Papeo Privacy Policy

Who this policy covers

This policy applies to the Papeo iOS application, bundle identifier dev.evgenedoronin.Papeo, provided by Evgenii Doronin in Spain. Evgenii Doronin is the controller of personal information described here.

Questions and privacy requests can be sent through Papeo Support.

What goes where

Papeo uses different services for four limited jobs. It does not send every type of data to every provider.

Account and food records

Signing in is required. Firebase Authentication processes the Apple account identifier used to sign in and any name or email address Apple supplies.

Cloud Firestore stores the accepted document version, calorie and nutrition goals, food catalogue, confirmed diary entries, AI consent state, AI operation and quota records, and Premium status under the Firebase user ID. Firestore also keeps a system-managed persistent cache on the device so ordinary records remain available during a temporary loss of network.

Photo recognition

Photo recognition is optional and requires separate consent. Only after you choose Camera or Gallery does Papeo send the selected image to a Papeo Cloud Function in Google Cloud. The server validates and re-encodes the image, removes embedded metadata, and sends the resulting JPEG to Vertex AI in the European Union. Papeo uses the response only to return an editable meal draft. Nothing is saved to the diary until you review and confirm it.

Papeo does not store the photo or recognized food content on its server. It stores limited operation, rate-limit and credit records needed to prevent duplicate processing, control cost and apply the free or Premium allowance. Google states that Vertex AI customer data is not used to train its models. Content selected by automated abuse monitoring may be retained by Google in the same region for up to 90 days for authorized review.

You can withdraw AI consent in Settings. Manual food entry remains available without photo processing.

Purchases and subscriptions

Apple processes payments. Papeo uses RevenueCat with the Firebase user ID to load subscription products, validate Apple purchase receipts, determine access, restore purchases, prevent fraud, maintain the 360-result Premium allowance and view subscription performance.

RevenueCat may process purchase history, subscription status, app and operating-system version, locale, currency and limited network or request information under its Privacy Policy. Papeo does not send diary content or photos to RevenueCat and does not authorize purchase data for advertising or cross-app tracking.

Crash diagnostics and server logs

Release builds use Firebase Crashlytics to report uncaught technical failures. Papeo sends a fixed failure code and stack trace. It does not set a Crashlytics user identifier and does not intentionally send food names, grams, calorie goals, diary content, photos, free text, external-service response bodies or account secrets.

Google Cloud also keeps restricted operational logs for service reliability and security. Papeo application logs use allow-listed status and operation fields without the Firebase user ID or user content. Firebase Crashlytics generally retains crash data for 90 days; the Papeo Google Cloud project uses the default 30-day retention for operational logs.

Support communications

If you contact support, we receive the email address, message and attachments you choose to send. Do not attach food photos, health details or other private information unless it is strictly needed and you intentionally choose to share it. Support messages are used to reply, troubleshoot, prevent abuse and keep reasonable records of the request.

Advertising, tracking and health data

Papeo contains no advertising SDK, does not access the Apple advertising identifier and does not track you across apps or websites owned by other companies. Product analytics are not connected in the first release. Papeo does not read Apple Health data and is not a medical service. We do not sell personal information or share it for targeted advertising.

Retention and account deletion

Account and diary records remain while the account exists. In Settings, Delete account permanently removes the account profile and its Firestore subcollections, deletes the RevenueCat customer profile, deletes the Firebase Authentication record, signs out the current device and clears its Firestore cache. Another signed-in device clears its accessible cache when it detects that the account no longer exists.

• A temporary deletion lock containing the former Firebase user ID and technical timestamps remains for at least 24 hours and, if deletion is interrupted, until it can safely finish. It stops delayed writes from recreating data.
• Crash reports and restricted operational logs follow the retention periods described above and are not used to rebuild an account.
• Google may retain abuse-review content for the limited period described above.
• Apple retains its own purchase and transaction records under Apple’s rules. RevenueCat or other providers may retain limited records where required for security, fraud prevention, legal obligations or claims.

Deleting a Papeo account does not cancel an Apple subscription. You can manage or cancel it in Apple Account subscription settings. Papeo cannot cancel it on your behalf. If you later create a new Papeo account, restoration is subject to Apple and RevenueCat rules and may require support.

Legal bases and your rights

Where a legal basis is required, account, diary and subscription processing is performed to provide the service you request; security, fraud prevention, diagnostics and support are performed for legitimate operational interests; records may be retained to meet legal obligations; and consent is used for optional photo recognition where required.

Depending on where you live, you may request access, correction, deletion, restriction, objection or portability of personal information we hold. You may withdraw AI consent in the app and may complain to your local data-protection authority. Contact support to exercise a right that cannot be completed directly in the app.

International processing

Core Firestore and Cloud Function processing is configured in European regions. Google, RevenueCat, Apple and support infrastructure may also process limited information in other countries, including the United States. Where required, providers are expected to use lawful safeguards for international transfers. Apple handles its own services under Apple’s terms and privacy notices.

Children, security and changes

Papeo is not directed to children under 13. Photo recognition is available only to people who confirm they are at least 18. We use authenticated access, Firestore rules, App Check for AI, server-side validation and provider security controls, but no system can guarantee absolute security or availability.

We may update this policy when features, providers or legal obligations change. The page will show the latest date, and material changes will be communicated where required.