Privacy

What stays on your phone

Your photos. A user-initiated scan is sent to a vision model under enforced zero-data-retention routing. The model provider uses it in memory to answer that request. Tab does not retain the scan photo unless you separately opt in to accuracy sampling. A journal copy you choose to keep stays in the app's private storage on your phone. Delete the entry and that local copy goes with it; deleting the app also removes local copies.

What we hold

• Your account. Email address and a Firebase user id. Passwords are handled by Google Firebase Authentication; we never see them.
• What you logged. Foods, portions, times and meals — the record the app exists to keep.
• Your profile. Sex, date of birth, height, activity, goal, weight and applicable maternity context are used to calculate calorie and macro targets. Specific diet presets, such as high-protein, keto, and low-carb, can also change macro targets. Diets and dietary preferences are applied as product filters where applicable. Allergens are a hard safety filter for food suggestions. Dislikes are stored in your profile but are not currently applied to suggestion ranking or filtering, and they do not affect safety. Other dietary preferences, dislikes and allergens do not calculate calorie or macro targets.
• Weigh-ins, so a trend can be drawn.
• Diagnostics. Which model read a scan, how long it took, whether it failed, and the food/portion result needed to review accuracy. Diagnostic model output is removed after 30 days.
• Optional accuracy samples. If you choose “Help improve food scans” in the app, Tab may privately save a random sample of up to 5% of your future meal scan photos, at most five per month. These samples help reviewers check food identification and portion estimates. Tab strips photo metadata, keeps samples in a private US bucket for at most 90 days, and limits access to authorized staff. They are not published, sold, used for advertising, or used to train a model. The choice applies only to future scans. Turn it off in Settings → Your data to delete retained samples; account deletion also deletes them. The scan taken before you choose is never included.
• Product analytics. Anonymous, privacy-filtered product analytics stay off until you enable them in Settings. Turning analytics off, signing out or deleting your account clears queued events and closes collection. After signing out or deleting your account, you must enable analytics again before collection resumes. Events from before you enable analytics are not sent later. Events are counts, durations and flags such as whether a scan completed. The app strips food names, weights, nutrition, photos, contact details and free text before an event can leave the phone.

Who else sees it

• Google Firebase Authentication — authentication only.
• Firebase Crashlytics — crash diagnostics in release builds. Tab limits attached fields to release, build, platform, route and operation, and does not set a Crashlytics user id, email, account id, recipe id or meal content.
• OpenRouter — routes a scan to a zero-data-retention vision endpoint. The request denies provider data collection and is not tied to your account.
• RevenueCat and the app stores — subscription state. They tell us whether you are paid; we never see your card.
• PostHog — anonymous, privacy-filtered product events while analytics is enabled. Analytics stays off until you enable it in Settings. You can turn it off at any time.
• Google Analytics — campaign and subscription conversion fields only, keyed by a one-way hash; never food, weight, nutrition, photos or email.
• Apple Health / Health Connect — only if you connect it and only what you allow. Steps, active energy and weight can be read; logged nutrition can be written back.

Nobody buys this data from us. There is no advertising SDK in Tab and no third-party analytics that follows you between apps.

Health data

Health data is stored in Tab's encrypted cloud database only to calculate and show your plan. It is never sent to the vision model, RevenueCat, product analytics, advertising measurement or crash reports.

Getting rid of it

Settings → Your data → Delete account removes your account and everything attached to it, including retained accuracy photos. Turn off Help improve food scans in Settings → Your data to delete those samples without deleting the account. From Settings → Export, you can download a CSV containing meal entries and weight history. Journal photos stay on your device; email hello@igotthetab.com for a copy of any retained accuracy sample while it is still within the 90-day retention period.

Children

Tab is for adults. We ask for a date of birth during setup and refuse to create an account under 18 — at the server, not only in the interface.

Where it lives

Data is held on servers in the United States. If you are in the UK or EU you have the right to access, correct, export or erase what we hold. The in-app delete removes your account data. The in-app CSV contains meal entries and weight history; email hello@igotthetab.com for access to other account data, as applicable.

Changes

If this notice changes in a way that affects what we collect or who sees it, the app will tell you before it takes effect.