iPhone beta privacy notice

Your meal journal and Apple Health

CarbSignal saves your meal journal on your iPhone. You can log meals and enter nutrition manually without sharing data with Gemini. If you enable iCloud sync, CarbSignal uses your private iCloud storage to sync confirmed meals, including their nutrition and saved descriptions, My Foods, and saved targets. Meal photos, unfinished scans, weight, and glucose are outside this sync.

Apple Health access is optional and follows the permissions you grant in Apple Health. Gemini requests exclude weight and glucose samples read from Apple Health. If you type health information into a meal description, that text can be shared when you request an AI estimate.

What you share for an AI estimate

When you allow AI sharing and request an estimate, CarbSignal sends the meal photos you selected and any description you entered through its Google Cloud service to Google Gemini. To correct an estimate, CarbSignal sends the current estimate and your previous and updated descriptions, without resending the original photos. Gemini may use Google Search for a named product or retrieve a recipe link you include.

Google describes retaining prompts, context, and responses for 55 days for abuse monitoring. When Gemini uses Google Search to ground a response, Google also describes retaining the prompt, context, and response for 30 days to support that feature. See Google’s abuse monitoring policy and Gemini’s data retention guide.

Beta service records and retention

CarbSignal verifies an Apple-signed app transaction and stores a derived identifier to manage monthly AI credits. It uses Apple DeviceCheck and Firebase App Check to verify requests. Earlier iPhone beta builds created anonymous Firebase accounts. Those accounts and related service records may still exist.

Firestore stores credit balances, request records, and ledger entries so CarbSignal can count credits and recover interrupted requests. The ledger stores request metadata and excludes uploaded photos and raw descriptions. A saved estimate can contain details from your input. It is available for retry for up to 24 hours. A Firestore expiration policy schedules the estimate for automatic deletion after it expires. Physical deletion can happen later. The retry window applies to the estimate, while credit and request records are kept separately. See Firestore’s deletion timing.

Google Cloud records operational information such as request status and timing to help diagnose service failures. The beta project’s default Cloud Logging bucket keeps logs for 30 days. Its separate required audit log bucket keeps logs for 400 days.

Optional usage metrics

Share usage metrics is on by default for new installs. While enabled, CarbSignal sends event names for actions such as tapping Analyze, saving a meal, and turning AI sharing or iCloud sync on or off. The service keeps daily totals without an account identifier, meal content, or health readings. To stop sending future usage events, open Settings and turn off Share usage metrics under Privacy & data (called Data & sync in earlier beta builds).

Your choices and privacy requests

Choose Not now when asked to share with Gemini, or turn off Allow AI sharing in AI sharing under Settings → Privacy & data (under Settings → AI in earlier beta builds) to stop future AI submissions. You can delete saved meals in the app. With iCloud sync enabled, those deletions sync to your other devices.

For privacy questions or to request deletion of records held by the beta service, including records from earlier beta builds, email shenruyi1994@gmail.com.