CONSUMER HEALTH DATA PRIVACY NOTICE
Effective date: [DATE]
Last updated: [DATE]
This notice is separate from our Privacy Policy on purpose. It exists because Tasty Shreds is a food and weight tracker, and what you log about your body and your eating is consumer health data under the Washington My Health My Data Act, Nevada’s consumer health data law, and similar laws. It applies to everyone who uses Tasty Shreds, wherever you live. Where this notice and the Privacy Policy differ about health data, this notice controls.
1. Who is responsible
Tasty Software LLC (“we”), the operator of the Tasty Shreds app and gettastyshreds.com. Contact: [email protected] · [BUSINESS MAILING ADDRESS].
2. What consumer health data we collect, and why
We collect only what the features you use need. Each category below is collected to provide the feature you asked for; nothing is collected for advertising, profiling, or resale.
| Category | What it is | Why we collect it |
|---|---|---|
| Body measurements | Weight, and any optional measurements (waist, hips, etc.) you log, with dates | To chart your progress and compute your targets |
| Profile stats | Height, biological sex, date of birth, activity level | To calculate your calorie and protein targets with a standard equation (which depends on age), and to confirm you are 18 or older |
| Goals | Your chosen direction (lose, maintain, gain), rate, and target weight | To set your daily targets and apply our safety limits |
| Food diary | Foods, recipes, and portions you log, and the resulting calorie and macro totals | To show your diary and totals against your goals |
| Progress photos | Photos of your body you choose to add, and the date of each | So you can compare your own progress. Collected only with your separate opt-in consent (see Section 4) |
| Saved meals and favorites | Meals and foods you save for quick logging | To make logging faster |
| Imported history | Diary and weigh-in history you choose to import from another app | So you can keep your record |
| Voice search text | The text your phone produces when you use voice search for a food | To run the search. We never receive or store audio |
We do not collect precise location, biometric identifiers (face or fingerprint templates), genetic data, or anything about your reproductive or sexual health. We do not use geofencing. We do not infer health conditions from your data.
Your date of birth is used to confirm you are 18 or older and is kept so your targets stay accurate as you age. If a store (Apple or Google) tells us an account belongs to a minor, we block it and use that signal for nothing else.
3. Where it comes from
Only from you: what you type, scan, speak, or photograph in the app or on our website, and what you choose to import. We do not buy or receive health data about you from anyone else. If you grant a store’s age signal (Apple or Google), we use it only to confirm you are an adult.
4. Consent
- Core features. Collecting the data in Section 2 is necessary to provide the tracking and recipe service you signed up for, and you control what you log. You can stop logging at any time.
- Progress photos are collected only after you read a notice in the app and tap “I agree”. You can withdraw that consent at any time in Settings (“Turn off & delete all photos”), which deletes every photo.
- We will ask for your separate consent before any new use or sharing of your health data that this notice does not already describe.
5. How we share consumer health data
We do not sell consumer health data. We do not share it for advertising. We do not share it with data brokers, ad networks, social platforms, or affiliates. We have no affiliates.
The only parties that process your health data do so on our behalf, under contract, and only to run the service:
| Processor | What they do | What they receive |
|---|---|---|
| Supabase, Inc. (US servers) | Database, authentication, file storage, server functions | Your account and everything you log, including progress photos (stored in a private area only your sign-in can open) |
| Cloudflare, Inc. | Network, security, and delivery in front of our website and servers | Requests pass through their network in transit; recipe images and the website are served from it |
The following receive no health data:
| Service | What they do | What they receive |
|---|---|---|
| PostHog (product analytics) | Counts what features are used | Named usage events such as “logged a food” or “saved a goal”, with no food names, quantities, weights, measurements, photos, or target numbers |
| Sentry (crash reporting) | Tells us when the app crashes | Technical error details, with personal data sending turned off |
| Stripe, Apple, Google, RevenueCat (billing) | Process your subscription | Billing details only |
| Resend (transactional email) | Delivers account and subscription emails | Your email address and the email content, which never includes health data |
The only way a progress photo leaves your account is when you tap Save or Share on it: that goes straight from your phone to your photo library or to the app you pick, and is your choice each time. If a law requires us to disclose data, or it is needed to protect someone’s safety, we may do so, and we will tell you unless the law forbids it.
6. Your rights
You can, at any time and at no charge:
- Confirm and access what consumer health data we hold about you, and get a copy, including the list of anyone we shared it with (today: the processors in Section 5).
- Withdraw consent to any collection or sharing that was based on consent (progress photos: Settings → Progress photos → Turn off & delete all).
- Delete your consumer health data. Delete individual entries and photos in the app, or delete your whole account at Settings → Delete Account. Deletion is real: your data is erased from our live systems and from backups within
[30]days, and we instruct our processors to do the same. - Appeal a decision we make about a request (Section 7).
To exercise access or deletion by request rather than in the app, email [email protected] from the address on your account, or write to the mailing address above. We will confirm your identity using your account, never by asking for more health data. An authorized agent may act for you with your written permission. We respond within 45 days; if we need longer we will tell you why, once, for up to 45 more days.
We will never deny you service, charge you more, or lower the quality of what you get because you exercised a right.
7. Appeals
If we deny a request, reply to our decision or email [email protected] with “Appeal” in the subject within 60 days. A different person will review it and answer in writing within 45 days with the reasons. If you are in Washington and we deny your appeal, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint. Residents of other states may contact their state Attorney General.
8. Security and retention
Health data is stored encrypted at rest, transmitted over encrypted connections, and accessible inside the company only to the people who operate the service and provide support. Progress photos can be read only through your own signed-in session; no administrator role can open them. We keep your health data while your account exists and for the deletion window after you close it. Anonymous, aggregate statistics (for example, how many foods were logged in a month) contain no health data and may be kept.
9. Changes
We will post changes here with a new effective date. If a change would expand how we collect or share consumer health data, we will ask for your consent first.
10. Contact
[email protected] · [BUSINESS MAILING ADDRESS]
This notice is linked from the footer of gettastyshreds.com, from the Privacy Policy, and from Settings in the app.