Simmerlo estimates the calories in a meal from a photo you take. This page explains what we store, what we send to a third party, and how to get rid of all of it.
Simmerlo is published by Dalian Zhiliaoshengsheng Culture Communication Co., Ltd., a limited liability company registered in Wafangdian, Dalian, China. For any question about this policy or your data, write to privacy@simmerlo.com.
We do not collect your name, phone number, contacts, location, advertising identifier, or a list of other apps on your device. The app contains no advertising SDK. The only third-party SDKs it embeds are the authentication, storage and purchase components described in section 4 — none of them is an analytics or tracking SDK.
A photo is sent for analysis only when you take or pick one. It is compressed on your device, transmitted over HTTPS to our server, forwarded once to a vision model, and discarded. We do not store your photos, not on the server and not in a database.
Our server keeps no copy on disk. The analysis result — a dish name, an estimated calorie range and macronutrients — is what gets saved, and only if you tap Save.
If you save a meal, the photo you took stays in the app's local storage on your own device so the entry can show a thumbnail. That copy never leaves your device except as part of your device's own backup, which is controlled by your operating system, not by us.
These providers process data on our instructions and are not permitted to use it for their own advertising. The one exception is the Gemini free tier described above, which may use submitted content to improve Google's products. We do not sell your personal information, we do not share it with data brokers, and we do not use it for cross-app tracking.
Where the GDPR applies, we rely on performance of a contract to provide the service you signed up for, and on legitimate interests to keep the service working and prevent abuse. You may object to processing based on legitimate interests at any time.
Your account data is kept until you delete your account. Deletion is immediate and irreversible: the account row, your profile and every meal entry are removed from the database at once. There is no soft-delete tombstone on the server and no backup copy we restore from.
Scan counters and IP addresses live only in the API server's memory, are keyed either to your user id (signed in) or to the requesting IP address (anonymous), and are discarded when the UTC day rolls over — they are never written to the database. Our hosting provider keeps standard HTTP request logs, which include the requesting IP address and a timestamp, for a short operational window; those logs contain no photo content.
If you are a California resident, you have the right to know what we collect, to delete it, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined by the CCPA/CPRA. We will not discriminate against you for exercising any of these rights.
Your meal entries and goal settings can qualify as consumer health data under the Washington My Health My Data Act and comparable state laws. For that data specifically:
Simmerlo is not directed to children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, email us and we will delete it.
Calorie estimates are approximations produced by a vision model. They can be wrong, particularly for oil, sauces, hidden ingredients and true portion size. Nutrition targets shown in the app are for general tracking only and are not medical advice, diagnosis or treatment. Consult a qualified professional before changing your diet for a medical condition. Do not rely on this app to manage diabetes, an eating disorder, an allergy, or any other health condition.
Data is transmitted over TLS. Database access is protected by row-level security, so one account cannot read another account's records. Our API server holds the model credentials and never exposes them to the app. No system is perfectly secure, but we keep the surface small: passwords are stored only as salted hashes by our authentication provider, and no photos at rest on our side.
If a breach of your data ever occurs, we will notify affected users without unreasonable delay and within 60 days of discovering it, describing what happened and what data was involved.
Our processors are all located in the United States: the database, the API server and both vision models (primary and backup). If you use the app from another country, your data will be transferred to and processed in the United States. No meal photo, entry or account detail is sent to a processor outside the United States.
If this policy changes in a way that affects what we collect, we will update this page and change the effective date above. Material changes will be announced in the app before they take effect.