Privacy Policy
Effective [REPLACE: 1 October 2026]. Last updated [REPLACE: 1 October 2026].
5erday is a fruit-and-veg diary. It works without an account, without a network, and without knowing who you are. Everything below is about the parts that are optional.
The short version
- Photographs are never stored. A photo you scan is analysed and discarded within the same request. It is not saved to our servers, not kept in a bucket, not hashed, and never used to train anything.
- No advertising, no tracking, no data brokers. There is no advertising code in the app and nothing is sold or shared for marketing.
- You can delete everything, permanently, from inside the app.
- An account is optional. Without one, your diary never leaves your phone.
Who we are
5erday is operated by [REPLACE: Legal entity name], [REPLACE: registered address]. For anything in this policy, write to hello@5erday.com.
For UK GDPR purposes we are the data controller for the information described below.
What we collect, and why
| What | When | Why | Legal basis |
|---|---|---|---|
| Email address | Only if you create an account with email, or if your Apple or Google account shares one | To sign you in, and to send confirmation and password-reset emails | Contract |
| An account identifier | The moment you first use anything online, including scanning as a guest | To keep your diary and your scan allowance attached to you rather than to a device | Contract |
| Your food diary: what you logged, when, your streak, XP and achievements | Only if you have an account | So it survives a new phone | Contract |
| Scan records: a timestamp, whether the analysis succeeded, and how much of the model it used | Every time you scan | To count your allowance fairly and to know what the feature costs | Contract, and our legitimate interest in not being billed for abuse |
| Subscription status: which tier, and when the period ends | Only if you subscribe | To give you what you paid for | Contract |
What we do not collect
- Your photographs. See below.
- Payment details. Apple and Google take the payment. We never see a card number, and we could not charge you if we wanted to.
- Your location. The app never asks for it.
- Your contacts, your gallery, your calendar or your other apps. The camera permission is used for the shutter and nothing else; the app does not read your photo library.
- Analytics from inside the app. The released app's analytics are switched off entirely. No product analytics leave your phone.
- Advertising identifiers. There are none, because there are no ads.
Photographs, in detail
This is the part people care about most, so here is exactly what happens when you press the shutter:
- The photo is resized on your phone and sent to our server over an encrypted connection.
- Our server holds it in memory, forwards it once to Google's Gemini API for analysis, and receives a list of foods and estimated weights.
- The photo is discarded when the request ends. It is never written to a disk, a database, a storage bucket, a log line, a cache or a backup. Not the image, not a thumbnail, not a hash of it.
- The list of food names comes back to your phone for you to check. Nothing is added to your diary until you confirm it.
We keep a normalised list of the detected food names for 24 hours, tied to that one request, so that if your connection dropped and your phone asks again you get the same answer without being charged a second scan. After that it is deleted. The photograph itself is never part of this.
Google processes the image as our service provider under their API terms and, on the paid API tier we use, does not use it to train their models. We do not send them your name, your email, your account identifier or your diary.
Who else sees anything
| Who | What | Why |
|---|---|---|
| Supabase | Everything in the table above, if you have an account | They host our database and authentication |
| Google (Gemini API) | The photograph, for the duration of one request | They do the analysis |
| RevenueCat | Your account identifier and your subscription status | They reconcile subscriptions across Apple and Google |
| Apple / Google | Your purchase | They take the payment. We are told which tier you are on, and nothing else |
Each of these processes data on our instructions under a data-processing agreement. Nobody else receives anything, and nothing is ever sold.
This website
Separately from the app, this site does two things worth naming:
- Vercel Web Analytics. Our host counts page views so we know which pages are read. It sets no cookies, does not follow you between sites, and does not build a profile of you.
- Google Fonts. The headings load a typeface from Google's font service, which means your browser makes a request to them to fetch it.
Neither is connected to your 5erday account, and neither happens inside the app.
Where data is stored
Our database is hosted in the European Union (Ireland). Some processing happens in the United States, under the transfer safeguards those providers offer: the UK Extension to the EU–US Data Privacy Framework, or Standard Contractual Clauses.
How long we keep it
- Your diary and account: until you delete them.
- Scan results: 24 hours.
- Scan accounting rows: for as long as your account exists, because they are how your allowance is counted. Deleted with the account.
- Billing records: kept without your account identifier after deletion, because a financial record that disappears is one nobody can reconcile.
- Photographs: not kept.
Your rights
Under UK GDPR you can ask us to:
- give you a copy of what we hold;
- correct anything wrong;
- delete everything;
- restrict or object to how we use it;
- port it elsewhere.
Deletion does not need an email: it is a button in the app. See how to delete your account. For anything else, write to hello@5erday.com and we will answer within one month.
If you are not happy with our answer you can complain to the Information Commissioner's Office.
Children
5erday is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has created an account, write to us and we will delete it.
Changes
If this policy changes in a way that affects you, we will say so in the app before the change takes effect. The date at the top always reflects the current version.