Privacy Policy

This Privacy Policy explains what data Ansyrs collects for the features described below, how that data is used and stored, and the choices you have.

What we collect

Complimentary access and subscriptions. Ansyrs sends Apple-signed app and subscription transactions to our backend to verify access. We keep an app-specific, keyed hash of Apple’s app transaction identifier, a hashed random installation credential, complimentary start and expiration timestamps, and subscription product, transaction, renewal, expiration, and revocation information. No Ansyrs account or email is needed for complimentary access. Apple processes purchases; Ansyrs does not receive your card or banking details. These records are used for access, restoration, and abuse prevention, never for advertising or behavioral profiling.

Apple DeviceCheck. When supported, the app sends an Apple-issued token to our backend so it can ask Apple whether this device has already received complimentary access and mark the offer as used. We do not store that token or use it as a tracking identifier. A separate Keychain credential and minimal app-specific eligibility record prevent reinstalling or changing local preferences from restarting the offer. Local elapsed-time and device restart checks support limited offline access; those clock values stay on your device.

Account identifiers. If you use Sign in with Apple, we receive a stable, app-specific Apple user identifier and the email address in Apple's identity token. The email may be an Apple private-relay address. The current app requests email access only; it does not ask Apple for your name or send a profile name to Ansyrs.

Legacy Lifetime Premium records. The current app does not accept new Lifetime Premium reservations or claim links. If you participated in the former reservation program, Ansyrs may retain the limited records described below to preserve an already-granted entitlement, resolve a still-pending record, prevent duplicates or abuse, and honor deletion requests. We do not use a retained address for advertising, marketing, tracking, resale, profiling, or unrelated communication.

Sign in with Apple authorization. The app sends Apple's short-lived, one-use authorization code and a nonce with sign-in. The backend verifies the identity, exchanges the code directly with Apple, discards the returned access token, and stores the Apple refresh credentials in encrypted form. Repeated authorizations can produce more than one distinct credential; Ansyrs keeps them solely to revoke every outstanding grant if you delete your account.

Account-linked settings and saved data. Depending on the features and sync controls you enable, this can include app preferences, followed brands, saved items, reusable saved meals, logged meals and journal entries, and recent meal builds. These records describe your food selections and saved app content. The current app does not collect dietary or allergy profile settings or restriction severity, and does not ask for diagnoses, biometrics, medications, or clinical records.

Recently viewed activity. The app keeps a limited, device-only list of opened items, brands, and restaurants to show recents and help you resume activity. This history is not uploaded or used to learn your preferences or rank search and Nearby results. Followed brands, pins, and saved items are choices you explicitly make.

Anonymous catalog reports and requests. An item-information report includes the brand and item, the fields you select, current and suggested values, the app version, and an optional note. The report record does not contain an Ansyrs account identifier, name, email, or device identifier. A note can still contain personal information if you choose to type it, so please do not include personal information in the note. A missing-brand request stores the brand name you submit.

Empty-brand update requests. If you ask Ansyrs to prioritize a visible brand that has no items, the current app sends the brand and a random identifier created for this installation. The identifier is not derived from your hardware, Apple ID, advertising identifier, or Ansyrs account. The backend replaces it with a keyed hash before storage and uses it only to de-duplicate anonymous demand for that brand. It is not used for tracking or advertising.

Security and request metadata. When you sign in, the service stores a hash of the refresh token, a keyed hash derived from the request IP address, and the request user agent with the session. Submission and other abuse-sensitive routes use short-lived, keyed-hash rate-limit records derived from request IP addresses. Hosting providers also process normal network request metadata to deliver and secure the service.

Deletion continuity records. To make an interrupted deletion safe to resume, the service can retain a pending deletion proof and, after completion, limited receipt metadata. These records use keyed hashes and a random receipt identifier; they do not store your Apple user identifier, email, or raw authentication tokens.

What we do not collect

• We do not request your name through Sign in with Apple.
• Your precise location is not sent to the Ansyrs backend. If you choose Nearby, the app passes a location and search request to Apple through MapKit so Apple can return nearby places. A coarsely rounded location may be cached in the app's sandbox on your device. See Apple's privacy information for how Apple processes MapKit requests.
• We do not access motion or fitness sensors. Visual parallax is driven by scroll position; the app does not read Core Motion or request motion permission.
• We do not embed third-party advertising or analytics SDKs. The app does not contain Google Analytics, Meta/Facebook SDK, Amplitude, AppsFlyer, or similar SDKs, and it does not upload app-performance telemetry to Ansyrs.
• We do not retain raw search text for analytics. Search text is sent to the Ansyrs backend as needed to return the result you requested, but the normal search flow does not store it. Search returns information from the Ansyrs catalog; it does not send your query to an external AI service or generate missing products. The separate missing-brand request described above does store the brand name you explicitly submit.

How we use data

We use account and saved data to authenticate you, sync the categories you enable, restore app preferences, and show your saved items, reusable meals, journal, and followed brands. Search uses your query and catalog relevance; Nearby uses location when you enable it. Suggestions may reflect catalog information, time of day, and brands you explicitly follow or pin, without learning from your viewing or search history. We use anonymous catalog submissions to review possible errors and prioritize catalog coverage. We use request metadata and keyed hashes to secure accounts, enforce rate limits, and investigate abuse.

We do not sell personal information, use it for cross-app tracking, or serve targeted advertising. We do not use an address retained from the former Lifetime Premium reservation program for advertising or marketing.

Service providers and data protection

We require every third party with whom we share user data to provide the same or an equal level of protection as described in this Policy and required by Apple's App Review Guidelines. Providers processing data on our behalf may use it only for the services we request and as required by law, subject to confidentiality, security, and data-protection obligations. They must also require equivalent safeguards from their subprocessors.

Our hosting and database providers, Vercel and Supabase, commit to these types of safeguards in their data-processing terms. You can read Vercel's Data Processing Addendum and Supabase's Data Processing Addendum for details.

How your data is stored

• On your device. Local app data is stored inside the app sandbox in databases, files, and preferences protected by iOS data protection. Authentication tokens are stored in Keychain.
• In iCloud Key-Value Storage. When the corresponding sync controls are enabled, pinned brands can sync through your iCloud account. The payload is keyed to your Ansyrs profile. Older versions also stored limited followed-brand and meal snapshots here; the current app migrates those snapshots to private CloudKit records.
• In your private iCloud database. When enabled, your followed-brand choices, full logged-meal history, saved items and reusable meals in Yours, and recent meal builds sync as individual CloudKit records. Logged meals use this iCloud path, not the Ansyrs journal service. The recent-build list still displays a limited number of recent builds; that display limit does not discard deletion records. Sync requires the same Ansyrs and iCloud accounts on both devices and is subject to available iCloud storage and service access. An older app's limited iCloud snapshot can be imported during migration, but meals that were never uploaded can only transfer from a device that still holds them. Saved items and reusable saved meals have separate sync controls. A synced reusable meal includes its name, selected items or builds, quantities, saved nutrition and ingredient/allergen details, and the timestamps and revision information needed to keep edits and deletions consistent. Unfinished meal drafts stay on your device. Custom entries and legacy journal bookmarks saved in older app versions stay on your device. Recently viewed activity also stays local. Raw search text, exact locations, MapKit results, and authentication tokens are not included in either iCloud data path.
• On the Ansyrs service. Account profiles, app preferences, followed brands, previously synced journal records, anonymous catalog submissions, complimentary eligibility and subscription records, and operational security records are processed by Ansyrs services hosted on Vercel and stored in Supabase/Postgres where applicable. The Apple refresh token used only for deletion-time revocation is encrypted at rest in a service-role-only store.
• Legacy Lifetime Premium records. For an unresolved record from the former reservation program, the service may retain one AES-256-GCM encrypted address, a keyed HMAC used to prevent duplicates, a masked display form, and a short-lived claim proof. The current app does not create new reservation records or accept claim links.

Removal of suggestion personalization

The current app no longer collects behavioral learning events or creates derived personalization snapshots. On upgrade and subsequent launches or foreground use, it removes legacy local learning files, brand-frequency counters, retired settings, the personalization encryption key, and legacy search-action and derived learning fields from Ansyrs payloads in the connected iCloud account. This cleanup preserves followed brands, pins, saved items, meals, and builds. Cleanup retries after locked-device or iCloud failures. Data in another iCloud account can only be cleaned when that account is connected; an older app version can recreate legacy data until it is updated.

How long we keep it

• Complimentary eligibility and purchase records are separate from an optional Ansyrs account. We retain the minimal app-specific redeemed-offer record while operating this offer so reinstalling or deleting an account does not create repeated complimentary periods. We keep the latest verified subscription state to restore purchases and apply renewals, refunds, and revocations; we do not store a behavioral purchase profile. Account deletion does not cancel an Apple subscription or erase Apple’s DeviceCheck state. Contact Ansyrs Support about these records using the app or purchase details needed to locate them. Deleting account content remains available even when app access has expired.
• Account data on the Ansyrs service is kept while your account exists, unless you remove a record earlier. A previously synced journal record you remove from the Ansyrs service is eligible for permanent cleanup after 30 days.
• iCloud deletion records are retained to prevent an older device from restoring a logged meal, saved item, reusable meal, build, or followed brand you removed. Deleted cloud logged-meal records retain item and account identifiers, creation/update timestamps, and revision/deletion metadata, but not the original meal content. Deleted saved-item, reusable-meal, and build records retain their identifier and revision metadata, without the removed content. Unfollow records retain a brand identifier, the unfollow choice, and revision metadata. These records remain until that iCloud copy is removed. The Ansyrs service also retains follow/unfollow ordering records until the account is deleted. Local journal files can retain deleted entry snapshots, including content used for Undo; clearing local app data or completing account deletion removes those local files.
• Sessions expire after 30 days. Expired or revoked session rows are removed by the service's retention cleanup after 45 additional days. Deleting the account removes its session rows with the account.
• Encrypted Apple refresh credentials are kept while the account exists so Ansyrs can revoke every outstanding app authorization. They are deleted after confirmed revocation as part of account deletion. An unresolved pseudonymous deletion record is kept until the deletion can be safely completed. After completion, a pseudonymous deletion-control record—request and receipt IDs, keyed hashes of the request proof and Apple subject, revocation state, and lifecycle timestamps—is scheduled for cleanup after 30 days (or after related Apple-revocation cleanup finishes, if later). It has no raw Apple identifier, email, authentication token, IP address, or user agent. The app may retain a local, non-secret support summary containing only the receipt ID, request ID, and completion time until app data is cleared.
• Anonymous catalog reports and requests may be retained as catalog quality and demand records until they are resolved or no longer needed. They are not automatically matched to or removed with an Ansyrs account because the records contain no account identifier.
• Legacy Lifetime Premium records are retained only while needed to resolve the former program's outstanding record or preserve an already-granted entitlement. Cancellation deletes any pending encrypted address and claim proof. A successful recoverable grant deletes them in the same database transaction and records the deletion time. Ansyrs may retain the masked form, a keyed HMAC for duplicate prevention, entitlement/reservation status, and safe audit timestamps needed to preserve access and prevent abuse.
• Rate-limit records use keyed hashes; scheduled cleanup deletes rows older than five minutes. Some security and administrative logs have separate operational schedules; for example, content-security-policy reports are cleaned after 14 days and administrative audit records after 180 days.

Account deletion and your rights

You can delete your account in Settings → Delete Account. A successful response means the backend has confirmed revocation of the app's Sign in with Apple authorization and completed one database transaction that removes the profile, encrypted Apple refresh credentials, identities, sessions, followed brands, dietary and user settings, product corrections, journal entries, any historical account-linked scan rows, and supported legacy or archived saved-meal/build data. For shared catalog notes, change-log records, legacy catalog submissions, or product-snapshot attribution, the transaction removes the account link while retaining the non-account catalog/audit content. For an older account without a stored Apple token, Ansyrs may ask you to confirm with Sign in with Apple first. Ansyrs records the pending deletion and revokes its app sessions before that confirmation; if you cancel or the confirmation fails, account content has not been deleted yet and the request remains pending. After backend success, the app clears local personal-data stores and attempts to remove the profile's private CloudKit records, including deletion records, and its iCloud Key-Value Storage payload. If iCloud is unavailable, local erasure can still finish. The app retains a separate cleanup record containing the Ansyrs profile identifier, hashed iCloud-account references, pending-cleanup time, and whether older cloud history is unknown. It contains no meal content or authentication credentials. Settings offers a signed-out retry for outstanding iCloud cleanup. Copies synced to a different iCloud account cannot be accessed through the currently connected account; reconnect that account to retry, or remove its Ansyrs copies through iCloud storage controls. Older copies with unknown account history require you to check the accounts previously used. If local erasure itself fails, the deletion request remains available for retry. Account deletion also removes an account-linked legacy Lifetime Premium record, any still-pending encrypted address and claim proof, and the account-bound entitlement.

Anonymous item reports, missing-brand requests, and empty-brand demand records are not account-linked and therefore cannot be found through account deletion. To request removal of an anonymous submission, contact support with enough information to locate it, such as the report ID, brand, item, approximate submission time, or submitted text.

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal data, and to appeal or complain to a regulator. To exercise a right, visit Ansyrs Support. We honor applicable rights under laws such as the GDPR, UK GDPR, and CCPA/CPRA.

Children

Ansyrs is not directed to children under 13 and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will take appropriate steps to delete it.

Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will update the bundled copy in a subsequent App Store release and update this canonical version. Material changes will be surfaced in the app when you next open it.

Contact

Privacy questions can be sent through Ansyrs Support.