Privacy policy

Last updated 26 October 2026

Measur keeps your food diary on your phone unless you choose otherwise. This page lists what leaves it and why, what the Measur server keeps and for how long, who else sees anything, why we are allowed to use it, and your rights.

Health data

With your permission, Measur reads body weight, body fat percentage, steps, active energy burned and workouts from the health app on your phone (Health Connect on Android, Apple Health on iOS). It reads nothing else, and it never writes anything back.

The readings fill in your weigh-ins, body-fat figure and activity list, chart your progress and work out your calorie goal. Steps and active energy can raise a day's calorie budget, but only if you accept it. A question to the coach carries your weigh-ins, body-fat figure, goal weight and recent workouts to the AI provider, with any movement energy you accepted, for that answer only. With sync on, your weigh-ins, body-fat figure and any budget you raised are copied to your account. Readings are never sold, never used for advertising, and never shared with anyone for their own purposes. Switching the import off in the app, or revoking the permission in the health app, stops any further reading.

For people in Washington State, our Consumer Health Data Privacy Policy at https://measur.me/washington-health-data sets out the same facts the way that state's law asks.

What leaves your phone, and why

Each of these leaves only when you use the feature, unless the item says otherwise.

A meal photo, or the words you describe a meal in - to the AI provider, to analyse it.
A question to the coach - to the AI provider, with what you keep in the app: summaries of your journal (the viewed day, the week and month around it, the months before, and the meals that match the question, with their amounts), your age, sex, height and activity level, your weigh-ins, body fat and body measurements, the water and coffee you log, your workouts, your supplement list and the days you ticked it, and your fasting hours. With the medication card on, also the days you logged an injection and where on your body it went; for a question about a vitamin or mineral, also your Nutrients page's figures, never the foods behind them.
A correction, a label or the plate, for a meal - what you type to put a meal right, a photo of its nutrition label, or a photo of the plate as served or of what is left of it, to the AI provider with that meal's foods and amounts, to correct that meal.
A restaurant menu - a photo of a menu or a delivery app's screenshot, to the AI provider with your language and food market, to list its dishes with their calories; not kept. A screenshot carries whatever else was on your screen.
Alternatives to the food you logged - by themselves once you have said yes to the AI: up to eight foods at a time from your last 30 days, with their usual amounts and nutrients, which nutrients your plan would move and which way, the foods you log most often, and your language and food market, to the AI provider for that answer only.
A line for your month or year, and a name for a combined meal - by themselves, once you have said yes to the AI: the month or year recap's figures go to the AI provider for its one-line summary, and a meal you combine from several sends its foods and amounts, without calories, for a name.
A food's name, for its picture - a meal without your own photo asks the Measur server for a picture, sending the food's name, its barcode for a scan, and the language and food market the app is set to. If none exists, an AI image provider draws one from the name. Nothing about you goes with it.
The foods you logged, for their vitamins and minerals - opening your Nutrients page sends the Measur server the names and barcodes of the foods in the days it covers, with your food market and time zone. No amounts, no dates, no age or sex. This also happens once a day by itself, unless you switch off "Nutrients running low" in Settings.
Products - a barcode you log is counted on the Measur server per food market per month, with nothing that ties it to you, so search leads with what people log. A product you add or put right is kept there outside your account and shown to everyone who finds it: the product's data only, never your name or address.
A rating you give an analysis - the face you tapped, the reason if you gave one, and the analysis's own confidence, kept on the Measur server for 13 months.
A plate you weigh after rating its amount wrong - with sync on, its photo and the weight, with the food's name if you weighed one food, are kept on the Measur server to test how well Measur measures meals. Deleting your account deletes them.
An error the app runs into - sent to the Measur server by itself, so it can be fixed: the error's message, the screen, and the platform, app version and build (for a photo-picker failure, also the system version). Never your journal, a photo or your email address, and nothing that ties it to you. Passed on to the team and kept no longer than 30 days.
An export from another tracker that Measur could not read - only if you tap to send it, so we can teach Measur the format: its layout (the app's name and the file's column, sheet and file names), or, if you choose, the whole file, with its record of what you ate and weighed. Not linked to your account; deleted after 30 days.
A message to the Measur team - your message, the email address you chose to leave, if you left one, and a screenshot if you attached one, emailed to the team and not stored on the server.
Your diary, if you turn sync on - copied into your account on the Measur server, described below.

What the Measur server keeps

With sync off

A line per AI call - the feature, the model, tokens, cost and time, with a one-way tag of this copy of the app, so we can see how much AI each phone uses. Never what was asked or answered. Deleted after 13 months.
A daily tally of what the app asked for - which server features this copy of the app used each day and how often, under the same tag, with its install day and platform, so we can see how Measur is used. Counted from requests the app already makes, and it stops once you turn sync on. Deleted after 13 months.
Your IP address - held in memory for the day, to keep one caller from spending everyone's AI budget; Measur never writes it down. The web server in front of ours and of this website keeps it in its access log, to fend off attacks.
Your phone's place in the line, if Measur is full - an anonymous id per new install, when it was let in and, once it subscribes, a one-way tag of the account. Deleted 30 days after the install's trial days end.
The waiting list, if you asked to be notified - your phone's push token and the notification text. Deleted once you are let in, or after 60 days.

With sync on

Turning sync on creates an account, which holds the following until you delete it.

Your email address - typed, or handed over by Apple or Google if you continue with them (Apple may give a private relay address). It names the account and receives only the confirmation links that protect it - no newsletters, no marketing. An account whose first link is never clicked is deleted after 7 days.
Your synced diary - meals and their photos, water, weigh-ins, body-fat figures and body measurements, workouts and any budget you raised from your movement, medication and supplement logs, recipes, your profile (your name, date of birth or age, sex and height), targets and settings. The server reads it for one purpose of its own: to know whether a meal reminder is still due.
Your progress photos, only if you switch on their backup - encrypted on your phone, then copied into your account so a new phone gets them back. We cannot open them. Never read by the AI, shown to an assistant or shared; switching the backup off deletes them from the server.
Which devices are signed in - a one-way hash of each device's key, and of any AI assistant's.
Your meal reminders, on a phone - its push token, time zone, your meal times and the reminder's text, so the server can send the reminder.
Your contributor points, and a name if you chose one - points for products you fix, shown on the public contributor board at https://measur.me/contributors as Anonymous, or beside a name you set in Settings until you clear it.
Your subscription status - the plan, since when and until when, whether a free trial ended without a charge, the purchase's id and any offer code, as checked with Apple or Google. Kept so the AI features stay with the people who pay for them, to answer your support questions, to see how many trials become subscriptions and to credit a partner whose code you used. The store's proof of purchase is not kept, and the purchase carries a one-way tag of your account, never your address.
A one-way tag on the bookkeeping lines - the AI-call lines and ratings carry a tag derived from your address that cannot be turned back into it, so spend can be attributed and abuse capped. It also ties this copy of the app's earlier AI-call lines to your account.

How it is kept safe

Encrypted on the way - everything the app sends travels over an encrypted connection (HTTPS).
Where it is kept - requests reach the Measur server through our hosting provider's server in Finland, and emails leave through an email service in the EU; Switzerland recognises the EU's protection as equal to its own. What goes to the AI is handled by an AI company in the United States, under the standard contractual clauses the Swiss and EU authorities approve. Messages to the team arrive in an inbox our email provider may keep in the United States, under the Swiss-US Data Privacy Framework. The United States has no general privacy law like the EU's, and its authorities can demand data held there in some cases; the contracts bind both companies to use what we send only for us.

On this website

A few counts - our own server counts pages opened, sections viewed, questions unfolded, theme switches, taps on an App Store or Google Play button and the name of the website you came from, never the page. Only counts, nothing that ties one visit to another, and nothing at all if your browser sends Do Not Track or Global Privacy Control.
Your theme - the light or dark choice you made is the only thing this site keeps in your browser.
Your blog subscription, if you asked for one - the address you type is kept on the Measur server with whether and when you confirmed it. An address never confirmed is deleted within days, and for a week after that only a one-way fingerprint of it is kept, so the form cannot mail it again. Each new post is one email, whose unsubscribe link takes you off the list in one click, and asking us at the address below removes it too.

Who else sees anything

The AI provider - a company in the United States that works only for us. It receives what the items above send it, for that request only.
Apple and Google - a subscription is paid through the App Store or Google Play, and Measur never sees your card or billing details. Their push services deliver meal reminders. Dictating a meal uses your phone's own speech service, theirs, and Measur gets only the words, never your recording. Continuing with Apple or Google tells that company you use Measur and when you sign in. On Android the barcode scanner is Google's ML Kit: it reads the barcode on the phone and sends Google figures on how it performs and the device it runs on, never the picture. Once per install the app asks Apple or Google to confirm it is Measur as their store delivered it, on a real device; Measur gets only their yes or no.
The companies that work for us - our hosting provider, our email service, our inbox's provider and the AI company handle only what their job needs, and only for us.
Anyone with a link you share - sharing a month or year recap by link uploads its figures, the AI's closing line, the photos you kept and a picture made from them; sharing a meal uploads its photo, name and nutrition. Each is stored on the Measur server outside your account, open to anyone with its long, unguessable link - which they can pass on - and deleted after 90 days, or when you remove the link.
The people at your table - once you join a table and choose which of your meal times it may see, each meal you log at those times is shared with the others there: its photo (and, for a combined meal, the photos it was made from), name, nutrition, the time of day, and your name at the table - the first word of your profile name and the first letter of its last word. Deleted after 7 days, or at once when you leave the table. Inviting someone by email tells them that name and, if you ask, sends them one email.
Anyone reading the contributor board - your points, and your name if you chose to show one.
An AI assistant you connect - with a sync account you can connect one, such as Claude or ChatGPT, approved with a code from the app. It can read what your account has synced, except progress photos, and add meals - a meal it describes is analysed by Measur's own AI - but never change or delete anything you logged. What you ask it is processed by its own provider under their terms. Disconnecting it in Settings cuts its access at once.
Fridg - if you also use Fridg, innonova's shopping list app, with the same confirmed email address, you can use your Measur account there. Fridg's server then asks for you by a one-way tag of your address, never the address itself. To plan your meals, Fridg reads your calorie target, each meal's share of it, your protein target and what you have eaten today, as numbers, for today and the next 13 days. The meals you plan in Fridg are added to your diary as planned meals, counted only once you say you ate them. The recipes you saved in Measur are copied to Fridg once, then deleted here. Those three start only when you choose to use your Measur account in Fridg, and stopping it there ends them. When you put foods from a meal on your shopping list, Measur asks Fridg by the same tag whether you have a Fridg account with that address; only if you do, the names of the foods you picked are sent, with a scanned product's barcode, what each food is in English and a link to Measur's picture of it, and Fridg keeps them on your household's list. Nothing else of your Measur account is read or written.
Nobody else - your data is never sold, never used for advertising, and never shared with anyone for their own purposes. The one exception is the law: if a court or authority lawfully orders us to hand something over, we hand over only what the order requires. And if Measur were ever sold, your data would move only under this policy, and you would be told first.

Why we are allowed to use it

To do what you asked - finding a food's picture or its nutrients, the confirmation links, your meal reminders, the waiting list, a product you add or put right, a link you share, your table, a message you send us and your subscription.
Your permission - keeping your diary in your account when you turn sync on, the AI features (analysing a meal or a menu, the coach), reading the health app, the medication card, backing up progress photos, a name on the contributor board, an AI assistant you connect, using your Measur account in Fridg, an export file you send and a blog subscription. Because meals, weight and medication are health data, your diary is kept on the Measur server only once you say yes as you turn sync on, and nothing from it goes to the AI provider until you say yes in the app, which asks the first time a feature needs it. Saying no only leaves that feature off. You can take any yes back at any time, in the app or by asking us: it stops what comes next, and does not undo what was done before.
Keeping Measur running and fair - the daily tally, the AI-call lines, the error reports, your IP address, your phone's place in the line, the product counts, the ratings, a plate you weighed and this website's counts exist because we need them to fix, pay for and protect Measur. None of them is needed to know who you are, and you can object to any of them at the address below.
The law - where a law obliges us to keep or hand over something, and only then.

Deleting your data

On the phone - deleting the app removes everything on the device, and Settings can erase your logged data at any time.
On the server - with sync, Settings > Account & data > "Delete account" removes your whole account for good, once you confirm it from an emailed link, and signs out every device. The diary already on each phone stays until you erase it there. Daily backups keep each copy for fourteen days, so a deleted account leaves them two weeks later.
A copy of everything - Settings exports your whole diary at any time, as a backup file with every entry and photo, and as a PDF.

Your rights, and asking us

Who is responsible - innonova GmbH, Sagenrainstrasse 35, 8320 Fehraltorf, Switzerland, makes Measur and runs this website, and is responsible for your data in both. In the EU, you can also write to our representative, Jørgen Wolf, Rua J. Pereira da Silva 12B, 2500-492 Foz do Arelho, Portugal, jay@measur.me. Jørgen Wolf is also our data protection officer (encarregado) for Brazil, at the same address.
What you can ask - to see what we hold about you and which companies received it, to have it corrected or deleted, to limit what we do with it, to have it in a file you can take elsewhere, and to stop a use that rests on our own need. Write with any of these, or any question about this page, to measur@measur.me: a person answers within 15 days. There is more about writing to us on the support page.
Complaints - if you think we got something wrong, you can complain to Switzerland's Federal Data Protection and Information Commissioner (edoeb.admin.ch), in the EU or EEA to the data protection authority where you live, in Brazil to the ANPD (gov.br/anpd), in the UK to the ICO (ico.org.uk), in Canada to the OPC (priv.gc.ca) and in Quebec also to the CAI (cai.gouv.qc.ca), in Japan to the PPC (ppc.go.jp), in Australia to the OAIC (oaic.gov.au), or in New Zealand to the Privacy Commissioner (privacy.org.nz).

How we govern personal information

Who is accountable - one person at innonova is responsible for protecting personal information, approves the rules below and handles complaints. Write to them at measur@measur.me, as above.
Who sees it - only the people who build and run Measur can reach the Measur server, and they use what it keeps only to run Measur, to answer you, or to deal with a fault or a breach. The companies that handle data for us do so under a written agreement.
Before something new - we assess the risks to you before a new feature changes what leaves your phone, and before your data goes to a new country - for people in Quebec, before it leaves Quebec.
Keeping and deleting - each thing is kept only as long as this page says, then deleted. Every breach is written down, and the people and authorities it concerns are told.

Children, and changes to this policy

Children - Measur is for people aged 18 and over. On a phone, Measur asks the app store whether you are 18 or over when you first open it, and the answer stays on your phone. If you think someone younger has given us data, tell us and we delete it.
Changes - when this policy changes, the date at the top moves. When a change means something new leaves your phone or someone new sees it, the app tells you before it happens.

← Back to Measur