How a request travels
Four hops, and it stops being anything about you at the first one. Your iPhone reads the receipt locally and sends food text to our gateway; the gateway strips the device identity, picks a model by price and capability, and forwards the text to a broker; the broker calls the model vendor; the answer comes back the same way. No hop after the first knows which device asked.
Apple
Distribution & paymentsSells the app and the subscription, runs App Attest and — if you switch it on — Apple Health. Apple holds your payment details and your Apple Account; we never see them. Governed by Apple's own terms and privacy policy.
OpenRouter
Model brokerOur primary route to models. Receives the food text of a single request and returns the answer. Gets no device identifier and no account. Where a model is available through a zero-data-retention supplier, we ask for that route.
Second broker[to confirm — name at launch]
Model brokerA cheaper second supply for the routine jobs — turning receipt lines into products, estimating nutrition. Same data, same absence of identity; it exists so the app can stay affordable when one supplier raises a price.
Model vendors
Reached through a brokerThe models themselves come from the large labs — Anthropic, OpenAI, Google and open-weight vendors among them. Which one answers is a routing decision made per request on price and capability, so the honest statement is the category rather than a fixed name. None of them receives anything that identifies you or your device.
Hosting[to confirm — provider and region]
InfrastructureRuns the gateway and its Postgres database — the usage ledger, device records and hashed session tokens described in the Privacy Policy. Intended to sit inside the EU.
Email delivery[to confirm — provider]
Waitlist onlyHolds waitlist email addresses and sends the one message announcing the beta. Nothing else is stored against an address — no open tracking, no click tracking, no segments.
Who is not on this list
No analytics vendor, no advertising network, no crash-reporting SDK that carries content, no data broker, no CRM. If one of those ever becomes necessary, it appears here before it is switched on.
Changes to this list
Model routing changes often; the roster of brokers and infrastructure rarely. We update this page when a subprocessor is added or removed, and waitlist members and app users get notice of a change that materially affects them. To be told about every change, write to [email protected] and we'll add you to the list.