Privacy Policy

Last updated: October 11, 2026

Swoodie (“we”, “our”, “us”) operates the Swoodie mobile application and the website swoodie.app (the “Service”). This Privacy Policy explains what information we collect, how we use it, and your choices regarding your data.

Data Controller

The controller of your personal data is Daniel Gruchociak QA, registered at Pionierska 9, 63-800 Gostyń, Poland (NIP: 6961894332).

For any privacy-related questions, requests, or to exercise your rights described below, contact us at privacy@swoodie.app.

By using our Service, you agree to the collection and use of information as described in this policy.

1. Information We Collect

a) Information You Provide

• Waitlist sign-up: When you join our waitlist, we collect your email address.
• Subscription purchases: When you subscribe to Swoodie Premium, payment is processed by the Apple App Store or Google Play Store. We do not directly collect or store your payment card details.

b) Automatically Collected Data

When you use Swoodie, we automatically collect:

• Usage data: Swipe history, saved favorites, ratings, comments, features used (such as Swipe Together sessions and Chef AI queries), and navigation patterns.
• Device information: Device type, operating system version, unique device identifiers, and IP address.
• Anonymous authentication: We create an anonymous account for you automatically — no email or password is required. This account is used to sync your data across sessions.

c) AI Feature Data

When you use our AI-powered features (Chef AI, recipe variations, nutrition estimation, Swoodie Scan photo analysis, meal planning), the text and images you submit (such as ingredient lists, recipe prompts, dietary preferences, or meal photos) are sent to our AI service providers for processing. Meal photos submitted via Swoodie Scan are processed in real-time and are not permanently stored on our servers. AI-generated meal plans, recipes, and nutritional estimates are for informational purposes only. We do not use this data to train AI models.

d) Photo Data

When you use Swoodie Scan, photos you take or select are:

• Converted to base64 format and sent to our secure backend for AI analysis
• Processed in real-time by our AI service providers (see Section 3 for the current list)
• Not permanently stored — photos are discarded after analysis is complete
• Never shared with third parties beyond the AI processing provider

1b. Apple Health & Health Connect (optional)

Swoodie can optionally connect to Apple Health (iOS) and Health Connect (Android). This integration is off by default and requires your explicit permission.

• What we read: your body weight and active energy burned (calories).
• What we write: the meals you log (calories and macronutrients) and your water intake.
• Why: so you don’t have to re-enter your weight, your workout calories adjust your daily calorie budget, and your meals and water stay in sync with your other health apps.
• Storage: your weight read from Health stays on your device. Your active-energy figure is saved with your daily nutrition record on our servers as part of your calorie tracking.

We never use health data for advertising or marketing, and we never share it with third parties or advertising partners.

Your control: you can revoke access at any time in your Apple Health or Health Connect settings, and deleting your account removes the associated nutrition data.

1c. Creator & Partner Programme

This section applies if you apply to or take part in our creator & partner programme (the application form at swoodie.app/creator-program and our invitation-only creator pages). If you only use a creator’s code in the app, the rest of this policy applies to you.

• Applications: your name, email address, main platform (Instagram, Facebook, TikTok, YouTube, blog or other), a link to your profile or group, approximate reach, whether you run a registered business (yes, no or in progress) and, optionally, your country of residence (it affects how you can be paid) and a short note on why Swoodie fits your community; plus the submission date, which form you used (public or invitation) and your consent. We use them to assess your application and contact you about the programme, based on your consent (Art. 6(1)(a) GDPR) given with the checkbox on the form. You can withdraw it at any time by emailing privacy@swoodie.app, without affecting processing before the withdrawal.
• Invitations: if we invite you, we record the invitation code issued to you, your name as the invitation’s label, and when the invitation page was first opened and last viewed, to manage invitations (our legitimate interest in running the programme, Art. 6(1)(f) GDPR).
• Form security: to stop automated or repeated submissions, we keep a short-lived counter tied to your IP address that expires automatically after one hour at most (our legitimate interest in security, Art. 6(1)(f) GDPR).
• If you become a partner: your name, email address, partner status and join date; your referral code(s); invoicing details (company name, tax ID, address) where applicable; payout details for the method agreed with you — bank account IBAN (bank transfer), IBAN or Revtag (Revolut), routing and account number (US bank account) or PayPal email address; the payout currency agreed with you; and records of earnings and payouts (amounts accrued, owed and paid per settlement period). The payout currency and payout terms are agreed individually with each creator. We use this data to run the partnership: attributing subscriptions to your code, calculating your commission, monthly settlement, paying you and keeping the accounting and tax records the law requires. Legal bases: performance of our agreement with you and steps taken at your request before entering into it (Art. 6(1)(b) GDPR); legal obligations under tax and accounting law (Art. 6(1)(c) GDPR); and our legitimate interest in preventing abuse of referral codes and in establishing, exercising or defending legal claims (Art. 6(1)(f) GDPR).
• Statistics and earnings panel: the panel shows aggregated figures only (e.g., how many subscriptions were attributed to your code, earnings, payouts); very small counts are hidden, and we never share with you the identity of the people who used your code. It opens from a private link: anyone who has the link can view it, so do not share it, and ask us for a new link if it leaks. We do not run analytics on the panel page.
• Recipients: the bank or payment service that executes your payout, depending on the method agreed with you (e.g., your bank, Revolut or PayPal); the IT providers that host our website and backend and act as our processors (see Section 3); and tax and other public authorities where the law requires it. We do not sell this data or use it for advertising. If you are paid to an account outside the European Economic Area (e.g., a US bank account), your payout details are necessarily sent there, because the transfer is necessary to perform our agreement with you (Art. 49(1)(b) GDPR).
• Retention:
  • Applications — until we have reviewed them and finished our contact about them, and no longer than 12 months from submission unless you become a partner. If you withdraw consent, we delete your application.
  • Invitation records — while the invitation is active, and no longer than 12 months after it was issued unless you become a partner.
  • Partner data — for the duration of the partnership. After it ends, settlement, payout and tax records are kept for as long as tax and accounting law requires (in Poland, generally 5 years from the end of the calendar year in which the tax payment deadline passed), and other partnership data for up to 3 years where needed to establish, exercise or defend legal claims.

Your rights: the rights in Section 7 apply. To withdraw your consent or ask us to delete your application, email privacy@swoodie.app.

1d. Day together (Wellness Journey)

Day together is an optional part of a Wellness Journey, a pairing between two Swoodie users who chose each other. It is off by default, and nothing is shared until both of you turn it on.

• What is shared: if you turn on Calories & goal, your Journey partner sees your calories logged today against your daily calorie goal, and whether you have logged anything today. If you also turn on Macros, your partner sees today’s protein, carbohydrates and fat and your goals for them. Macros can be shared only together with calories. While you share calories, your partner may also see a short “lighter day today” signal. It means that you have eaten noticeably less than your goal so far today. It is never shown without your calories consent. Day together shows only today’s totals: no meals, photos, food names or history.
• Both ways, per category: your partner sees a category only while both of you share it, and you see theirs on the same terms.
• With whom: only the one person you are paired with in that Wellness Journey. Your consent applies to that one Journey. It is never shared with other users, circles or third parties, and never used for advertising.
• Age: the first time you turn it on, you confirm that you are 16 or older.
• How to stop: you can stop sharing any time in the app (Wellness Journey → What I share → Stop sharing). This doesn’t depend on your plan. Your partner stops seeing your numbers at their next refresh, usually within a minute. Sharing also ends automatically when the Journey ends or when either of you blocks the other.
• Notifications: no notification ever contains your food or calorie data. The only notification is an invitation from your partner to start sharing (“… wants to see your days side by side”). It is sent at most once a day per Journey, never within 7 days after you stopped sharing, and you can turn these invitations off.
• What we store: Day together creates no copy of your nutrition data. Your partner’s app reads today’s totals from your existing nutrition record through our server, which checks the Journey and both consents on every request. We store (i) which categories you share in which Journey, (ii) a record of each time you turned sharing on or off, with the version and language of the consent text you saw and your age confirmation, and (iii) your choice to mute invitations.
• Retention: your sharing settings are deleted when you stop sharing, when the Journey ends, or when you delete your data. The consent record is our proof of your consent, so we keep it after a Journey ends, for as long as your account exists. Settings → Delete My Data deletes it, together with your sharing settings and muted invitations. If your partner deletes their data, your own record notes that the sharing ended for that reason.
• Legal basis: calories and macros can reveal information about your health. We process them for Day together only on the basis of your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR). You can withdraw it at any time. Withdrawing doesn’t affect sharing that happened before.

2. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve the Service
• Personalize your recipe recommendations
• Facilitate Swipe Together partner sessions
• Show your Wellness Journey partner your day, when you both choose to share it (Day together)
• Process subscription purchases
• Translate recipe content into your preferred language
• Analyze usage patterns and fix bugs
• Detect fraud, abuse, and enforce our Terms of Service

2b. How We Process Your Data

We process your personal data only when we have a lawful basis under the GDPR. Below is what we collect, why, the legal basis, and how long we keep it.

Health data note. Meal logs, nutrition tracking, and dietary preferences may qualify as health data under Art. 9 GDPR. We process this data only with your explicit consent, given when you create a profile and select your goals. You can withdraw consent at any time by deleting your account.

You may withdraw consent at any time without affecting the lawfulness of processing performed prior to withdrawal.

3. Third-Party Services

We use third-party service providers to operate and improve the Service. These providers may process your data in the following capacities:

• Supabase (cloud infrastructure and database) — to store and manage your account data, favorites, ratings, meal plans, and usage data.
• OpenAI (AI service provider) — to power Chef AI recipe generation, recipe variations, nutrition estimation, and Swoodie Scan photo analysis. Text and images you submit to AI features are sent to OpenAI for processing.
• Google Gemini (AI service provider) — to power the AI Meal Planner feature. Dietary preferences and recipe data are sent to Google for processing.
• DeepL (translation service provider) — to translate recipe content into supported languages (currently German, Polish, French, Italian, Spanish, Portuguese, and Thai). Recipe text is sent to DeepL for translation.
• Spoonacular (recipe data provider) — to provide recipe data, nutritional information, and ingredient details.
• TheMealDB (recipe data provider) — to provide additional recipe content.
• Open Food Facts (open product database) — to identify packaged foods and show their nutrition information. When a barcode is not already in our database, our server sends only the barcode number to Open Food Facts — never your account or personal data. Product photos are loaded directly from Open Food Facts’ image servers, so Open Food Facts receives your device’s IP address and standard request information when a photo is displayed. See the Open Food Facts privacy policy.
• RevenueCat (subscription management) — to process and manage premium subscriptions, including purchase data, device identifiers, and subscription status.
• Vercel — hosts our website and provides anonymized performance analytics via Speed Insights.
• Upstash (database service for our website) — stores the creator & partner programme applications sent through our website’s forms and the short-lived counters tied to your IP address that protect those forms (see Section 1c). It also keeps aggregate click counts for our app-store buttons, which contain no personal data.
• Apple App Store / Google Play — for app distribution and payment processing, subject to their own privacy policies.
• YouTube (Google) — plays the short videos embedded on some of our pages. Nothing loads from YouTube until you choose to play a video; when you do, YouTube receives your IP address and may store data on your device. See Google’s Privacy Policy.

We do not sell your personal information to third parties.

3b. Advertising & Measurement

We use the following third-party SDKs in the mobile app for advertising, conversion measurement, and analytics. These providers may receive your device’s advertising identifier (Apple IDFA on iOS, Google Advertising ID on Android) and app events (such as installs, sessions, and in-app actions like saved recipes or completed scans):

• Meta Platforms, Inc. (Facebook SDK / App Events) — measures conversions for Meta-served advertising and supports analytics. See Meta’s Privacy Policy.
• TikTok Pte. Ltd. / ByteDance Ltd. (TikTok Business SDK) — measures conversions for TikTok-served advertising. See TikTok’s Privacy Policy.
• Google LLC (AdMob) — serves advertising in the Free tier of Swoodie. See Google’s Privacy Policy.

Advertising identifier. On iOS, we request your consent through the system App Tracking Transparency prompt before any advertising identifier is shared with the SDKs above. You can reset or disable the advertising identifier in your device settings at any time:

• iOS: Settings → Privacy & Security → Tracking
• Android: Settings → Privacy → Ads

No sale of personal information. Swoodie does not sell your personal information. Data shared with the SDKs above is limited to advertising-measurement events and device-level identifiers, and does not include directly identifying information such as your email address or name.

4. Cookies and Tracking Technologies

Our website (swoodie.app) uses the following technologies:

Essential

• Language preference storage (localStorage)
• Consent preference cookie (swoodie_consent)

Analytics

• Vercel Speed Insights — collects anonymized page performance data, device type, browser version, page load times. No personally identifiable information is collected. Data is processed by Vercel Inc. (USA). Privacy: https://vercel.com/legal/privacy-policy
• Umami Analytics — cookieless page analytics: pages visited, referrer, country, device type and browser. It sets no cookies, stores nothing on your device, collects no personally identifiable information and does not track you across sites. Data is processed in aggregate by Umami Software, Inc. Privacy: https://umami.is/privacy

Mobile App

• Local device storage — preferences, cached recipes, and offline data. This data never leaves your device unless synced to your account.
• Anonymous authentication — creates a unique anonymous identifier for data synchronization. No personal information is collected.

You can manage cookie preferences at any time via the cookie settings link in the website footer.

5. Data Retention

• Account data: Retained while your account is active.
• Application logs: Automatically deleted after 30 days.
• Cached recipe data: Automatically expires after 2 hours.
• Meal plans: Retained until deleted by the user.
• Swoodie Scan photos: Processed in real-time and not permanently stored.
• AI Cookbook recipes: Retained until deleted by the user (soft-delete supported).
• Apple Health / Health Connect data: Active energy burned is stored with your daily nutrition record until account deletion; body weight is read on-device and not stored on our servers.
• Day together: Sharing settings are deleted when you stop sharing or the Journey ends; the record of your consent is kept as proof until you delete your data.

You may request deletion of your data at any time by contacting us.

6. Data Security

We implement appropriate technical measures to protect your data, including:

• Encryption in transit (HTTPS/TLS)
• Row-level security on all database tables
• Server-side API key storage (no API keys stored on your device)
• Rate limiting on all backend services

No method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

6b. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach
• Notify affected users without undue delay if the breach poses a high risk to their rights and freedoms
• Document all breaches, including their effects and remedial actions taken

Notification will be sent via the email address associated with your waitlist registration (if provided) or through an in-app notice.

6c. International Data Transfers

Several of the providers listed above (Supabase, OpenAI, Google, Meta, TikTok, Vercel) are located in or transfer data to the United States. We transfer your personal data outside the European Economic Area on the basis of:

• Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914 of 4 June 2021), and
• where applicable, the EU–U.S. Data Privacy Framework for providers self-certified under it.

You can request a copy of the transfer safeguards in place by emailing privacy@swoodie.app.

Our service providers and their locations:

For EU/EEA users, transfers to the US are protected by Standard Contractual Clauses (SCCs) or adequacy decisions where applicable.

7. Your Rights

Under the GDPR you have the following rights regarding your personal data:

1. Right of access — request a copy of the personal data we hold about you.
2. Right to rectification — correct inaccurate or incomplete data.
3. Right to erasure (“right to be forgotten”) — delete your data; you can do this directly in the app via Settings → Delete My Data, or by emailing privacy@swoodie.app.
4. Right to restriction of processing — limit how we use your data in specific situations.
5. Right to data portability — receive your data in a machine-readable format.
6. Right to object — object to processing based on legitimate interests, including profiling.
7. Right to withdraw consent — withdraw any consent you have given at any time, without affecting the lawfulness of processing before withdrawal.
8. Right to lodge a complaint — lodge a complaint with the Polish supervisory authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

To exercise any of these rights, email privacy@swoodie.app. We will respond within 30 days as required by GDPR.

7b. Automated Decision-Making

Swoodie uses automated processing in the following ways:

• Recipe recommendations: Based on your swipe history, dietary filters, and allergen preferences. No profiling for marketing.
• AI meal planning: Generates meal plans based on your calorie target, goal mode, and favorite recipes.
• Nutrition estimation: AI estimates nutritional content from food photos and recipe data. These are estimates only and should not replace professional dietary advice.
• Allergen detection: Keyword-based ingredient scanning to flag potential allergens. May produce false positives — always verify ingredients yourself.

None of these automated processes produce legal effects or similarly significant effects on you. You may contact us to request human review of any automated decision.

8. Children’s Privacy

Swoodie is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such data, we will delete it promptly.

8b. Deleting Your Account

You can delete your Swoodie account at any time:

• In the app: Settings → Delete My Data
• By email: privacy@swoodie.app

When you delete your account, we permanently remove your meal logs, favorites, profile data, and any associated identifiers. Some data may be retained for limited periods where required by law (e.g., subscription invoices retained for 5 years under Polish accounting law) or in anonymized form for analytics.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the “Last updated” date at the top of this page.

10. Contact Us

For general questions: support@swoodie.app

For data protection inquiries, data access requests, or to exercise your GDPR/CCPA rights:

Data Protection Contact: privacy@swoodie.app
Response time: Within 30 days of receiving your request

If you are located in the EU/EEA and believe your data protection rights have not been adequately addressed, you have the right to lodge a complaint with your local Data Protection Authority (DPA).

For users in Poland: Urząd Ochrony Danych Osobowych (UODO)
Website: https://uodo.gov.pl

See also: Terms of Service | Cookie Policy