Privacy policy

Last updated 11 November 2026

Measur keeps your food diary on your phone unless you choose otherwise. This page lists what leaves it and why, what the Measur server keeps and for how long, who else sees anything, why we are allowed to use it, and your rights.

Health data

With your permission, Measur reads body weight, body fat percentage, steps, active energy burned and workouts from the health app on your phone (Health Connect on Android, Apple Health on iOS). It reads nothing else, and it never writes anything back.

The readings fill in your weigh-ins, body-fat figure and activity list, chart your progress and work out your calorie goal. Your steps, active energy and workouts can raise a day's calorie budget, but only if you accept it. A question to the coach carries your weigh-ins, body-fat figure, goal weight and recent workouts to the AI provider, with any movement energy you accepted, for that answer only. With sync on, your weigh-ins, body-fat figure, workouts and any budget you raised are copied to your account. Readings are never sold, never used for advertising, and never shared with anyone for their own purposes. Switching the import off in the app, or revoking the permission in the health app, stops any further reading.

For people in Washington State, our Consumer Health Data Privacy Policy at https://measur.me/washington-health-data sets out the same facts the way that state's law asks.

What leaves your phone, and why

Each of these leaves only when you use the feature, unless the item says otherwise.

A meal photo, or the words you describe a meal in - to the AI provider, to analyse it.
A question to the coach - to the AI provider, with the conversation so far and what you keep in the app: summaries of your diary (the viewed day, the week and month before it, the months before, and the meals that match the question, with their amounts), your goal, targets, goal weight and goal date, your age, sex, height and activity level, your weigh-ins, body fat and body measurements, the water you log, your workouts, your supplement list and the days you ticked it, and your fasting hours and fast days. With the medication card on, also the days you logged an injection, where on your body it went and how often you inject; for a question about a vitamin or mineral, also your Nutrients page's figures, never the foods behind them.
A correction, a label or the plate, for a meal - what you type to put a meal right, a photo of its nutrition label, or a photo of the plate as served or of what is left of it, to the AI provider with that meal's foods and amounts, to correct that meal.
A restaurant menu - a photo of a menu or a delivery app's screenshot, to the AI provider with your language and food market, to list its dishes with their calories; not kept. A screenshot carries whatever else was on your screen.
Alternatives to the food you logged - by themselves once you have said yes to the AI: up to eight foods at a time from your last 30 days, with their usual amounts and nutrients and the meal you have them at, which nutrients your plan would move and which way, the foods you log most often, and your language and food market, to the AI provider for that answer only.
A line for your month or year, and a name for a combined meal - by themselves, once you have said yes to the AI: the month or year recap's figures, your goal and your most-logged meals go to the AI provider for its one-line summary, and a meal you combine from several sends its foods and amounts, without calories, for a name.
A food's name, for its picture - a meal without your own photo asks the Measur server for a picture, sending the food's name, its barcode for a scan, and the language and food market the app is set to. If none exists, an AI image provider draws one from the name. The ask carries this copy of the app's one-way tag, so each phone's drawings can be capped; nothing about you goes to the image provider.
The foods you logged, for their vitamins and minerals - opening your Nutrients page sends the Measur server the names and barcodes of the foods in the days it covers, with your food market and time zone. No amounts, no dates, no age or sex. This also happens by itself: when the app opens, for foods it has not looked up yet, and once a day to check for nutrients running low, unless you switch off "Nutrients running low" in Settings.
Products - a barcode you log is counted on the Measur server per food market per month, with nothing that ties it to you, so search leads with what people log. A product you add or put right is kept there outside your account and shown to everyone who finds it: the product's data only, never your name or address.
An error the app runs into - sent to the Measur server by itself, so it can be fixed: the error's message, the screen, and the platform, app version and build (for a photo-picker failure, also the system version). Never your diary, a photo or your email address, and nothing that ties it to you. Passed on to the team and kept no longer than 30 days.
An export from another tracker that Measur could not read - only if you tap to send it, so we can teach Measur the format: its layout (the app's name and the file's column, sheet and file names), or, if you choose, the whole file, with its record of what you ate and weighed. Not linked to your account; deleted after 30 days.
A message to the Measur team - your message, the email address you chose to leave, if you left one, and a screenshot if you attached one, emailed to the team and not stored on the server.
Your diary, if you turn sync on - copied into your account on the Measur server, described below.

What the Measur server keeps

With sync off

A line per AI call - the feature, the model, tokens, cost and time, with a one-way tag of this copy of the app, so we can see how much AI each phone uses. Never what was asked or answered. Deleted after 13 months.
A daily tally of what the app asked for - which server features this copy of the app used each day and how often, under the same tag, with its install day and platform, so we can see how Measur is used. Counted from requests the app already makes, and it stops once you have an account. Deleted after 13 months.
Your IP address - held in memory for the day, to keep one caller from spending everyone's AI budget; Measur never writes it down. The web server in front of ours and of this website keeps it in its access log for 30 days, to fend off attacks.
Your phone's place in the line, if Measur is full - an anonymous id per new install, when it was let in, a one-way tag of the account once it signs in or subscribes, and when its store trial week ends. Deleted 30 days after the install's trial days or that trial week end.
The waiting list, if Measur is full - your phone's place on it and, if you asked to be notified, its push token and the notification text. Deleted once you are let in, or after 60 days.

With an account

Subscribing, or turning sync on, creates an account, which holds the following until you delete it.

Your email address - typed, or handed over by Apple or Google if you continue with them (Apple may give a private relay address). It names the account and receives only the confirmation links and notices that protect it - no newsletters, no marketing. If you change it, the old address stays with the account, pointing to the new one. An account whose first link is never clicked is deleted after 7 days.
Which devices are signed in - a one-way hash of each device's key, and of any AI assistant's.
Your contributor points, and a name if you chose one - points for products you fix, shown on the public contributor board at https://measur.me/contributors as Anonymous, or beside a name you set in Settings until you clear it.
Your subscription status - the plan, since when and until when, whether a free trial ended without a charge, the purchase's id and any offer code, as checked with Apple or Google. Kept so the AI features stay with the people who pay for them, to answer your support questions, to see how many trials become subscriptions and to credit a partner whose code you used. The store's proof of purchase is not kept, and the purchase carries a one-way tag of your account, never your address.
A one-way tag on the bookkeeping lines - the AI-call lines carry a tag derived from your address that cannot be turned back into it, so spend can be attributed and abuse capped. It also ties this copy of the app's earlier AI-call lines to your account. These lines are not deleted with your account, but after their 13 months.

With sync on

Turning sync on also keeps the following in your account until you delete it.

Your synced diary - meals and their photos, water, weigh-ins, body-fat figures and body measurements, workouts and any budget you raised from your movement, medication and supplement logs, recipes, your profile (your name, date of birth or age, sex, height and, if you tell the app, whether you are pregnant or breastfeeding), targets and settings. We read it for two purposes of our own: to know whether a meal reminder is still due, and to count how Measur is used, such as how many meals each account logs. Those counts stay with us.
Your progress photos, only if you switch on their backup - encrypted on your phone, then copied into your account so a new phone gets them back. We cannot open them. Never read by the AI, shown to an assistant or shared; switching the backup off deletes them from the server.
Your meal reminders, on a phone - its push token, time zone, your meal times and the reminder's text, so the server can send the reminder.

How it is kept safe

Encrypted on the way - everything the app sends travels over an encrypted connection (HTTPS).
Where it is kept - requests reach the Measur server in Denmark through our hosting provider's server in Finland, encrypted copies of its database are kept by our hosting provider and a storage service, both in the EU, and emails leave through an email service in the EU; Switzerland recognises the EU's protection as equal to its own, and Brazil does too. What goes to the AI is handled by an AI company in the United States, under the standard contractual clauses the Swiss and EU authorities approve. For people in Brazil, what goes to the AI company rests on the yes the app asks the first time an AI feature needs it. Messages to the team arrive in an inbox our email provider may keep in the United States, under the Swiss-US Data Privacy Framework. The United States has no general privacy law like the EU's, and its authorities can demand data held there in some cases; the contracts bind both companies to use what we send only for us. You can ask us for a copy of these safeguards at the address below.

On this website

A few counts - our own server counts pages opened, sections viewed, questions unfolded, theme switches, taps on an App Store or Google Play button and the name of the website you came from, never the page. Only counts, nothing that ties one visit to another, and nothing at all if your browser sends Do Not Track or Global Privacy Control.
Your theme and your language - the light or dark choice you made, and the language you picked from the menu, are the only things this site keeps in your browser.
Your blog subscription, if you asked for one - the address you type is kept on the Measur server with whether and when you confirmed it. An address never confirmed is deleted within days, and for a week after that only a one-way fingerprint of it is kept, so the form cannot mail it again. Each new post is one email, whose unsubscribe link takes you off the list in one click, and asking us at the address below removes it too.

Who else sees anything

The AI provider - a company in the United States that works only for us. It receives what the items above send it, for that request only.
Apple and Google - a subscription is paid through the App Store or Google Play, and Measur never sees your card or billing details. Their push services deliver meal reminders. Dictating a meal uses your phone's own speech service, theirs, and Measur gets only the words, never your recording. Continuing with Apple or Google tells that company you use Measur and when you sign in. On Android the barcode scanner is Google's ML Kit: it reads the barcode on the phone and sends Google figures on how it performs and the device it runs on, never the picture. Once per install the app asks Apple or Google to confirm it is Measur as their store delivered it, on a real device; Measur keeps only their yes or no.
The companies that work for us - our hosting provider, our backup storage service, our email service, our inbox's provider and the AI company handle only what their job needs, and only for us.
Anyone with a link you share - sharing a month or year recap by link uploads its figures, the AI's closing line, the photos you kept and a picture made from them; sharing a meal uploads its photo, name and nutrition. Each is stored on the Measur server outside your account, open to anyone with its long, unguessable link - which they can pass on - and deleted after 90 days, or when you remove the link.
The people at your table - once you join a table and choose which of your meal times it may see, each meal you log at those times is shared with the others there: its photo (and, for a combined meal, the photos it was made from), name, nutrition, the time of day, and your name at the table - the first word of your profile name and the first letter of its last word. Deleted after 7 days, or at once when you leave the table. Inviting someone by email keeps their address, which the people at the table see, until they answer or the invitation is withdrawn, and for 30 days at most; it tells them the names at the table and, if you ask, sends them one email.
Anyone reading the contributor board - your points, and your name if you chose to show one.
An AI assistant you connect - with a sync account you can connect one, such as Claude or ChatGPT, approved with a code from the app. It can read what your account has synced, except progress photos, and add meals - a meal it describes is analysed by Measur's own AI - but never change or delete anything you logged. What you ask it is processed by its own provider under their terms. Disconnecting it in Settings cuts its access at once.
Fridg - if you also use Fridg, innonova's shopping list app, with the same confirmed email address, you can use your Measur account there. Fridg's server then asks for you by a one-way tag of your address, never the address itself. To plan your meals, Fridg reads your calorie target, each meal's share of it, your protein target and what you have eaten today, as numbers, for today and the next 13 days. The meals you plan in Fridg are added to your diary as planned meals, counted only once you say you ate them. A dish you tell Fridg you made is added as eaten, for today or yesterday. The recipes you saved in Measur are copied to Fridg once, then deleted here. Those four start only when you choose to use your Measur account in Fridg, and stopping it there ends them. When you put foods from a meal on your shopping list, Measur asks Fridg by the same tag whether you have a Fridg account with that address; only if you do, the names of the foods you picked are sent, with a scanned product's barcode, what each food is in English and a link to Measur's picture of it, and Fridg keeps them on your household's list. Nothing else of your Measur account is read or written.
Nobody else - your data is never sold, never used for advertising, and never shared with anyone for their own purposes. The one exception is the law: if a court or authority lawfully orders us to hand something over, we hand over only what the order requires. And if Measur were ever sold, your data would move only under this policy, and you would be told first.

Why we are allowed to use it

To do what you asked - finding a food's picture or its nutrients, the confirmation links, your meal reminders, the waiting list, a product you add or put right, foods you put on your Fridg shopping list, a message you send us and your subscription.
Your permission - keeping your diary in your account when you turn sync on, the AI features (analysing a meal or a menu, the coach), reading the health app, the medication card, backing up progress photos, a link you share, your table, a name on the contributor board, an AI assistant you connect, using your Measur account in Fridg, an export file you send and a blog subscription. Because meals, weight and medication are health data, your diary is kept on the Measur server only once you say yes as you turn sync on, and nothing from it goes to the AI provider until you say yes in the app, which asks the first time a feature needs it. Saying no only leaves that feature off. You can take any yes back at any time, in the app or by asking us: it stops what comes next, and does not undo what was done before.
Keeping Measur running and fair - the daily tally, the AI-call lines, the error reports, your IP address, your phone's place in the line, the store check, the product counts, this website's counts, the trial count and a partner's credit on a subscription, and the usage counts we take from synced diaries exist because we need them to fix, improve, pay for and protect Measur. You can object to any of them at the address below.
The law - where a law obliges us to keep or hand over something, and only then.

Deleting your data

On the phone - deleting the app removes everything on the device, and Settings can erase your logged data at any time.
On the server - with an account, Settings > Account & data > "Delete account" removes your whole account for good, once you confirm it from an emailed link, and signs out every device. The diary already on each phone stays until you erase it there. Backups keep each copy for up to 90 days, so a deleted account leaves them within 90 days. A few records outlive the account, without your address: the AI-call lines until their 13 months are up, your contributor points as Anonymous, and links you shared until they expire.
A copy of everything - Settings exports your whole diary at any time, as a backup file with every entry and photo, and as a PDF.

Your rights, and asking us

Who is responsible - innonova GmbH, Sagenrainstrasse 35, 8320 Fehraltorf, Switzerland, makes Measur and runs this website, and is responsible for your data in both. In the EU, you can also write to our representative, Jørgen Wolf, Rua J. Pereira da Silva 12B, 2500-492 Foz do Arelho, Portugal, jay@measur.me. Jørgen Wolf is also our data protection officer (encarregado) for Brazil, at the same postal and email address.
What you can ask - to see what we hold about you and which companies received it, to have it corrected or deleted, to limit what we do with it, to have it in a file you can take elsewhere, and to stop a use that rests on our own need. Write with any of these, or any question about this page, to measur@measur.me: a person answers within 15 days. There is more about writing to us on the support page.
Complaints - if you think we got something wrong, you can complain to Switzerland's Federal Data Protection and Information Commissioner (edoeb.admin.ch), in the EU or EEA to the data protection authority where you live, in Brazil to the ANPD (gov.br/anpd), in the UK to the ICO (ico.org.uk), in Canada to the OPC (priv.gc.ca) and in Quebec also to the CAI (cai.gouv.qc.ca), in Japan to the PPC (ppc.go.jp), in Australia to the OAIC (oaic.gov.au), or in New Zealand to the Privacy Commissioner (privacy.org.nz).
In the United States - no third party collects your health data over time and across websites or online services. If we turn down a request, you can ask us to look at it again at measur@measur.me, and a person answers within 15 days. If we still say no, you can complain to your state's Attorney General, such as Connecticut's (portal.ct.gov/ag), Nevada's (ag.nv.gov) or Washington's (atg.wa.gov).

How we govern personal information

Who is accountable - innonova's managing director is responsible for protecting personal information, approves the rules below and handles complaints. Write to them at measur@measur.me, as above.
Who sees it - only the people who build and run Measur can reach the Measur server, and they use what it keeps only to run Measur, to answer you, or to deal with a fault or a breach. The companies that handle data for us do so under a written agreement.
Before something new - we assess the risks to you before a new feature changes what leaves your phone, and before your data goes to a new country - for people in Quebec, before it leaves Quebec.
Keeping and deleting - each thing is kept only as long as this page says, then deleted. Every breach is written down, and the people and authorities it concerns are told.

Children, and changes to this policy

Children - Measur is for people aged 18 and over. On a phone, Measur asks the app store whether you are 18 or over when you first open it, and the answer stays on your phone. If you think someone younger has given us data, tell us and we delete it.
Changes - this policy takes effect on the date at the top, which moves when it changes. When a change means something new leaves your phone or someone new sees it, the app tells you before it happens.

← Back to Measur