. Our server sends every AI request through OpenRouter, which passes it to the model named below.
Google (Gemini models), for every AI feature except daily tips, and for the moderation check of shared photos described below.
Anthropic (Claude model), for daily tips only, and only while they are on.
Perplexity (search), which our server asks for published nutrition facts about a dish and for a chosen restaurant's menu.

What each feature sends, when you use it:

Photo estimate: your meal photo. Typed estimate and refine: the words you type about the meal.
With every estimate, menu pick, recipe, weekly page, week review and daily tip, the profile details that feature needs, from this list: your goal, a portion size worked out from your weight, height, sex, age, activity level and training sessions, your eating patterns, allergies, dislikes and note on how you eat, the cuisines you like, the habits you want to watch, the coach's tone, and your language and region; and, if you gave them, your health conditions, pregnancy or breastfeeding, and health note.
Menu picks: the menu photo, or the name and address of the restaurant you chose, with your remaining calories for the day, what you are short on, the meal (Suhoor or Iftar while Ramadan mode is on) and your local time.
Recipes: a recipe photo you import, or the dish you ask for, with your remaining calories and protein for the day and your targets. Your weekly cooking plan is made on our server without an AI model, and nothing from it is sent to one. Nor is anything from the vitamins and minerals on the Week page, which are also worked out on our server without one.
Next-meal suggestion on Today (Pro): nothing. It is picked from our recipe catalogue on our server, without an AI model.
Share caption: the dish name, calories, protein, fat and carbohydrates of the meal.
Coaching tip on Today (Pro): your goal and your totals for the last 7 days (calories, protein, fat, carbohydrates, fibre and number of meals). Weekly page (Pro): the meals you logged that week. Week review (Pro), once the week is over: each day's calories, protein, fibre and carbohydrates for that week, your targets, the previous week's averages, and the patterns our server finds in that week's meals, each with the dish, time and meal (breakfast, lunch, dinner or snack) of the plates that show it. Those patterns are worked out from the meals' calories, protein, fibre, free sugars and times, whether you picked them from a restaurant menu in the App, and your targets.
Workout you log by hand, when you turn on Refine with AI: the sport, minutes and effort, your weight, and the note you add. A calorie figure you enter from a watch or machine is used as you type it and never reaches an AI model, and a workout logged without Refine with AI is costed from a published table of activity values and never reaches one either.
Body-fat estimate from a photo: the body photo alone, with no name, email address, account ID or any other detail about you. The model is instructed to return only a percentage and a range.
Daily tips: described in their own section below.

Perplexity receives only search text: the name of a dish (as you typed it, or as the model read it from your photo) or of a packaged product, a restaurant's name and address, and, where you have told us about a health condition and allowed AI processing, the ingredient that condition concerns (for example sodium or added sugar), which can imply the condition itself. It never receives your name, email address, account ID, photos, meal notes or health note.

We do not include your name, email address or account ID in any AI request. However, a photo can show more than food, so avoid including people, documents or other personal information in your photos.

On every request, our server asks OpenRouter to use only providers that do not collect your data, meaning providers that do not store it or use it to train their models. The providers process the data to return a result to the App. OpenRouter's, Google's, Anthropic's and Perplexity's handling of the data they receive is also governed by their own terms and privacy policies.

For body photos specifically, we want to be exact about the limit of what we can promise. We do not store the photo, and we ask OpenRouter to route the request under a zero-retention policy to a single named provider, with no fallback provider. However, OpenRouter treats short-lived in-memory caching as something other than retention, and the Gemini endpoints this request can reach support that kind of caching. So the photo may be held briefly in Google's processing cache after it leaves us. That copy is outside our control and we cannot delete it for you. We tell you this in the App before the camera opens, and the estimate is optional for exactly this reason.

Whether or not you allow AI processing, a photo you share with other people (a shared meal or recipe, or a new photo on one) and a photo you set as your profile picture are sent on their own to a Google Gemini model, through OpenRouter, to check them against the Community rules before anyone else can see them. This check keeps the community safe and cannot be turned off for shared photos; photos you do not share are never sent for it. If the check cannot run, a shared post waits for a person on our team to review it, and a new profile photo is not accepted.

Daily tips

Daily tips are a Pro feature, written only while your account has Pro. The screen that asks for AI processing says what they read and who receives them, and allowing AI processing on it turns them on. If you allowed AI processing on an earlier version of that screen, which did not say so, the App asks you about daily tips separately, with the same information, and they start only when you tap Turn on tips. Their settings are in Settings → Daily tips.

Once a day, at the time you choose in Settings → Daily tips, our server sends Anthropic's Claude model, through OpenRouter: the meals you logged that day (dish, meal and time eaten), up to three patterns our server found in them, each with the figures that show it (worked out from those meals' calories, protein, fibre and free sugars, whether you picked them from a restaurant menu in the App, your targets and that day's calorie budget), the profile details described under AI processing including your health conditions and health note if you gave them, and, if you linked them, that day's steps and active energy and your workouts from Apple Health, WHOOP or Strava. If a reply fails our checks on its length, its punctuation, its reasons or the figures it quotes, the same request is sent once more.

The tip is stored with your account and shown in the App. Its notification never shows the tip or anything from your diary: only a short line, in your language, that says a note is waiting and, at most, whether it is about something that stood out, an idea for the day or what is going well. The tip itself appears only inside the App.

You can turn daily tips off at any time on the same screen, and turning off AI processing in Settings → AI processing turns them off too. Turning them off stops the daily request and cancels any tip notification not yet sent.

Location and restaurant search

The App asks for location access the first time you open restaurant search, when you tap Find it near you on a next-meal suggestion you choose to buy, or on the budget page when you set up a week in Cook, not before. You can decline and still search by typing a restaurant name, a city or both. You can change location access at any time in your device or browser settings.

When you search for a restaurant, your search text and language are sent through our server to Google Maps Platform (Places API) to find matching restaurants. If you allowed location, your current latitude and longitude are sent too, and results are sorted by straight-line distance. Without location, the two-letter region code of your device's language settings (for example FR) is sent instead, so results come from your country. We do not store your coordinates or track your location in the background.

On the next-meal suggestion on Today (Pro), Buy it shows the nearest restaurant that serves the suggested dish. To find it, the App runs the restaurant search described above with the dish's name as the search text, and only when location is allowed: it then sends your device's current position with the search. Without location, it shows Find it near you, which asks for access. The position is sent with that search only and is never saved: while the App is open, your device keeps it in memory only to search again once you have moved more than 500 metres. The suggestions themselves are picked without it. The App does not order food: Log it adds the recipe to your diary, as logging a recipe from Cook does.

Cook prices a week's shopping in the currency of the country you are in. When you set up a week, the App reads your position if you have already allowed location, and asks for access on the budget page if you have never answered. Your device's own geocoding service (Apple's on iPhone, Google's on Android) turns the position into a country, and only its two-letter code (for example AE) reaches our server, where it is stored with that week's plan. Without location, the plan is priced for the country of your previous plan or the region code of your device's language settings. Your coordinates are never sent to our server for this.

The next-meal suggestions on Today (Pro) favour the cuisines common in the country you are in. If you have already allowed location, the App works out that country in the same way, and only its two-letter code is sent with the request for suggestions. It is used to order them and is not stored. The App never asks for location for this. Without location, the suggestions follow the country your device's time zone or region setting points to.

When you select a restaurant, its name, address and place identifier are used to look up that branch's menu, including through Perplexity search. The restaurant name and the menu reading are saved as a menu read. Google processes search requests under its terms and privacy policy: https://policies.google.com/privacy and https://maps.google.com/help/terms_maps/.

Apple Health

Health sync is available only in the iOS app and is off until you turn it on in Settings or link Apple Health, during onboarding or under Settings → Connections. Before the Apple Health permission screen, the App tells you what it will read, that it is synced to our server, and when it is shared with an AI model. On iPhone, with your permission, the App:

reads Active Energy Burned and Step Count for the current day, and your most recent Body Mass (weight);
writes Dietary Energy Consumed: the calories of each meal you log, labelled with the dish name and dated to the time you ate it. When you change a meal's time the sample moves with it, and when you delete the meal the App deletes the sample. This applies to meals logged while sync is on with this version of the App; earlier samples cannot be found again and stay in Apple Health until you delete them there.

The App asks for no other Apple Health data types.

What leaves your device: the day's steps and active energy and your latest weight are synced to our server when you link Apple Health and then about every 30 minutes while the App is open. We store the steps and active energy with that day's activity, and the weight with your account. We use them to calculate each day's calorie budget and to cost your workouts. When Apple Health has a weight from today, the App also offers it on Today's weigh-in; it is saved as a weigh-in only if you save it.

Who else receives it: Apple Health data is shared with a third party only in these cases. While daily tips are on, that day's steps and active energy are sent to Anthropic's Claude model through OpenRouter, as described under Daily tips. The day's calorie budget, which includes the calories you earned from activity, is one of the numbers recipe suggestions work from. And when you add a note or your own figure to a workout you log by hand, your weight goes with it to the AI model, and that weight comes from Apple Health if it is the only one we have.

Apple Health data is not used for advertising, marketing or data mining, is not sold, and is not stored by us in iCloud.

You can turn sync off in Settings, or unlink Apple Health in Settings → Connections. Either one stops the App from reading or writing health data and deletes the Apple Health activity and weight stored on our server. You can also review or revoke the App's permissions in the Health app on iPhone. Data the App has already written to Apple Health stays there until you delete it in that app.

WHOOP and Strava

You can link a WHOOP or Strava account in Settings → Connections, so your exercise can add to the day's calorie budget. Linking opens WHOOP's or Strava's own sign-in page, where you approve the access.

WHOOP: the App asks for the scopes "read:cycles read:workout offline". Our server pulls the last 7 days of your WHOOP cycles (the energy you used, which we split into active and resting energy, and strain) and your scored workouts (sport, duration and energy), and stores your WHOOP member ID. It pulls when you link WHOOP, when the App syncs (about every 30 minutes while it is open), and when WHOOP tells our server that new data is ready, which can happen while the App is closed. To split the energy, our server uses your weight, height, birth year and sex; these are not sent to WHOOP.
Strava: the App asks for the scope "activity:read" and nothing else. Our server pulls your activities from the last 7 days (sport, moving time, start time and the activity's ID) when you link Strava and when the App asks for a sync while it is open; there is no background sync. It costs each activity from a published table of activity values and your weight. It reads no followers, kudos, comments, clubs or other social data, and posts nothing to Strava.

The access tokens WHOOP and Strava give us are stored on our server, encrypted, because exchanging and refreshing them needs a secret that cannot be kept inside the App, and because the day's budget is calculated on our server. They are used only to read the data described above. The activity we pull is stored with your daily activity until you unlink the service or delete your account.

While daily tips are on, the workouts and active energy from WHOOP or Strava are part of what is sent to Anthropic's Claude model, as described under Daily tips.

Unlinking, in Settings → Connections, deletes the tokens and the activity pulled from that service from our server at once, and asks WHOOP or Strava to revoke the App's access. If WHOOP cannot be reached, our server keeps retrying the revocation for up to 7 days. If Strava cannot be reached, you can remove Triffin from the apps connected to your Strava account in Strava's settings. The calorie budgets already calculated for past days stay with your diary. Deleting your account unlinks both.

Health-related data and your consent

Some of what the App can hold says something about your health: the health conditions and health note you give us, whether you are pregnant or breastfeeding, your body measurements, activity from Apple Health, WHOOP or Strava, and a body photo if you use the photo estimate. In many places, including the European Union and the United Kingdom, this is treated as a special category of personal data, which may only be processed with your explicit consent. We ask for that consent wherever you live.

We ask for it at the moment it applies rather than burying it here. The health questions can be skipped, and your answers are saved only when you tick the consent box, which explains that they are stored on our server and sent to AI services only if you allow AI processing. Linking Apple Health shows you what is read and shared before the permission screen. The body-fat question can be skipped, and the photo estimate shows you what is sent, to whom, and what we cannot control, before the camera opens. You have to accept that screen for the camera to open at all, and it is shown every time rather than remembered, so your answer is always a current one.

You can withdraw consent at any time, and withdrawing it is not made harder than giving it: remove your health details in Settings → Health; remove your body-fat value in Settings → Body, which deletes the percentage and range, removes the percentage from your past weigh-ins and recalculates your protein target without them; unlink Apple Health, WHOOP or Strava in Settings → Connections; and turn off AI processing in Settings → AI processing or daily tips in Settings → Daily tips. Withdrawal does not undo processing that already happened, and it cannot reach a copy held in a third party's processing cache, which is why that limit is stated above and in the App.

Stored encrypted in our database, under keys kept separately from it: in your profile, your health conditions, health note, pregnancy or breastfeeding, allergies, sex, birth year, height, weight, target weight and body-fat values; the weight and body fat of each weigh-in; the note on a workout you log by hand; the WHOOP, Strava and Apple sign-in tokens; and a rejected daily tip. Stored without this extra encryption: the rest of your profile answers (your goal and weekly pace, eating patterns, note on how you eat, dislikes, cuisines, habits you want to watch, coach tone, activity level, training sessions, language and region), the copy of your sex, age, height, weight and targets kept with your account settings for the daily calculations, the weight read from Apple Health, your meal logs, your activity figures, and your social content.

Subscriptions and payments

Subscriptions and top-ups are sold through Apple In-App Purchase on iPhone and through Google Play's billing system on Android. Apple or Google processes your payment; we never receive your payment card details.

We use RevenueCat to manage subscriptions. The App's RevenueCat software connects to RevenueCat to check your subscription status and available plans, and when you sign in we link your purchases to your Triffin account ID in RevenueCat. Our server also asks RevenueCat whether your account is subscribed and which top-ups it has bought, so it can count your credits. RevenueCat's handling of data is also described in its own privacy policy.

Sign-in providers

Google and Apple authenticate you when you sign in and share the account information described above with us. Their handling of your data is governed by their own privacy policies.

Notifications, camera and photos

The App schedules most of its notifications itself, on your device: reminders to log your lunch and your dinner, only on days you have not logged that meal yet; a recap of your week on Mondays; a weekly reminder to weigh in, once you have weighed in since onboarding; a reminder when your free photos come back; and, before you have saved a meal, a reminder on your first and third day. They follow your choices in Settings → Notifications: at most two a day, none between 22:30 and 08:00 unless you chose that time yourself, and a kind you have not answered five times in a row pauses for 14 days. If you allow notifications, we also store the push token Expo issues for your device and send these through Expo and Apple's push service (or Google's, on Android), none of them between 22:30 and 08:00 your time:

the daily tip notification, if tips are on, which never shows the tip or anything from your diary, only a short line saying a note is waiting;
social notifications, which show the display name of the other person and what they did, for example that they liked, commented on, saved or reposted your meal, liked or replied to your comment, mentioned you in a comment, shared a new post, followed you or asked to follow you. A comment, a reply, a mention or a follow request is sent straight away; the rest wait and are sent together, at most every 3 hours, and no more than 3 social notifications reach you in a day. They never contain the meal, the comment's text or a photo; those are shown in the App's inbox. You can turn social notifications off in Settings → Notifications, and they still appear in the inbox.
the reminder if you stop logging, described above;
notices about your Pro plan: a payment that did not go through, and a plan you set not to renew about to end. They say only that, and nothing about how you use the App;
offers about Pro, only if you turned on Offers and news in Settings → Notifications.

The App uses the camera and photo library only when you take or choose a photo yourself: a meal photo, a menu photo, a recipe photo, a profile photo, or, if you choose the optional body-fat estimate, one body photo. It never opens the camera on its own. A body photo taken for an estimate is never written to your device's storage or photo library. You can change camera, photo library and notification permissions at any time in your device settings.

When you choose to share a meal card or photo to another app, that app receives what you share.

Within Triffin, a shared meal's photo, dish name, calories and public caption are visible according to the creator's current profile audience. When you share a meal or a recipe it also appears in the feed of the people who follow you, in the order it was shared, rather than only on your profile; sharing it again moves it back to the top of their feed. Nothing you have not shared ever appears there, and the feed is ordered by time alone. Find people and an empty feed suggest profiles to follow: first the people whose recipes you saved, then accounts we feature and public profiles that shared something in the last 14 days. Only public profiles are suggested, so if your profile is public and you shared something recently, it can be suggested to other people; a private profile never is. Comments, and the number of likes on the meal and on each comment, are visible to people who can access the meal. Liking, commenting on, reposting or saving another person's meal notifies its creator and identifies your social profile, and liking a comment notifies the person who wrote it. You can mention another account in a comment only if you follow each other. A mention links to that account's profile, so people who can see the comment can tell that you follow each other, and the person you mention is notified only if they can see the meal. Your Saved meals collection is visible only to you, even though individual saves notify creators. Blocking and access restrictions also apply to these features.

Reports: when you report a profile, post, comment or repost, the people who run Triffin see the report, the reported content and the reported account; the person you report is not told who reported them. The first report of an item sends an email alert to our team; the alert contains no user content. A notice of illegal content sent to us by email (see our Terms of Use) is kept in our email, with the sender's name and email address, for as long as we need it to handle the notice and any dispute about it; the person it concerns is not told who sent it.

Newsletter and blog

The articles on our blog at triffin.app open once you subscribe to the Triffin newsletter with your email address. When you subscribe, our server stores that address, the time you subscribed and the article you subscribed from. We use the address only to send you the newsletter. Subscribing does not create a Triffin account and is not linked to one.

Subscribing also places a cookie named triffin_reader in your browser, which keeps the blog's articles open in that browser for one year. It holds the time you subscribed and a signature showing that our server issued it, not your email address. Our website sets no other cookies and uses no analytics or advertising cookies.

Your address stays on the list until you unsubscribe. To unsubscribe, email support@triffin.app and we delete the address. Deleting your account in the App does not remove it, because the list is kept apart from App accounts.

Who we share information with

We share information only as described in this policy:

Hosting and database providers (currently Render), which store and process the information described above on our behalf.
OpenRouter, Google (Gemini) and Anthropic (Claude), which receive the data described under AI processing and Daily tips, and the photos checked by the moderation model.
Perplexity, which receives the search text described under AI processing.
Google Maps Platform, which receives the restaurant search text, language, and your coordinates or region code, as described under Location and restaurant search.
WHOOP and Strava, if you link them: they know that your account is linked to the App and receive our requests for your data and for revocation.
RevenueCat, for subscription management.
Apple and Google, as sign-in providers and payment processors, and Apple as the sender of App Store notifications.
Expo, Apple and Google, for delivering the notifications described above.
Sentry, which receives the crash reports described above and keeps them in its European Union data region.
Hostinger, our email provider, which delivers the sign-in codes described above and so receives your email address and the code.
Authorities or other parties, where required by law or to protect the rights, safety and security of our users, the public or us.
A successor, if the App is transferred as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your information.

We share information with these service providers only so they can perform services for us, and they are required to protect it in a way that is consistent with this Privacy Policy.

The App does not contain advertising, third-party analytics or cross-app tracking tools. The usage events described above are counted on our own server and are not shared with anyone.

How long we keep information

Account information, your profile, meal logs (including saved photos), corrections, weekly pages, week reviews, recipes, logged activity, daily tips and your social content are kept until you delete them or delete your account (see below).
Health details are kept until you remove them in Settings → Health or delete your account. The body-fat percentage and range you accept are kept until you remove the value in Settings → Body or delete your account.
Weigh-ins are kept until you delete your account. Removing your body-fat value in Settings → Body removes the percentage from them.
A body photo used for an estimate is never stored: it exists only in memory for the length of that one request and is erased when it ends, whether the estimate succeeded or not.
Activity from Apple Health, WHOOP and Strava is kept until you unlink that service or delete your account.
Menu reads are deleted automatically 30 days after they are made.
The recipes you mark "Not for me" on the next-meal suggestion are deleted automatically 90 days after you marked them, or straight away if you tap Undo or Show them again. Next-meal suggestions written by earlier versions of the App, with any restaurant they named, are deleted automatically 8 days after they were written, and the meals marked "Not for me" in them, with the reason chosen, 90 days after they were marked. Whether you told an earlier version that you eat a kind of meal at home or out is kept with your account settings until you delete your account.
A rejected daily tip's encrypted text is deleted automatically after 30 days.
Your credit usage for a period is deleted automatically 35 days after the period ends. Your top-up balance is kept until your account is erased, and the record of each top-up purchase is kept after that, without your account ID (see below).
Individual meals and activity entries you delete in the App are removed from our database straight away.
Unsharing a meal hides its caption and interactions; they can return if the same meal is shared again. Deleting the meal removes its likes, comments, the likes on those comments and saved-meal references. Deleting a comment removes its text and its likes; a request identifier and timestamp are retained to prevent an old request from recreating it.
Session tokens are removed when you sign out or delete your account, and are otherwise removed automatically after they expire, 7 days after sign-in. When a new password replaces your old one, the sessions on your other devices are removed too.
A sign-in code we email you is stored as a one-way hash, together with a one-way hash of the password you chose with it, and both are deleted when the code is used or 15 minutes after it was sent.
Push tokens are removed when you sign out, when Expo reports that the device no longer accepts notifications, or when you delete your account.
The record of the notifications our server sent you is deleted automatically 90 days after each was sent, and erased with your account (see below).
Token revocation requests to Apple and WHOOP that fail are retried for up to 7 days, then dropped; any still waiting are deleted with your account.
Typed estimates and search results are cached for 30 days, so the same request is not sent to an AI model or search service twice. A cached estimate is stored under a one-way hash of what was typed and of the profile details used; a cached search is stored under its search text. Neither carries an account ID, email address or device identifier. We also keep daily totals that name no account, of AI and server usage and of how many times each onboarding page is first shown; they are deleted automatically after 400 days.
Usage events are deleted automatically 400 days after they are recorded, and those recorded with your account are erased with it (see below). Sentry deletes crash reports automatically after at most 90 days.
To keep the service running and secure, our server briefly holds a record of recent requests: the time, the part of the service requested, the account or device that made it, its IP address and the approximate city that address corresponds to, which is worked out on our own server without sending your address to anyone. These records are held in memory only and are never saved to our database; each is overwritten as newer requests arrive, usually within minutes, and all of them are erased whenever the server restarts. Only the people who operate Triffin can see them. Separately, to limit abuse, our database keeps short-lived counters of how many requests each account, device and network address has made, and, for sign-in by email, how many attempts were made for each email address. Each counter is stored under a keyed digest of what it counts rather than the address or account itself, and is deleted automatically shortly after the hour or day it covers ends. Our hosting provider may also keep its own short-lived logs of requests to our server.
App Store notifications that are not matched to an account (for example renewal notices, or a withdrawal of consent we could not match) are deleted automatically 180 days after they arrive. One matched to your account is kept until your account is erased. If your account is erased less than 8 days after Apple sent that notification, we keep only Apple's identifier for it until those 8 days have passed, so that a copy Apple sends again is not acted on a second time.
Logs made on a device before signing in stay linked to that device's identifier until they are moved into an account.

Deleting your account and data

You can delete your account in the App's Settings (Delete account). If you have a subscription, the App first reminds you that deleting the account does not cancel it. When you delete your account, we straight away: sign you out on all devices; revoke the App's access to your Apple ID if you use Sign in with Apple (retrying if Apple cannot be reached); unlink WHOOP and Strava and ask them to revoke our access; delete your activity, daily budgets and daily tips, what you marked "Not for me" and any next-meal suggestions we still hold from earlier versions of the App, your push tokens and the Apple Health data we hold; delete your social notifications; and mark your account, meal logs (including saved photos), weekly pages, week reviews, menu reads, recipes and social profile as deleted, withdraw the meals and recipes you shared, and hide your comments, likes and reposts, so none of it appears in the App or to anyone else.

For 30 days after deletion, you can restore your account and logs by signing in again and choosing to restore it. After 30 days, the account can no longer be restored.

After the 30 days, your account and everything held under it are permanently erased from our database: your profile including the health fields, your weigh-ins, meal logs and their photos, corrections, weekly pages, week reviews, menu reads, recipes, credits, social profile, posts, comments, reposts, likes, saves, follows, blocks, reports you filed and reports about you, strikes, bans and moderation decisions, your usage events, the record of the notifications we sent you, and any App Store notification matched to your account. Other people's comments that mentioned you keep their words but no longer link to your account. To have this done sooner, email support@triffin.app from the email address linked to your account, and we will erase it and confirm when this is done.

Three records are deliberately kept after that, and why:

Our record of each moderation decision the people who run Triffin made (for example removing a post or banning an account), and of each App Store consent withdrawal an operator applied to an account: the time, the operator who made it, the action, the account it concerned, the rule category or reason, the report or App Store notification it answered, and the note written about it. It is kept as the operator's own record of decisions taken to enforce the Community rules and to act on withdrawn consent.
Your handle, with the date it was released and no link to your account, so that nobody else can claim it for 30 days and pick up links or mentions that pointed at you. We do not currently delete this record after the 30 days.
The record of each top-up purchase: the store's identifier for the purchase, its date and when we credited it, with no link to your account, so that the same purchase can never be credited twice. We do not currently delete this record.

If Apple tells us that a parent or guardian has withdrawn consent for an account's use of the App, we disable the account as soon as we can match the notification to it (our team reviews any we cannot match automatically). A disabled account cannot be signed into or restored, and it is deleted in the same way.

Deleting your account does not cancel your subscription (manage it in Settings > Apple Account > Subscriptions on iPhone, or in Google Play > Payments & subscriptions > Subscriptions on Android), and it does not delete data held by Apple, Google, RevenueCat, WHOOP or Strava under their own policies, or data the App has written to Apple Health.

Your choices and rights

Allow or withdraw AI processing in Settings → AI processing, and turn daily tips on or off in Settings → Daily tips.
Withdraw health access: turn off health sync in Settings, unlink Apple Health in Settings → Connections, or revoke permissions in the Health app.
Link or unlink WHOOP and Strava in Settings → Connections.
Remove your health details in Settings → Health, and your body-fat value in Settings → Body, which also withdraws your consent for them. Decline the photo estimate at the screen shown before the camera, or skip the question entirely.
Turn meal reminders, summaries, social notifications and offers on or off in Settings → Notifications; hide a post from your feed, block an account, or unshare what you shared.
Withdraw camera, photo library, location or notification access in your device settings.
Delete individual meals and activity entries in the App, or delete your account from Settings.
Ask for a copy of your information, or ask us to correct or erase it, by emailing support@triffin.app.

Depending on where you live, you may have additional rights over your personal information, such as the right to object to or restrict certain processing, and the right to complain to your local data protection authority. We will not treat you differently for exercising your rights.

Security

Your logs are only returned to the signed-in account they belong to. Session tokens are kept in the operating system's secure storage on your device and only as a one-way hash on our server. A password is stored only as a salted one-way hash. The fields listed under Health-related data are encrypted in our database. No method of storing or transmitting data is completely secure, so we cannot guarantee absolute security.

Children

The App is only for people aged 18 and over. It asks for your birth year before any profile question and does not let anyone younger continue, and on iPhone it also checks Apple's Declared Age Range. When either shows that you are under 18, the App deletes your account, in the same way as Delete account in Settings. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us personal information, contact us at support@triffin.app and we will delete it.

Where information is processed

Our server and database are hosted by Render in the United States. Our other service providers, including OpenRouter, Google, Anthropic, Perplexity, RevenueCat, Expo, Hostinger, WHOOP and Strava, may process information in the United States and in other countries. Crash reports are kept by Sentry in the European Union (Germany).

Changes to this policy

We may update this Privacy Policy. When we do, we will change the effective date above, and for material changes we will let you know in the App or by other reasonable means before they take effect.

Contact

Triffin F.Z.E, B.C. 1309418, Ajman Free Zone, United Arab Emirates. Email: support@triffin.app.