Last updated: 30 October 2026
This policy applies to FoodSussed, including the web tracker, Android app and iPhone app. Keith O'Beirne, trading as No Nonsense Fitness in Ireland, is the controller.
1. Account and tracker data
FoodSussed uses Supabase for sign-in, account security and sync. It processes your email address, account identifier and authentication information. On iPhone you can use Sign in with Apple. Apple may send your name and email, or a private relay address instead of your email. You can also sign in with Google, which can send your name and email. We store the name and email we receive with your account identifier. With your explicit health-data consent, it syncs diary entries, nutrition and calorie targets, weight, measurements, exercise records and preferences to a database in Ireland (eu-west-1). These records can reveal health information. If you tell Coach you are pregnant or breastfeeding, or you answer the other suitability questions (eating concerns, a medical diet, concerning symptoms, or heavy food restriction), those answers are saved in your preferences with your account. They are used to stop automated calorie targets. They are not sent to an advertising network. The app also keeps a local cache and pending-sync queue on your device.
FoodSussed Coach and Food processing reports use account data to provide the features you choose. Their calculations run on your device; they are not sent to an AI provider for those calculations. We rely on providing the requested account service and, for health-related storage, sync and analysis, your explicit consent. You can withdraw that consent in the app; withdrawal stops future health-data sync and removes synced tracker records as described in the app.
If you opt in, we may email you FoodSussed news and offers, including come-back discounts. That choice is stored on your account. You can unsubscribe in the app. This is our own email to you, not advertising by another company.
2. Photos and scans
Progress photos stay on your device and are not included in account sync. If you choose photo scanning, FoodSussed sends the ingredient-list, meal or nutrition-label image you selected through Cloudflare to Cloudflare Workers AI or Google Gemini, to read ingredients or estimate nutrition. A failed Gemini read can be sent on to Workers AI. We strip photo metadata before the image is sent, and the model request does not include your account id. The scan is still tied to your signed-in account. We keep an allowance record, and if the scan fails that record includes a failure stage. It does not include the photo. A record is eligible for cleanup after 32 days, when a later photo scan is reserved. Nothing deletes those rows on a schedule. This requires your explicit health-data consent. We do not use the image for advertising. Google may keep prompts, including images, for a limited period to detect abuse. Cloudflare describes Workers AI inference as not kept after the response, with exceptions in Cloudflare's terms. Those providers' retention terms apply.
If you choose to submit missing product details, that submission is optional. Product-detail submissions do not include photos; photo scanning is described above. We ask for consent before sending it. Product information may be reviewed and, if accepted, added to the shared food database. Do not include personal information in a submission.
3. Food data reports and submissions
When a valid barcode lookup cannot provide usable nutrition and the app appears online, FoodSussed attempts to send a missed-barcode report only if you are signed in, have accepted health-data storage and have turned on Share missing food data in Account settings under the current notice. The report contains the barcode, an Ireland or UK language or time-zone market hint when available, a fixed miss reason, app version and UTC day. The stored report has no account id and contains no diary, photo or device identifier. Our handler uses an in-memory IP-keyed rate limiter and does not write the IP to Supabase. Hosting logs can still include the request and an IP address. Raw miss records are kept for 90 days, then only weekly totals per barcode and market hint for up to 24 months. The app attempts at most one report per barcode per UTC day from this browser session using session-only storage. Turning off the choice stops future attempts. Stored misses cannot be identified for individual removal on account deletion.
Optional product details you add after a missed scan, or ingredient text you confirm, are sent under the same Share missing food data choice. They contain the barcode, product name, brand when you add one, confirmed nutrition or ingredients, a submission id, source type, market hint and app version. The saved product row has no account id. We check your sign-in before saving it, and keep a send count on your account for about a week. Logs of that signed-in request can tie the details you sent to your account. They include no diary or photo. Accepted product facts may be added to the shared food database. Food catalogue entries, including Open Food Facts product facts and licensed retailer data, are food information. Some barcode lookups from the app request that product from Open Food Facts, and food search text can appear in our hosting logs. We do not keep a separate search-history table. Open Food Facts says it keeps visitor IP addresses and request logs for 3 years for security, technical analysis and popularity measurement. That lookup does not create an Open Food Facts account.
4. Payments
Google Play handles purchases and subscriptions. To verify and restore access, FoodSussed processes the Google Play purchase token, the account it is linked to, product and plan identifiers, trial status, subscription state, expiry, renewal and acknowledgement details. We do not receive your full payment-card details. We use this information to provide the subscription and protect against misuse.
On iPhone, the App Store handles purchases and subscriptions. To verify and restore access, FoodSussed processes the Apple transaction identifier, the account it is linked to, product and plan identifiers, trial status, subscription state, expiry and renewal details. We do not receive your full payment-card details. We use this information to provide the subscription and protect against misuse.
5. Help form
The Help form is available without signing in. It collects your name, email address, topic and message so we can answer your request. It is stored in the FoodSussed Supabase project in Ireland (eu-west-1), in a server-only Help-request table. The app has no read access to that table. We use it only to answer and follow up on the request, relying on our legitimate interest in providing support. Help requests are deleted after 24 months. Please do not send passwords, full diary exports or unnecessary health information through the form.
6. Cookies, local storage and analytics
FoodSussed uses local storage and IndexedDB for sign-in state, local tracker data, settings and pending sync. Removing site data can remove local records, so export anything you need first. Sign-in and password reset load Cloudflare Turnstile in the app to block automated sign-ups. Turnstile processes signals such as IP address and a connection fingerprint for that security check. We do not use it for advertising. The tracker account page does not load Google Analytics or Microsoft Clarity. Other No Nonsense Fitness website pages have their own privacy and cookie information.
7. Retention, export and deletion
You can export your data or delete your account using the app controls. Local records remain on your device until you remove them or clear site data. Deleting an account removes its server tracker records and clears its local cache on that device; provider backups and security logs can have separate retention periods. Photo-scan allowance records are tied to your account and do not include the photo. A record is eligible for cleanup after 32 days, when a later photo scan is reserved. Open Food Facts says it keeps visitor logs for 3 years. We keep consent receipts as needed to demonstrate consent history. Help requests are kept for 24 months. If you need help with a request, use the Help form.
8. Your rights and contact
You can request access, correction, erasure, restriction, portability or objection where applicable, and you can withdraw consent without affecting processing already carried out lawfully. Use the Help form or email privacy@nononsensefitness.ie. We answer data-subject requests within one month. Where GDPR allows, we may extend this by up to two further months; if we do, we will tell you within the first month and explain why.
You can complain to Ireland's Data Protection Commission. FoodSussed is intended for adults aged 18 and over and is not directed at children.
9. Providers and international transfers
We use Supabase for account services, Cloudflare for delivery, scanner hosting and Turnstile, Cloudflare Workers AI and Google Gemini for optional photo scanning, Apple for Sign in with Apple and App Store billing, Google Play for Android billing, and Open Food Facts for barcode lookups. A provider or its subprocessors may process data outside Ireland or the EEA. Where required, we rely on applicable transfer safeguards. We do not sell your personal data.
10. Changes
We may update this policy when FoodSussed or legal requirements change. The revised date will appear above.