Privacy Policy

1. Who we are and scope

Munchio is a general-wellness food diary operated by Engineers Space LLC (“Munchio,” “we,” “us”). This policy applies to the Munchio mobile app, munchio.app, and support communications.

Engineers Space LLC is the controller responsible for the personal information described here. Munchio is not a healthcare provider, health plan, or medical-record service, and the app is not intended for clinical care.

Additional disclosures about nutrition and related wellness data appear in the Consumer Health Data Privacy Notice.

2. Information we process

• Account and identity information — email address, Supabase account identifiers, authentication method, session and security events, and limited identity-provider information returned by Apple or Google.
• Profile and settings — display name, 18+ confirmation, timezone, unit preferences, app settings, and an optional saved daily energy-reference value. Optional body inputs used to calculate that reference are processed for the calculation and are not saved by Munchio.
• Food and wellness information — food descriptions, meal labels, times, portions, calories, protein, carbohydrates, fat, notes, corrections, custom foods, diary history, summaries, meal suggestions, declared allergens, foods to avoid, and related version history.
• Capture information — a photo, voice recording, or typed description you deliberately submit for an AI-assisted estimate, plus the structured estimate, assumptions, confidence class, corrections, provider/model version, safe outcome codes, and bounded usage and latency metadata.
• Purchase and entitlement information — RevenueCat customer identifier, product, entitlement status, renewal/expiry state, and minimized store-event metadata. To operate purchases, the RevenueCat software in the app also collects device information such as the iOS identifier for vendor, IP address, device model, operating system version, app version, and locale. Munchio does not enable RevenueCat’s collection of advertising identifiers. Apple or Google processes payment details; Munchio does not receive or store payment card numbers.
• Support information — your email address and the messages or attachments you knowingly send to support. Please do not send passwords, one-time codes, tokens, food photos, recordings, or detailed health information to support.
• Technical and operational information — app version, platform, IP address, user-agent and network metadata, country inferred from network routing, request IDs, timestamps, safe error codes, provider/model versions, latency, bounded cost/usage counts, and security or rate-limit events. Munchio does not request precise location permission, does not use advertising identifiers, and does not include third-party analytics, crash-reporting, or advertising software. Operational logs are designed not to contain raw media, transcripts, prompts, tokens, or unnecessary free text.
• Information stored on your device — the app keeps your session token in the device’s secure storage and a local copy of your diary, preferences, drafts, and pending capture results in app storage so that Munchio loads quickly and works during short network interruptions. Deleting your account in the app clears this local data. Uninstalling the app removes the local copy but does not delete your server account; use the in-app deletion or the Account Deletion page for that.

Website data

The initial munchio.app website uses no behavioral analytics, advertising pixels, session replay, or non-essential cookies. Cloudflare may process ordinary delivery and security information such as IP address, request headers, requested URL, and timing when it serves the site. The website does not sign users in or read diary data.

3. Capture and AI processing

When you choose Photo, Voice, or typed AI capture, the app sends the selected input through a Munchio server function to OpenAI to create an editable food and nutrition estimate. We do not include your email, display name, Supabase user ID, or unrelated diary history in the capture request.

Before a photo leaves your device, the app re-encodes it, removes embedded metadata such as camera details and location, and reduces its size. A voice transcript is not stored as a separate permanent record after finalization. The original typed description is not required after finalization unless you explicitly save it as a note. A validated but unfinished structured capture result may be kept for up to 24 hours so you can recover the review step after a network interruption.

Munchio does not perform facial recognition, speaker or voice identification, or any other biometric identification, and does not create voiceprints or faceprints. A recording is transcribed to text and a photo is analyzed only to identify food. Please keep people, documents, and unrelated personal items out of the frame and the recording.

Munchio does not use your photos, recordings, descriptions, diary, or corrections to train or fine-tune AI models. Munchio requests OpenAI processing with application storage disabled where supported. OpenAI states that API data is not used to train its models unless the API customer opts in, and Munchio has not opted in. Under default API controls, customer content may appear in OpenAI abuse-monitoring logs retained for up to 30 days unless different approved controls apply. See OpenAI API data controls.

4. How we use information

We use information to:

• authenticate you and keep your account secure;
• provide the diary, editable estimates, summaries, meal suggestions, export, deletion, and purchase restoration you request;
• preserve saved nutrition snapshots so historical entries do not silently change when a model or catalog changes;
• enforce account ownership, capture quotas, paid access, dietary exclusions, rate limits, and abuse prevention;
• troubleshoot failures, measure reliability and provider cost without retaining raw media or unnecessary user content;
• send transactional messages such as sign-in codes and important service, security, or legal notices; and
• comply with law and enforce the Terms of Service.

We do not sell personal information, do not share it for cross-context behavioral advertising, do not use it for marketing profiles, and do not make automated decisions about you that have legal or similarly significant effects. AI estimates are suggestions that you review and can change before anything is saved.

Legal bases

Where the law of your location requires a legal basis, including in the European Economic Area, the United Kingdom, and Switzerland, we rely on the following:

• Performance of our agreement with you — account creation and sign-in, the diary, requested estimates, summaries, suggestions, purchase restoration, export, and deletion.
• Your explicit consent — processing of food, allergen, dietary, energy-reference, and other health-related information. You give that consent when you deliberately submit such information for the feature you chose after reading these disclosures, and you can withdraw it at any time by removing the information, disabling the feature, or deleting your account. Withdrawal does not affect processing that already occurred.
• Legitimate interests — securing the service, preventing fraud and abuse, enforcing quotas and entitlements, measuring reliability and cost, and defending legal claims, balanced against your rights and using minimized data.
• Legal obligations — tax, accounting, responding to lawful requests, and honoring privacy rights.

5. Providers and disclosures

We use the following providers for specific, limited purposes:

• Supabase — authentication, Postgres database, Row Level Security, Edge Functions, and scheduled maintenance. Supabase processes the account, diary, preference, entitlement, capture-result, and operational records described above. See Supabase Privacy.
• OpenAI — transient photo, voice, and typed capture processing, plus bounded inputs for requested summaries and familiar meal suggestions. See OpenAI Privacy Policy.
• RevenueCat — purchase status, entitlement reconciliation, device information needed to operate purchases, and provider-side customer deletion. It does not need your food diary to perform those tasks. See RevenueCat Privacy.
• Apple and Google — identity services where selected, app distribution, purchases, refunds, and store subscription management under their own privacy policies.
• Resend — delivery of transactional authentication email through Supabase. See Resend Privacy.
• Cloudflare — delivery and security for the static munchio.app website. See Cloudflare Privacy Policy.

These providers act as processors or service providers under contracts that limit their use of your information to the stated purpose. We may also disclose information when reasonably necessary to comply with law or a valid legal request, protect users or the service, investigate fraud or security incidents, enforce our terms, or complete a merger, acquisition, financing, bankruptcy, or sale of assets, in which case the recipient must honor this policy or give you notice and a choice.

6. Retention

• Account, profile, preferences, diary, saved estimates, summaries, and plans are generally retained while your account is active so you can use and export your history. They are deleted when you delete your account.
• Raw food photos and voice recordings are not persisted in Munchio storage. Provider retention is described in section 3.
• Unfinished structured capture results expire after 24 hours.
• A content-free, pseudonymous deletion receipt is removed within 30 days after terminal completion or failure.
• Minimized operational, security, billing, tax, fraud-prevention, and dispute records may be retained as long as reasonably necessary for those purposes or as required by law. Apple, Google, RevenueCat, and payment processors may retain their own transaction records under their policies and legal obligations.
• Support email is retained as long as needed to resolve the request and for a reasonable period afterwards to handle follow-ups and disputes.

7. Your choices and rights

You can correct diary items and preferences in the app. Under Settings → Privacy & data, you can request an account export and permanently delete your account. If you cannot use the app, follow the Account Deletion page.

Depending on where you live, you may also have rights to access, correct, delete, restrict or object to processing, withdraw consent, receive a portable copy, or appeal a denied request. Contact [email protected]. We may need to verify that you control the account before acting on a request. We will not ask for your password, one-time code, access token, food diary, photo, or recording to verify a privacy request.

We respond within the time applicable law requires. Where the law allows, an authorized agent may submit a request on your behalf if we can verify the agent’s authority and your identity. If we deny a request, we will explain why, and you may reply with “Appeal” to have the decision reviewed.

You may complain to the privacy or data-protection authority where you live. We will not discriminate against you for exercising a privacy right.

8. Regional disclosures

European Economic Area, United Kingdom, and Switzerland

Section 4 lists the legal bases we rely on. You have the rights described in section 7, including the right to object to processing based on legitimate interests and the right to lodge a complaint with your local supervisory authority. Food, allergen, and related wellness information may be treated as special-category data; we process it only for the features you choose, on the basis of your explicit consent, and never for advertising or profiling.

United States

We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information, including health-related information, for purposes other than providing the features you request, securing the service, and complying with law. We do not offer financial incentives in exchange for personal information. The categories of information listed in section 2 correspond to identifiers, account and customer records, commercial information, internet and network activity, health-related sensitive information, and the summaries derived from your own entries. Residents of states with consumer privacy laws may exercise the rights in section 7 and may appeal a denied request. Additional disclosures for consumer health data appear in the Consumer Health Data Privacy Notice.

9. Security and international processing

Munchio uses access controls, encrypted transport, secret separation, Row Level Security, bounded requests, minimized logs, and ownership-scoped operations. No security measure can guarantee absolute protection.

Engineers Space LLC is based in the United States, and its providers may process information in the United States and other countries whose laws may differ from yours. Where required, transfers rely on standard contractual clauses, the United Kingdom International Data Transfer Addendum, or another lawful transfer mechanism, together with the provider safeguards described in section 5. Contact us if you want more information about a transfer relevant to your account.

If a legally reportable breach occurs, we will provide notice to affected users and regulators as required by applicable law.

10. Age and sensitive content

Munchio is intended only for adults aged 18 or older. We do not knowingly offer the service to children or collect information from anyone under 18. If you believe a person under 18 created an account, contact support so we can investigate and delete the account and its data.

Munchio is designed for ordinary food and general-wellness logging. Do not use capture or support channels to submit medical records, government identifiers, payment-card numbers, account credentials, or another person’s sensitive information.

11. Changes and contact

We may update this policy when the product, providers, or law changes. The date above will change, and for a material change we will provide additional notice by email or in the app, and request consent where required, before the change takes effect.

Privacy questions and requests: [email protected]

Engineers Space LLC
75 E 3rd St
Sheridan, WY 82801
United States