先講三件最重要的：

• 我們不販售、不出租、不交換你的個人資料，也沒有安裝任何廣告或行為追蹤 SDK。
• 你的位置座標不會被保存：它只在你按下「找餐點」的那一刻用來找附近分店與計算車程，用完即丟。
• 你可以在 App 內直接刪除整個帳號（設定 → 刪除帳號），不需要寄信給我們。

• 收什麼：只有你自己在那一區按下去的標籤本身（全素、蛋奶素、五辛素、 不吃牛、不吃豬、不吃血製品）。我們不問你的宗教、不問原因、也沒有那一格可以填 —— App 裡沒有任何「宗教信仰」的選項。
• 只用來做一件事：把含有那些食材的餐點排除在推薦之外， 以及在推薦頁上說明「為什麼這幾張卡沒有出現」。除此之外沒有第二個用途 —— 不拿去分析、不拿去分眾、不拿去做廣告或個人化行銷，也不會出現在我們跟餐飲品牌談合作的 那份彙總報告裡。
• 不會傳給任何第三方：它從來不隨你的位置一起送去 Google，也不會出現在 送給 Gemini 的那句話裡（見第 3 節）。它只在我們自己的伺服器上，用來從清單裡把東西拿掉。
• 刪帳號時一起刪：它存在你的帳號記錄裡， 設定 → 刪除帳號會連同其他資料一起整筆刪除（見第 7 節），不留副本。
• 你隨時可以改：到設定 → 飲食習慣把勾取消掉，下一次推薦就不再套用。

在 App 裡自己新增一款蛋白粉時，你填的那幾格（品牌、品名、口味、一勺幾克、每勺的熱量與三大營養素） 會送交我們審核；通過之後，這一款會成為所有使用者都搜得到的公開品項。

上傳的只有那幾格資料本身，不含你的帳號、名字或位置， 所以其他使用者看得到那款蛋白粉，但無從得知是誰新增的。這件事在你按下送出前， 表單上也會再說明一次。

你改掉我們估的熱量時也一樣。 記一餐時，我們替某些餐點提供的是估算值 （畫面上會寫「我們估的」）。你把那個數字改掉之後，我們會把 品名、店名、你填的熱量，以及我們原本估的那個數字送回去， 讓同一道菜的估算對所有人都變準一點 ——「我們估了多少」是算出「我們偏了幾成」的分母， 少了它就只有那一道菜受惠，從來沒有人記過的新菜色永遠等不到修正。 你把我們算的份量克數改掉時同理，送回去的是改了幾倍（例如 1.4）， 用來校正「一個拳頭大的飯大概幾克」那張共用的表。 上傳的不含你的帳號、名字或位置，也不含你吃了幾份、花了多少錢或什麼時候吃的。 一起送的只有一個隨機代號：它在你這台手機上隨機產生， 與你的帳號無關（不是從帳號算出來的，所以我們也無法拿它回推是誰）， 而且你把下面那顆開關關掉時會連它一起刪除 —— 再打開就是一個全新的代號。 它的用途只有一個：讓我們分得出「三個人都這麼說」與「一個人說了三次」—— 這張表會改變所有使用者看到的估算，所以一個人說了算是不行的。

這件事預設是開著的，我們不會跳出來問你。 理由是送出去的那幾格裡沒有任何可以指認出你的東西（上一段列的就是全部）， 而每記一餐就跳一次確認框，對你是打擾、對資料也沒有比較安全。 你隨時可以關掉：「設定 → 偏好設定 → 幫忙讓估算變準」； 關掉的那一刻，還沒送出去的那幾筆會從你的手機上刪除，之後也不再送。

你分享一項餐點時也一樣。 填好商家名稱與熱量的卡片底下會有一格 「分享營養資訊，幫助完善公開資料庫」；你拍過營養標示的那幾張卡上， 那一句會寫成「分享營養資訊與那張標示照片，幫助完善公開資料庫」——多出來的那半句就是字面的意思。 維持勾選並按下記下來時，我們會把商品名稱與商家名稱、熱量與三大營養素、 價格，以及那組數字對應多大一份上傳到我們的伺服器，交給審核； 通過之後，那個品項會成為所有使用者都搜得到的公開資料。

那張標示照片會留下來，而且只有我們看得到。 它的用途只有一個： 核對那組數字是不是真的印在包裝上——那是這條路上唯一能證明一個數字有出處的東西。 關於它，有三件事請先知道：

• 它存放在只有我們讀得到的位置：沒有公開網址，不會出現在 App 裡， 也不會給其他使用者看到。公開出去的只有讀出來的那組數字。
• 上傳前，App 會先在你的手機上把照片裁成標示那一塊， 所以多數時候背景不會跟著走。但裁切是自動的，我們無法保證每一張都乾淨—— 按下快門前請先看一眼取景框裡還有什麼。
• 它跟那個品項綁在一起，不跟你綁在一起：上傳的內容不含你的帳號、名字或位置， 我們也無從得知哪一張是誰拍的。代價是刪除帳號不會刪掉它—— 我們找不到它與你的關聯。不想留下照片的話，把那一格的勾取消掉， 這一項連同那張照片就完全不會上傳。

那組數字是你自己打的，我們也收——但會標明它是手打的， 而且一定要有人看過才會進資料庫。你從我們的資料庫裡叫出某一項、發現數字不對、 改掉它的時候，我們原本那一筆的數字會跟你改的那組一起上傳， 好讓審核的人知道你指的是哪一筆、差在哪裡。你改掉的那幾格以外的東西不會送。

上傳的不含你的帳號、名字或位置，也不含你吃了幾份、什麼時候吃的。 一起送的只有一個隨機代號：它在你這台手機上隨機產生， 與你的帳號無關（不是從帳號算出來的，所以我們也無法拿它回推是誰）， 重裝 App 就是一顆新的。用途只有一個：讓審核的人分得出「五個人都這麼說」與 「一個人說了五次」。回送的三條路（改估算、投稿、掃條碼）各用各的一顆， 所以那幾份資料之間也對不起來。

沒有填商家名稱的那幾項一律不會送出—— 自己煮的、朋友家吃的、路邊無名攤子是你的私事；有商家名稱的則是「某一家店賣什麼」的公開事實。 把那一格的勾取消掉，這一項（連同那張標示照片）就完全不會上傳；那一格只在填了商家名稱與熱量的 卡片上出現——它出現的條件與會不會上傳的條件是同一個， 所以你不會有一張「沒問過你、卻送出去了」的卡片。

掃條碼那條路也一樣。 你掃了一支條碼、而我們查不到那個商品時， 你接著填的那組數字可以留給下一個掃到同一包的人。維持那一格勾選並按下記下來 （食材庫是按下存起來）時，我們會把那支條碼、商品名稱與品牌，以及換算成每 100 公克的 熱量與三大營養素上傳，成為所有使用者掃得到的公開資料。

這一條同樣不含你的帳號、名字或位置，也不含你吃了多少、什麼時候吃的； 一起送的只有一個隨機代號（與上一段同一種，但是另外一顆）， 用途只有一個：讓畫面上說得出「1 位使用者提供」還是「37 位使用者提供」。 條碼表那一份仍然只收從營養標示（拍的或掃到的）來的數字—— 它的答案會直接端給下一個掃到同一包的人，中間沒有人看過，所以它那道門比較窄。

The three things that matter most:

• We do not sell, rent, or trade your personal data, and the app contains no advertising or behavioural tracking SDKs.
• Your location is never stored. It is used at the moment you tap “Find a meal” to locate nearby branches and estimate travel time, then discarded.
• You can delete your entire account from inside the app (Settings → Delete account). No email required.

• What we collect: only the labels you tick yourself (vegan, lacto-ovo vegetarian, wu-xin vegetarian, no beef, no pork, no blood products). We never ask for your religion, never ask why, and there is no field to enter it — the app has no “religion” option at all.
• Used for exactly one thing: to exclude meals containing those ingredients from your recommendations, and to explain on the recommendations screen why certain cards are missing. There is no second purpose — never analytics, segmentation, advertising or personalised marketing, and never part of the aggregated reports we share with restaurant brands.
• Never shared with third parties: it is never sent to Google with your coordinates and never appears in the text sent to Gemini (see section 3). It stays on our own server and is used only to remove items from a list.
• Deleted with your account: it lives in your account record, and Settings → Delete account removes it along with everything else (see section 7). No copy is kept.
• You can change it any time under Settings → Dietary habits; unticking a box stops it applying from your next recommendation onward.

When you add a protein powder yourself, the fields you fill in (brand, product, flavour, grams per scoop, and the calories and macros per scoop) are submitted for review; once approved, that product becomes a public entry every user can find.

Only those fields are uploaded — not your account, name or location — so other users see the product but cannot tell who added it. The form tells you this before you submit.

The same applies when you correct a calorie figure we estimated. Some meals are logged with an estimate (the card says so). When you change that number, we send back the dish name, store name, the figure you entered and the figure we had estimated so the estimate gets better for everyone — what we guessed is the denominator that tells us how far off we were, without which only that one dish improves and a brand-new dish nobody has logged never does. The same goes for the portion weight we calculated: if you change it, we send how far off it was (say 1.4×) to correct the shared table behind “roughly how many grams is a fistful of rice”. Nothing else goes with it — not your account, name or location, and not how many servings, how much you paid or when you ate. The only thing sent alongside is a random token generated on your phone. It is not derived from your account, so we cannot work back from it to you, and turning off the setting below deletes it — switch it on again and you get a brand-new one. It does one job: it lets us tell “three people said this” apart from “one person said it three times” — this table changes the estimate every user sees, so one person must not be able to move it alone.

This is on by default and we do not prompt you about it. The reason is that none of the fields listed above can identify you (that list is everything we send), and a confirmation dialog on every meal you log is an interruption that makes the data no safer. You can turn it off at any time under Settings → Preferences → “Help make estimates more accurate”. Turning it off deletes any corrections still waiting on your phone and stops any further ones being sent.

The same applies when you share a nutrition label scan. After you scan a label, that card shows a checkbox reading “Share the nutrition information and that label photo to help improve the public database” (on cards where you did not photograph a label it reads “Share the nutrition information to help improve the public database”, and no photo is sent). If you leave it ticked and save the meal, we upload the nutrition label photo you took, the product and store names, the calories and macros printed on the label, the price, and what size of serving those figures refer to to our server for review; once approved, that product becomes public data every user can find.

That label photo is kept, and only we can see it. It does one job: it lets us check that the figures really are printed on the packaging — it is the only thing on this path that can show a number has a source. Three things to know about it:

• It is stored where only we can read it: no public URL, never shown in the app, never shown to other users. Only the figures read off it become public.
• Before uploading, the app crops the photo down to the label itself on your phone, so most of the time the background does not travel with it. The crop is automatic and we cannot promise every one is clean — glance at the viewfinder before you take the shot.
• It is tied to the product, not to you: nothing uploaded contains your account, name or location, and we have no way to tell who took which photo. The cost of that is that deleting your account does not delete it — we cannot find the link. If you would rather not leave a photo, untick the box and the item, photo included, is not uploaded at all.

Nothing that identifies you goes with it — not your account, name or location, and not how many servings you had or when you ate. The one thing sent alongside is a random token generated on your phone. It is not derived from your account, so we cannot work back from it to you, and reinstalling the app gives you a new one. It is used for a single purpose: so the reviewer can tell “five people said this” apart from “one person said it five times”. The three paths that send data back (estimate corrections, submissions, barcode scans) each use their own token, so those records cannot be matched up either.

Items with no store name are never sent — food you cooked yourself, ate at a friend’s place or bought from an unnamed stall is your private business, whereas an item with a store name is a public fact about what that shop sells. Unticking the box means the item is not uploaded at all, and the box appears only on cards where you actually photographed a nutrition label, or scanned a barcode.

The same applies to barcodes. When you scan a barcode and we have no record of that product, the figures you then type in can be left for the next person who scans the same package. If you leave that box ticked and save the meal (or tap Save in your pantry), we upload the barcode, the product name and brand, and the calories and macros converted to a per-100-gram basis, which become public data any user can scan.

Here too, nothing that identifies you is sent — not your account, name or location, and not how much you ate or when. The only thing sent alongside is a random token of the same kind as above — but a separate one — for a single purpose: so the app can say “contributed by 1 user” rather than “by 37 users”. Figures you typed from memory are never sent — only those that came from a nutrition label, photographed or scanned.