Privacy Policy

Last updated 4 November 2026

Foodpile is run by Refleksion · Planlægning · Handling (CVR DK45818659), a small Danish company. It is the data controller for the personal data described on this page. Write to privacy@foodpile.app with any question about it.

Foodpile stores what you log so that you and your assistant can see it again. It does not sell your data, shows no ads, and shares nothing for advertising. Foodpile is a datastore, not an AI service: the server calls no AI models. Your own assistant does the estimating.

Health information and your consent

Much of what you log says something about your health: what you eat and drink, your weight and body measurements, fasts, caffeine, water, supplements and activity. Under the GDPR this is health data, a special category of personal data. Foodpile stores it only to provide the service to you: to show it to you and to the assistants you connect yourself.

Foodpile stores health data only with your explicit consent (GDPR article 9(2)(a)). The first time you sign in, before anything is stored, Foodpile shows a page about what is stored and why, and you give your consent by ticking a box. If your account is older than that page, you are asked once, the next time you open Foodpile. Connecting an assistant shows the same statement and the same box if you have not answered yet. Until you have consented, Foodpile stores and shows nothing for you, in the app or through an assistant.

You can withdraw your consent at any time by deleting your account under Settings, or by writing to us. The processing then ends and your data is deleted. Foodpile cannot be used without storing what you log. Withdrawing does not make the processing before it unlawful.

Foodpile gives no medical advice and is not a medical device. Calorie goals, macros and forecasts are estimates.

What we store

Account: your email address, which you sign in with and which the few mails Foodpile sends go to. If you sign in with Google, Google confirms the address to Foodpile, and Foodpile keeps the address and nothing else from your Google account.
Profile and body data you enter: name, weight, goal weight, height, age, sex, activity level, time zone, bedtime, and your unit choices (kcal or kJ, kg or lb).
Goals: your calorie and macro goals, and when the calorie goal changed.
What you log: meals and food items (name, calories, protein, carbs, fat, fibre and time), activities, weigh-ins, body measurements, water, caffeine, supplements, fasts, and days you mark as neutral.
Your own short description: with a meal, an activity or a caffeine entry, your assistant may also store a short description of that one entry in your own words (at most 200 characters), never the rest of the conversation. You see it with the entry when your assistant reads your log, and in your data export. Your assistant can change or remove it, and it is deleted with the entry.
Reminders: if you turn on notifications, your browser's push subscription for that device (an address at the browser's push service and its keys) and the day the daily reminder last went out.
Signing in: a session for each browser you are signed in on, and the sign-in links you ask for.
Connected assistants: which assistants you approved and when, and the access they were given. Their access tokens are stored only as hashes, never in the clear.
Use by assistants: when your assistant last called Foodpile, counters of how many calls were made today and this minute, on which days a limit was reached, and short-lived markers (2 to 3 minutes) that stop a repeated call from logging the same thing twice.
Service figures: for each call to the MCP server, the tool's name, how long it took and whether it worked. Not who called and not what it carried. Only Foodpile's operator sees them.
Errors: when a request to Foodpile fails unexpectedly, the address it went to (without anything after the ?), the method and the error the code gave, which can quote a little of what the request carried. Not who made it. Only Foodpile's operator sees them.
Protection against misuse of sign-in mail: counters per email address and per IP address (for IPv6 its /64 network), for the hour they count.

Why, and on what basis

To provide the service you asked for (contract, GDPR article 6(1)(b)): your account, signing in, storing and showing what you log, reminders you turned on, and the assistants you connect.
Health information: your explicit consent (article 9(2)(a)), as described above.
To keep the service running and safe (legitimate interest, article 6(1)(f)): the limits on assistants' calls, the caps on sign-in mail, the service figures and error logs.

We do not use your data for advertising, for profiling or to train AI models, and we do not sell it.

Who else receives data

Cloudflare: runs Foodpile and stores the data (the database, and a key-value store for sign-in and connected assistants), and sends Foodpile's mails through Cloudflare Email Service. Cloudflare is our processor.
Resend: sends a mail only when Cloudflare cannot. Resend then receives your email address and the mail. Resend is our processor.
Google: only if you choose Continue with Google. Google signs you in and tells Foodpile your email address. Foodpile sends Google nothing about what you log. Google handles your sign-in under its own privacy policy.
Your browser's push service (for example Google, Apple, Mozilla or Microsoft, depending on the browser): delivers the reminders to your device, if you turned them on. The message is encrypted so that only your device can read it.
healthchecks.io: receives a signal every hour that Foodpile's scheduled jobs ran. Once a day the signal carries the ids of users who often reach a limit. Random ids only, never email addresses or health information.
The AI assistants you connect yourself (for example Claude, ChatGPT or Mistral): when your assistant calls one of Foodpile's tools, it receives what the tool returns, which can be health information you logged. It gets data only from your account, only while it is connected, and only when it asks. What the assistant's provider does with it falls under that provider's own terms and privacy policy.
No advertisers, no analytics companies, no data brokers. Authorities only where Danish or EU law requires it.

Where the data is

Foodpile's database is in one of Cloudflare's data centres in Europe. Cloudflare's network answers each request from a data centre near you, and the key-value store that holds sign-in and connected assistants is replicated across Cloudflare's network. So some data passes through or is held outside the EU/EEA, and Resend is based in the US. Such transfers follow the processors' data processing agreements with the EU's standard contractual clauses.

How long we keep it

Your account and everything you log: until you delete it, one entry at a time or the whole account.
Sessions: 30 days, or until you sign out. Sign-in links: 15 minutes, and they are deleted once used or expired.
Push subscriptions: until you turn notifications off, the browser drops the subscription, or you delete your account.
Connected assistants: until you disconnect them or delete your account. Their access tokens run out after 30 days and are renewed while the assistant is in use.
Counters for calls and sign-in mail: until the minute, hour or day they count is over. On which days a limit was reached: 30 days, and deleted with the account.
Service figures (with no user): 30 days. Unexpected errors: 30 days. Error logs at Cloudflare: at most 7 days.
The database keeps 30 days of history so it can be restored after a fault. What you delete is therefore gone from it entirely after 30 days.

What you can do yourself

See and export: Settings, Account, Export my data downloads everything you logged as a JSON file.
Correct or delete single entries: in the dashboard, or ask your assistant.
Disconnect an assistant: Settings, Connected assistants, Disconnect. Its access ends at once, and the next connection asks for your approval again.
Stop reminders: turn notifications off on the Daily reminder card in the dashboard.
Delete your account: Settings, Account, Delete account. The account and everything in it are deleted at once, and every connected assistant loses its access. This also withdraws your consent.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict its processing, to object, to receive it (data portability) and to withdraw your consent. Write to us and we answer within a month.

You can also complain to the Danish Data Protection Agency (Datatilsynet), datatilsynet.dk, or to the supervisory authority in your own country.

Cookies and browser storage

One cookie keeps you signed in, for 30 days. The browser's own storage remembers your choices on that device: theme, language, the dashboard's layout and the charts' period. None of it is used for tracking. There are no tracking or advertising cookies.

Changes

If this policy changes in a way that matters to you, we tell you in the app or by mail before it applies. The date at the top says when it last changed.

Contact

Refleksion · Planlægning · Handling, CVR DK45818659, Denmark. privacy@foodpile.app

Help with the app, and reporting a security problem: Support and contact. The terms: Terms.