👋 Overview
CarpeCarb ("we", "our", or "the app") is a carbohydrate tracking tool for iOS. We are committed to protecting your privacy. This policy explains what information we collect, how we use it, and the choices available to you.
📋 Information We Collect
Information you provide
- Food names and carb amounts you enter into the app
- Daily carb goals and macro nutrition goals you set
- Foods you add to your Saved list
- Foods you logged recently, kept on your device for up to 30 days so you can log them again in one tap. They are not synced or sent to us.
Information collected automatically
- Anonymous Firebase Auth UID — a randomly generated identifier used solely to enforce per-user rate limits on our nutrition lookup API. It is not linked to your name, email, or any other personal identifier.
- Rate-limit counters — short-lived request counts stored in Firebase Firestore, keyed to your anonymous UID, to prevent API abuse. These expire automatically.
- Lookup count for the rating prompt — a count kept only on your device, used to decide when to show Apple's standard rating prompt. It is never sent to us.
Information we do NOT collect
- Name, email address, or any account credentials
- Device identifiers (IDFA, IDFV)
- Precise or approximate location
- Crash reports or analytics beyond what Apple provides to all developers
🔍 Nutrition Lookups
When you search for a food item, the text you type is sent to our Firebase Cloud Function, which forwards it to Perplexity AI to retrieve nutrition data. The request is associated only with your anonymous UID — no personal information is transmitted.
To find nutrition values, a short search phrase based on the food you type is also sent to USDA FoodData Central, a public nutrition database run by the U.S. Department of Agriculture. It is sent from our server, with nothing that identifies you.
We do not log or store your food search queries beyond what is necessary for rate limiting. Perplexity AI's use of data is governed by their own Privacy Policy.
🍎 Apple HealthKit
With your explicit permission, CarpeCarb can read from and write to Apple HealthKit to log nutrition data and display your carb history.
- HealthKit data is stored on your device and in your personal iCloud Health account — we never access it on our servers.
- We do not share HealthKit data with third parties, advertisers, or analytics services.
- HealthKit data is never used for advertising or marketing.
- You can revoke HealthKit permission at any time in Settings → Privacy & Security → Health → CarpeCarb.
☁️ iCloud Sync
If you enable Cloud Sync, today's food log, your saved foods, and your goals are stored in your personal iCloud account using Apple's iCloud Key-Value Store. This data is:
- Accessible only to you, through your Apple Account
- Used solely to sync your data across your own devices
- Never read, analyzed, or shared by us for any other purpose
This data lives in your iCloud account, not on our servers, so only you can delete it. To remove it, turn off iCloud for CarpeCarb in Settings > [your name] > iCloud, or delete the app on all your devices.
💳 In-App Purchases
Premium subscriptions are processed entirely by Apple via the App Store. We do not receive or store your payment information. To confirm your subscription, our server verifies the signed transaction the App Store provides and stores a subscription record linked to your anonymous ID: the plan, the App Store transaction ID, its expiry date, and whether it has been refunded. This lets premium follow your subscription — including renewals, cancellations, and refunds.
🔗 Third-Party Services
CarpeCarb uses the following third-party services. Each is governed by its own privacy policy:
- Firebase (Google) — anonymous authentication, and Firestore storage linked to your anonymous ID: your subscription record, your daily count of lookups (for the free-tier limit), and short-lived request counters used for rate limiting, which expire automatically. Firebase Privacy Policy
- Perplexity AI — nutrition data lookups. Perplexity Privacy Policy
- USDA FoodData Central — public nutrition database searched for nutrition values. USDA Privacy Policy
- Apple HealthKit — nutrition data (with permission). Apple Privacy Policy
- Apple App Store — in-app purchases and subscription management.
👶 Children's Privacy
CarpeCarb is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.
🌍 Data Retention & Deletion
Food logs, saved and recent foods, and goals are stored locally on your device and deleted when you delete the app.
Anonymous rate-limit records in Firestore are automatically expired and deleted after a short window.
If you use iCloud Sync, the synced copy stays in your iCloud account until you remove it, as described under iCloud Sync above; we can't access or delete it. To ask us to delete the data linked to your anonymous ID on our servers, contact us at the email below and include "Data Deletion Request" in the subject line.
🔄 Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the app after changes constitutes your acceptance of the revised policy.
✉️ Contact Us
If you have questions or concerns about this Privacy Policy or your data, please contact us:
CarpeCarb Support
carpecarb@icloud.com