Privacy Policy

Restaurant suggestions, feedback and service counts

Optional nearby assistant suggestions use coordinates you supply for the current search only. We do not save them with your account. Your saved nutrition targets and dated diary are read for personalization only when you request it; your assistant receives the resulting suggestions and target summary.

Feedback and restaurant requests are stored for human review, linked to your account. They contain your message and, for a restaurant request, the restaurant name and optional town or city. Do not include private contact information, exact locations, medical details or other sensitive information. Requests do not create restaurant records. Items become eligible for deletion after 90 days; bounded cleanup during later submissions can delay removal. Deleting your account removes its feedback.

To count daily use, we store one account identifier per UTC day for up to 90 days, with cleanup during service activity and removal when your account is deleted. We also store daily counts by a fixed set of assistant tool names and outcomes. Hourly operational logs contain aggregate counts only, including pending requests and verified subscription categories; they exclude account identifiers, message text, diary content and precise location. Private operational access uses existing Google Cloud and database permissions.

Optional assistant connections

You can authorize a remote assistant to read your food diary and recent foods, log meals, or both. Enshape shows the requested permissions and connected account before you approve. The assistant may receive meal names, dates, portions and nutrition values, plus your Enshape plan status and assistant usage limits when requested, and processes that information under its own privacy policy. These connections do not publish your diary to Enshape's shared food catalog.

We store connection records and hashes of authorization credentials to enforce permissions, expiration and revocation. Access credentials expire after one hour; refresh credentials expire after 30 days. Disconnect a remote assistant from Assistant connections in Enshape to stop its access. Disconnecting does not erase information already received by that assistant. Deleting your Enshape account removes its Enshape connection records. Native Siri and Android assistant controls are separate from remote connections.

Enshape in your browser

The Enshape website uses Google or Apple sign-in. A secure, HttpOnly session cookie keeps you signed in for up to seven days; signing out revokes that browser session. Short-lived sign-in cookies protect against login replay. Your saved meals, recipes, targets, and account are shared with the mobile app.

When you use a camera QR link, both devices must sign in to the same account. Links expire after ten minutes and accept one photo. We temporarily store the resulting nutrition estimate so your computer can retrieve it; expired links and results are removed during subsequent camera-link activity. Uploaded images are processed in memory and sent to the disclosed AI processors as described below.

Google AdSense may display non-personalized advertisements on our public About page after consent is available through Google's consent management platform. Advertising code is not loaded on your private food diary, camera, sign-in, or account screens. We do not send your meals, images, nutrition targets, or account identifiers as advertising targeting data. You can manage advertising consent using the Ad privacy choices control on that public page when ads are enabled.

Chase Cargill built the Enshape app as a Freemium app. This SERVICE is provided by Chase Cargill at no cost and is intended for use as is.

This page is used to inform visitors regarding my policies with the collection, use, and disclosure of Personal Information if anyone decided to use my Service.

If you choose to use my Service, then you agree to the collection and use of information in relation to this policy. The Personal Information that I collect is used for providing and improving the Service. I will not use or share your information with anyone except as described in this Privacy Policy.

The terms used in this Privacy Policy have the same meanings as in our Terms and Conditions, which are accessible at Enshape unless otherwise defined in this Privacy Policy.

Enshape stores your account information, such as your email address and username, and the profile, goals, meals, and recipes you choose to save on our servers. Profile information may include your age, height, weight, activity level, and nutrition preferences. We use this information to provide your meal log, nutrition calculations, account access, and related features. Passwords are stored as hashes, not as readable passwords.

Assistant data retention and security records

Meals saved through assistant tools include the food name, local date, portion, nutrition values, nutrition source and a request identifier used to prevent duplicate saves. These records remain in our active database until you delete the meals or your Enshape account. Assistant tools do not receive your email address, profile measurements, passwords or subscription payment details. Share only the food and nutrition information needed for your diary; do not provide medical records or diagnoses through this integration.

We retain assistant permission records and credential hashes to enforce access and detect reuse of refresh credentials. Authorization codes expire after five minutes, access credentials after one hour, and refresh credentials after 30 days. Refreshing does not extend that 30-day period. Rotated credential hashes remain through their refresh lifetime for reuse detection. Expired authorization codes and credential records whose refresh lifetime has ended are eligible for removal in bounded batches during later authorization activity. Permission records older than 30 days are eligible for removal once no associated credential records remain. Cleanup may be delayed when activity is low or cleanup fails; expiration and revocation still stop future authentication. Account-based and IP-based request counters enforce short-term rate limits and the daily allowance; they expire at the end of their minute, hour or UTC-day window and are removed during subsequent activity.

Assistant client registrations are separate records containing a client identifier, name, callback URLs and creation time. They do not grant access to your account. Registrations have no automatic expiry and remain until removed through operator review so assistants can reconnect. Disconnecting an assistant or deleting your account does not remove its shared client registration. Deleting your account removes its account-bound authorization codes, permission records and credential hashes from our active database. Disconnecting does not delete meals you have saved in Enshape or recall information already received by an assistant.

Google Cloud hosts the service and stores operational infrastructure logs for 30 days and required cloud administration audit logs for 400 days under our existing retention settings. Application logging redacts request bodies and authentication secrets. We use security records and counters to operate the service, prevent abuse and enforce access; we do not use them for advertising profiles. A connected assistant receives only data returned by the tools you authorize and retains it under that assistant provider's own policy. You can disconnect it, remove meals or delete your Enshape account using the controls described here.

If you grant location permission and use nearby restaurant features, your location is sent to our service to find relevant restaurants. You can deny location access and continue using the other meal logging features. Advertising and service SDKs may also process IP addresses, device identifiers, app interactions, purchase history, and diagnostic information.

When enabled, Food chat sends your message, the photo you select, relevant nutrition targets, daily totals, recent chat context, bounded structured observations from older food drafts, and food preferences you explicitly save directly to Anthropic, with your explicit AI sharing permission and a supported client. Without permission or if unavailable, log manually. Estimates require your review before saving to your diary. This feature provides food logging and brief nutrition help. It does not provide diagnoses or guarantee allergen safety.

Chat messages, drafts and signed provider text responses are kept for 30 days. Older conversation facts are compacted without extra AI calls and expire no later than the earliest source message. Sanitized chat photos are kept privately and may be resent for follow-ups within the latest 12 completed exchanges, for up to 24 hours. Worker cleanup removes photos once either limit is reached; failed or interrupted processing removes the uploaded photo. Deleting a conversation removes its content, compacted facts and signed responses while preserving your logged meals and minimal quota and request identifiers for up to 90 days. Deleting your account removes its chat, preferences, notification devices and private job records. Cleanup depends on the worker running; provider retention and backups have their own policies.

Optional response notifications use Expo Push Service, Apple APNs and Google FCM. We register a device token with your signed-in account and send generic notification text and opaque conversation identifiers. Notifications contain no meal names, nutrition values, allergy details or photos. Turning them on does not enable proactive reminders. Chat advertising uses the existing consent controls; we do not send your messages, photos, nutrition context or food preferences as ad targeting data. Premium and unverified entitlement states display no chat advertisements.

When you submit a food or nutrition-label photo for analysis, Enshape sends that image only through our server directly to Anthropic for supported clients with explicit account sharing permission. Camera access and photo submission are optional; you can enter food details manually. We process the uploaded image in memory for the standalone photo tools; chat photos use the transient private queue described above. Food and nutrition values that you choose to save become part of your meal log or food catalog entry.

Anthropic processes AI requests under its commercial API terms. Anthropic states commercial API inputs and outputs are not used for model training by default and are deleted within 30 days, except for agreed terms, safety enforcement or legal requirements. This is not a zero-retention service. Review nutrition values before saving.

This separate, account-specific permission is off by default. AI & Assistants displays the current processing companies, data categories, purpose and retention terms from the server before you choose to agree. Current recipients are Anthropic. Supported clients may send selected food and label photos, chat messages, recent chat history, derived older food facts, nutrition targets and diary totals, past logged meals, preferences and allergies, and retrieved food/menu context for food chat, photo estimates and nutrition-label reading. Requests go directly to Anthropic with no alternate provider fallback.

Changing a model within the same disclosed sharing scope does not grant a new company access. A material change to recipients, data use or retention terms requires updated permission. Prior Meta, Fireworks or OpenRouter-route permission does not enable this sharing scope. Revoking permission stops future sends, including queued messages, but cannot recall information already received by a processor. Revocation may wait up to 60 seconds for an already-started request to finish. Older clients, nonconsenting accounts and unavailable configurations use manual logging. AI does not save meals without your review and confirmation. Provider retention and deletion are separate from Enshape's chat cleanup. See Anthropic data use notice, Anthropic retention policy.

Apple or Google processes native subscription payments. Stripe processes payments made on the website. Enshape verifies purchase history with the payment provider and links Premium access to an opaque account identifier for restoration and account access. Enshape does not receive your full payment-card details. AdMob may collect and share approximate location derived from your IP address, device identifiers, interactions, and diagnostics for advertising, analytics, and fraud prevention. Enshape does not send your meal log or health export records to advertising services.

If you explicitly enable health export, Enshape writes your logged meal name and nutrition totals (calories, protein, carbohydrates, fat, and fiber) to Apple Health on iOS or Health Connect on Android. Enshape requests write access only and does not read or import data from either health service. A local synchronization queue and identifiers are stored on your device to update records without creating duplicates.

You can pause export or change permission access at any time in Enshape or your device settings. Pausing does not remove records already exported. The Health & Nutrition settings screen can remove nutrition records created by Enshape without deleting your Enshape meal log.

You can delete your Enshape account in the app or request deletion at enshapeapp.com/delete-my-account. Contact us using the address below for help with associated service-provider data. Deleting an Enshape account does not cancel an App Store or Google Play subscription; manage that subscription through the store. Health records you exported remain under your control in Apple Health or Health Connect and can be removed through the health settings described above.

I want to inform you that whenever you use my Service, in a case of an error in the app I collect data and information (through third-party products) on your phone called Log Data. This Log Data may include information such as your device Internet Protocol (“IP”) address, device name, operating system version, the configuration of the app when utilizing my Service, the time and date of your use of the Service, and other statistics.

Cookies are files with a small amount of data that are commonly used as anonymous unique identifiers. These are sent to your browser from the websites that you visit and are stored on your device's internal memory.

The Enshape website uses the sign-in and session cookies described above. The mobile app and third-party service libraries may also use cookies or equivalent local storage to provide their services. You have the option to either accept or refuse these cookies and know when a cookie is being sent to your device. If you choose to refuse our cookies, you may not be able to use some portions of this Service.

I may employ third-party companies and individuals due to the following reasons:

I want to inform users of this Service that these third parties have access to their Personal Information. The reason is to perform the tasks assigned to them on our behalf. However, they are obligated not to disclose or use the information for any other purpose.

I value your trust in providing us your Personal Information, thus we are striving to use commercially acceptable means of protecting it. But remember that no method of transmission over the internet, or method of electronic storage is 100% secure and reliable, and I cannot guarantee its absolute security.

This Service may contain links to other sites. If you click on a third-party link, you will be directed to that site. Note that these external sites are not operated by me. Therefore, I strongly advise you to review the Privacy Policy of these websites. I have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

I may update our Privacy Policy from time to time. Thus, you are advised to review this page periodically for any changes. I will notify you of any changes by posting the new Privacy Policy on this page.

If you have any questions or suggestions about my Privacy Policy, do not hesitate to contact me at support@enshapeapp.com.