Privacy policy

Your diary is not our database.

Last updated: 23 October 2026

Who is responsible

DishReveal is developed by Josh Waller, trading as Kovus, in Perth, Western Australia. Email josh@kovus.dev with a privacy question or request.

Adults only

DishReveal is for people aged 18 and over, and is not directed at children. Onboarding will not build a plan for an age below 18. Kovus does not knowingly collect information from a child. If you believe a child has provided information through the app, email josh@kovus.dev and it will be deleted.

Information kept on your iPhone

DishReveal stores its private diary in an on-device SQLite database. This includes:

• profile and onboarding answers, nutrition targets and unit preferences;
• meals and their meal types (breakfast, lunch, dinner or snack), meal items, saved foods, favourites, recipe ingredients, quantities, yields, notes, versions and drafts;
• extra nutrient details, such as saturated fat, calcium or net carbs, for meals logged from a nutrition label, an Open Food Facts barcode or a USDA food (photo and description estimates never add them);
• optional saved meal photos, progress photos and local photo references;
• weight, water and exercise logs;
• the optional fasting timer's schedule, start and end times and the result of its safety check;
• streak state, earned milestones, reminder times, quiet hours and app settings; and
• Coach threads, messages, generated cards and report history.

This information is not synchronised to a Kovus diary database. Under the app's backup setting, it may be included in your own iPhone or iCloud device backup, which Apple controls. Removing the app can remove local data, subject to any backup you control. Meal types, extra nutrient details, progress photos, milestones and fasting records are not sent to Coach, weekly reports or an AI provider.

You can export your diary, saved foods, recipes and drafts, nutrition details, settings and progress as JSON, up to 32 MB. The file is created on your device and shared only where you choose. It excludes internal delivery queues and temporary photo and acknowledgement handles. Archiving a recipe keeps its versions locally and in exports until you delete it fully. You can also export your meals as a spreadsheet (CSV) for your own analysis. Like the JSON file, it is plain text created on your device and shared only where you choose; it cannot be restored.

You can restore a DishReveal export from Settings → Export and restore, or from the Welcome screen after reinstalling. The app reads only the file you choose, up to 32 MB for JSON or 64 MB for a photo ZIP, checks every record on your device and shows what it holds before anything changes. Merge adds what this device is missing and keeps entries already here; Replace removes the local diary and restores the file. The file and its contents are not sent to Kovus or any provider. Restoring does not change your account, subscription or Apple Health, and reminder switches stay as they are on the device. Pro comes from your Apple ID, not from the file.

If you turn on the optional fasting timer, its start and end times, your chosen schedule, the result of its safety check and the latest device-clock time used to enforce its limits stay in the local database. Your answers to the safety questions are not saved. Fasting history is included in export and deleted with local data, and it is never sent to Coach, weekly reports, Apple Health or our servers.

Optional saved meal photos

Keeping a reduced, metadata-stripped photo with a meal is off by default when saving a scan. You can also add, replace or remove a photo from meal detail without asking AI to analyse it. These retained photos stay in the app's storage on your device and may be included in your own device backup. Kovus does not keep a server photo library or provide photo sync.

Removing or replacing a photo deletes its local file once no other entry needs it. A deleted meal's photo is kept while Undo is available; interrupted cleanup is retried. Full local or account deletion also removes saved meal photos. This does not remove an original selected from Apple Photos, an exported copy or an earlier device backup. Photos taken inside DishReveal are not automatically added to Apple Photos.

In Settings, Export and restore, Export without photos creates a private JSON file that excludes photographs. Export with photos creates a ZIP and file manifest on your device, up to 64 MB, and shares it only where you choose. JSON export remains available for larger photo collections. Restoring a ZIP export brings its photos back into the app's own storage on your device: each one is checked again and kept only if it is still a metadata-free JPEG. Exporting or restoring does not send photos to Kovus. Signing in does not download a diary or photos from a DishReveal server.

Optional progress photos and milestones

Progress photos are optional. You can take one in DishReveal or choose one from your library to compare how you look over time. DishReveal keeps them in the app's storage on your iPhone, in their own folder, reduced to at most 1,440 pixels on the longest side and re-encoded without metadata. When you choose a photo from your library, DishReveal reads only its capture date, to suggest the photo's date; location and other photo metadata are not kept. DishReveal never uploads progress photos or sends them to Coach, weekly reports or any AI provider, and Kovus keeps no server copy. DishReveal has no share button for them. In the gallery they stay blurred until you choose Show photos, on every visit. A photo you open, or a pair you compare, is shown in full.

Each photo keeps its date, a pose label you choose (Front, Side, Back or Other) and, if you add one, a weigh-in for that date. That weigh-in is an ordinary local weigh-in and follows the same rules as any other: if you have connected Apple Health, it is written there; if you use Coach or weekly reports (Pro), it can be among the dated weight entries they send; and it is in your export. The photo itself is not written to Apple Health or sent to Coach or reports. Deleting a progress photo removes the DishReveal copy; a weigh-in saved with it stays. Full local data deletion and account deletion remove every progress photo and its folder, and interrupted cleanup is retried.

Your private JSON export includes each photo's date, pose, size and linked weigh-in, but not the image or its file name. Photo files are added to a ZIP export only if you switch that on. Progress photos may be included in your iCloud or device backup. Deleting them in DishReveal does not delete the original you chose from Apple Photos, exported copies or copies in an earlier device backup. Photos taken inside DishReveal are not added to Apple Photos.

Milestones and your year in review are calculated on your iPhone from your local diary. Earned milestones are stored in the local database with the date each was reached, are included in your JSON export and are deleted with your local data. Nothing about them is sent to our backend or an AI provider. A milestone or year card becomes an image only when you tap Share. It contains only the items switched on in the share screen (stats start off) and goes only where you choose.

Account and server records

Sign in with Apple is optional and comes after your personalised plan in setup. The free local diary works without an account; online and account features require sign-in. Your email address or Apple relay address is used for authentication. When Apple supplies your name, DishReveal stores it with your account. The diary still lives only on the device. The hosted service is used for authentication, subscriptions, online food search, barcode lookup, AI features, request limits, temporary photo analysis, feedback and operational accounting.

The hosted service uses the following database tables. They are protected by row-level security and are not a second copy of your diary:

• scan_jobs for temporary upload ownership, expiry, delivery status and cleanup;
• barcode_cache for product records fetched from Open Food Facts, without a DishReveal user identifier;
• subscription_entitlements and revenuecat_webhook_events for purchase status and reliable webhook processing;
• feedback_submissions for feedback you choose to send;
• apple_revocation_tokens for an encrypted Sign in with Apple revocation credential;
• coach_thread_usage, report_jobs, api_rate_limits, external_api_rate_limits, ai_feature_quota_usage, ai_quota_claims and meal_fix_usage for limits, free AI meal log counters, delivery state and abuse prevention;
• ai_usage_events and ai_cost_alerts for model, token, cost and operational accounting.

AI usage records contain operational metadata such as the model, feature, token counts, timestamps and estimated cost. They do not contain a prompt, meal photo, AI answer or diary entry. Account deletion removes the account link; cleanup removes the remaining anonymous cost records after 90 days. Anonymous daily AI budget totals and random request identifiers are kept for up to eight UTC calendar days without account, purchase, diary, prompt or photo data.

Food search and barcode lookup

My foods searches your saved and recent foods on this device. Choosing Search online sends your search words through our backend to USDA FoodData Central. We do not send your account identifier, diary history, photos or audio to USDA. Our backend does not keep the query as search history; it keeps request-limit counters. USDA receives the search words and our server's network address, and processes them under its own service terms. Kovus does not control USDA's logging or retention.

Online search needs an account and internet connection, but not Pro. Results use USDA's English food descriptions, including reference ingredients and Survey (FNDDS) dishes, which may differ from your recipe. Review the food, preparation and portion. When you log a result, its reference nutrition and source stay in your local diary and remain available offline.

Barcode lookup requests product information from Open Food Facts. Product records may be cached globally without a DishReveal account identifier. Neither catalogue is an AI estimate or a measurement of your individual meal.

Barcode and online search requests can also ask for extra public nutrient values, such as fat types, cholesterol, potassium, calcium, iron and vitamins A and C. That request adds no personal data and no new provider. Net carbs are calculated on your device. These details are stored with the meal in your local diary and export, and are not sent to Coach, weekly reports or an AI provider.

Meal photos and analysis

Before upload, the app resizes the longest image edge to no more than 1,024 pixels, re-encodes the image as JPEG and rejects a prepared file if an EXIF metadata segment remains. The JPEG is uploaded through a short-lived signed URL to a private Supabase Storage bucket.

The analysis service downloads the photo and sends it to Google's Gemini API, with the Anthropic backup described below. Upload records do not keep a meal hint or correction text. The temporary upload is deleted before a successful analysis response is returned. The result is returned in that response, without a server-side diary copy. If deletion fails, the result is withheld and the scan allowance is released; cleanup retries outstanding deletion. Temporary job and deletion metadata can remain until signed upload access has expired. The providers' separate retention is described below.

Text meal descriptions and correction requests follow the same Google-first processing and consented Anthropic backup when you use those features. When you correct a scan, the request includes your selected photo, current estimate and correction text. Photo analysis and meal descriptions use Pro or one of your free AI meal logs (see Subscriptions). Dictation uses on-device speech recognition with your permission. DishReveal does not keep a recording or upload audio. You review the transcript and any local text cleanup before tapping Estimate meal; only the text you confirm is sent for that request. Nutrition-label OCR runs on your device. The label image and recognised label text are not sent to the DishReveal backend or an AI provider.

Coach and weekly reports

When you agree to send a Coach question, your device sends the question, up to eight recent messages in the thread and a fresh bounded numeric summary through our backend to Anthropic, with the Google fallback described below. The summary can include up to 14 dated days of calories, macros, fibre and meal counts; goals and target weight; up to 14 dated weight entries; and the local date, timezone, display units, summary window and reasons some days were omitted. A day whose entries use different carbohydrate definitions is sent without its carbohydrate figure. The summary also carries a GLP-1 medication-mode flag; the current app has no switch for that mode and sends it as off. Both Coach consent prompts name the timezone and this flag.

If you turn on exercise add-back and today's activity earns a credit, the Coach summary can also include that credit, your chosen 50% or 100% share, and today's energy target including the credit. Your device calculates it from Apple Health active energy and the exercise you log. These values are sent only when the Coach consent prompt names them and you agree. At 100%, the credit reveals the activity total rounded to the nearest kilocalorie; at 50%, it reveals half of that total, rounded. The add-back goes to Anthropic through our backend. Google fallback requests leave out these fields, but still include recent messages, which can repeat the figures if you or an earlier answer mentioned them.

Other than that optional add-back, the numeric summary excludes individual meals, meal types, extra nutrient details, water, activity, fasting records, progress photos and Apple Health records. Raw Health samples, workouts, steps and your exercise log are not sent. Information you type in a question or message is still submitted with that text.

Weekly reports use a separate summary of up to seven days of numeric nutrition totals, goals and optional weights, with the same omission of mixed-definition carbohydrate figures. They do not receive the exercise add-back. The server does not open or synchronise your diary. It does not retain a completed Coach prompt or answer as user content; your Coach conversation stays on your device.

In app versions whose report consent names both Google and Anthropic, a new report is generated during the request and returned directly. The server keeps completion and period metadata, but no copy of the submitted summary or completed report. A lost response cannot be recovered from the server. If the app received the report but could not save it, you can retry that save on the device.

Older Google-only report requests use the provider's batch workflow. A completed batch report can be held on the server until your device collects it or its 24-hour expiry, after which cleanup removes it. If delivery is interrupted, you can request the same completed report from its existing provider batch within 24 hours; this does not generate another report. The service resumes an existing pending or recently completed batch report before creating a new one. Operational job metadata preserves its original period across midnight. Locally saved reports remain on your device until you delete them.

New AI requests include your selected app language. Previously saved results are not automatically translated when you change language. Language support depends on the installed app version. Device-language preferences are used locally, and changing the interface language does not translate USDA's English food descriptions. Recorded meals do not prove a full day's intake, and these features provide general wellness information rather than medical advice.

Coach first screens your question on your device. A matching question about severe restriction, purging or another immediate safety concern receives a support message there and is not sent to Kovus or an AI provider. If that check cannot run, the question follows the normal consented request to the server, which also screens questions and generated answers. When Coach shows the safety support message, it stops nutrition optimisation and asks you to contact a local health professional, eating-disorder support service or emergency service; it does not look up country-specific services. If the fasting timer is on, the app pauses it on your device. Other provider refusals can receive a brief support response without pausing the timer. No fasting data is sent to Coach.

AI provider processing

Photo analysis, photo corrections, text meal estimates and weekly reports use Google's Gemini Developer API first. In versions whose consent prompt names both Google and Anthropic, the same submitted data may be sent to Anthropic's Claude API as a backup if Gemini cannot be reached, times out, is rate-limited, returns a server error, or reports exhausted credit or explicitly disabled billing. The prompt identifies the photo, correction, meal description or report summary and both providers' retention before you send. Declining sends nothing, and the local diary remains usable. Older versions with Google-only consent stay on Gemini. Other authentication, permission or configuration failures, a provider refusal, or a DishReveal usage or spending limit do not trigger this backup.

Coach uses Anthropic's Claude API. If Anthropic is unavailable before any answer text arrives, DishReveal may send the same Coach request once to Google's Gemini instead, leaving out the exercise add-back fields as described above. One answer does not combine Google and Anthropic text. The Coach consent prompt names both providers and their retention before each send; older versions whose prompt names only Google keep Coach on Gemini.

Google handles submitted content and service metadata under the Gemini API terms and related data-processing terms. Deleting Kovus's temporary upload or response does not delete Google's separately retained processing records.

Google's current abuse-monitoring policy specifies 55 days of retention for prompts, context and generated output. Authorised personnel may review flagged content. Google's paid-service restrictions on using submitted content to improve its products are separate from this retention; they do not mean zero retention. See Google's data-retention guidance.

Anthropic processes submitted content under its Commercial Terms and Data Processing Addendum. Its training policy says API inputs and outputs are not used to train its models by default.

Anthropic's commercial retention policy describes deletion of API inputs and outputs within 30 days. Content flagged as violating its usage policy can remain for up to two years, and associated safety-classification scores for up to seven years. Law or policy enforcement can require longer retention. Its developer retention guidance also describes non-retention by default, while directing standard-service users to the commercial policy. These disclosures use the ordinary commercial retention period; we do not promise zero retention for these features.

Coach also permits Anthropic to retry a refused request on its recommended model for that refusal category; the recommendation can change. Anthropic's routing record stores a hash of the conversation prefix and the serving model for about an hour, without the message content. The photo, correction, text and report backup does not enable this provider-managed retry.

Subscriptions

Pro is an optional subscription for AI meal estimates, photo analysis, corrections, Coach and weekly reports. The diary, manual entries, food search, barcode lookup, on-device nutrition-label scanning, optional local meal and progress photos, milestones and the fasting timer do not require Pro.

If you sign in with Apple and do not have Pro, you get three AI meal logs by photo or description and three corrections at no cost, for the life of your account. A log only counts when an estimate is delivered. Free AI requests are also capped at 12 attempts for the life of the account, whether or not they return an estimate. The photos and descriptions are handled exactly as described above for photo analysis and meal descriptions; nothing extra is sent or kept. To enforce the allowance, Kovus keeps counters and opaque request identifiers with your account, which are removed when you delete your account. A shared counter that limits how many free requests the service admits each hour has no account identifier. After the free logs are used, photo scans, spoken or typed estimates and scan fixes require Pro. Coach and weekly reports require Pro.

Apple processes purchases. DishReveal uses RevenueCat to validate App Store transactions, maintain the Pro entitlement and restore purchases. RevenueCat can receive an app user identifier, device and operating-system information, Apple receipt information, purchase history and last-seen time. It does not receive your meal diary, photos, Coach messages or Apple Health data from DishReveal.

Read Apple's privacy policy and RevenueCat's privacy policy. Kovus does not receive your payment-card details. Current catalogue prices are listed on the support page and on the first paywall screen in the app.

Apple Health

Apple Health access is optional and requires your permission. When you connect Health, DishReveal requests permission to read steps, active energy and workouts, and to write dietary energy, protein, carbohydrate, fat and body mass. Connected Health writes dietary energy, protein, carbohydrate and fat when a meal is saved or edited, and body mass when a weight is logged. If Health is not connected or a write fails, the on-device diary still saves.

Apple Health samples are handled on your device and are not used for advertising. If you enable exercise add-back and agree to the Coach prompt that names it, today's derived energy credit, your chosen percentage and adjusted target are sent through our backend to Anthropic as described above. Raw Health samples, workouts and steps are not sent. Google fallback requests omit the add-back fields, but recent conversation messages can repeat figures already mentioned. Weekly reports do not receive this add-back.

Feedback, notifications and diagnostics

If you send feedback, Kovus receives the category and message with your account identifier so the issue can be handled. Do not include information you do not want to submit.

DishReveal schedules its reminders locally on your device, including chosen reminder times, meal check-ins, free-trial reminders and the fasting timer's planned-end alert. Reminder times and quiet hours stay in the app's settings on your device; no diary content, reminder setting or schedule is sent to a server or provider. Trial reminders use the trial end date and renewal status DishReveal already receives from Apple through RevenueCat. Product events are written only to the development console in development builds. There is no third-party product-analytics SDK (including PostHog).

DishReveal sends crash reports, reports of the app freezing or being closed by iOS, and handled operational error reports to Sentry to diagnose faults. Diagnostic information can include the app version, device and operating-system information, stack traces, an installation identifier and approximate city or country derived from the network address. This information can be linked to a device. It is used for app functionality, not advertising or tracking across other companies' apps and websites.

DishReveal does not attach meal photos, screenshots or session recordings to these reports. Handled error reports are filtered before transmission to remove diary text, AI prompts and answers, and authentication tokens. Native crash and app-freeze reports use Sentry's separate crash-reporting path and server-side filtering. Read Sentry's privacy policy. Apple may also provide App Store or TestFlight crash reports under Apple's own service terms.

App updates

Each time DishReveal opens, it asks Expo, our app-delivery provider, whether a fix is available for your version of the app. The check sends the app version and update channel, the device platform, the fix currently installed and a random identifier created for this installation. Expo also receives the network address of the connection.

If the app closed because of an error the last time you used it, the next check also includes a short technical description of that error, so a faulty fix can be withdrawn. The app does not attach your diary, photos, Coach conversations or account records to update checks. A technical error description may contain text included in the error. We use update checks only to deliver fixes, not for advertising or tracking across other companies' apps and websites. Deleting the app removes the identifier. Read Expo's privacy policy.

Withdrawing consent and your choices

You can change your mind at any time:

• AI features: DishReveal asks before each photo, correction, meal description, Coach question or weekly report is sent, and does not remember a yes for later requests. Choose Cancel, or stop using AI features, and nothing more is sent to Google or Anthropic. Information already sent stays subject to the provider retention described above.
• Apple Health: turn exercise add-back off in DishReveal's Settings, and change or remove DishReveal's Health access in the Health app or iOS Settings. Removing access stops new reads and writes; samples DishReveal already wrote stay in Health until you delete them.
• Camera, photos, microphone and notifications: change these permissions in iOS Settings at any time. Reminders can also be turned off in DishReveal's settings.
• Your account: Sign out on this device in Settings keeps your diary on the device and deletes nothing. Delete account and data in Settings removes your account and server records as described below. You can also email josh@kovus.dev to ask about or request deletion of your information.

Retention and deletion

Local information remains until you delete it in DishReveal, delete your account and local data, or remove the app, subject to your own device backup.

Delete account and data first removes outstanding private scan uploads, revokes the stored Apple credential where available, deletes the Supabase Auth user and removes or unlinks linked server records according to the rules above. After server deletion is confirmed, DishReveal wipes the local diary, saved foods, recipes, drafts, favourites, saved meal photos, progress photos, milestones, fasting records, Coach history, reports, profile, settings, reminders and queued uploads, and cancels any pending fasting alert.

If deletion is interrupted, a protected request stays on your device so you can retry. You can return to the app while confirmation is unresolved; retrying deletion will erase the diary then on this device. Stopping further attempts cannot restore anything already deleted by an earlier request. To delete your current account, start a new request in Settings.

Account deletion also attempts to remove nutrition and weight samples DishReveal wrote to Apple Health. It cannot remove another app's records. If Health write permission has been revoked, you may need to remove DishReveal's samples in the Health app. This cleanup stays on your device.

Deleting a DishReveal account does not cancel an Apple subscription. Cancel it separately in Apple ID subscription settings. Apple, RevenueCat, Google, Anthropic, Sentry, Expo and other service providers may retain records required by their own legal and operational obligations.

Security and international processing

Online requests use encrypted HTTPS connections. Private uploads require signed tokens and are restricted to JPEG files of no more than 3 MiB. Server tables deny direct client access unless a specific service path allows it. No system is completely secure, so do not put identifying or highly sensitive information in a meal description, correction, Coach question or feedback message.

Kovus shares personal information only with the service providers named in this policy, and only for the purposes it describes. Each processes it under service terms that require them to protect it, and Kovus expects that protection to be at least equal to the protection this policy describes.

Supabase, Google, Anthropic, Apple, RevenueCat, USDA, Open Food Facts, Sentry and Expo may process information outside Australia under their service terms and privacy arrangements. Anthropic's data-residency documentation permits inference in available regions unless a geographic restriction applies, and places stored workspace data in the United States.

Changes and contact

This policy will be updated when the app, providers or retention practices change. The current update date will remain at the top of this page.

Email josh@kovus.dev. You can also read the terms of use and methodology.