Privacy Policy

Flora ("the app") is a gut-health food tracker. This policy explains what data Flora handles and where it goes. The short version: your data lives on your phone. A Flora account is optional. Without one, and unless you turn on the optional cloud backup described below, no Flora server stores your meals, scores, or profile; creating a Flora account turns cloud backup on, and you can turn it off at any time.

What Flora stores, and where

Everything you enter in Flora — your profile (age, height, weight, sex, activity level, goals, allergies), your logged meals, scores, sensitivity reports, learned triggers, saved recipes, grocery list, and water tracking — is stored locally on your device. Deleting the app deletes this data. "Reset app & onboarding" inside the app also erases it.

A Flora account is optional: you can create one with Sign in with Apple, Google, or your email address (described below), and everything in Flora works without it. There is no automatic cloud sync — the optional cloud backup (described below) is the one exception, and you control it: it is off by default without an account, creating a Flora account turns it on, and you can turn it off at any time in You → Privacy & data. There is no third-party analytics SDK and no advertising SDK in Flora. Two third-party services do ship inside the app for other jobs, and both are described below: RevenueCat (subscription processing) and Sentry (crash reporting — inactive unless a build is configured with a crash-reporting key). The App Store version of Flora sends a small stream of anonymous usage signals to Flora's own server (described below) — never to an analytics company.

What leaves your device

Some features send limited data to outside services to work. This is the complete list — what each service is, what it receives, and when. Every service named here receives only what its paragraph says, and each one is bound, by its own data-processing terms, to protect that data at least as well as this policy does: no sale, no advertising use, no use beyond the job named.

Meals and AI analysis

• AI analysis (Anthropic Claude). When you use photo scanning, spoken/typed meal analysis, Ask Flora, or AI-generated recipes, the relevant content is sent to Anthropic's API. For Ask Flora that context is: your question, your profile (first name, age, sex, height, weight, activity level, allergies and your daily calorie and macro targets), your two gut scores, your goals and learned triggers, your recent meals and their scores, your latest gut check-in, and your current grocery list — this is what makes the answer about you rather than generic. For photo or typed meal analysis it is the photo or description itself through Flora's proxy server to generate the response. Flora's proxy does not store this content; Anthropic processes it under its own API data policies and does not use it to train models. Flora asks for your explicit permission before its first AI request (a card explaining exactly this), and the "AI analysis" switch in You → Privacy & data turns it off again — photo scans and Ask Flora then pause, and typed meals use the on-device estimate.

Product and label lookups

When you scan a barcode or search for a packaged product, Flora asks food databases about the product — a barcode number or a product name. None of these requests carry your name, profile, health answers, or scores.

• Open Food Facts. Scanned barcodes and product-name searches go to this free community food database to fetch label data and product images.
• USDA FoodData Central. When Open Food Facts can't answer, the barcode number is sent to the U.S. Department of Agriculture's public food database for the product's label data.
• NIH Dietary Supplement Label Database. Supplement barcodes — and, for supplement-shaped products, the product name — are checked against this U.S. National Institutes of Health database to read the real Supplement Facts label.
• UPCitemdb. A barcode none of the above know is sent to this commercial barcode directory to recover at least the product's name and a catalog photo.
• FatSecret. Some barcodes are relayed through Flora's own server to FatSecret, a commercial nutrition database (when that lookup is enabled on Flora's server). Flora's server holds the access credentials; FatSecret receives the barcode, nothing about you.
• Nutritionix — built in, but not active. The app contains a nutrition lookup that would send a typed meal description (the food words only) to Nutritionix. It requires access keys the App Store build does not include, so today nothing is ever sent to Nutritionix. If we ever switch it on, this policy will say so first.

Restaurants near you

• OpenStreetMap Overpass. When you grant location permission, your approximate coordinates are sent to public OpenStreetMap "Overpass" servers to find restaurants and cafés around you — currently the instances operated by Kumi Systems (Austria) and overpass-api.de (Germany). Location is used only in the moment, never stored off your device, and you can use the app fully without granting it.
• Yelp. When you open a restaurant's detail page, that place's name and coordinates are relayed through Flora's own server to Yelp to fetch its rating, review count, price level, hours and a photo. Flora's server holds the key and stores nothing; Yelp sees a place lookup, not who asked.

Images

• Photography (Pexels). Recipe and article images are fetched from the Pexels photo API using food keywords only — no personal data.
• Brand logos (Google). Restaurant logos are fetched from Google's public favicon service using the restaurant's web address only (like mcdonalds.com) — no personal data.

Flora's own server

• Anonymous usage signals. So we can tell whether onboarding works and catch crashes, the App Store version of Flora sends Flora's own server small anonymous events: which onboarding step was viewed, a coarse band of the starting score shown at the reveal (like "60s" — never the exact number), that a purchase started, succeeded, was cancelled or failed (a coarse failure category only — never the store's error text), and an error's type and code location. Each event carries a random install id minted on your device — it is not your name, email, or a device identifier, and "Reset app & onboarding" mints a new one. The list above is illustrative rather than complete — Flora emits roughly forty such events covering navigation, feature use and milestones, all of the same shape. None of them ever include your health answers, symptoms, allergies, meals, exact scores, or profile, and they go only to Flora's own server — no third-party analytics service ever receives them. When you correct a scan — removing or adding an ingredient, picking an alternate identification, or reporting an ingredient's score as off — the corrected food names (never your health answers, symptoms or scores) are included in these anonymous signals so Flora's food database learns from real fixes. If you answer the one-time "Where'd you find Flora?" question after setup, your one-tap answer — and, if you pick "Somewhere else", the short note you can optionally type — is included the same way, so we know which channels to thank; skipping the question sends nothing.
• App settings. About every six hours the app downloads its own settings from Flora's server (things like which paywall layout to show). That request carries the app's access token and nothing about you.
• Optional push notifications (anonymous push token, Flora's own server) — only if you turn on News & offers. Reminders are scheduled on your device and need no server. If you turn on News & offers in Flora's Notifications settings, the App Store version of Flora registers an anonymous push token — a delivery address for this device generated by the notification service, not your identity — with Flora's own server, stored under the same random install id as the usage signals above, so Flora can send occasional product news and offers to your lock screen. It is never sold or shared, and delivery goes through Expo's push service (which routes it to Apple's push system). The switch is off by default; turning it off, turning notifications off in iOS Settings, or resetting the app deletes the token from Flora's server. Flora never sends marketing notifications without this switch.
• Optional weekly email (Flora's own server) — only if you sign up. If you enter your email address for Flora's weekly email (on a weekly report or in You → Privacy & data), Flora's own server stores that address together with the app's random install id — used only to send you the emails you asked for. It is never sold or shared, never used for advertising, and never linked to your meals, scores, or health answers (the emails themselves are short written notes — a gut insight, something to try, what's new in Flora — not your data). Unsubscribing — the in-app toggle, or replying "unsubscribe" to any email — deletes the address from Flora's server, and "Reset app & onboarding" deletes it too. If you never sign up, Flora never has your email.
• Optional friend codes (Flora's own server). Flora's share message includes your personal friend code (like "FL-X7K2M9"), derived on your device from the app's random install id — the code is a one-way scramble that contains nothing about you. The first time the app shows or shares your code, it registers it with Flora's own server together with this device's random install id, so a reward can only ever be credited to the phone the code came from; that row holds the code and the install id, nothing else, and is retired when you use "Reset app & onboarding". Sharing the code itself sends nothing further to any server. If a friend gives you *their* code and you enter it at the "Did a friend send you?" step of setup, Flora's own server stores that code together with this device's random install id, used only to count how many friends joined from each code so the sharer can be thanked. It contains no health data and no identity, is never sold or shared, and one device can count at most one code. The row is deleted from Flora's server when you use "Reset app & onboarding". If the in-app "Friends joined" counter is enabled, Flora asks its server how many devices entered your code — that request carries only the code itself.
• Optional Flora account (Apple, Google or email; Flora's own server) — only if you create one. Flora offers an account on the welcome screen, at the end of setup ("Keep my data on this phone" skips it) and in You → Account. With Sign in with Apple, Apple performs the sign in; Flora's own server verifies Apple's token and stores the stable, anonymous user identifier Apple assigns to Flora for you, your name and email address only if you choose to share them at that first sign in (an Apple "Hide My Email" relay address counts as your email), and when you signed in. With Google, Google performs the sign in on your phone; Flora's server verifies Google's token and stores the stable identifier Google assigns to Flora for you, plus the name and email address on your Google account. With email, Flora's server sends a 6-digit code to the address you type (from Flora's own mailbox; the code is stored only as a scrambled hash and expires after ten minutes) and, once you enter it, keeps that address as your account's identity — there is never a password. Whichever way you sign in, Flora stores nothing else from the provider. The account exists so a cloud backup (below) can be kept under the account instead of the anonymous identifier, and a new phone restores it with one sign in — so creating or signing in to a Flora account turns cloud backup on (you can turn it off at any time in You → Privacy & data). It has nothing to do with billing: your subscription stays with your Apple ID, and your account is never sent to RevenueCat. It is never sold or shared and never used for advertising. Sign out any time (your data stays on the phone; cloud backup pauses). Delete it any time in the app (You → Account → Delete account): Flora's server erases the account, its sign-in sessions and its cloud backup (and, for a Sign in with Apple account, revokes Flora's Sign in with Apple authorization), then the app erases everything on the phone. Deleting the account does not cancel a subscription; manage that in your iPhone's Settings.
• Optional cloud backup (Flora's own server) — off by default without an account; creating a Flora account turns it on. While Cloud backup is on — because you turned it on (You → Account → Privacy & data) or because you created a Flora account — Flora keeps one copy of your Flora data — your profile (including the first name you entered at setup, plus age, height, weight, sex, activity, goals and allergies), logged meals and scores, sensitivity reports and learned triggers, safe foods, check-ins, grocery list, saved recipes and reminder settings, as a single JSON file — on Flora's own server, refreshed about once a day, so a new phone can pick up where you left off. It is sent over an encrypted connection (TLS) and stored under your Flora account's identifier if you have an account, otherwise under an anonymous identifier (your subscription's anonymous billing id, or the app's random install id) — the identifier itself is never your name or email, though the backed-up profile inside the file does contain the first name you entered at setup. The copy is used only to restore your data to a phone you sign into with the same account, subscription or backup, is never sold or shared, and never trains any AI model. The server accepts backups up to 5 MB; if your history ever outgrows that, the app stops uploading and tells you so, and you can always export your data as a file instead. You can turn Cloud backup off at any time in You → Privacy & data, and delete the server copy at any time in the app: turn the toggle off and choose delete, delete your Flora account (which deletes its backup), or use "Reset app & onboarding" — all three remove it. With the toggle off (the default without an account), nothing is ever uploaded.

The Flora Gut Health Program

• Booking a call (Calendly) — only if you tap Apply. A monthly report may close with an honest read of your month and an offer to apply for the Flora Gut Health Program, a one-on-one program with Flora's founder. If you tap "Apply for Flora Gut Health Program", Flora opens the founder's booking page in a browser sheet. Flora sends nothing to that page — not your name, not your scores, not your meals. Anything you choose to type there (your name, email, the time you pick) goes to the booking service, Calendly, under its own privacy policy, and reaches Flora's founder as your application. The offer is a recommendation based on your own logged data; it is not medical advice.

Crash reporting

• Sentry — present in the app, inactive by default. Flora ships with the Sentry crash-reporting kit. It is fully inactive unless a specific build is configured with a Sentry key: with no key — including the current App Store build unless the version notes say otherwise — it never starts and nothing is ever sent. In a build where it is enabled, a crash sends the error's type, the code locations involved (stack frames), the device/OS model and the app version to Sentry so the crash can be fixed. Flora configures it to strip error messages and activity trails before anything is sent — so what you ate, asked, or answered never rides along — and it collects no browsing, no location, and no identity. (Independently of Sentry, crashes are also counted in the anonymous usage signals above: an error's type and code location, nothing more.)

Subscriptions and attribution

• Subscription processing (RevenueCat). Purchases go through Apple; Flora uses RevenueCat, a subscription-management service, to validate them. RevenueCat receives your App Store purchase receipts and the app's random install id (the same anonymous id described above — never your name, email, meals, or health answers), which lets Flora keep your subscription working across reinstalls and, if you shared a friend code, recognise when a friend you invited becomes a subscriber. RevenueCat processes this under its own privacy policy; "Reset app & onboarding" mints a new install id. To credit referral rewards honestly, RevenueCat also notifies Flora's server when a subscription is first paid or refunded; the server stores only the install id, the date of the first payment, and a refunded yes/no — never an amount, a product, or anything about you — and a refund removes the credit.
• Web purchases. Every Flora Plus plan is sold through the App Store as an auto-renewable subscription, under the purchases section above. Sales on the Flora website are paused, and no code typed into the app unlocks anything; if web sales return, this policy will describe them before they do.
• Apple Ads attribution (AdServices). The app asks Apple's AdServices system for an attribution token so an install that came from an Apple Ads campaign can be counted. This is Apple's own campaign-level system: the token identifies the ad campaign, not you, and Apple designed it to work without any tracking permission. RevenueCat receives the token alongside the receipt data above.
• No tracking and no advertising identifier (IDFA). Flora does not track you across other companies' apps or websites, never shows the iOS tracking prompt ("Allow Flora to track…"), and never collects the device's advertising identifier. If that ever changes for an ad campaign, it will arrive in an app update, this policy will describe it before that update ships, and iOS will ask your permission first. Your meals, scores and health answers would never be part of it.

Permissions

• Camera — photographing meals and scanning barcodes. Optional.
• Photo library — choosing an existing meal photo uses the system photo picker, which hands Flora only the photo you pick; Flora never asks for access to your library.
• Microphone — the optional "Speak it" meal logging listens while you describe your meal. Optional.
• Speech recognition — what you say is transcribed on your device into text you review and edit before anything is scored; nothing you say is sent to a Flora server. If on-device recognition isn't available, the feature falls back to the keyboard's own dictation. Optional.
• Location (while using) — finding restaurants near you, via the OpenStreetMap and Yelp lookups described above. Optional.
• Notifications — optional reminders (morning gut update, streak guard, post-meal check-in, weekly report, daily log reminder, trial reminders, away check-backs), scheduled on your device — never more than two a day, and never at night — plus, only if you turn on News & offers, the occasional product news or offer Flora sends through the push channel described above. Turning notifications off stops both and deletes the push token.

Every permission is optional; the relevant feature simply stays off without it.

Health disclaimer

Flora offers general wellness information, not medical advice, diagnosis, or treatment. Gut scores are informational estimates. Consult a qualified professional about medical concerns.

Children

Flora is not directed at children under 13 and does not knowingly collect data from them.

Changes

We'll update this document when the policy changes and note the date above.

Contact

Questions: cw23business@gmail.com