Privacy Policy

Effective date: September 27, 2026

This Privacy Policy explains how the mobile application “Nourish” (hereinafter referred to as the “App,” “we,” “our,” or “us”) collects, uses, stores, and protects your information. By using the App, you consent to the practices described in this Privacy Policy.

1. Introduction and Scope

1.1. Purpose: This Privacy Policy describes how we handle information when you use the Nourish mobile application, which is designed to support eating disorder recovery through journaling, self-care tools, reminders, and related features.

1.2. Applicability: This policy applies to all users of the App, regardless of your location or the device you use to access the App. It also covers optional support payments on our website at nourish-app.com. It does not replace Apple’s, Google’s, Stripe’s, or a bank’s own privacy notice for payment data they collect.

1.3. Legal basis: Where the GDPR or similar laws apply, we rely on consent and contract (providing the App), legitimate interests (for example App availability checks, abuse prevention, and product improvement that does not override your rights), and legal obligation where applicable.

2. Information We Collect

2.1 Information you provide or create (stored primarily on your device)

The App stores most operational data locally on your device using Hive and related storage under your app documents directory. Depending on how you use the App, this can include:

Profile and onboarding data: display name, gender, year of birth (if you provide it), situation (for example recovery context you select), allergens you record, and eating-disorder–related categories you choose in onboarding.
Journal and recovery-related content: meals and feelings you log, notes, optional photos attached to entries, optional voice memos, sliders and scores you enter, and similar fields you choose to save.
Self-care and other in-app content: text and optional images you add in guided exercises.
App settings: for example language preferences (SharedPreferences).

Sensitive nature: much of this information is health-related or otherwise sensitive. It remains on your device unless you create an optional account and turn on cloud sync, explicitly submit certain items to us (see 2.2), or export/share data yourself.

2.2 Information processed on our servers (Appwrite)

We use Appwrite (backend-as-a-service) hosted at our API endpoints (api.litfinger.com and, when that host is unreachable, api.nourish-app.ru) for:

Availability check: on launch, the App may call a lightweight ping to confirm the backend is reachable. This may generate standard server logs (which can include IP address and timestamp) similar to any HTTPS request.
Optional account: if you register, we create an email/password Appwrite Auth user and keep a session on the device. Sign-out ends the session and leaves local data in place. Delete account (in the App under Account settings, or on nourish-app.com/…/delete-account) removes the Auth user and patient cloud data. In the App it then wipes clinical data on that device; the website deletes cloud data only.
Cloud sync (available to anyone with an account, for the scopes you turn on): we store ciphertext of the scopes you enable (core profile is required when sync is on; optionally extended profile, journal bundle including media, and other tracking such as medications, sleep, DBT cards, pleasant moments, and achievement facts). A clear user_preferences row may store non-health UX settings (locale, theme, feature toggles). Journal and clinical payloads are encrypted on your device (AES-256-GCM) before upload. We design the system so we cannot read that journal content. A recovery key is required if you forget your password; if you lose both password and recovery key, we cannot unlock the cloud backup. Cloud copies remain until you delete your account.
Feedback feature: when you choose to send in-app feedback, we create a row in our Appwrite database containing:
- your rating, free-text message, category, and trigger identifiers you selected;
- app version and build number;
- a device summary (for example OS version and device model string) to help us reproduce issues;
- a timestamp.

An account is optional. If you never sign in, the App continues to work locally and we do not create an Auth user for routine use.

Legal bases: Art. 6 (contract / consent) for the account itself; Art. 9(2)(a) explicit consent for health scopes you enable for sync. You can withdraw by turning off a scope, turning off sync, or deleting the account.

2.3 Information collected automatically (device / network)

Connectivity checks: the App periodically checks internet reachability (for example via DNS resolution of api.litfinger.com). This does not upload your journal contents; it only infers connected/disconnected state for the UI and feedback submission.
Local logging: development and production builds may emit logs on the device (for example debugPrint / logger output). We do not operate a third-party crash analytics or product-analytics SDK (such as Firebase Analytics or Amplitude) in the codebase this Policy is aligned with. If we add one, we will update this Policy and store disclosures before enabling it.

2.4 Information we do not intentionally collect in the current version

No third-party advertising ID or ad-personalisation SDK is integrated in the App version described here.
No precise GPS / continuous location: the App does not request location permissions for tracking; any references to “location” in code are for routing/navigation within the App UI, not geolocation of the user.
No social graph: the App does not offer user-to-user messaging or public profiles shared between strangers.

2.5 Purchases, subscriptions, and tips

Payments inside the App are processed by Apple (App Store) or Google (Google Play). We do not receive your card number, full payment credentials, or your Apple or Google account password.

On the device: after a successful Premium or Cats purchase, the App may store a local unlock flag (for example in SharedPreferences). That flag is not health data.
Signed in: when you buy or restore Nourish Premium or the Cats theme pack, the App sends the store product identifier, transaction identifier, and purchase verification data (an Apple signed transaction, or a Google Play purchase token) to our server. We ask Apple or Google whether the purchase is valid, then store an entitlement row on your account: product, entitlement type (premium or theme_cats), status, store, expiry if any, when we verified it, and the transaction id or purchase token so we can re-check later. We use this only to unlock those features and restore them to your account. Delete account removes these rows. Deleting the account does not cancel the store subscription or refund the purchase; the store keeps its own purchase history under Apple’s or Google’s terms.
Signed out: the store still processes the payment, and the unlock can remain on that device. We do not create a server entitlement row until you sign in and the App confirms the purchase.
In-app tips (“Support Nourish”) are optional consumable purchases through the same stores. They unlock nothing. We do not store tip receipts on our servers.
Website tips on our support page are also optional and unlock nothing. They are not Premium and are not linked to your journal. Card payments go through Stripe; we do not receive your full card number. Where offered, a Sberbank pay-by-phone link is handled by the bank, not by us, and is not tied to an App account.

We update entitlement status when the App next confirms the purchase with the store (for example when you open the App while signed in). Until that check succeeds, a cancellation in the store may not yet be reflected on our servers.

Legal bases: Art. 6(1)(b) (contract — providing a paid feature, or processing a tip you choose to make) and Art. 6(1)(f) (legitimate interests in confirming purchases and preventing fraud). Where we must keep accounting records of website tips we actually receive, Art. 6(1)(c) (legal obligation) may also apply.

3. How We Use Your Information

3.1 Primary App functionality

Core services: rendering your profile, journal, reminders, self-care flows, and statistics from on-device storage.
Notifications: scheduling local notifications you configure (Android may show POST_NOTIFICATIONS; audio recording uses the microphone only when you record a voice memo).
Optional media: saving photos you pick for journal or self-care entries (via the system picker; the implementation uses the photo library path by default in the shared image utility).

3.2 App improvement and development

Feedback you submit helps us understand bugs and feature requests.
We may derive aggregated, non-identifying statistics internally from support traffic or server logs.

3.3 Communication and support

User support: responding when you email us or submit feedback through the App.
Important updates: notifying you about material changes to this Policy or the EULA via the App or app-store release notes.

3.4 Legal and security

Compliance: meeting legal obligations.
Security: protecting against abuse and securing our backend infrastructure.

3.5 Purchases

Confirming Premium and Cats purchases with Apple or Google, unlocking those features, and restoring them to a signed-in account.
Recording a voluntary website tip where a payment provider sends us a payment record. We do not use purchase data for advertising or to read your journal.

4.1 We do not sell your data

We will not sell, rent, or trade your personal information to third parties for their independent marketing purposes.

We may share information only as follows:

Processors (service providers): Appwrite B.V. (or its successors) processes feedback payloads and metadata we send to our Appwrite project, under our configuration, for hosting and database APIs. Their terms and security documentation apply at the infrastructure layer.

App stores: Apple and Google process in-app payments under their own privacy policies. They are independent controllers of that payment data. When you are signed in, our servers send purchase verification data to the relevant store only to check that a Premium or Cats purchase is valid.

Website tip payments: Stripe processes card tips started from our website. Sberbank (or the bank that completes that pay-by-phone transfer) processes those payments. We do not receive your full card number.

Legal requirements: when required by law, court order, or lawful government request.

Safety: to protect the rights, safety, or property of users, the public, or ourselves.

Business transfers: in a merger or acquisition, with continuity protections for personal data where required by law.

4.3 Data processing expectations

We contractually or by standard platform terms require processors to handle personal data only for defined purposes.

4.4 Advertising

The current version of the App does not display third-party advertisements and does not integrate ad SDKs for behavioural targeting. If that changes, we will update this Policy and obtain any required consents before enabling advertising.

5. Data Security and Protection

5.1 Security measures

In transit: communication between the App and api.litfinger.com / api.nourish-app.ru uses HTTPS (TLS).
On device: data is stored in the application sandbox provided by iOS/Android. Local Hive files are not separately encrypted by the App; use a device passcode and OS disk encryption. Session keys for cloud sync live in the platform Keychain / Keystore.
On server: feedback records and encrypted patient sync rows/files are stored in our Appwrite project. We cannot read envelope-encrypted journal content.

5.2 Data breach response

If we become aware of a breach affecting personal data we hold on our systems, we will notify affected users and supervisory authorities as required by applicable law (including GDPR timelines where they apply). Purely local data on your phone is primarily protected by your device security; loss of the device or uninstalling the App without backups can permanently delete that data.

6. Data Retention and Deletion

6.1 Retention periods (high level)

On-device profile, journal, and media files: retained until you delete them in the App, use Delete account, clear storage, or uninstall the App.
Synced patient cloud data: retained while your account exists and the relevant sync purpose lasts. Delete account removes Auth and patient cloud rows/files.
Feedback submissions on Appwrite: retained as long as necessary to review, improve the product, and meet legal or evidentiary needs, then deleted or anonymised unless a longer period is required by law.
Support emails: retained only as long as needed to resolve your request and for ordinary business / tax record-keeping where applicable.
Purchase entitlements (Premium or Cats status on a signed-in account): kept while the account exists, then deleted with Delete account. Apple or Google may keep the underlying purchase under their own rules.
Local unlock flags: kept on the device until you clear the App’s storage, uninstall, or use Delete account in the App.

6.2 Data deletion and export

You can delete individual journal entries or profile fields inside the App where the UI allows it.
Delete account: after two confirmations in the App (Account settings) or on our website (Delete account), we call our deletion function to erase the Auth user and patient cloud data. In the App, we then wipe clinical Hive data and photos on that device. On the website, cloud and Auth are erased; journal data left on a phone stays until you use Delete account in the App, clear storage, or uninstall. We do not claim success if the server delete fails.
Clinician export (on device): under Support → Data export, you can create a ZIP archive of selected data (journal, breakdowns, profile, and related categories you choose), optionally including photos and audio, optionally protected with a password (AES-256-GCM). The App saves the file via your system “Save” dialog; you choose how to transfer it to a doctor or therapist (we do not upload export files to our servers).
Uninstalling the App typically removes local Hive data; export or copy anything important first. Cloud data remains until you delete the account.
For data we hold on servers (for example a feedback row tied to your message), contact privacy@litfinger.com to request deletion, subject to legal exceptions.

7. Your Privacy Rights

7.1 Access and control

Depending on your jurisdiction, you may have rights to access, rectify, erase, restrict, object, and data portability regarding personal data we process as a controller (for example feedback content and server logs).

Because most journal and profile data stays on your device, you can often fulfil access and deletion directly in the App or by uninstalling.

Where we rely on consent (for example optional notifications, microphone use, or health-data sync scopes), you may withdraw it through system settings, by turning off the scope / sync, by Delete account, or by discontinuing the feature.

7.3 Exercise your rights

Contact privacy@litfinger.com. We aim to respond within 30 days unless applicable law requires a shorter period.

8. International Data Transfers

8.1 Cross-border processing

Appwrite and our hosts may process data at api.litfinger.com and api.nourish-app.ru. Where GDPR applies, we use appropriate safeguards (such as Standard Contractual Clauses) as required and described in processor documentation.

8.2 Compliance with local laws

We aim to comply with applicable privacy laws, including the GDPR (EEA/UK) where relevant. Specific U.S. state consumer privacy laws may apply depending on our processing; we will update this section if our U.S. processing expands materially.

9. Children’s Privacy

9.1 Age restrictions

The App is not directed at children under 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent as required by applicable law (including COPPA where it applies).

9.2 Teens and parents

If you are 13–17, use the App with the involvement of a parent or guardian where your local law expects it. A cloud account (email/password) is optional and should be created only with guardian involvement where the law expects it. In-app purchases are charged to the Apple or Google account that approves them; a parent or guardian who controls that account is responsible for those charges. Parents may contact privacy@litfinger.com to request deletion of information their child submitted to our servers (account, synced ciphertext, or feedback), or use Delete account on the website. Local journal data is controlled by whoever holds the device passcode. Delete account in the App also wipes this device’s clinical data.

The current App build has no behavioural advertising and no user-to-user social feed. If you later add certified ad networks or social features, copy the detailed COPPA / teen-advertising subsections from your historical policy or from LitFinger’s legal counsel template, and update Google Play / App Store “Data safety” and age rating questionnaires accordingly.

10. Changes to This Privacy Policy

10.1 Policy updates

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or App features.

10.2 Notification of changes

Material changes: we will notify you through the App and/or app store release notes, and seek consent where required.
Effective date: changes take effect on the date stated at the top of the updated Policy.
Continued use: continued use after notice may constitute acceptance where permitted by law.

11. Contact Information

11.1 Privacy inquiries

For questions about this Privacy Policy or to exercise your privacy rights, contact us:

Email: privacy@litfinger.com
Address: Budilova 161/15, Plzeň, 301 00, Czech Republic
Phone: Not applicable
Data Protection Officer: Not applicable — for privacy inquiries, please contact privacy@litfinger.com

Controller: LitFinger Studio s.r.o., Czech Republic.

11.2 Response time

We will respond to privacy-related inquiries within 30 days, unless applicable law requires a shorter period.

11.3 Supervisory authority

If you believe we have not addressed your concerns adequately, you may contact your local data protection authority.

12. Additional Information

12.1 Third-party services

The App may open websites (for example legal documents at nourish-app.com) or system apps (mail, share sheet). Their privacy policies govern those services.

12.2 Cookies and similar technologies

Nourish is primarily a native mobile application. Our marketing website may use cookies or analytics as described on that site’s own policy.

12.3 Do Not Track

“Do Not Track” browser signals do not apply inside the native App in the same way as on websites. We do not run cross-app behavioural ad networks in the current build.

By using the Nourish App, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of information as described herein, to the extent consent is legally required.

Last updated: September 27, 2026