Privacy Policy

Information we collect

Account information

We collect information such as your name, email address, verification status, securely hashed authentication credentials, account role, preferences, profile image and support communications.

Health, food and activity information

You choose whether to provide information including date of birth, biological sex, height, weight, body measurements, goals, progress photos, food and recipe data, meal plans, water intake, steps, cardio, strength routines, workout results and calorie information. Some features cannot work without the relevant data.

Subscription information

We receive subscription identifiers, plan, billing status, renewal date and cancellation status from our payment provider. The payment provider processes payment-card and billing details; Wazzumi does not store complete card numbers or card security codes.

Technical and usage information

Our systems and providers may process IP address, browser and device information, request times, pages requested, diagnostic logs and security events. We use essential cookies for authentication and security, plus local storage or cookies for preferences such as theme and browser timezone. The installable app uses a service worker to provide its offline screen. Workout recovery separately stores a draft of your set entries, notes, duration and calorie details in this browser, scoped to your account and workout. Drafts can remain on the device after sign-out. They are removed when you complete or discard the workout or clear the relevant browser storage. Drafts older than 30 days are not automatically restored. This does not provide full offline access or cross-device syncing.

Meal photos

When you request a meal photo estimate, your photo and optional meal details are sent to OpenAI. Wazzumi processes the photo temporarily and does not save it in the database or image storage. The browser preview is cleared when you leave the page. We save the nutrition and notes you accept, and request counts for usage limits. Unaccepted estimates expire after one day and are cleared on a subsequent request; they contain no photo. OpenAI’s separate retention controls are described below.

AI feature inputs

When you request an AI recipe or when an administrator runs a food-mapping tool, relevant targets, preferences or food text are sent to our AI service provider to produce the requested result. We use pseudonymous safety identifiers rather than sending your account ID directly, and request that generated responses are not stored as application state where supported. Do not include unnecessary personal or sensitive information in free-text AI prompts.

How we use information

• Provide accounts, diaries, calculations, plans, recipes, shopping lists, workouts and requested AI features.
• Authenticate users, prevent abuse and protect the Service.
• Process subscriptions, cancellations and customer support.
• Send transactional messages such as verification and password-reset emails.
• Diagnose faults, maintain performance and improve features.
• Comply with law, resolve disputes and enforce our Terms and Conditions.

We do not sell or rent personal or health information. We do not currently use health information for third-party advertising.

Legal bases where applicable

Depending on your location, we process information to perform our contract with you, with your consent, to comply with law, and for legitimate interests such as securing and improving the Service where those interests are not overridden by your rights. In Australia, health information is sensitive information under the Privacy Act 1988 (Cth); you provide it voluntarily for the features you choose to use.

Service providers and disclosures

We use specialist service providers to operate Wazzumi. These providers may supply application hosting and delivery, database hosting, payment and subscription processing, transactional email delivery, security and artificial-intelligence processing. We disclose only the information reasonably required for them to perform those services, and they may process it only in accordance with their agreements, applicable law and their own privacy obligations.

Our AI service provider states that API data is not used to train its models unless the customer opts in. Under its default controls, prompts, responses and related metadata may appear in abuse-monitoring logs retained for up to 30 days, or longer where legally required. Provider practices can change, so their own privacy notices also apply.

We may also disclose information when required by law; to protect users, the public or our rights; to investigate fraud or security incidents; or as part of a merger, restructure or sale, subject to appropriate notice and protections.

Barcode scanning

Barcode camera frames are processed on your device and are not uploaded or saved by Wazzumi. When a product is not already available locally, our server sends its barcode to Open Food Facts to request product information. We do not send your account details or diary to Open Food Facts. We save foods you choose to keep and account-linked lookup counts and outcomes for usage limits and administration. We cache public product information separately and make that imported information available with its source attribution and licence; this public extract excludes your personal food edits, diary and account details.

Nutrition-panel photos and AI product search

When you choose to read a nutrition panel, the compressed photo and product details you supply are sent to OpenAI. Wazzumi processes the photo temporarily and does not save it in its database or image storage. AI product search sends the product name, variant and optional barcode to OpenAI and its web-search tools to find supporting product information.

Unaccepted reviews are held in the browser with an account-bound review token that expires after one day. When you save, we retain your private food, reviewed values, original extracted nutrition, source links where available, review date and AI-assistance notes. We also record usage counts and provider usage metadata for limits and costs. Provider retention is described above.

International processing

Our primary application and database infrastructure is configured in Sydney, but providers may process technical, payment, email or AI data in other countries and global delivery networks. Privacy protections and government-access laws can differ outside your jurisdiction. We take reasonable steps appropriate to the information and provider to protect cross-border disclosures.

Retention and deletion

We retain account and health information while your account is active and as needed to provide the Service. You can edit many records in the app and permanently request account deletion through Settings. Deletion removes account-linked application records from the active database, but some information may remain temporarily in backups, security logs or provider systems. Transaction and subscription records may be retained where required for tax, accounting, fraud prevention, dispute handling or other legal obligations.

AI provider retention is described above. We retain diagnostic information only as long as reasonably needed for security, troubleshooting and legal compliance.

Security

We use measures such as encrypted network connections, restricted credentials, authenticated private routes and provider security controls. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security. Use a unique password and notify us if you believe your account has been compromised.

Your choices and rights

You can update profile information and preferences, disable optional diary trackers, change or delete many records, cancel a subscription and delete your account through the Service. Settings also provides JSON and CSV exports of saved account data and separate downloads of saved photos. Exports exclude sign-in credentials and browser-only drafts. Depending on applicable law, you may also request access, correction, deletion, restriction, objection or portability, or withdraw consent where processing relies on it. We may need to verify your identity before acting.

Australian users may make a privacy complaint or request access or correction under the Privacy Act and Australian Privacy Principles. Contact us first so we can investigate and respond. If unresolved, you may be entitled to contact the Office of the Australian Information Commissioner.

Children

Wazzumi is intended for adults and is not directed to anyone under 18. If we learn that we have collected information from a person under 18 without appropriate authority, we may close the account and delete the information. A parent or guardian who believes this has occurred should contact us.

External links

The Service may link to websites we do not operate. Their privacy practices are controlled by their operators, and you should review their policies before providing information.

Changes to this Policy

We may update this Policy as Wazzumi, our providers or applicable laws change. We will publish the new effective date and provide additional notice of material changes where appropriate.

Optional website analytics

Where analytics is enabled, we use Google Analytics to measure visits to our public homepage, pricing, FAQ, installation, terms and privacy pages, and clicks to open registration. Google may process analytics cookie identifiers, browser and device information, approximate location and referral information. Our events use fixed public-page addresses and titles, without URL query strings or fragments. We do not send your name, email address, account ID, diary entries or health information, and do not track account or private app pages. Advertising features are disabled.

For visitors detected in Australia, analytics starts automatically with a small notice and an option to turn it off. Elsewhere, or when the country is unknown, Google Analytics loads only after you choose Allow analytics. We use the country supplied by our hosting provider from your IP address, not your browser language, for this decision. A browser Global Privacy Control signal keeps analytics off. You can decline or change your choice using Analytics preferences in the public website footer. Your explicit choice is saved in this browser. Dismissing the Australian notice does not record consent. Declining stops future analytics collection; it does not delete information already collected. Google also processes information under its Privacy Policy.

Contact

Privacy questions, access or correction requests, and complaints can be sent to support@wazzumi.com.