Privacy Policy

1. Information we collect

The information we receive depends on how you use Wellportion. Reading the public website does not require an account or a health profile.

Information you provide

• Account details: your email address, account identifier and verification status. If you register with an email and password, our authentication provider, Supabase, processes your credentials to create and secure the account.
• Profile and preferences: the name, country, timezone, measurement units, dietary preferences and daily nutrition or water targets you enter or select.
• Food and health records: foods, portions, meal dates and categories, calculated nutrient totals, and any water, weight, sleep or step entries you choose to log. This also includes recipes, meal plans, grocery lists and saved snack details you create or import.
• Messages: your email address, message contents and any attachments you choose to send when requesting support or exercising your privacy rights. Please do not send passwords or unnecessary medical records.

Information from sign-in providers

If you choose Google sign-in, we receive the basic identity information described in section 4. We do not obtain a food diary or medical history from Google.

Technical information

When you visit or use the service, our hosting and security providers may process your IP address, browser and device information, requested pages or endpoints, timestamps, and error or security logs. These records help deliver the website and protect it against abuse. An IP address may indicate an approximate location. Country and timezone preferences are based on your selections and available browser settings; the app does not request GPS access or continuously track your location.

2. How we use information

We use information for the following purposes:

• Create, verify and secure accounts, manage sign-in sessions and recover account access.
• Save and display your diary across devices, calculate totals from your entries, and apply your chosen country, timezone, units and targets.
• Provide food searches, recipes, plans, imports and exports that you request.
• Send account verification, password recovery and other necessary service messages.
• Respond to questions, process privacy requests, investigate errors and prevent unauthorized use.
• Meet applicable legal obligations and address security incidents or legal claims.

The current service does not include advertising networks, marketing analytics, paid subscriptions or wearable-health integrations. We do not use your personal journal or Google account information to train AI models. We will explain material new uses before introducing them and request additional permission where required.

3. Health information and your choices

Food logs, weight entries and dietary notes can reveal information about your health. You decide whether to provide these details. We use them to provide the tracking features you select, including the totals and progress shown in your account.

You can leave optional fields blank, edit entries or stop recording information at any time. If you ask us to stop processing or delete information required for a feature, that feature may no longer work for you. Creating an account does not grant permission to use health information for unrelated advertising or research. Where separate consent is required for a use of health information, we will request it before that use.

4. Google sign-in

If you select “Continue with Google”, Google and Supabase process your Google account identifier, email address, email verification status and basic profile information, such as your name and profile picture where supplied. We use that information to authenticate you and link your Wellportion account to your journal.

The integration requests OpenID, email and basic profile permissions. It does not request Gmail messages, contacts, Drive files or Google health records. We do not receive your Google password. You can review or revoke the connection in your Google Account settings. Revocation stops the connection but does not by itself delete your Wellportion records.

Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements where applicable.

5. Label photos and food searches

Label recognition: if you select a nutrition-label photo, its text recognition and any HEIC conversion take place in your browser. Wellportion does not upload the selected photo or raw recognized text to its servers or save them in your account. Nutrient values, serving details and product information you confirm and save become part of your records. Selecting a file does not give us access to the rest of your photo library.

Packaged-food lookup: when you search for a packaged product, we send the search phrase or barcode through our server to Open Food Facts. That upstream request does not include your account identity or journal. Product results may be cached for up to 24 hours. Avoid entering personal or medical information in food searches.

Other directories: general-food, Indian-food and fast-food reference lists are supplied with the app. If you follow a link to a food source or another website, that website's own privacy practices apply.

6. How information is shared

We use service providers for account authentication, secure hosting and storage, email delivery, customer support and food lookups. These providers process the information needed for those functions, which may include account details, saved journal information, technical records or messages you send us.

We do not sell or rent your personal information, share it for cross-context behavioral advertising, or disclose your health records to advertisers. Your diary is not made available to other users, restaurants or food brands.

For the providers involved and the functions they perform, see our Service providers page.

We may also disclose information when required by applicable law or a valid legal request, or as necessary to address fraud, security threats or protect legal rights. If you ask us to send a copy of your information to someone else, we will first verify the request. Files you export and share yourself are under your control.

7. Cookies and browser storage

Authentication information is stored in your browser to keep you signed in and renew your session. Hosting providers may use security cookies to distinguish legitimate traffic from automated abuse. Browser caches may store app resources, including the label reader.

The app does not include advertising cookies or third-party marketing analytics. You can manage cookies and stored website data in your browser. Blocking essential storage may prevent sign-in or other features from working. Clearing browser storage, signing out or closing the website does not delete information already saved to your account. Any backup file you download remains on the device or storage service where you save it.

8. Retention and deletion

Your journal and sign-in identity remain while you keep your account. You can delete individual entries, delete the journal, or delete the whole account. We do not automatically delete an account solely because it is inactive.

• Journal deletion: “Delete my saved health data” removes your active profile, meals, recipes and health logs; your sign-in identity and privacy choices remain.
• Consent withdrawal: Settings → Privacy and account → “Withdraw health-data consent” stops journal use and deletes the active journal. Your identity and consent receipts remain unless you delete the whole account. You may export first.
• Full account deletion: “Delete my account” removes your sign-in identity, journal and consent records from the active database. Type the confirmation phrase to authorize this irreversible action. You may instead request help at privacy@wellportion.app.
• Support and privacy correspondence: our operating schedule is to review and delete routine closed correspondence after 12 months, unless a dispute or legal obligation requires longer retention. This is an operator procedure, not an automated mailbox deletion feature.
• Logs and backups: providers apply their own configured retention periods. Account deletion does not immediately erase all provider backup or security-log copies. We restrict use of retained copies and handle requests affecting them with the relevant provider.

Downloaded exports remain under your control. A preserved pre-migration recovery copy is kept separately from the live service and must be considered when handling an applicable deletion request; it is not automatically linked to a new account. Where the law requires deletion from additional copies or processors, we must carry out that request, subject to permitted exceptions.

9. Privacy rights and requests

You can edit your entries and profile and export your saved journal in Settings. You may also contact privacy@wellportion.app to ask what information we hold, request a copy, correct inaccurate details, request deletion, or raise a privacy concern.

Depending on where you live and the laws that apply, additional rights may include withdrawing consent, restricting or objecting to processing, obtaining a portable copy, appealing a decision on a request, or complaining to a privacy regulator. Rights and exceptions can differ between India and US states. This policy does not limit rights provided by applicable law.

Tell us the account email and the nature of your request. We may ask for information reasonably necessary to verify ownership or an authorized representative's authority. Do not send identity documents unless we explain why they are needed. We will respond within the time required by applicable law, explain any refusal or permitted extension, and tell you how to raise a concern about our response. We will not penalize you for exercising an applicable privacy right. Withdrawing consent does not undo processing that was lawful before withdrawal.

10. International processing

Wellportion uses cloud and email services that may process information outside your country. Your country selection changes food and measurement preferences; it does not choose a data-storage country. Account authentication and journal storage are configured in Supabase’s South Korea region. The Hostinger application server is in India; Hostinger identifies Singapore as its hosting backup location. Other providers may process data in additional countries. Laws governing access to information may differ from those where you live. Where a transfer is subject to additional legal requirements, we must meet those requirements; this policy is not a request to waive your rights.

11. Security

Connections to Wellportion use HTTPS, and account-data requests require a verified sign-in session. Saved journals are associated with account identifiers so that users access their own records. We rely on our providers for parts of authentication, infrastructure and security. No online service can guarantee that all loss or unauthorized access will be prevented.

Protect your password, devices and verification links. Report suspected unauthorized access to support@wellportion.app. If a personal-information incident requires notification, we will notify affected people and authorities as required by applicable law.

12. Children

Wellportion is intended for adults aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has supplied personal information, contact privacy@wellportion.app so we can investigate and take appropriate steps to remove it.

13. Changes and contact

We will update this policy if our practices change and show the new effective date on this page. For material changes, we will provide a notice through the app or another appropriate channel before the change takes effect and seek consent when required.

Privacy requests: privacy@wellportion.app
App support: support@wellportion.app