Privacy Policy

Who is responsible

Sparebite (the website sparebite.com, the web app and the iPhone and Android apps) is run by RUSU D. DINU-ȘTEFAN PFA, trading as CodingShadows, CUI RO50977819, registered in Romania. We are the controller of the personal data described here. For anything about your data, write to contact@codingshadows.com.

Sparebite is for people aged 16 and over. If you are younger, please do not use it.

Using the apps without an account

In the iPhone and Android apps you can use the wallet without an account. Your profile (sex, birth year, height, weight, activity and goal), your food log, workouts and weigh-ins are then stored only on your phone, and none of it is sent to us. On Android, the system may include the app's data on your phone (your wallet, including workouts and weights read from Health Connect) in your Google backup, which you control in your Android settings; we never receive these backups. On iPhone, the app keeps this data out of iCloud and computer backups, so on a new iPhone the wallet starts empty unless you use an account.

Without an account the apps still contact a few services: food searches go to our servers (see Food search, labels and described meals), the app checks with our servers whether it needs an update when it opens, crash reports are sent (see Crash reports and server logs), and RevenueCat is asked whether Premium is active, under a random id that is not linked to you. Our servers also count, once per install, the first time the app opens and the first food you log, with the label of the link the install came from when Play passes one on (for example tiktok); the count carries no id and nothing you entered.

The web app needs an account. It keeps no wallet in the browser.

Your account and sync

Accounts are run by our own sign-in service at auth.codingshadows.com. It stores your email address, the name you choose (optional), your password as a secure hash or, if you use Sign in with Google or Sign in with Apple, the link to that account, and the address of your profile picture. It keeps a log of sign-in events for 180 days, for security.

When you are signed in, your wallet (profile, food log, workouts, weigh-ins, saved foods and meals, and your budget settings) is synced to our servers, so it is the same on your phone and on the web. Our servers run at Hetzner in Falkenstein, Germany. The database is backed up every night, and backups are kept for 90 days.

We process this to provide the service you signed up for. Body weight and workouts are health data, so we also rely on your explicit consent, which you give by entering them and syncing them with an account. You can withdraw it at any time by deleting the account.

Apple Health and Health Connect

If you connect Apple Health (iPhone) or Health Connect (Android), Sparebite only reads from it and never writes to it. On iPhone it reads workouts with the energy they burned and body weight, and, to prefill setup, date of birth, sex and height. On Android it reads exercise sessions and the calories burned during them, weight and height, and, if you allow it, it reads them in the background.

These values are used only to credit workouts to your budget, follow your weight trend and prefill setup, and, when you import your history from another app, to bring in the meals that app saved there, read only at that moment (see Importing from another app). They stay on your phone unless you are signed in; then the workouts and weights sync with the rest of your wallet. They are never used for advertising and never sent to analytics or crash reports. You can turn access off at any time in Health or Health Connect.

Food search, labels and described meals

Food searches go to our servers. When our own food index has too few matches, our servers look the food up at Open Food Facts; that request carries only the search words, not who you are. Our reference data also comes from USDA FoodData Central.

Nutrition labels are read on your phone. Only when the phone cannot read a label well enough, and you are signed in, the photo and the text read from it are sent to our servers for a second read. Describing a meal in words (Premium) works the same way: the text goes to our servers.

For both, our servers use our own AI gateway, which sends the request to Google's Gemini service or, if that is unavailable, to the same model through OpenRouter. Neither receives your name, email or account id. Our gateway keeps the request and the answer for up to 60 days, linked to your account id, to fix errors and keep costs and abuse in check, and then deletes them. We count how many reads you used, to apply the limits. The result becomes a food entry only if you save it.

Importing from another app

When you import history from another app, our server reads the file you choose to turn it into wallet entries and then discards it: the file is never stored, and nothing of it is sent to our AI gateway. The imported entries become part of your wallet like anything you log, together with a short record of the import (which app, which dates, how many entries) so you can remove it again.

In the phone apps you can also import the meals another app saved in Apple Health or Health Connect: they are read on your phone when you start the import and handled the same way.

Profile picture

You can add a profile picture while signed in. Your phone or browser crops it, and our servers re-encode it as a small square JPEG, which removes metadata such as the place where the photo was taken. It is stored in our object storage at Hetzner in Falkenstein, Germany, and shown from storage.codingshadows.com at an address that cannot be guessed from your name or email. Like any profile picture, it can be seen by anyone who has that address.

When you change the picture, earlier ones are kept until you remove the picture or delete the account. Then every picture stored for the account is deleted.

Purchases

Premium bought in the apps is paid through Apple or Google, and on the web through Stripe, which processes the payment as the reseller. We never see your card details. Stripe's payment form sets the cookies __stripe_mid and __stripe_sid to prevent fraud; they are strictly necessary for a payment you asked for.

RevenueCat (United States) manages subscriptions on every platform. It receives your account id and, while you are signed in, your email address and name, so a purchase follows your account and receipts reach you. Before you sign in, and on the web's Premium page when you are not signed in, it sees only a random id. If you allowed statistics, the apps also give RevenueCat their Google Analytics instance id.

Our servers keep a record of each subscription event (product, store, price, currency, country and dates). Purchase records are kept as long as accounting and tax law requires, also after the account is deleted.

Usage statistics, only if you agree

Statistics are off until you say yes. The apps ask once on the Today screen, and you can change your answer in Settings. The website asks with a cookie banner, and you can change your answer with Cookie settings at the bottom of the page or in the web app's Settings.

With a yes, Google Analytics for Firebase (Google) records which screens and features are used, such as logging a food or opening the Premium page, with words and yes or no values only: never a calorie, weight or other health value, and never what you typed. Your account id is attached, so the phone and the web count as one person, together with whether you have Premium. On Android it also notes which Google Play listing or campaign the app was installed from. There is no advertising id, no advertising and no Google signals, and the data is deleted after 14 months.

On the website a yes also sets the Google Analytics cookies _ga and _ga_XF3W99BK26, which hold a random id, and cw_headline, which remembers which of two homepage headlines you saw (the letter a or b). Saying no, or withdrawing later, deletes them and the data Google Analytics stored in the browser.

Separately, our servers count active users from requests made while signed in: we store a shortened one-way hash of the account id per day for 35 days and keep only the daily totals after that. This is our legitimate interest in knowing whether the service is used. It uses no cookies.

When you arrive from a link that says where it was shared (for example ?src=tiktok), the website remembers that label, and only that, in the cookie sb_src for 90 days and in the browser's storage. Our servers count, per day, how many browsers first arrived with each label and how many of them logged a first food, without any id. If you create an account, the label is stored with it so we can tell which channels bring people who stay; it is deleted with the account. This is our legitimate interest in knowing which channels work. No other site receives it.

You can try the web app without an account. The wallet you set up then stays only in this browser's storage (your answers, your budget and the foods you log) until you keep it with an account, which moves it into your account, or clear the site's data.

Crash reports and server logs

To find and fix crashes, the apps send crash reports to Sentry (stored in the EU, in Germany) and, in the store versions, to Firebase Crashlytics (Google). They contain the error, the app version and the device model, and for Sentry your account id when you are signed in; never your entries or health values. Our servers report their own errors to Sentry the same way. We rely on our legitimate interest in a working, secure service; no advertising id is involved.

Our servers log each request (IP address, the address requested, including search words, and the time) for security and troubleshooting. Logs are kept for 90 days.

Support chat

The support chat runs on Crisp (Crisp IM SAS, France) and loads only when you open it. Crisp then receives what you write and send, the app and its version, your device's system and model (in the apps), your language, whether you have Premium and, while you are signed in, your account id, email address and name, so we can answer about your account. Your food, workout and weight entries never go to Crisp. Crisp sets its own cookies (crisp-client) to keep the conversation; they are strictly necessary for a chat you asked for. Signing out or deleting your account ends the conversation on that device.

Reminders

The weekly check-in, the evening balance and the workout credit reminders are scheduled on your phone. They are off until you turn them on, and no server sends them.

In your browser

The website stores a few things in your browser that it needs to work: your light or dark theme, the language you chose (the cookie cw_locale), your preferences in the web app (including favourite foods, which stay until you delete the account or clear the site's data), your sign-in for the current tab, and your answer to the cookie banner. They are not shared with anyone. Analytics cookies are described under Usage statistics.

Exporting and deleting

You can export everything at any time, in Settings: the apps create a file on your phone, the web app downloads one, and the apps can email you a download link that works for 72 hours. That email is sent by our messaging service through Google's Gmail, and the service keeps a record of the message (address, subject and the start of the text).

Deleting your account, in Settings in the apps or on the web, removes your wallet from our servers, every profile picture of the account, your sign-in account and, if you used Sign in with Apple, Apple's authorisation for Sparebite. What is kept, and why, is listed on the Delete your account page.

Who receives data

Hetzner (Germany) hosts our servers, database, backups and pictures. Google receives AI requests (Gemini), statistics if you agree (Google Analytics for Firebase), crash reports (Crashlytics) and export emails (Gmail). OpenRouter (United States) receives AI requests only when Google is unavailable. RevenueCat (United States), Apple, Google and Stripe handle purchases. Sentry (stored in Germany) receives crash reports, Crisp (France) support conversations, and Open Food Facts only search words. Apple and Google also handle Sign in with Apple and Sign in with Google when you use them.

Some of these companies are based outside the EU, mainly in the United States. Where personal data leaves the EU, the transfer relies on the EU-US Data Privacy Framework for companies certified under it, or on the European Commission's standard contractual clauses. We do not sell personal data and do not share it with advertisers.

How long we keep data

Your wallet, profile picture and sign-in account: until you delete the account. Database backups: 90 days. Server logs: 90 days. Sign-in event logs: 180 days. AI requests in our gateway: up to 60 days. Active-user hashes: 35 days. Statistics in Google Analytics: 14 months. Purchase records: as long as accounting and tax law requires. Export links: 72 hours. Imported files: not kept; read once and discarded. Import records: until you remove the import or delete the account.

Your rights

You have the right to access your data, get a copy of it, correct it, delete it, restrict its use, object to processing based on our legitimate interest, and withdraw a consent at any time (this does not affect what happened before). Most of this you can do yourself in Settings; for the rest, write to contact@codingshadows.com and we answer within one month.

You can also complain to the Romanian data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, www.dataprotection.ro), or to the authority in the EU country where you live.

Changes to this policy

If we change this policy in a way that matters, we tell you in the app or by email before the change applies. The date at the top shows the current version. The Terms of Use cover the rest of how Sparebite works.