Privacy Policy

1. Who we are

SnapKai is operated by Corvidae Limited (New Zealand) ("we", "us", "our"). This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you use the SnapKai website and app (the "Service").

We are a New Zealand company and we comply with the New Zealand Privacy Act 2020 and its Information Privacy Principles. This policy applies to everyone who uses the Service, wherever in the world you are. The short version of our whole approach: a food log is personal, so we collect the minimum we need, we don't keep your meal photos, and you can export your data or delete your account from Settings in one tap.

2. What we collect

2.1 Information you provide

• Account details: Email address, display name, and a password (or a social sign-in via Google or Microsoft).
• Food log entries: The foods, portions, calories, and macros you confirm and save, along with the date and time of each entry.
• Meal photos and label images: Processed to identify foods or read a nutrition panel, then discarded (see section 4). They are not stored.
• Body measurements (optional): Weight entries and a goal weight if you choose to track them.
• Payment information: Payments are processed by Stripe. We receive limited billing details (such as which credit pack you bought and the last four digits of your card) but never your full card number. All purchases are one-off; we hold no recurring billing mandate.
• Communications: Messages you send via the contact form or support channels.

2.2 Information collected automatically

• Usage data: Features used and credit transactions (so we can show your balance and refund failed scans).
• Device information: IP address, browser type, operating system.
• Cookies and similar technologies: See section 9.

2.3 Health-adjacent data: handled minimally

What you eat and what you weigh can reveal things about your health. We treat your food log and weight entries as sensitive: we collect only what the features need, we never sell it, we never share it with advertisers, we don't build advertising profiles from it, and we don't use it to train AI models without your explicit opt-in. SnapKai is not a medical service and does not provide medical advice.

3. How we use your information

We use personal information to:

• Provide the Service: analyse your meal photos and label scans, maintain your food log, and calculate your reports, trends, and streaks
• Manage your credit balance, process one-off purchases, and refund credits for failed scans
• Send you service messages (receipts, security notices, support replies), not marketing, unless you opt in
• Respond to your inquiries and provide support
• Detect, prevent, and address technical issues, abuse, or fraud
• Comply with legal obligations

Where the law requires consent for particular processing (for example, non-essential cookies), we ask for it first, and you can withdraw it at any time.

4. AI processing and meal photos

SnapKai's photo and label features use AI vision models to identify foods, estimate portions, and read nutrition panels. Here is exactly what happens to an image you scan:

• Processed, then discarded: Your photo is sent securely to our AI provider, analysed, and the result is returned to your confirmation screen. The image is then discarded. We do not store your meal photos on our servers, and they never appear anywhere in your account.
• What we keep: Only the structured food data you confirm (e.g. "chicken salad, ~450 kcal") becomes part of your log, never the image.
• No training without opt-in: Your images and your food log are not used to train AI models, ours or anyone else's, unless you explicitly opt in. Our AI provider processes images per-request and does not retain them or use them for training.
• Estimates are estimates: AI output can be wrong. Results are labelled with confidence, and you review and can edit everything before it is saved.

5. The shared product database

When you scan a nutrition label and confirm the result, the product information (product name, barcode, and nutrition panel values) may be added to SnapKai's shared product database so that other users get a free barcode match for that product in future.

• This is product data, not personal data: it contains nothing about you, your log, or your account.
• Contributions are not linked publicly to any user.
• Your food log itself is never shared.

6. When we share information

We do not sell your personal information, and we do not share your food log or weight data with advertisers. We disclose personal information only in these situations:

• Service providers: Trusted third parties that run parts of the Service under confidentiality and security obligations:
  • Amazon Web Services (AWS): hosting and database
  • AI processing (Amazon Bedrock, running Anthropic Claude models): per-request image and label analysis; no retention, no training on your content
  • Amazon SES: account and notification emails
  • Stripe: one-off payment processing
  • Cloudflare Turnstile: bot and abuse protection
  • Google and Microsoft: optional social sign-in; analytics and ad measurement only where enabled and consented (see section 9)
  • OpenAI: ad measurement (the ChatGPT Ads pixel) only where you have agreed or where consent is not required (see section 9)
• Legal requirements: When required by law, court order, or governmental authority.
• Business transfers: In connection with a merger, acquisition, or sale of assets (you will be notified).
• Protection: To protect our rights, property, or safety, or that of our users.

Data location: Our servers and database are hosted on AWS in Auckland, New Zealand, and account emails are sent through AWS in Sydney, Australia. If you use the Service from outside New Zealand, your information is transferred to New Zealand. Some providers (for example, Stripe, Google, Microsoft, and our AI provider) operate globally, so some processing takes place outside New Zealand. When personal information is disclosed overseas, we take reasonable steps to ensure it receives protection comparable to the NZ Privacy Act 2020, as Information Privacy Principle 12 requires.

7. Security and retention

• Data is encrypted in transit and at rest
• Access controls and authentication protect our systems
• Meal photos are not retained at all (section 4)
• Your food log is kept while your account is active so your history and trends work

When you delete your account (one tap in Settings), your personal information is deleted. We may retain limited records where the law requires it (for example, tax records of purchases). No method of transmission over the Internet is 100% secure, but we work hard to protect your information.

8. Your rights: export and delete in one tap

Wherever you live, you can view and correct your food log, export key parts of your data, and delete your account yourself, using controls we build into the app:

• Export: Download your profile, weight history, favourites, and a summary of your recent diary in a structured, machine-readable file, one tap in Settings.
• Delete: Permanently delete your account and all your data, one tap in Settings, no email ping-pong, no retention dark patterns.
• Access & correction: Your log is fully visible and editable in the app at all times.
• Complaints: Contact us first at [email protected]. If you are not satisfied, you can complain to the New Zealand Office of the Privacy Commissioner (privacy.org.nz).

9. Cookies and similar technologies

We keep tracking to a minimum. Strictly necessary cookies and browser storage (the ones that keep you signed in or remember a preference) need no consent. Everything else falls into two optional categories, Analytics and Advertising, and you decide about each one separately.

• In the EEA, the UK or Switzerland, or if we can't tell where you are: both categories are off until you switch them on. A banner asks on your first visit, with "Accept all" and "Reject all" side by side, and nothing is requested from Google, Microsoft or OpenAI until you agree.
• Everywhere else: both start on (Advertising stays off if your browser sends a Global Privacy Control signal), and you can switch them off at any time.
• Changing your mind: use "Cookie settings" in the footer of this site, Settings → Privacy & cookies in the app, or the link on the sign-in page. Withdrawing takes effect immediately, and the cookies we set for that category are removed.
• Your choice is remembered in one cookie shared by snapkai.com and app.snapkai.com, so you are asked once for both. It is stored only in your browser, and we ask again after 6 months or when we add a new category or provider.

Strictly necessary (always on)

• snapkai.identity: keeps you signed in. A first-party, HttpOnly cookie that lasts up to 7 days.
• snapkai_consent: remembers your cookie choice above. Lasts 6 months.
• sk_country: the country our server works out from your IP address (the address itself is not kept in it). It tells us whether consent is required and lets us show prices in your currency. Lasts 24 hours.
• Storage on your device: your language, theme and currency, offline scan and favourites data, and short-lived items such as an invite code or where to return to after signing in. It stays on your device until you clear it.
• Cloudflare Turnstile: protects the sign-up, sign-in and contact forms from bots.
• Stripe: when you buy credits you go to Stripe's own checkout page, which sets its own cookies under Stripe's policies.

Analytics (optional)

• Google Analytics 4: counts visits and page views so we can see what is used. Sets _ga and _ga_<id> (up to 2 years), with IP anonymisation on.
• Microsoft Clarity: records how pages of the marketing site are used (clicks, scrolling and navigation) as session replays and heatmaps, and sets _clck (1 year) and _clsk (1 day). Microsoft processes this data under its own privacy statement.
• Where you found us: if another website, a search or a campaign link brought you to SnapKai, the cookie sk_src keeps the name of that site, the page of ours you landed on and any campaign tag for up to 30 days. If you then create an account we record it on the account, so we can tell which channels are worth our time; it is never combined with your food log or weight entries.

Advertising (optional)

• Google Ads: sets _gcl_au and _gcl_aw (about 90 days) so we can tell whether an ad click led to a sign-up.
• OpenAI (ChatGPT) Ads pixel: tells OpenAI that a sign-up followed an ad on ChatGPT, so we can measure that campaign. OpenAI sets its own identifiers under its own privacy policy.

• No ad tracking of your food data: Your food log and weight entries are never used for advertising, and we never send them to these providers.
• Fonts: we host our fonts ourselves, so opening SnapKai does not send a request to Google Fonts.

10. Children's privacy

The Service is not intended for individuals under 16 years of age, and food or weight tracking is not appropriate for young children. We do not knowingly collect personal information from children. If you believe we have, please contact us immediately.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date. We will never quietly downgrade your privacy: material changes to how we handle your food log or photos will be announced in the app.

12. Contact

Questions, concerns, or requests about this Privacy Policy or our data practices: