Privacy policy

Who operates Nourish

Nourish is operated by Remodeled AI, LLC. Use the support form for questions about privacy, access, correction, or deletion. Include contact information and the type of request, without adding unnecessary health details.

Your journal includes records you choose to create: food, water, weight, treatment plans and doses, symptoms, check-ins (including 0–10 food noise ratings), notes, milestones, reusable meals, and personal targets. Nourish does not sell health records or use them to target advertisements, and neither the web app nor the iPhone app contains advertising or third-party tracking.

Web and iPhone at a glance

Your account

Accounts and sign-in

The web app needs a Nourish account. In the iPhone app, signing in is optional; an account lets you use the same journal and Premium on the web and on another device. You can sign in two ways, on either:

• Email code. We store your email address and send a six-digit code to it.
• Sign in with Apple. Apple gives us a stable identifier for your Apple ID. On the web, Apple also shares the email address you choose (your own address or an Apple private relay address) and, the first time, your name if you choose to share it. In the iPhone app, Nourish asks Apple for no name or email, so we receive only the identifier.

For your account we keep: the email address and name described above, whether the email was verified, which sign-in methods are linked, the Apple identifier if you use Apple, the dates the account was created and updated, and internal account and billing identifiers. When you sign in with Apple on the web, Apple also returns sign-in tokens, which are stored with the linked Apple sign-in method. When you sign in with Apple on the iPhone, Nourish stores an encrypted Apple token only so it can revoke Sign in with Apple when you delete the account.

If you sign in with Apple and Apple shares a verified email that matches an existing email-code account, both sign in to the same account. Private relay addresses don’t match your own address. You can link Sign in with Apple to an email account in the web app under Settings → Account & sign-in.

Sign-in requests are rate-limited to prevent abuse. The counters use a salted hash of your IP address or account identifier, not the address itself, and are deleted within about an hour after their window ends.

Sign-in codes

Codes are sent by email from no-reply@nourishjournal.app through Cloudflare’s email service. The email contains only the code. We store a one-way hash of the code, never the code itself, together with the email address it was sent to and an expiry time. A code works once and expires after 10 minutes. Five wrong tries cancel it, and requesting a new code replaces the old one. Used codes are deleted immediately; expired ones are removed by hourly cleanup. Copies of the email in your mailbox are under your control.

Sessions and the cookie

Signing in creates a session. On our servers, a session record holds a random session token, its expiry, and the IP address and browser or device description (user agent) from when it was created. A session lasts 90 days and is extended at most once a day while you use Nourish. It ends when you sign out, when it expires, or when you delete your account; expired sessions are removed by hourly cleanup. The iPhone app keeps its session token in the iOS Keychain and uses no cookies.

The web app sets one cookie, nourish.session_token, on nourishjournal.app. It holds only a signed copy of the random session token: no email, name, or health data. It is first-party, sent only over HTTPS, and unreadable by page scripts (HttpOnly), and it expires with the session (up to 90 days after your last visit). While Sign in with Apple is in progress, a nourish.state cookie protects the redirect for up to 5 minutes.

These cookies are strictly necessary to keep you signed in to a service you asked for, so they don’t require consent and the site shows no cookie banner. Nourish sets no analytics, advertising, or tracking cookies, on the website or in the app. Blocking cookies prevents signing in to the web app.

Web app

Your journal on the web

The web app keeps your journal in your Nourish account on Nourish’s Cloudflare backend, so it works on any browser where you sign in. Opening the web app turns on journal sync for your account; an iPhone signed in to the same account can then sync the same journal. Records are stored with your account, together with minimal sync history and deletion markers that stop deleted records from reappearing on another device.

The web app has no notifications, reminders, Apple Health access, or widgets, and it does not ask for push permission.

When you take or choose a meal photo, the web app resizes it and removes its original metadata, such as location, in your browser. The photo stays in this browser as a draft until you save or discard the meal. It leaves the browser only if you ask for a photo estimate (see meal analysis). The web app does not keep photos with saved meals.

What stays in your browser

So the web app opens quickly and works offline, your browser keeps, for each account used there: a copy of your journal and changes waiting to sync, an unsaved meal draft, your last subscription status, setup answers and target-calculator inputs (such as age, height, sex, and activity), display preferences, and your AI permission choices. This is browser storage, not cookies, and it is not sent to anyone except when the journal syncs with your account.

Signing out removes this browser’s journal copy and saved subscription status. Deleting your account also removes the setup answers and calculator inputs. A few display settings can remain until you clear this site’s data in your browser settings. On a shared computer, sign out when you finish.

Web subscriptions and Stripe

On the web, Nourish Premium is sold through Stripe. Checkout and subscription management (Settings → Subscription) happen on pages hosted by Stripe. Stripe collects your payment details and any billing information it needs, such as your country or postal code, and handles payment security, fraud prevention, and applicable tax. Nourish never receives your full card number. Stripe processes this information under the Stripe Privacy Policy.

When you first check out, Nourish creates a Stripe customer with your account email and internal account and billing identifiers. Nourish stores the Stripe customer ID and, for each subscription, its ID, status, plan, trial end, current period end, whether it will renew, and when it last changed. We also keep Stripe event identifiers so each billing update is processed only once. We use this to decide whether your account has Premium.

Each web subscription also carries your account’s billing identifier, so the iPhone app can recognize web Premium for the same account. Nourish’s subscription service, RevenueCat, may receive the Stripe subscription record for that purpose. When you use the web app, Nourish also asks RevenueCat whether your account has an App Store subscription, using the same billing identifier. No journal, health, or medication data goes to Stripe or RevenueCat.

iPhone app

What stays on your iPhone

The iPhone app stores your journal locally with iOS data protection and doesn’t require a Nourish account. Milestone celebrations are computed on your iPhone from what you recorded. App-managed sensitive journal files are excluded from automatic device backup where the app can set that protection.

Local reminders, appearance preferences, Health permissions, and imported Apple Health data stay on the device. Purchase verification uses an anonymous server-issued account identifier, even when you never sign in.

Meal photos remain in a local draft until you save or discard it. Keeping a photo with a saved meal is a separate choice, off by default. Kept photos stay on this iPhone; remove them from the meal detail or by deleting the meal.

If you request suggested targets, age, height, weight, sex, and activity are used on your device. These calculator inputs are not sent to AI or included in journal backup. The targets you choose to save follow your journal backup settings.

Widgets, Lock Screen, and Live Activity

Nourish widgets show today’s protein, water, and your streak, read from a shared container on your iPhone; this data is not sent to Nourish. Your next dose day appears on widgets only if you turn on reminder details for the Medication reminder. The dose-day Live Activity is on only if you choose it during setup or in Settings → Reminders → Medication, and it says “Planned check-in” unless reminder details are on. Medication names never appear on widgets. Remove a widget from your Home or Lock Screen, and turn Live Activities off in Nourish or in iPhone Settings.

Reminders and notification actions

Reminders are scheduled locally on your iPhone. With reminder details off (the default), Lock Screen text stays general and medication reminders have no “Log dose” action. The “+1 glass” action saves a water record on your iPhone; “Log dose” and “Log symptoms” open the app; snooze reschedules the reminder locally. Turn any reminder off in Settings → Reminders or in iPhone Settings.

Cloud backup on iPhone

If you sign in and enable backup, app-created journal records, profile preferences, and targets are transmitted to Nourish’s Cloudflare backend for recovery and synchronization, the same place the web app reads from. Imported Apple Health records and meal photos are excluded from the journal backup.

Disabling backup stops future synchronization from that iPhone. It does not delete an existing cloud copy. Signing out returns the iPhone to a local journal and keeps its records; the account and its backup stay on the server. Use account deletion to remove the cloud records. Changes made offline, including consent revocations, may need a connection to finish on the server.

Weekly review notifications

If you turn on server delivery for your weekly review in the iPhone app, Nourish receives a summary of your recorded days, protein averages, and target-day counts. The backend prepares your weekly review and uses an Apple push token to send a generic ready notification. Raw journal entries, notes, photos, treatment details, and Apple Health data are excluded.

Weekly summaries are kept for up to 30 days plus scheduled cleanup. Device registrations expire after 90 days without an update. Turning this option off clears the summaries and queued alerts once connected; offline revocations retry on reconnection. Account deletion removes linked registrations and reviews. Apple controls notification delivery, and an alert already accepted by Apple cannot be recalled.

Apple Health

Apple controls authorization for supported weight, step, water, and dietary data. Reading and writing are separately optional. Health imports are not used for advertising, sent to OpenAI, or included in Nourish cloud backup, so they never appear in the web app. Nourish tracks its own written samples so edits can replace them. You can manage permissions and stored Health records in Apple Health.

App Store purchases

In the iPhone app, Apple handles payment. RevenueCat processes subscription status, product and transaction identifiers, an anonymous billing identifier, ordinary purchase-device metadata, and paywall interaction events used for subscription reporting. Nourish sends no medication, symptom, food, weight, or journal attributes to RevenueCat. Nourish does not receive your payment-card details. See RevenueCat’s privacy policy and Apple’s privacy policy.

Web app and iPhone app

Optional meal analysis

Photo and text analysis is a separate choice. When enabled and available, Nourish sends the selected meal photo or description to OpenAI to generate a draft food estimate. The app asks for permission before this processing. It does not send your treatment history, Health imports, weight history, or other journal context with the meal.

Both apps resize selected photos and remove their original metadata before upload. Cloudflare stores processing photos privately; processing photos and analysis results are scheduled for deletion after 24 hours, with additional scheduled cleanup. Revoking AI permission cancels remaining jobs and removes their stored inputs and results from Nourish’s processing systems. Data already sent to OpenAI is subject to OpenAI’s policy and its applicable API retention controls; Nourish does not claim zero processor retention. Results are estimates that you review before saving.

Optional recipe creation

After separate permission, OpenAI receives your food idea, selected ingredients, and dietary preferences to create and check a recipe. Your journal and Apple Health data are excluded. Keep personal and health details out of food prompts.

Finished generic recipes and illustrative images join Nourish’s shared library. Prompts and account details are not displayed with them. Nourish clears prompts when processing finishes or is canceled, and expires requests after 24 hours plus hourly cleanup. OpenAI’s API retention controls still apply.

Shared recipes and images remain after account deletion, without your account association. Deletion removes your processing requests and reports; minimal usage reservations remain for up to 93 days without an account link. Saved recipes are kept on your iPhone, or in your browser on the web. Recipe reports are linked to your account to prevent duplicate reports and are removed with your account.

Food search

Online food search sends the food query or barcode to Nourish and the USDA FoodData Central service. Search for food, not personal health details. Public food records may be cached separately from journals. Source links identify the database record. Nutrition lookup does not require sending your journal history.

Exports and reports

You can export every record as JSON or CSV, with or without a subscription. In the web app, exports are created in your browser and downloaded to your device; in the iPhone app, they are created on the iPhone and removed from the app’s export cache during cleanup. PDF reports (a Premium feature) are also made on your device: in the web app, through your browser’s print dialog. iPhone PDF reports exclude photos unless you explicitly include them, and CSV and JSON exports do not contain image files. Copies you save or share elsewhere are under that destination’s control.

Anonymous usage statistics

To learn which parts of Nourish help people and where setup or purchasing gets confusing, the iPhone app sends a small set of anonymous usage events to Nourish’s own server on Cloudflare: for example, which setup step was shown, which plan was selected, whether a purchase started or completed, and whether a feature such as a photo estimate, widget, or shared progress card was used. No third-party analytics or advertising SDK is involved in these events.

Each installation uses a random identifier created on the device. It is not linked to your Nourish account, session, billing identity, Apple ID, or IP address, and it is not used for tracking across apps or websites. Events never include health values, food or meal details, medication names, weights, notes, or other free text. Event records are deleted after 90 days. You can turn this off at any time in Settings › Account & backup › Privacy and AI › Share anonymous usage stats; collection stops immediately and unsent events are discarded.

On the web. The Nourish web app at nourishjournal.app/app sends the same kind of anonymous events to Nourish’s own server: for example, that the sign-in screen or a setup step was shown, that an account was created or signed in to (by email or Apple, new or returning), which plan was selected, whether checkout started, was canceled or completed, that a first record was logged (its type only, such as “water”), and whether a feature such as a photo estimate, report or recipe was used. On your first visit it also records where you came from as a broad category (such as “search”, “social”, “email”, “ads”, or which link on our website you used), never the address of the page or the campaign name.

Each browser uses a random identifier stored in that browser. It is not linked to your Nourish account, session, billing identity, or IP address, and no cookies are used for this. Events never include health values, food or meal details, medication names, weights, notes, or other free text, and are deleted after 90 days. Nothing is collected if your browser sends a Do Not Track or Global Privacy Control signal. You can turn this off at any time in the web app under Settings › Account & sign-in › Share anonymous usage statistics; unsent events are discarded and the identifier is deleted.

Your rights and our practices

How long we keep data

Saved records can be read, exported as CSV or JSON, and deleted with or without a subscription; without one, the journal is read-only, and logging, PDF reports, and other Premium features require Nourish Premium. You can ask us through the support form for access to, or correction or deletion of, data we hold about you; we may need to confirm that you own the account first.

Deleting your account

Delete your account in the web app under Settings → Account & sign-in → Delete account, or in the iPhone app under Settings → Account & backup. For your protection, you confirm with a fresh email code or Apple sign-in. The deletion guide has the steps, including what to do without access to the app.

Account deletion removes your account, sign-in methods, every session, your cloud journal records, consents, and pending processing requests, and queues temporary files for removal. In the web app it also removes that browser’s copy of your journal.

• Web subscription. Nourish cancels any active Stripe subscription immediately, so no further charges are made, and deletes your Stripe customer record. If Stripe can’t be reached, Nourish keeps only the Stripe customer ID and retries every hour until the deletion succeeds. Stripe may keep records of past payments that it must retain by law, under its own policy.
• App Store subscription. Deleting an account does not cancel an Apple subscription. Cancel it in your Apple Account settings.
• RevenueCat. Nourish requests deletion of its RevenueCat customer profile. If RevenueCat is temporarily unavailable, the billing identifier is kept in a retry queue for up to 30 days.
• Sign in with Apple. When Nourish holds an Apple token (iPhone sign-ins), it revokes Sign in with Apple; an encrypted token may wait in a retry queue for up to 30 days if Apple is unavailable. Otherwise, including accounts that used Apple only on the web, you can stop using your Apple ID with Nourish in your Apple Account settings under Sign in with Apple.

Infrastructure backup copies may remain until the provider’s backup retention expires. Shared library recipes remain without your account association, as described above.

This website and support

Visits from a shared progress card may carry ref=share and a random 10-character rc code created on the sharer’s iPhone. We count visits by UTC day and share code for up to 90 days plus scheduled cleanup. These are visit counts, not unique people or purchase attribution. We do not store a visitor identifier, cookies, a full URL, or join the code to an IP address, account, journal, or purchase. Invalid codes are discarded. Requests are separately rate-limited with short-lived salted hashes; those abuse-control records are not joined to referral counts. Website referral counting respects Do Not Track and Global Privacy Control.

The portion tools run in your browser and do not transmit portions or personal health information. The site has no advertising pixels, session replay, or analytics cookies. Cloudflare serves the site and the web app and processes ordinary connection data such as IP address, user agent, and request time under its service policies.

The website and the web app use Cloudflare Web Analytics to count page views and measure loading speed. Its script records the page address, the referring page, the browser and device type, the country, and page performance timings, and reports them to Cloudflare in aggregate. It sets no cookies, uses no local storage or visitor identifier, and doesn’t track you across sites. Journal data, health details and account information are never sent to it. See Cloudflare’s privacy policy.

If you join the launch list, we store your email, the signup source, consent version, and date. The list is separate from private journal records. We use it for the updates you requested and remove the entry when you unsubscribe. Support requests store your email, category, message, and reference number until the request is resolved and for up to 90 days afterward. Please leave health details out of support messages.

Security and service providers

Nourish uses HTTPS for every request, private object storage, authenticated ownership checks, an HttpOnly cookie for web sessions, and the iOS Keychain for iPhone session credentials. App and API logs intentionally exclude journal text, photos, and health fields.

Service providers process data for Nourish only as needed for the features you use:

• Cloudflare: hosting, database, queues, private storage, and sign-in code email. See Cloudflare’s privacy policy.
• Stripe: web payments and subscription management.
• Apple: Sign in with Apple, App Store payments, and push delivery.
• RevenueCat: subscription status.
• OpenAI: optional meal analysis and recipe creation.
• USDA FoodData Central: food search.

The production database and private processing bucket are provisioned with EU jurisdiction; edge request handling and other providers, including Stripe, RevenueCat, and OpenAI, may process data in the United States and other locations.

No system can guarantee that data will never be lost. Keep an export if you need an independent copy.

Audience and changes

Nourish is intended for adults managing their own records. It is not designed for children or emergency care. We will update this page when Nourish’s data handling changes and request new consent when needed for a new optional use.