Privacy policy

Your diary is not our database.

Last updated: 7 September 2026

Who is responsible

DishReveal is developed by Josh Waller, trading as Kovus, in Perth, Western Australia. Email josh@kovus.dev with a privacy question or request.

Adults only

DishReveal is for people aged 18 and over, and is not directed at children. Onboarding will not build a plan for an age below 18. Kovus does not knowingly collect information from a child. If you believe a child has provided information through the app, email josh@kovus.dev and it will be deleted.

Information kept on your iPhone

DishReveal stores its private diary in an on-device SQLite database. This includes:

• profile and onboarding answers, nutrition targets and unit preferences;
• meals, meal items, saved meals and local photo references;
• weight, water and exercise logs;
• streak state, reminders and app settings; and
• Coach threads, messages and generated cards.

This information is not synchronised to a Kovus diary database. Under the app's backup setting, it may be included in your own iPhone or iCloud device backup, which Apple controls. Removing the app can remove local data, subject to any backup you control.

Account and server records

You can complete onboarding without an account. After onboarding, Sign in with Apple is required before purchase, restore or use of the app. The diary still lives only on the device. The hosted service is used for authentication, subscriptions, AI features, request limits, temporary photo analysis, feedback and operational accounting.

The hosted service uses the following database tables. They are protected by row-level security and are not a second copy of your diary:

• scan_jobs for temporary upload ownership, expiry, delivery status and cleanup;
• barcode_cache for product records fetched from Open Food Facts, without a DishReveal user identifier;
• subscription_entitlements and revenuecat_webhook_events for purchase status and reliable webhook processing;
• feedback_submissions for feedback you choose to send;
• apple_revocation_tokens for an encrypted Sign in with Apple revocation credential;
• coach_thread_usage, report_jobs, api_rate_limits, external_api_rate_limits, ai_feature_quota_usage and meal_fix_usage for limits, delivery state and abuse prevention;
• ai_usage_events and ai_cost_alerts for model, token, cost and operational accounting; and
• referral_codes for invite and reward redemption.

AI usage records contain operational metadata such as the model, feature, token counts and estimated cost. They do not contain a meal photo, Gemini answer or diary entry. After account deletion, the user link on an AI usage record is removed. A redeemed referral record may remain to preserve a reward, but the deleted referred user's identifier is removed.

Meal photos and analysis

Before upload, the app resizes the longest image edge to no more than 1,024 pixels, re-encodes the image as JPEG and rejects a prepared file if an EXIF metadata segment remains. The JPEG is uploaded through a signed one-time URL to a private Supabase Storage bucket.

The analysis service downloads the photo and sends it to the Gemini API with an optional meal hint. DishReveal may briefly stage the structured result to complete delivery, then clears the result and removes the photo. It does not keep the photo or result as server-side diary history. If the normal path fails, expired upload jobs are processed by the cleanup service. Temporary job metadata can remain until the signed upload token has expired so the same path cannot be reused.

Text meal descriptions and correction requests are also sent to Gemini when you use those features. Dictation uses on-device speech recognition with your permission. Audio is not sent to the DishReveal backend or Gemini. You review the transcript before requesting an estimate; only the meal text you confirm is sent for that request. Nutrition-label OCR runs on your device. The label image and recognised label text are not sent to the DishReveal backend.

Coach and weekly reports

Coach sends your question, up to eight recent messages and a bounded numeric nutrition snapshot to Gemini. The snapshot can include up to 14 days of energy, macro, fibre, meal-count, goal and optional weight values. Weekly reports use up to seven days of numeric totals, goals and optional weights.

Kovus does not keep Coach answers or completed weekly report text on the server. Your Coach conversation and any locally cached report remain on your device.

Gemini processing

Google acts as the AI sub-processor for photo and text meal analysis, corrections, Coach answers and weekly reports. Google handles submitted content and service metadata under the Gemini API terms and related data-processing terms. Kovus's deletion of its own temporary copies does not control any limited provider retention required for security, policy enforcement or law.

Subscriptions

Pro is an optional subscription for AI meal estimates, photo analysis, Coach and weekly reports. The food diary, manual entries, barcode lookup and on-device nutrition-label scanning do not require Pro. Apple processes purchases. DishReveal uses RevenueCat to validate App Store transactions, maintain the Pro entitlement and restore purchases. RevenueCat can receive an app user identifier, device and operating-system information, Apple receipt information, purchase history and last-seen time. It does not receive your meal diary, photos, Coach messages or Apple Health data from DishReveal.

Read Apple's privacy policy and RevenueCat's privacy policy. Kovus does not receive your payment-card details. Current catalogue prices are listed on the support page and on the first paywall screen in the app.

Apple Health

Apple Health access is optional and requires your permission. When you connect Health, DishReveal requests permission to read steps, active energy and workouts, and to write dietary energy, protein, carbohydrate, fat and body mass. Connected Health writes dietary energy, protein, carbohydrate and fat when a meal is saved or edited, and body mass when a weight is logged. If Health is not connected or a write fails, the on-device diary still saves.

Apple Health values are handled on the device. DishReveal does not send Apple Health-derived values to its backend or to Gemini, and does not use them for advertising.

Feedback, notifications and diagnostics

If you send feedback, Kovus receives the category and message with your account identifier so the issue can be handled. Do not include information you do not want to submit.

DishReveal schedules its reminders locally on your device. Product events are written only to the development console in development builds. There is no third-party product-analytics SDK (including PostHog).

DishReveal sends crash and handled operational error reports to Sentry to diagnose faults. Diagnostic information can include the app version, device and operating-system information, stack traces, an installation identifier and approximate city or country derived from the network address. This information can be linked to a device. It is used for app functionality, not advertising or tracking across other companies' apps and websites.

DishReveal does not attach meal photos, screenshots or session recordings to these reports. Handled error reports are filtered before transmission to remove diary text, Gemini prompts and answers, and authentication tokens. Native crash reports use Sentry's separate crash-reporting path and server-side filtering. Read Sentry's privacy policy. Apple may also provide App Store or TestFlight crash reports under Apple's own service terms.

Retention and deletion

Local information remains until you delete it in DishReveal, delete your account and local data, or remove the app, subject to your own device backup.

Delete Account first removes any outstanding private scan uploads, revokes the stored Apple credential where available, deletes the Supabase Auth user and removes or unlinks linked server records according to the rules described above. DishReveal then wipes the local diary, Coach history, profile, settings, reminders and queued local uploads.

Deleting a DishReveal account does not cancel an Apple subscription. Cancel it separately in Apple ID subscription settings. Apple, RevenueCat, Google, Sentry and other service providers may retain records required by their own legal and operational obligations.

Security and international processing

Online requests use encrypted HTTPS connections. Private uploads require signed tokens and are restricted to JPEG files of no more than 3 MiB. Server tables deny direct client access unless a specific service path allows it. No system is completely secure, so do not put identifying or highly sensitive information in a meal hint, Coach question or feedback message.

Supabase, Google, Apple, RevenueCat and Sentry may process information outside Australia under their service terms and privacy arrangements.

Changes and contact

This policy will be updated when the app, providers or retention practices change. The current update date will remain at the top of this page.

Email josh@kovus.dev. You can also read the terms of use and methodology.