Privacy Policy

Introduction

Amy Food Journal ("Amy", "we", "us", or "our") helps people track meals, calories, nutrition, water, weight, and related wellness goals. This Privacy Policy describes how we collect, use, disclose, and protect information when you use Amy's mobile app, website, API, OAuth login pages, MCP server, and related services (collectively, the "Service").

Amy is a wellness and nutrition journal. It is not a medical device, medical records system, emergency service, or substitute for professional medical advice. Please do not enter medical records, government identifiers, payment card numbers, account passwords, API secrets, or other information that is not needed for food and nutrition tracking.

AI Connector Privacy Summary

AI connectors are optional. If you connect Amy to ChatGPT, Claude, Claude Code, Codex, Gemini, Cursor, or another MCP-compatible client, Amy only exposes tools that use your authenticated Amy account and the permissions granted for that connection.

Amy's tools do not request your full AI conversation history. A connected AI client may separately process your prompts, tool calls, and Amy tool results under that client's own privacy policy and account settings.

Information We Collect

Account and Profile Information

When you create or use an Amy account, we may collect:

• Name, email address, username, avatar, and authentication identifiers
• Encrypted password credentials or third-party sign-in identifiers
• Subscription, beta access, billing status, and support status
• Profile details you choose to provide, such as age, height, weight, dietary preferences, goals, timezone, and health profile settings

Food, Nutrition, and Wellness Data

To provide the calorie and nutrition tracking experience, we collect information you enter or choose to sync, including:

• Food entries, meal logs, visible food descriptions, and optional detailed descriptions used for nutrition analysis
• Estimated calories, macros, micronutrients, water, and other nutrition details
• Meal photos, barcode scans, menu scans, and restaurant or location context when you choose to use those features
• Nutrition goals, water settings, saved meals, streaks, weight history, and related progress data
• Apple Health data only when you explicitly enable Apple Health sync

API, MCP, and Connector Data

If you connect Amy to an AI app or API client, we may process:

• OAuth connection metadata, token identifiers, scopes, and authorization decisions
• Amy API key names, display prefixes, scopes, hashed key values, last-used timestamps, and keyed IP hashes; we do not store the raw API key after it is shown once
• MCP tool requests and responses needed to read data or log, edit, merge, or delete specific food items at your direction
• Usage events, request IDs, rate-limit counters, and audit logs used for security, reliability, abuse prevention, and cost controls

Usage, Device, and Diagnostics Data

We automatically collect certain information when you use Amy, such as device type, operating system, app version, IP address, access times, feature usage, crash reports, performance data, and security logs.

How We Use Your Information

We use information to:

• Provide, maintain, and personalize Amy's food logging and nutrition tracking features
• Estimate nutrition, explain calculations, and update your journal when you ask Amy or a connected AI app to do so
• Sync your data across your devices and optional integrations
• Operate OAuth login, API keys, MCP tools, rate limits, abuse protections, and audit logs
• Send service messages, support replies, and optional notifications
• Improve safety, reliability, app performance, and product quality
• Detect, prevent, and investigate fraud, abuse, security issues, and policy violations
• Comply with legal obligations

We do not use personal nutrition journal data to sell ads. We do not sell your personal information.

AI-Powered Features

Amy uses AI and search services to help identify foods, estimate portions, analyze nutrition, interpret photos, and explain calculations. We send only the information reasonably needed for the feature you are using, such as food text, detailed descriptions, photos, restaurant context, or barcode/menu information.

AI outputs can be wrong. You should review nutrition estimates before relying on them, especially for allergies, medical conditions, or clinical nutrition needs.

Connected AI Apps and MCP Clients

You can choose to connect Amy to third-party AI apps or clients, including ChatGPT, Claude, Claude Code, Codex, Gemini, Cursor, and other MCP-compatible tools. These connections may allow the client to read Amy data or take actions such as logging, editing, merging, or deleting specific food items, depending on the permissions you grant and the tools Amy exposes.

Write tools are designed for specific food-journal actions. Amy does not expose account deletion, full-history deletion, broad food-log wipes, or payment actions through MCP. If a third-party AI client asks Amy to perform an unsupported broad wipe, Amy should refuse the tool action and route you to support.

When you use a third-party AI client, that client may process your prompts, Amy tool results, and related connector data under its own privacy policy and account settings. You can disconnect Amy from the third-party client, revoke Amy API keys in Amy Settings, or contact us for help with access and deletion requests.

Categories of Recipients

We may disclose information only as needed for the Service and in the categories below:

• At your direction: With connected AI apps, API clients, Apple Health, or other integrations you choose to enable
• Service providers: With vendors that help us run Amy, such as hosting, database, authentication, analytics, crash reporting, payments, support, AI processing, and search services
• Legal and safety: When required by law or necessary to protect rights, safety, security, and the integrity of the Service
• Business transfers: In connection with a merger, acquisition, financing, reorganization, or sale of assets

Service providers are authorized to process information only for the services they provide to Amy. Third-party AI clients you choose to connect are independent services, and their processing is governed by their own policies.

Data Security

We use technical and organizational safeguards to protect your information, including encryption in transit, access controls, secure cloud infrastructure, rate limits, audit logging, and abuse monitoring. Amy stores only hashed API keys after creation and shows the raw key once.

No internet service can guarantee perfect security. If you believe your account or API key has been compromised, revoke the key in Amy Settings and contact us.

Data Retention

We retain personal information for as long as needed to provide Amy, maintain your account, comply with legal obligations, resolve disputes, enforce agreements, and protect the Service. Our usual retention periods are:

• Account, profile, goals, food journal, nutrition, water, and weight data: retained while your account is active or until you delete the data or request account deletion, subject to backups and legal requirements
• Photos, scans, restaurant context, and analysis inputs: retained while needed to provide the feature, keep your journal usable, or support troubleshooting, unless you delete them earlier where the app allows
• API keys: raw keys are shown once and not stored; hashed key records, display prefixes, scopes, and last-used metadata are retained until the key is revoked or your account is deleted
• OAuth, MCP, usage, security, rate-limit, and audit logs: retained as needed for rate limiting, abuse prevention, debugging, auditability, safety, and cost controls, typically for up to 24 months unless a longer period is required for security, legal, or dispute-resolution reasons
• Support messages: retained as needed to respond to your request and maintain support history

When you delete your account, we will delete or anonymize personal information within 90 days unless retention is required by law or needed for legitimate security, fraud prevention, or dispute-resolution purposes. Backup copies are overwritten or isolated from active use according to our backup lifecycle.

Your Rights and Choices

You can:

• Access, update, or correct information in the Amy app
• Delete specific food entries or request account deletion
• Revoke Amy API keys from Amy Settings
• Disconnect Amy from third-party AI apps or OAuth clients
• Opt out of marketing communications
• Request a copy, correction, deletion, restriction, or export of your personal data where applicable law provides those rights

To exercise privacy rights, contact us at privacy@amyfoodjournal.com.

Children's Privacy

Amy is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, please contact us.

International Data Transfers

Your information may be processed in countries other than where you live. We take steps designed to protect your information in accordance with this policy and applicable law.

California Privacy Rights

California residents may have rights to know, access, correct, delete, and limit certain uses of personal information. We do not sell personal information as the term is commonly understood under California privacy law.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated policy on this page and update the "Last updated" date.

Contact Us

If you have questions about this Privacy Policy or our data practices, contact us: