nodiet.ai

Privacy Policy

regarding the processing of personal data

Effective as of October 11, 2026

Summary

  • nodiet.ai is a food diary that analyses photos, voice messages and text with AI. To do this we process your food diary, photos, voice messages, body measurements, activity and goals.
  • nodiet.ai runs as two separate services. The International service is for users outside Russia: data is stored in the EU (Scaleway, France), the controller is Iurii Menshikov, Spain, and the GDPR applies. The Russian service is for users in Russia: data is stored in Russia (Selectel), the operator is Individual Entrepreneur Maxim Dmitrievich Nagovitsin, and Russian law applies.
  • Before you start, the app asks for your consent to process this data. To analyse your food we send photos, voice and messages to AI models through OpenRouter (USA). We do not sell your data and do not use it for advertising.
  • In the International service, analytics and session recording run only if you allow them. In the Russian service, they are part of the processing you consent to.
  • You can delete your account in the app. This deletes your diary, photos and other data.
  • Questions and requests: support@nodiet.ai.

1. Who is responsible for your data

1.1. nodiet.ai runs as two separate services, each with its own servers and database:

  • International service — for users outside Russia: the web app at eu-app.nodiet.ai and the iOS and Android apps for accounts registered with this service. The controller is Iurii Menshikov, a private individual residing in Spain.
  • Russian service — for users in Russia: the web app at app.nodiet.ai, the Telegram mini app and the iOS and Android apps for accounts registered with this service. The operator is Individual Entrepreneur Maxim Dmitrievich Nagovitsin (Yekaterinburg, Russia; OGRNIP 325665800292355, INN 668602006513).

1.2. The app chooses the service once, when you first open it, using signals from your device: time zone, language, app store country and, on Android, the country of your SIM card or mobile network. If these signals disagree, the app asks both services which country your IP address belongs to. Accounts created before the International service launched stay with the Russian service. If you are not sure which service your account belongs to, write to us.

1.3. "We" means the controller or operator of the service your account belongs to. Where the two services differ, this Policy says so. The Policy also covers the website nodiet.ai and email correspondence with us.

1.4. This Policy is published in English and Russian with the same content. If the versions differ, the English version prevails for the International service and the Russian version for the Russian service.

1.5. International service: the controller is established in Spain, so the lead supervisory authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD). We have not appointed a data protection officer. Russian service: this Policy is the operator's policy on the processing of personal data under Article 18.1 of Federal Law No. 152-FZ "On Personal Data".

1.6. For any privacy question, write to support@nodiet.ai.

2. Whose data and what data we process

2.1. We process data of users of the app, visitors of the website and people who write to us.

2.2. Data of users:

  • Account: your account identifier, email address, name and profile photo link from Sign in with Apple or Google; an anonymous account identifier if you use the app without signing in (on iOS and Android it is kept in the device's secure storage and survives reinstalling the app); the date the account was created and the country where it was created, determined from your IP address. In the Russian service, also your Telegram identifier, name, username and profile photo link, or your Yandex ID identifier, email address, name and profile picture, if you sign in with them, and the Telegram data passed when you open the Telegram mini app.
  • Email address, if you add one, and confirmation codes (we store only their hashes).
  • Profile and goals: sex, year of birth, activity level, goal (lose, maintain or gain weight, gain muscle), the formula used for calculations, weight and height with dates, daily calorie and macronutrient goals.
  • Food diary: meals (date, meal type, dish names, portion sizes, calories, protein, fat, carbohydrates, fibre, alcohol) and water intake.
  • Apple Health and Health Connect, if you connect them: we import weight, height, daily step count and active calories, and write the weight, height, meals (name, meal type, calories and nutrients) and water you log in the app to Apple Health or Health Connect on your device (section 4.4).
  • Content you send: photos of food and product labels, voice messages and their transcripts, messages to the AI assistant and its replies, products you add to the shared product catalogue. Photo files may contain metadata added by your camera, such as the time and, if enabled on your device, the location; we do not use it.
  • Feedback and support: messages you send us and your ratings of assistant replies.
  • Purchases: the payment method or app store, product, transaction identifiers, price, currency, subscription periods and status. In the Russian service, if you pay by card on the web, also the payment method identifier issued by YooKassa, the card type and its last four digits. We never receive the full card number.
  • Device and technical data: platform, app version, device model, operating system version, language, time zone, push notification token, IP address, app store country and, on Android, SIM or network country.
  • Usage data: onboarding progress, which features you use, interactions with reminders and in-app messages, AI usage (amount and cost of requests).
  • Analytics data (section 6).

2.3. Data of website visitors: IP address, browser and device details, pages visited and actions on the website, cookie choices (section 6.5). Data of people who write to us: email address, name and the content of the message.

2.4. We do not ask for medical diagnoses. Please do not send us information about medical conditions in messages, photos or feedback.

2.5. We process data with and without automation, including transfer over the internet. The processing consists of collection, recording, systematisation, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (provision, access), depersonalisation, blocking, deletion and destruction.

3. Why we use your data and on what legal basis

For each purpose we give the legal basis under the GDPR for the International service and under Article 6 of Federal Law No. 152-FZ for the Russian service.

  • To provide the service — account, diary, AI analysis, calculations, syncing between devices, reminders you set up. International: performance of our contract with you (Art. 6(1)(b) GDPR) and, for health data, your explicit consent (Art. 9(2)(a) GDPR). Russian: your consent (Art. 6(1)(1) of 152-FZ) and performance of the agreement with you (Art. 6(1)(5)).
  • To process purchases, check them with the store or payment provider and, in the Russian service, issue receipts. International: contract (Art. 6(1)(b)). Russian: agreement (Art. 6(1)(5)) and the operator's legal obligations under the tax laws (Art. 6(1)(2)).
  • To keep the service working and secure — choosing the service region, error monitoring, server logs, preventing abuse. International: our legitimate interest in a reliable and secure service (Art. 6(1)(f)). Russian: the operator's legitimate interests (Art. 6(1)(7)) and your consent.
  • Product analytics and session recording in the app. International: your consent (Art. 6(1)(a) GDPR; for reading and storing information on your device, Art. 5(3) of the ePrivacy Directive). Russian: your consent.
  • Subscription statistics calculated by our servers (for example, that a trial started or a subscription was paid), linked to a pseudonymous identifier. International: legitimate interest in understanding how our business performs (Art. 6(1)(f)); you can object. Russian: your consent.
  • Notifications — reminders, tips and offers within the app, by push and, in the Russian service, through the nodiet.ai Telegram bot if you use it. Basis: your consent, which you give by allowing notifications or starting the bot; you can turn them off in the app, device or Telegram settings.
  • Answering your messages and requests. International: contract and legitimate interest. Russian: agreement and your consent.
  • Proving consent, meeting legal obligations and defending legal claims. International: legal obligation (Art. 6(1)(c)) and legitimate interest. Russian: legal obligations (Art. 6(1)(2)) and legitimate interests (Art. 6(1)(7)).

4. Food diary, body data and your consent

4.1. International service. Your food diary, food photos, voice messages about food, body measurements, activity data and goals can reveal information about your health, so we treat them as special category data under Art. 9 GDPR. Before you start, the app asks for your explicit consent with a separate checkbox. The service cannot work without this data, so the consent is required to use it.

4.2. Russian service. The operator does not process special categories of personal data about health under Article 10 of 152-FZ: the service does not collect diagnoses or medical information. Your food diary, body parameters, activity and goals are processed as data you provide to calculate your diet, on the basis of a separate consent to the processing of personal data that you give in the app (text of the consent).

4.3. You can withdraw your consent at any time by deleting your account in the app (Profile → Delete account) or by writing to us. Withdrawal does not affect processing that took place before it. After withdrawal we delete your data as described in section 9. We do not use this data for advertising, marketing or profiling and do not sell it.

4.4. Apple Health and Health Connect. Synchronisation is off until you turn it on in your profile and allow access in the system dialog, where you choose which data types to share. Data imported from Apple Health or Health Connect is stored in your account only to show it in the app and keep your diary in sync. We do not use it for advertising, marketing or data mining, do not sell it, do not send it to AI models or analytics services, and share it only with the processors that run the service for us (section 7). Analytics receives only the fact that you connected or disconnected synchronisation. Our use of data received from Health Connect complies with the Health Connect Permissions policy, including its Limited Use requirements. You can turn synchronisation off in your profile and revoke access in the Health app (iOS) or Health Connect settings (Android) at any time; data already imported stays in your account until you delete it or your account.

5. How the AI features work

5.1. When you send a photo, a voice message or a text, our servers pass it to AI models through OpenRouter, Inc. (USA). Together with your message we send what the model needs to answer: your first name, the local date and time, your daily goals and what you have eaten today and, for the assistant, your recent meals. We do not send your account identifier or email address.

5.2. Models in use: Gemini by Google LLC (USA) for photos and text, and Whisper for speech recognition, run by DeepInfra, Together AI or Groq (USA). We configure OpenRouter to use only providers that do not use your requests to train their models and do not store them (zero data retention).

5.3. In the Russian service, requests to OpenRouter pass through the operator's proxy server hosted by Servercore in Kenya; the server forwards them without storing their content.

5.4. In the web app and on iOS, live voice input may use the speech recognition of your browser or operating system (for example, Google or Apple). In that case your voice is processed by that provider under its own terms.

5.5. AI results are estimates, not medical advice. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

6. Analytics, error monitoring and storage on your device

6.1. Analytics. The app sends PostHog (PostHog, Inc., data stored in the EU, Germany) the screens you open and the actions you take, device and app details, your IP address and the approximate location derived from it, and a pseudonymous identifier. Session recordings show the app screen with all text masked and images hidden; they are kept for 30 days.

  • International service: only if you tick the analytics box or turn analytics on in your profile. Without your consent the app does not record analytics events or session recordings and does not link anything to your account. You can withdraw your consent in your profile at any time.
  • Russian service: analytics and session recording are part of the processing you consent to (section 4.2) and start only after you give this consent. In the iOS and Android apps, events are also sent to Yandex AppMetrica (Yandex LLC, Russia) together with the same pseudonymous identifier. To stop analytics, withdraw your consent by deleting your account.

6.2. Error monitoring. The app and our servers report errors so we can fix them: to Sentry (Functional Software, Inc., data stored in the EU, Germany) — the error, the device or browser, the app version and the page address with login tokens removed, without your account identifier; and to PostHog — app warnings and errors without your identity, and our server logs, which contain your internal account identifier.

6.3. App updates. The iOS and Android apps download updates through Capgo (Digital Shift OÜ, Estonia), which receives the app version, operating system, platform and a random device identifier.

6.4. Storage on your device. The app stores:

  • strictly necessary data: login tokens, the chosen service region, language, your consent choices, temporary sign-in state;
  • preferences: dismissed banners, payment mode, notification settings;
  • analytics identifiers of PostHog — in the International service only after you consent.

6.5. Website. The website nodiet.ai is hosted in Russia (Selectel) and shows a cookie banner. Until you choose, PostHog counts visits without cookies, using a hash of your IP address and browser that changes daily. If you accept, PostHog sets a cookie to recognise repeat visits. Visitors whose browser uses a Russian time zone who accept are also counted by Yandex Metrica (Yandex LLC, Russia). If you follow an advertising link to nodiet.ai/download on a mobile device, you are redirected to the app store through Yandex AppMetrica (Russia), which records the click to measure the campaign. You can change your choice through "Cookie settings" at the bottom of the website. For visitors in Russia the website is the responsibility of the operator of the Russian service, for all other visitors — of the controller of the International service.

7. Who receives your data

7.1. Processors act on our instructions under data processing agreements or, in the Russian service, under the operator's instruction (Article 6(3) of 152-FZ).

International service:

  • Individual Entrepreneur Maxim Dmitrievich Nagovitsin (Russia) — development, technical operation and support of the service, with remote access when needed;
  • Scaleway SAS (France) — servers, database, file storage, sending emails;
  • OpenRouter, Inc. (USA) and the model providers behind it (section 5) — AI analysis;
  • PostHog, Inc. (USA; data stored in Germany) — analytics and logs;
  • Functional Software, Inc. (Sentry; USA; data stored in Germany) — error monitoring;
  • Google LLC (Firebase Cloud Messaging, USA) — delivering push notifications: the push token and the notification text;
  • Digital Shift OÜ (Capgo, Estonia) — app updates;
  • Selectel (Russia) — hosting of the website nodiet.ai and of demo files shown during onboarding;
  • Timeweb (Russia) — our support mailbox support@nodiet.ai.

Russian service:

  • Selectel (Russia) — servers, database, file storage, sending emails, website hosting;
  • Servercore (Kenya) — hosting of the operator's proxy server for requests to OpenRouter and Telegram (section 5.3);
  • OpenRouter, Inc. (USA) and the model providers behind it (section 5) — AI analysis;
  • PostHog, Inc. (USA; data stored in Germany) — analytics and logs;
  • Yandex LLC (AppMetrica, Russia) — analytics in the iOS and Android apps;
  • Functional Software, Inc. (Sentry; USA; data stored in Germany) — error monitoring;
  • Google LLC (Firebase Cloud Messaging, USA) — delivering push notifications: the push token and the notification text;
  • Digital Shift OÜ (Capgo, Estonia) — app updates;
  • NBCO YooMoney LLC (YooKassa, Russia) — accepting card payments; earlier payments were also accepted through Robokassa LLC (Russia);
  • Telegram Messenger Inc. (outside Russia) — delivering messages of the nodiet.ai Telegram bot and storing copies of feedback in our team chat;
  • Timeweb (Russia) — our support mailbox support@nodiet.ai.

7.2. Independent controllers. Apple, Google, Yandex (Yandex ID) and Telegram process your data under their own privacy policies when you sign in with them, buy a subscription in their stores, open the Telegram mini app or receive push notifications on their platforms.

7.3. Products you add to the shared catalogue (name, nutrition facts, photo) are visible to other users of the same service, without your name.

7.4. We do not sell your data and do not share it with advertisers. We disclose data to authorities only when the law requires it.

8. International transfers

8.1. International service — transfers outside the EU:

  • USA. PostHog, Sentry and Google take part in the EU-U.S. Data Privacy Framework; their data processing agreements also include the Standard Contractual Clauses of the European Commission. For OpenRouter we rely on the Standard Contractual Clauses (Module 2) in its data processing agreement. Capgo stores update data with its own providers in the United Kingdom (adequacy decision), the USA and other countries under the Standard Contractual Clauses.
  • Russia. Russia has no adequacy decision. Data reaches Russia when our contractor develops and supports the service with remote access, when you write to our support mailbox, when you visit the website, when the app loads onboarding demo files and when the app asks the Russian service which country your IP address belongs to (section 1.2). For these transfers we use the Standard Contractual Clauses (Module 2) between the controller and our contractor, and we limit them: your data is stored in the EU, we do not keep copies of it in Russia, and it is accessed from Russia only when needed for development or support.

8.2. Russian service — cross-border transfer. Data of users of the Russian service is stored in databases in Russia. To provide the service it is transferred to the USA (OpenRouter and AI model providers, PostHog, Sentry, Google, Apple), Kenya (the proxy server), Germany (where PostHog and Sentry store data), Estonia, the United Kingdom and other countries where Capgo's providers operate, and the countries where Telegram stores data. Some of these countries, including the USA and Kenya, are not considered to ensure adequate protection of personal data subjects' rights. The transfer is carried out in accordance with Article 12 of 152-FZ.

8.3. You can request a copy of the safeguards we use by writing to support@nodiet.ai.

9. How long we keep data

  • Account, profile, diary, data imported from Apple Health or Health Connect, photos, chats and purchase records — until you delete your account or withdraw your consent. Meals and chats you delete in the app disappear from it; the related records and files are erased when you delete your account.
  • Voice recordings — deleted 30 days after you send them; the transcript stays in the chat.
  • PDF files you export — deleted within 30 days.
  • Records of your consents — up to 3 years after you delete your account, to prove that consent was given.
  • Analytics events — up to 7 years; session recordings — 30 days. After you delete your account, the analytics identifier is no longer linked to you.
  • Error reports — up to 90 days; server logs — 14 days.
  • Backups — overwritten within 30 days.
  • Support emails and copies of feedback in our team chat — as long as needed to handle your request, and no longer than 2 years.
  • Russian service: receipts issued under the tax laws are kept by the tax authority and by us without your personal data.

We stop processing and delete data when the purposes are achieved, when you withdraw consent or delete your account, or when processing becomes unlawful. In the Russian service this happens within 30 days of such an event (Article 21 of 152-FZ), unless the law requires us to keep the data longer.

10. Your rights

10.1. International service. Under the GDPR you have the right to:

  • access your data and get a copy of it;
  • correct inaccurate data;
  • have your data erased;
  • restrict processing;
  • receive the data you provided in a machine-readable format (portability);
  • object to processing based on our legitimate interests;
  • withdraw consent at any time, without affecting processing before the withdrawal;
  • lodge a complaint with a supervisory authority: the Spanish Data Protection Agency (AEPD, www.aepd.es) or the authority of the EU country where you live or work.

We answer within one month; for complex requests this can be extended by two more months, and we will tell you if so.

10.2. Russian service. Under 152-FZ you have the right to:

  • receive information about the processing of your data (Article 14);
  • demand that we clarify, block or destroy your data if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
  • withdraw your consent at any time;
  • appeal our actions or inaction to Roskomnadzor (rkn.gov.ru) or to a court.

We answer within 10 working days; this can be extended by 5 working days, and we will tell you why.

10.3. In the app you can edit your data and delete your account (Profile → Delete account); in the International service you can also turn analytics on or off in your profile. For anything else, including a copy of your data, write to support@nodiet.ai, preferably from the email address linked to your account. We may ask you to confirm that the account is yours.

11. Security

We take legal, organisational and technical measures to protect data: we encrypt connections (TLS), keep files in private storage and give access to them only through short-lived links, store confirmation codes as hashes and limit who can access the data. No system is completely secure; if a personal data breach puts you at risk, we will notify the supervisory authority and you as required by the GDPR and, in the Russian service, notify Roskomnadzor as required by 152-FZ.

12. Age

The service is for people aged 18 and over. We do not knowingly process data of children. If you believe a child has given us their data, write to us and we will delete it.

13. Changes to this Policy

We update this Policy when our processing changes. The date at the top shows the current version. If the changes are significant, the app will ask you to review the documents again. The current version is always available at https://nodiet.ai/en/privacy-policy and https://nodiet.ai/ru/privacy-policy.

Contact

International service — controller:
Iurii Menshikov
Calle Siete Aguas, 11, 5D, 46023 Valencia, Spain
Email: support@nodiet.ai

Russian service — operator:
Individual Entrepreneur Maxim Dmitrievich Nagovitsin
Yekaterinburg, Russia
OGRNIP 325665800292355, INN 668602006513
Email: support@nodiet.ai