Cyster Plate privacy policy
Cyster Plate is a food and symptom journal for people with PCOS (also called PMOS). It is operated by its developer ("we", "us"). This policy explains what Cyster Plate collects, where it goes, and the choices you have. It applies to the Cyster Plate iPhone app and the website at cyster.cobena.dev.
The short version
- Your food logs, symptom check-ins, periods, water and weight stay on your iPhone. They are not synced to us.
- Our server keeps only a random anonymous account number, a record of your AI consent, counts of AI estimates used, your subscription status, an optional request for hardship access, and anonymous product-usage events with no health values (you can switch these off).
- If you use AI estimates, the photo or text you submit goes through our server to Google (the Gemini API) so a nutrition estimate can be made. Photo metadata is removed first. We do not store the photo or text.
- We do not sell your data. There are no ads and no tracking.
- You can export your data and delete your account and data inside the app.
- Cyster Plate is a journal and educational tool, not medical advice.
What we collect
Stays on your device only. Food entries (including items, amounts and nutrition values), photos you choose to keep, symptom check-ins and notes, periods and flow, water, weight (only if you turn it on), saved recipes, meal plans, grocery checks, lesson progress and your settings. This is stored in the app's private storage on your iPhone, protected by iOS Data Protection. We cannot see it. Your own iPhone or iCloud device backup may include it; that is between you and Apple.
Stored on our server.
- An anonymous account: a random account number created when you first open the app, a key identifier from Apple's App Attest check that confirms the request comes from a genuine copy of the app, the app version, and an approximate region. We do not ask for your name, email address or phone number to create an account.
- A session token, stored only as a one-way hash, so the app can talk to our server.
- Your AI consent record: which consent and privacy-policy version you accepted or withdrew, which provider it named, and when.
- AI usage counts: for each AI estimate, a request number, your local date and time zone, and whether it counted toward your daily limit. This is how we apply the free daily limit. It does not contain the photo, the text or the result.
- Subscription status: whether Plus is active, the product, when it expires, and whether it renews. This comes from Apple through RevenueCat.
- Hardship requests, if you send one: an optional email address and an optional note.
- Anonymous product-usage events, such as "log saved" or "paywall viewed", with a few non-health details like the source of a log (photo, barcode, search). They never contain nutrient values, symptom scores, period dates, notes, weights or free text. You can switch this off in Settings.
- Technical logs: error codes, timings, counts and costs. They do not contain photos, typed food text or estimate results.
Things your phone sends when you use the app. Like any online service, our server and the services below can see your IP address when your phone connects. We use it for security and to limit abuse. We do not link it to any health data, because we do not hold any. If you scan a barcode, the barcode goes to our server to look up the product in our food index. Barcode lookups and food searches are answered from a food index on our server, and we do not keep the search terms.
If you write to us. If you email support or privacy, we receive your email address and what you write, and we use it only to reply.
What we don't collect or do
- We do not collect your food logs, symptoms, periods, water or weight.
- We do not use ad networks, tracking, advertising identifiers or third-party analytics or crash-reporting tools.
- We do not sell your data or share it for advertising.
- We do not use health data for advertising, marketing or data mining.
- We do not collect your precise location, contacts or photo library. The app only sees photos you pick or take.
- We do not see your card number. Apple handles payment.
Apple Health
Apple Health is optional, and each type has its own switch in Settings. Cyster Plate can read your daily step count to show it next to your meals and check-ins. If you turn those options on, it can save the water you log, and the periods you log, to Apple Health. If you turn on "Import periods from Health", it can read menstrual flow you recorded there, and you confirm what is imported. Health data stays on your iPhone. It is never sent to our server, to Google or to analytics. If you say no, the app works fully without it.
AI estimates and Google
AI estimates are optional. Before the first one, the app asks you to allow it. You can say "Not now" and still use barcode, label, search and manual logging.
- What is sent. The photo of your food, or the text you typed (up to 400 characters). If you ask for "More ideas" on a meal you logged (a Plus feature), the app sends that meal's food names (up to 80 characters each, at most 30 items), their amounts in grams and their carbohydrate, protein, fiber and added-sugar values where known, and the plate type the app worked out. Before a photo leaves your phone, the app resizes it and removes metadata such as location. We do not send your name, email or account number to Google.
- Who receives it. It goes over an encrypted connection to our server, which passes it to Google's Gemini API to read the meal and return an estimate.
- Why. To estimate the items, amounts and nutrition in your meal, or, for "More ideas", to suggest food swaps for a meal you logged. The result is an estimate or a suggestion. You can edit every number before you save.
- What we keep. Our server does not store the photo, the text, the meal details or the result. The result is saved on your phone only if you save the entry.
- What Google does. We use Google's paid API terms. Google may log API inputs for a limited period to detect abuse and meet legal requirements, and says it does not use them to improve its products. We re-verify this before launch and whenever Google changes its terms.
- Your control. You can withdraw your permission at any time in Settings under Privacy. The app then stops sending photos and text. If the provider or this policy changes in a way that affects AI, the app asks again before sending anything.
Who processes it
- Google (Gemini API): reads photos and typed food text you submit for AI estimates, and the food names and nutrition numbers you send for "More ideas", as described above.
- Amazon Web Services: hosts our server and database in the US East region. It processes the account, consent, usage, subscription, hardship and event records listed above.
- RevenueCat: manages purchases and subscription status. It receives your anonymous account number and purchase information from Apple. It does not receive card data.
- Apple: runs the App Store, payments, App Attest, Apple Health and your device backups. Apple's own privacy terms apply to what it handles.
We do not use other third parties with your data. Our food index is built from public sources, USDA FoodData Central and Open Food Facts. When an AI estimate names a food our index cannot match, our server looks up that food name in USDA FoodData Central. It sends only the name, never your photo, note or account, and nothing is sent to Open Food Facts.
How long we keep things
- On your device: until you delete entries, delete your data in the app, or remove the app.
- On our server: your anonymous account and its records stay until you delete your account.
- When you delete your account in the app: we delete your server records right away, including consent, usage, subscription, hardship, email and event records, and we ask RevenueCat to delete your subscriber record. Encrypted database backups are removed on a rolling basis within 7 days.
- Photos, typed text and "More ideas" meals for AI: not stored by us. Google's retention is described above.
- Technical logs: our server and proxy logs are kept for up to 14 days and hold no photos, food text, estimate results or health values.
Your choices
- Allow or withdraw AI estimates: Settings, Privacy.
- Turn off anonymous product-usage events: Settings, Privacy.
- Apple Health: switch each type on or off in Settings, Apple Health, or in iPhone Settings.
- Export your data: Settings, Export data gives you one zip file with a JSON file and CSV spreadsheets of your logs, check-ins, periods, water and weight (if you turned it on), made on your phone.
- Delete your data: Settings, Delete my data erases the data on your phone and your account on our server.
- Reminders: change or turn off the daily check-in reminder in Settings.
- Subscriptions: manage or cancel in your Apple ID settings, and use Restore Purchases in the app on a new phone.
- Questions or requests: email privacy@cyster.cobena.dev. Because we hold only an anonymous account number, in-app deletion is the quickest way to remove your data. Residents of some US states have extra rights over personal information. We do not sell or share personal information for advertising, and we will respond to valid requests we can verify.
Children (13+)
Cyster Plate is for people aged 13 and over. It is not directed to children under 13 and we do not knowingly collect their information. If you believe a child under 13 has used the app, email privacy@cyster.cobena.dev and we will delete the account.
Security
Connections use encrypted HTTPS. The server database is encrypted and not reachable from the public internet. On your phone, your journal is protected by iOS Data Protection. No system is perfectly secure, so please keep your iPhone locked and updated.
Changes
We may update this policy. Each version has a number and an effective date at the top. If a change affects what is sent to Google or any other provider, the app asks for your permission again before sending anything. Older versions are available on request.
Contact
Privacy questions: privacy@cyster.cobena.dev. General support: support@cyster.cobena.dev. See also the terms of use.