Nutrifax is run by Novadiem. This policy covers nutrifax.app and the Nutrifax web app. Last updated 3 September 2026.
The short version
We collect the account details you give us, the recipes you build, and enough usage data to run the product and understand how people find it. We do not sell your data. We do not show third-party advertising on the site. Your recipes are private to your account unless you publish or share them yourself.
What we collect
Account information
- Your email address, and a password stored only as a bcrypt hash. We never store your password itself.
- If you sign in with Google: your Google account identifier and display name. We do not receive your Google password.
- A two-letter country code inferred from your IP address, used to pick a currency and default label format.
Content you create
- Recipes, ingredients, quantities, instructions, serving and yield settings.
- Images you upload to a recipe or gallery.
- Ingredient prices you log for recipe costing.
- Support tickets, including your name, email, and the messages you send us.
Usage data
- Which labels, audit reports, and AI imports you generate, and the Ω spent on each.
- A daily record that your account was active, plus a last-seen timestamp. We use these for retention reporting.
- How you first arrived: UTM campaign parameters, referral code, and landing page, recorded once at signup.
AI recipe import
When you paste recipe text or upload a recipe photo, that content is sent to our AI provider for parsing and ingredient matching. We also store the input text, a reference to any uploaded image, and the provider's responses so we can debug failed imports and improve matching. If you would rather not have recipe text processed this way, build the recipe by searching ingredients directly instead.
Payments
Payments are processed by Stripe. Card numbers go to Stripe and never reach our servers. We store the Stripe charge identifier, the amount, the currency, and which product you bought, so we can show your billing history and apply your membership. Stripe's handling of your payment details is governed by Stripe's privacy policy.
Cookies
We use a small number of cookies and browser storage keys. None of them are third-party advertising cookies.
| Name | Purpose | Life |
|---|---|---|
| Session and refresh tokens | Keeps you signed in | Until you sign out or the token expires |
nfx_attribution | Records the campaign or referral you first arrived from | 60 days |
nfx_region | Remembers Canada or US for currency and label defaults | 1 year |
Who we share data with
We do not sell personal data. We share it only with the service providers we need to run Nutrifax:
- Stripe for payment processing.
- Google for sign-in, if you choose Google sign-in, and for measuring ad conversions if you arrived from one of our ads.
- OpenRouter for AI recipe parsing, when you use AI import.
- Amazon Web Services for image storage and delivery.
- ipinfo.io receives your IP address to return a country code.
- Sentry receives error reports when something breaks, which can include the URL and your account identifier.
- SMTP2Go delivers our transactional email, such as verification and password reset.
Our web analytics run on a self-hosted Umami instance on our own server. Analytics data is not sent to a third-party analytics company.
We may also disclose data if the law requires it, or to protect the rights and safety of our users.
Where data is stored
Our servers and database are hosted in the United States. If you are in Canada or the EU, your data is processed outside your country. Our service providers, listed above, may process data in other countries under their own terms.
How long we keep it
We keep your account and recipes for as long as your account exists. Deleted recipes are soft-deleted and stay recoverable until you ask us to purge them. Support tickets and payment records are kept for our own accounting and dispute-handling needs. When you ask us to delete your account, we remove your personal data and content, except records we are required to keep for tax and accounting.
Your choices
Whatever your jurisdiction, you can ask us to:
- Send you a copy of the data we hold about you.
- Correct anything inaccurate.
- Delete your account and its content.
- Stop sending you non-essential email.
Email privacy@nutrifax.app or open a ticket from the support page. We answer within 30 days.
If you are in Canada, you also have rights under PIPEDA, including the right to complain to the Office of the Privacy Commissioner of Canada. If you are in California, you have rights under the CCPA, including the right to know what is collected and the right to deletion. We do not sell personal information as the CCPA defines it. If you are in the EU or UK, you have rights under the GDPR, including access, rectification, erasure, portability, and objection.
Children
Nutrifax is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has created an account, email us and we will remove it.
Changes
If we make a material change to this policy, we will update the date at the top and, for significant changes, tell account holders by email.
Contact
Novadiem, operator of Nutrifax. Email privacy@nutrifax.app, or use the support page.