Privacy policy

1. Who the app is for

Chickpea is for adults aged 18 or older. It is not directed to children, and we don’t knowingly collect information from anyone under 18. If you believe someone under 18 has given us information, email us and we will delete it.

2. Information we collect

2.1 Account information

• Your email address. If you use Sign in with Apple and choose Hide My Email, we receive an Apple private relay address instead of your real one.
• An account identifier that we create.
• Sign-in data: the one-time code we email you, or the token Apple gives us when you use Sign in with Apple. We don’t use passwords.

2.2 Your preferences

• Your weight goal (lose, maintain or gain weight) and, if you add them, your birth year, height, weight and activity level, a goal weight and weekly pace, and the dated weight and height entries you save under Measurements, which we use only to estimate your daily targets and to show your own history and progress; your diet (for example vegetarian or vegan), foods you leave out (for example gluten or dairy), and your food allergies.
• If you choose to tell us, whether you are pregnant or breastfeeding, and when you last answered. The question is optional. We use the answer only to switch off the calorie target and the weight-loss goal and to adjust the fiber reference while it applies. It is never shared, never used for advertising, never sent to an AI provider, and never put in the reports you create.
• Reminders you create: the name you give them, the time and the days.

2.3 Food logs, photos and plans

• The foods and meals you log: the name, brand, amount, meal and date, and the nutrient values and food score we calculate for them.
• Meal photos you take or choose in order to log a meal, and photos of nutrition labels or barcodes you scan. When you pick an existing photo, the app reads only the picture you pick.
• Meals you describe in your own words for the app to log, kept with what the app read from them so we can check and improve how it reads descriptions, and amounts you type in your own words for a food.
• Recipes you create or save, foods you mark as favorites, your meal plans and the items you tick on your shopping list.
• The barcodes you scan or photograph: the barcode, when you scanned it, whether we found the product and how long the lookup took, so we can see which products are missing or slow in our data. Numbers you change on a product for yourself are kept as your own version of it.

2.4 Cycle and symptom entries

Period days and flow, the symptoms you choose (for example acne, cravings or tiredness), mood and energy ratings, and any notes you write.

2.5 Voice input

If you dictate a meal instead of typing it, the app asks for microphone access and uses Apple’s speech recognition to turn your words into text. Apple may process the audio on your device or on its servers, under Apple’s privacy policy. We receive only the text, and we don’t store the recording.

2.6 Messages to us

If you send feedback in the app or email us, we receive your message and, for in-app feedback, your app version and device model.

2.7 Purchase information

If you start a free trial or subscribe, Apple handles the payment. We and RevenueCat receive the status of your subscription (the product, price, dates, trial, renewal and cancellation), linked to your account identifier. We never receive your card or bank details.

2.8 Technical information

• Like any app that talks to a server, our servers see the IP address your phone connects from and keep it in short-lived server logs for security.
• Crash reports: when the app crashes or hits an error, it sends a report to Sentry describing the failure, with your device model, operating system and app version. Crash reports are about the failure, not about you: they don’t include your food logs, your cycle and symptom entries or your photos.
• Your device’s push notification token, if you allow notifications.

2.9 Chat

If you use the chat (Ask Chickpea), we store your conversations: your questions, the answers and a short title for each conversation, so you can come back to them. They are deleted when you delete your account.

We don’t collect your location, your contacts or your browsing history, and the app doesn’t use your device’s advertising identifier.

3. How we use information

• To run the app for you: sign you in, store and show your logs, calculate nutrient totals and food scores, build meal plans and shopping lists, schedule your reminders, and create the reports you ask for.
• To identify the foods in your photos and in meals you describe, read nutrition labels, answer your questions in the chat and write the short summary in your weekly report (section 4).
• To provide and manage your subscription.
• To answer your messages and to find and fix problems, including from crash reports.
• To keep the service secure and prevent abuse.
• To meet our legal obligations.

We don’t sell your information, we don’t use it for advertising, and we don’t build advertising profiles. We don’t use your health information to train AI models. We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects; food scores describe foods and are general information.

4. Who we share it with

We share information only with the service providers below, which process it on our behalf under contracts that limit them to providing their service to us, and where the law requires it.

About the AI features

The app asks for your permission before it first sends anything to Anthropic or Google, and tells you what goes and to whom. If you say no, or later turn the AI features off in the app (Profile, then Settings, then AI features), nothing more is sent to Anthropic or Google: the chat, photo and label reading, described meals and typed amounts, AI recipes and the weekly AI summary stop, and the rest of the app works as before. Your cycle and symptom entries are never sent.

When you log a meal with a photo, describe a meal or type an amount in your own words, photograph a nutrition label or a barcode, ask for a recipe, chat with Ask Chickpea, or open your weekly report, the information listed for Anthropic in the table above is sent to Anthropic’s Claude API to produce the result. Google’s Gemini API matches the foods it finds to our food data, and answers instead when Claude can’t. We use the paid API services of both, whose terms say that what we send is not used to train their models. Each may keep it for a limited period for safety and abuse monitoring and for legal reasons, under its own data usage and retention policies, which we don’t control and which may change. Foods, amounts and label readings come back to the app as estimates that you can check and correct before you save them. A recipe comes back as a draft you can edit; its nutrition and score are worked out from our own food data, not by the AI.

Other disclosures

We may disclose information if the law requires it, or to protect the rights, property or safety of our users, the public or us. If Invictus Logic LLC is involved in a merger, acquisition or sale of assets, your information may be transferred as part of it; we will tell you first, and this policy will continue to apply to it.

5. Advertising and tracking

The app contains no advertising SDKs and no analytics SDKs, never shows Apple’s tracking permission prompt, and never shares your information with advertising networks or data brokers. If that ever changes, we will update this policy first and ask for your consent where the law requires it.

6. How long we keep it

• Your account, preferences, logs, photos, cycle and symptom entries, reminders and plans: while your account exists, or until you delete them.
• When you delete your account: we delete your data from our live systems straight away. Copies in our database backups are overwritten within 30 days.
• Emails you send us: kept in our support mailbox for as long as we need them to handle your request and keep a record of it. Ask us and we will delete them.
• Purchase records: Apple keeps its own records under its policies. We may keep a record of transactions (product, price, date and country), without your name or email address, where accounting or tax law requires it.
• Server logs and crash reports: a limited period set by each provider, typically 30 to 90 days.
• Information held by the providers in section 4: under each provider’s own retention policy.

7. Your choices and rights

7.1 In the app

• See and edit your logs, entries and preferences at any time, and delete any single entry.
• Delete your account and all your data from the Profile tab (Settings, then Data & privacy), or from Account at the bottom of the subscription screen. This is permanent and immediate (see how to delete your account).
• Turn the AI features off, or on again, in the Profile tab (Settings, then AI features). While they are off, nothing is sent to Anthropic or Google.
• Turn notifications off, or withdraw camera, photo or microphone access, in your iPhone’s Settings.

7.2 By email

Email support@joinchickpea.com from the address on your account to ask for a copy of your data, a correction or deletion, or to withdraw a consent. If you signed in with Apple using Hide My Email, write from your relay address or tell us roughly when you signed up, so we can find your account. We answer within 30 days, and sooner where the law requires.

8. US state privacy rights

Depending on where you live (for example California, Colorado, Connecticut, Oregon, Texas, Virginia or another state with a consumer privacy law), you may have the right to know what personal information we hold about you and get a copy, to correct it, to delete it, and to opt out of its sale, of targeted advertising, and of profiling that has legal or similarly significant effects.

• We don’t sell personal information and don’t share it for cross-context behavioral advertising, so there is nothing to opt out of. We still honor Global Privacy Control signals as an opt-out request.
• We use sensitive personal information, such as health information, only to provide the app you asked for.
• We won’t treat you differently for using your rights.
• You can use an authorized agent where your state allows it. We may need to confirm your identity, usually by email to the address on your account.
• If we turn down a request, you can appeal by replying with “Appeal” in the subject line. We will answer within 45 days and explain our decision; if we deny the appeal, you can contact your state attorney general.

Notice at collection (California)

We collect these from you and from your device, use them for the purposes in section 3, keep them as section 6 describes, and don’t sell or share them for advertising.

9. Consumer health data

Your food logs, allergies, diet, cycle and symptom entries, and even the fact that you use an app for PCOS (PMOS), can be consumer health data under Washington’s My Health My Data Act and similar laws in other states. We collect it only to provide the features you use, share it only with the service providers in section 4, never sell it, and let you access and delete it at any time. Our consumer health data privacy policy sets out the details and how to use your rights.

10. Users in the United Kingdom, the EU/EEA and Switzerland

Invictus Logic LLC, 1444 Rhode Island Ave NW, Apt 212, Washington, DC 20005-5421, United States, is the controller of your information. Contact: support@joinchickpea.com.

We rely on these legal bases:

• Contract: to run the app you signed up for, including your account, logs, plans and subscription.
• Explicit consent: for health information you enter, such as food logs linked to your health, allergies and cycle and symptom entries. You can withdraw it at any time by deleting those entries or your account; that doesn’t affect processing that happened before.
• Legitimate interests: to keep the service secure, prevent abuse, and find and fix problems from crash reports. You can object to this.
• Legal obligation: where the law requires us to keep or disclose information.

You have the right to access, correct and erase your information, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent. You can also complain to a data protection authority, such as the Information Commissioner’s Office in the UK or the authority in your country, though we would welcome the chance to help first.

Our servers are in the United States. When information about people in the UK, the EU/EEA or Switzerland is transferred there, we rely on our providers’ data processing agreements, which include the EU Standard Contractual Clauses and the UK addendum where required. You can ask us for details.

11. Security

Data travels over encrypted connections (TLS) and is stored with Supabase in the United States, encrypted at rest. Database access rules (row-level security) let each account read only its own data, and our own access is limited to what we need to support you and run the service. No method of storage or transmission is completely secure. If a breach affects your information, we will notify you and the authorities as the law requires, including under the US Federal Trade Commission’s Health Breach Notification Rule.

12. This website

This website uses no cookies, no analytics, no advertising pixels and no third-party scripts, and its fonts are served from our own domain. Our hosting provider processes your IP address and the pages you request in order to deliver the site and keep it secure, in short-lived logs.

13. Changes to this policy

When we change this policy, we will post the new version here with a new date and, for material changes, tell you in the app before they take effect. If a change affects how we use health information, we will ask for your consent where the law requires it.

14. Contact us