Privacy Policy

Last updated: April 27, 2026

1. Who We Are

PlateFuel ("we," "us," or "our") is a nutrition tracking application operated by Polsia Inc. You can reach us at platefuel@polsia.app.

Our app is available at platefuel.org and on the Google Play Store.

2. Information We Collect

We collect only what's necessary to provide the service:

Account information:

• Email address and password (hashed — we never store plain-text passwords)
• Name (optional, only if you provide it in your profile)

Profile and health data you provide:

• Height, goal weight, and weight unit preference
• Daily calorie target and macro goals
• Dietary preferences (e.g., vegetarian, vegan)
• Cuisine preferences selected during onboarding
• Fitness goal type (lose weight, gain muscle, maintain, eat healthier)

Activity data you log:

• Food logs (meal type, foods eaten, serving sizes, timestamps)
• Weight entries and body measurements
• Fasting sessions (start/end times)
• Meal plans you generate
• Photos uploaded to Snap & Count (processed by AI, not permanently stored)

Technical data collected automatically:

• IP address (for security and fraud prevention)
• Browser/device type (for rendering the app correctly)
• Authentication tokens (stored as secure HttpOnly cookies)

We do not collect location data, contact lists, camera roll, or any device sensor data beyond photos you explicitly upload for Snap & Count analysis.

3. How We Use Your Information

Your data is used solely to provide and improve PlateFuel:

• Authenticate your account and maintain your session
• Display your daily dashboard, calorie tracking, and history
• Generate personalized meal plans based on your calorie targets and cuisine preferences
• Analyze photos you upload to estimate nutritional content (Snap & Count)
• Show your weekly reports, body composition trends, and fasting history
• Send transactional emails (account confirmation, subscription receipts) — we do not send marketing emails unless you opt in
• Improve the food database and app features based on aggregate, anonymized usage patterns

4. AI Processing (Snap & Count)

When you use the Snap & Count feature, photos you upload are sent to OpenAI's API for nutritional analysis. OpenAI processes these images per their privacy policy. We do not permanently store the images you upload — they are processed in memory and discarded after analysis is complete.

We recommend not uploading images that contain identifiable people or sensitive personal information beyond the food you're tracking.

5. Data Sharing

We do not sell your personal data. Ever.

We share data only in these limited circumstances:

• Service providers: We use Neon (database hosting), Render (application hosting), OpenAI (AI analysis), and Stripe (payment processing). Each processes only the data necessary for their specific function.
• Legal requirements: We may disclose data if required by law, court order, or to protect the rights and safety of users.
• Business transfers: If PlateFuel is acquired or merged, your data may transfer to the new entity under the same privacy terms. We will notify you before any such transfer.

6. Payments and Billing

Payment processing is handled by Stripe. We do not store your credit card number, CVV, or full payment details on our servers. Stripe handles all payment data per their privacy policy. We store only your subscription status and plan tier.

7. Data Retention

We retain your data for as long as your account is active. When you delete your account:

• Your food logs, weight entries, measurements, and fasting history are deleted within 30 days
• Your email may be retained for up to 90 days in backup logs for fraud prevention, then deleted
• Aggregated, anonymized data (not linked to your account) may be retained indefinitely for analytics

8. Your Rights

You have the right to:

• Access: Request a copy of all data we hold about you
• Correction: Update inaccurate data in your profile settings
• Deletion: Request account deletion at any time — email us at platefuel@polsia.app
• Portability: Request an export of your food logs and health data in JSON format
• Objection: Opt out of any non-essential data processing

For EU/EEA residents, these rights are provided under the GDPR. For California residents, they are provided under CCPA. To exercise any right, email us and we will respond within 30 days.

9. Children's Privacy

PlateFuel is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete it promptly. If you believe a child has provided us their data, contact us at platefuel@polsia.app.

10. Security

We protect your data with:

• All passwords hashed with scrypt (strong, industry-standard key derivation)
• Authentication tokens stored as secure, HttpOnly cookies (inaccessible to JavaScript)
• HTTPS enforced for all connections
• Database hosted on Neon with encryption at rest
• Parameterized SQL queries to prevent injection attacks

No method of transmission over the internet is 100% secure. We use commercially reasonable measures to protect your data and will notify you of any breach within 72 hours where required by law.

11. Cookies

We use one essential cookie: pf_token, which stores your authentication session. This cookie is:

• HttpOnly (cannot be read by JavaScript)
• Secure in production (only sent over HTTPS)
• SameSite=Lax (protects against CSRF attacks)
• Valid for 30 days

We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

12. International Data Transfers

PlateFuel is operated from the United States. If you access the app from outside the US, your data is transferred to and processed in the US. By using the app, you consent to this transfer. We ensure appropriate safeguards are in place for international transfers.

13. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page and, for significant changes, by email. Continued use of PlateFuel after changes constitutes acceptance of the updated policy.