Privacy Policy

Your privacy is important to us. This Privacy Policy explains how House of Duck, LLC, the parent company and owner of Snacked, collects, uses, stores, and shares information when you use https://snacked.co, the Snacked mobile app, and related services.

Snacked is a fitness and wellness app. It is not a medical app and does not provide diagnosis or treatment.

This policy is effective as of July 12, 2026.

Last updated: July 12, 2026

Information We Collect

We collect information you provide directly, information created while you use the app, information imported from connected services you authorize, and limited technical information needed to operate and improve Snacked.

Account information. This may include your name, email address, profile image, login provider, account identifiers, onboarding status, timezone, language, notification preferences, and push notification device token if you enable notifications.

Fitness and wellness information. Depending on what you enter, upload, import, or permit the app to access, Snacked may collect meals, food items, meal photos, workouts, workout plans, steps, sleep, weight, body-composition data, progress photos, check-ins, notes, mood entries, goals, profile details, uploaded files, and AI coach conversations.

Subscription information. If you subscribe, Snacked stores subscription status, entitlement, product, store, renewal, transaction, and related billing metadata. Snacked does not store your full payment card number.

Support and form information. If you contact us, join the waitlist, submit a website form, or send a support message, we collect the information you choose to provide, such as your name, email address, enquiry type, message, and any screenshots or attachments.

Technical and usage information. We collect app events, error reports, logs, session replay data when enabled, device and app metadata, request identifiers, and similar information used to operate, secure, debug, and improve the service.

Device Permissions And Connected Services

Snacked asks for device permissions only when a feature needs them. Depending on the feature you use, this may include:

  • Apple Health or Android Health Connect permissions to read fitness and body metrics such as steps, workouts, sleep, heart rate, weight, body composition, distance, and active energy, and to write Snacked-created workouts, progress entries, and body data back when you grant write permission.
  • Camera, photos, files, or storage access for meal photos, progress photos, uploaded files, profile media, or support screenshots.
  • Microphone access if you use voice or transcription features.
  • Notification permission if you want Snacked to send push notifications.

You can change these permissions in your device settings. If you revoke a permission, the related feature may stop working or may have less context.

How We Use Information

We use information to:

  • Create, authenticate, and secure your account.
  • Sync your Snacked data across devices.
  • Track meals, workouts, progress, habits, and goals.
  • Personalize coaching and app recommendations.
  • Generate AI coach responses and nutrition analysis.
  • Store photos, files, notes, and other content you choose to provide.
  • Process subscriptions and manage access to paid features.
  • Send transactional emails, invite emails, and push notifications.
  • Support sharing with trainers or friends when you enable it.
  • Detect abuse, debug problems, measure reliability, and understand product usage.
  • Respond to support requests.
  • Meet legal, accounting, tax, and audit obligations.

We do not sell user data to anyone. Our suppliers process data only to provide the service to Snacked and our users.

Where Data Is Stored

Snacked uses Cloudflare and PlanetScale for its core infrastructure. User data is primarily stored and processed in the United States on Cloudflare infrastructure.

  • Cloudflare provides our app and website compute, queues, workflows, storage, email sending, per-user data storage, authentication database, sessions, and media storage. This is where your Snacked account data, fitness and wellness data, photos, uploaded files, sessions, and related app data are stored and processed.
  • PlanetScale, accessed through Cloudflare, hosts Snacked’s shared food and exercise reference library database. This supports lookup and enrichment features. Your personal Snacked health record is stored separately from that shared reference library.

How We Protect Health Information

Your health and fitness data is part of your private Snacked account and is never sold to anyone. It is kept in isolated, per-user data storage, so each user’s health and fitness data is stored separately and privately instead of being pooled in a shared table with other users’ data.

In individual analytics, error-log, and AI telemetry events, health-related operational information is linked to a private internal ID, not your name, email address, phone number, or other direct contact information. Some account-level tools, such as analytics person profiles and support conversations, may include your email or contact details so we can support your account and process deletion. When you delete your account, your health data and the account records that connect that internal ID back to you are removed.

AI Coach And Nutrition Features

Snacked’s AI coach uses health and fitness context to generate coaching responses. That context may include your profile, goals, meals, workouts, steps, sleep, progress, notes, mood entries, uploaded files, prior coach messages, and other relevant app data.

Snacked uses OpenAI models and transcription services across its AI features. Relevant health context may be sent to OpenAI to generate coaching responses, analyze meals, interpret nutrition information, and power related AI features. Meal voice audio may be sent to OpenAI when you use voice transcription. Snacked accesses OpenAI through business or API offerings governed by its commercial or API terms.

You can review the OpenAI Privacy Policy and OpenAI API Business Terms.

OpenAI Zero Data Retention. Snacked uses OpenAI’s API under our organization’s Zero Data Retention (ZDR) configuration. In plain terms, the information needed for your request still has to be sent to OpenAI and processed to provide the result, but OpenAI does not use API content to train its models. Under ZDR, customer content from eligible API requests is excluded from abuse-monitoring logs. Snacked explicitly sends store: false on all current Responses API and Chat Completions API requests, so OpenAI does not keep those calls as persistent response history. Snacked’s audio transcription requests use an OpenAI endpoint that OpenAI lists as having no application-state retention under ZDR. Limited exceptions may apply under OpenAI’s data controls, such as legal or safety requirements. ZDR applies to OpenAI’s systems only: Snacked may still retain your conversation and related account data in Snacked’s own systems as described in this policy.

We do not send raw coach messages, meal text, images, or model outputs to analytics or logging systems for product analysis. AI telemetry is limited to operational metadata such as provider, model, token counts, latency, success or failure, request ID, session ID, and account identifier.

AI responses are for fitness and wellness support only. They are not medical advice, diagnosis, or treatment.

Data Minimization

We try to avoid collecting or keeping data that Snacked does not need.

  • Raw high-frequency health samples are summarized when possible. For example, step imports are stored as daily totals instead of retaining raw step-by-step streams.
  • Photos and uploaded files are stored as media files, while app records generally store references and metadata.
  • Individual analytics, error-log, and AI telemetry events use private internal IDs instead of direct contact information such as your name, email address, or phone number.
  • Mobile session replay masks text inputs and images.

Sharing With Trainers Or Friends

You can grant another Snacked user, such as a trainer or friend, access to selected categories of your data. You control which categories are shared and can update, pause, or revoke access.

Sharing categories may include profile, goals, meals, workouts, plans, steps, sleep, body composition, progress photos, check-ins, documents, notes, and mood. The person you share with can view the selected categories and, where you grant write access, add or edit permitted categories. Coach conversations are not shared through this feature.

When you revoke access, the other person loses access. Snacked also attempts to remove check-ins and files that person authored for your account.

User-Authorized Integrations

You may choose to connect Snacked to your own AI tool or other third-party client. When you authorize that connection, Snacked may share the health and fitness data needed for the integration with the client you choose.

Those tools are not Snacked suppliers. They process data under their own terms and privacy policies, and you should only connect tools you trust. You can revoke authorized access.

Disclosure To Suppliers And Third Parties

We share information with suppliers only as needed to provide, secure, support, and improve Snacked. User-authorized integrations are described separately above.

  • Cloudflare: App hosting, compute, queues, workflows, storage, email sending, per-user data storage, authentication database, sessions, media storage, and related infrastructure.
  • PlanetScale: Shared food and exercise reference library database, accessed through Cloudflare.
  • PostHog: Product analytics, session replay, error tracking, logs, operational telemetry, and support conversations. Individual analytics, log, and telemetry events use internal identifiers; PostHog person profiles may include account identifiers such as your email address. Support messages may include the content and contact details you choose to send.
  • OpenAI: AI model and transcription provider used to generate coaching responses, nutrition analysis, meal voice transcription, and related AI features from the health context or audio needed for those features. Our OpenAI API organization uses Zero Data Retention for eligible API requests.
  • RevenueCat: Subscription status, entitlements, and billing metadata.
  • Apple, Google, and Facebook/Meta: Social sign-in where you choose those providers. Apple and Google also process app-store billing flows when you subscribe through their stores, and Google Firebase Cloud Messaging processes push notification device tokens and notification payloads when you enable notifications.
  • Formspark: Contact form and waitlist submissions from the website.

Retention And Deletion

We keep account and app data while your account is active and as needed to provide Snacked. Some operational records are kept for limited periods for security, debugging, abuse prevention, support, accounting, tax, or audit reasons.

You can delete your account and your data at any time from within the Snacked app. The current deletion process removes your account records, authentication records, sessions, per-user health and wellness data, uploaded media, sharing links, pending sharing invites, and sharing access-audit rows that identify your account. It also requests deletion of your PostHog analytics person profile and associated events.

Billing records are anonymized rather than deleted so Snacked can preserve financial, audit, and webhook integrity without keeping the original account identifier.

Deletion is not instant across every supplier. Residual operational metadata, such as logs and AI telemetry, may remain until normal retention periods expire. These records are intended to contain only unresolvable identifiers after account deletion, not raw personal information or raw health content.

Session replays are different: when session replay is enabled, it can capture on-screen app content, including health content such as coach messages, notes, and meal or check-in details, as it appeared while the account was active. Residual session replays may remain until their normal retention period expires after account deletion.

Support tickets are different. If you contact support, the ticket may include the message, contact details, and screenshots or attachments you chose to send. Those support records may remain under Snacked’s normal support retention process.

Known retention references include session replays around 90 days and PostHog logs around 14 days.

For details, see the Delete Your Data page.

Your Choices And Rights

You can:

  • Delete your account in the app.
  • Revoke Apple Health or Android Health Connect permissions in your device settings.
  • Turn push notifications on or off in the app or operating-system settings.
  • Update or revoke trainer/friend sharing permissions in the app.
  • Contact Snacked about access, deletion, or privacy questions at https://snacked.co/contact.

Children

Snacked is not intended for children under 13, and we do not knowingly collect personal information from children under 13.

Security

We use commercial safeguards appropriate for a consumer fitness app, including authenticated API routes, per-user access controls, session controls, and provider-managed infrastructure. Data stored on Cloudflare infrastructure is encrypted at rest by Cloudflare. No system can guarantee absolute security.

International Processing

Snacked and its suppliers may process information outside your state, province, or country.

Changes To This Policy

We may update this Privacy Policy when the app, suppliers, or legal requirements change. We will update the effective date when we publish changes.

Contact Us

For privacy questions or requests, contact us at:

https://snacked.co/contact