Privacy Policy

1. Who We Are

SteadyFuel is an independently developed nutrition tracking app. Developer: David Hildebrand, trading as Orivent Studios, based in Cape Town, South Africa. For any questions about this policy or to exercise your privacy rights, contact us at: [email protected]

2. What Data We Collect

2.1 Data stored on your device (local only)

The following data is created and stored exclusively on your device using a local on-device database (ObjectBox). It is never uploaded to our servers or any cloud service, unless you sign in and enable cloud backup:

• Your food diary entries — food names, quantities, servings, macros, meal type, and date
• Custom foods you create — name, serving size, and macro values
• Meal templates — saved meal layouts with their food items
• User profile preferences — calorie goal, macro targets, goal type, activity level, units
• App settings and onboarding state

2.2 Data stored in the cloud (Firebase / Firestore)

A small amount of data is stored in Firestore, tied to your Firebase UID. Anonymous users get only a UID. Google Sign-In users also get profile metadata:

• Firebase UID — a unique identifier for sync and purchase management
• Google display name and email address (Sign-In only)
• Subscription tier — Free, Plus, or Pro plan status
• Fuel Credits balance — credit count for AI feature purchases
• Processed purchase tokens — for idempotent credit fulfilment (prevents double-crediting)
• Daily nutrition summary — aggregate calorie and macro totals per day, shared within the Steady ecosystem

2.3 Data processed transiently (not stored by us)

When you use AI features (Pro or credits), anonymised nutrition data is sent to our Cloud Functions to generate AI responses. This data is processed in memory and is not stored by us:

• Daily macro totals — calories, protein, carbs, fat consumed and remaining
• Your macro goals — calorie and macro targets
• Your goal type — cut / maintain / bulk, and activity level
• Food item names are only included if you have enabled "Meal Data Sharing" in Settings
• No personal identifiers — your name or email are never included in AI requests

2.4 Data we never collect

• Location data
• Contacts or calendar access
• Device advertising identifiers
• Camera images — the camera is used only to read barcodes; no images are stored
• Financial account information — payment processing is handled entirely by Google Play and RevenueCat

3. How We Use Your Data

We use the data described above for the following specific purposes and no others:

• To authenticate you and maintain your purchase and credit status across reinstalls
• To sync your food diary data to the cloud so it can be restored on reinstall or device change
• To share your daily nutrition totals within the Steady ecosystem (SteadyForge and future apps)
• To generate personalised AI nutrition suggestions via Cloud Functions
• To process and fulfil in-app purchases idempotently (preventing duplicate credits)
• To crash-report and diagnose technical issues via Firebase Crashlytics

We do not use your data for advertising, profiling, or any purpose beyond operating the app.

4. Third-Party Services

Firebase (Google LLC)

Firebase provides authentication, our Firestore cloud database, Cloud Functions, App Check, and Crashlytics. Firestore stores only the fields listed in Section 2.2. Cloud Functions process AI requests server-side so the AI API key is never exposed to your device. Firebase App Check (Play Integrity on Android) verifies that requests come from a legitimate, unmodified version of SteadyFuel — it does not collect personal data.

Firebase Privacy Policy

Google Gemini API (Google LLC)

Gemini powers AI coaching features (Pro and Fuel Credits). Requests sent via our Cloud Functions include anonymised nutrition totals only — your Google identity, name, and email are never shared with Gemini. Per Google's API terms, data submitted via the Gemini API is not used to train AI models. All prompts include a hard system boundary — the AI is instructed to provide nutrition guidance only and must never provide medical or clinical dietary advice.

Google Cloud AI Data Use

Open Food Facts

The barcode scanner (Plus & Pro) queries the Open Food Facts API to retrieve product nutrition data. The barcode number is sent to their public API — no personal data is included in this request. Scanned food data is cached locally in ObjectBox so future lookups don't require a network call.

Open Food Facts Privacy Policy

RevenueCat

RevenueCat manages in-app purchases and subscription status. Your payment information is processed entirely by Google Play and is never visible to us or RevenueCat. RevenueCat stores a purchase receipt and your Google Play account identifier to validate subscription status.

RevenueCat Privacy Policy

5. Data Storage and Retention

Local device data

All food diary, custom food, template, and profile data is stored on your device using the ObjectBox local database. This data remains on your device until you uninstall the app or delete it within the app. We have no access to this data directly.

Firestore cloud data

Your Firestore record is retained for as long as your account is active. If you request deletion, we will delete your Firestore record within 30 days. Anonymous accounts that have been inactive for 12 months may be purged.

AI query data

We do not store your AI queries or nutrition data in our own database. Queries are processed in Cloud Functions and discarded. Google may retain API request data subject to its own retention policies for the Gemini API.

6. AI-Generated Content Disclosure

SteadyFuel uses AI to generate meal suggestions, nutrition analysis, and meal plans. Key points:

• AI-generated content is for general nutrition guidance and informational purposes only. It is not medical or clinical dietary advice.
• The AI is technically constrained to suggest foods, macros, and meal structures. It is explicitly prohibited from providing medical diagnoses, clinical dietary prescriptions for medical conditions, or any advice requiring a professional licence.
• AI suggestions are not a substitute for advice from a registered dietitian, nutritionist, doctor, or other licensed professional.
• Calorie and macro estimates in AI suggestions are approximations — treat them as guidance, not precise measurements.
• If you have a medical condition, eating disorder, or specific clinical dietary requirement, consult a qualified professional before following any AI-generated nutrition guidance.

These constraints are enforced at the system level in our Cloud Functions code — not merely as guidelines — but no AI system is perfect. Always apply your own judgement to AI-generated suggestions.

7. Purchases and Payment Data

All payment processing is handled by Google Play and RevenueCat. We never see or store your payment card information. When you make a purchase, Google Play processes the payment, RevenueCat validates the receipt, and we update your subscription tier or Fuel Credit balance in Firestore. Fuel Credit fulfilment is idempotent — each purchase token can only be processed once, preventing duplicate credits.

8. Your Rights and Choices

Access

Your local food diary data is accessible directly within the app at any time.

Deletion

You can delete all local data by uninstalling the app. To request deletion of your Firestore cloud record, delete your account directly from within the app in Settings → Account, or email us at [email protected]. We will process your request within 30 days.

AI data sharing opt-in

By default, only aggregate macro totals are sent to AI features — food item names are not included. You can opt in to full meal data sharing (which includes food names) in Settings → Meal Data Sharing. You can revoke this consent at any time and the setting takes effect immediately.

Opting out of AI features

AI features are entirely optional and user-initiated. You can use SteadyFuel as a fully offline macro tracker without ever using AI coaching. No AI queries will be sent if you do not use these features.

9. Children's Privacy

SteadyFuel is rated for general audiences on Google Play and is targeted at adults aged 18 and over. AI features involve third-party AI services. We do not knowingly collect data from children under 13. If you believe a child under 13 has used the app and you have concerns, please contact us at [email protected].

10. Data Security

We take reasonable steps to protect your data:

• All communication between the app and Firebase is encrypted in transit (TLS).
• Firebase App Check (Play Integrity) is enforced in production to block requests from modified or spoofed versions of the app.
• AI API calls are routed exclusively through server-side Cloud Functions — the AI API key is never included in the app binary or exposed to the client.
• Purchase fulfilment uses a transaction-safe idempotent check to prevent double-crediting.

No system is perfectly secure. We cannot guarantee absolute security, but we are committed to following industry best practices.

11. Changes to This Policy

If we make material changes to this Privacy Policy, we will notify you within the app before the changes take effect. The updated policy will also be posted here with a revised effective date. Continued use of SteadyFuel after the effective date constitutes acceptance of the updated policy.

12. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy, please contact us:

• Email: [email protected]
• Developer: David Hildebrand, Orivent Studios
• Location: Cape Town, South Africa

We aim to respond to all privacy-related enquiries within 5 business days.

13. Request Data Deletion

To request deletion of your SteadyFuel data, delete your account directly in the app under Settings → Account, or email us at [email protected].

Subject line: "Data Deletion Request – SteadyFuel"

Please include the device you used and the approximate date of first install. We will process your request within 30 days.

What gets deleted:

• Your Firebase user record (Auth)
• All Firestore data (nutrition summaries, tier, credits, purchase tokens)
• Google account link (Firebase Auth record)
• Name and email stored in Firebase Auth (if signed in with Google)

What is not deleted automatically: Local data stored in ObjectBox on your device — this is deleted when you uninstall the app.