Your data, your device.

Keto Tracker AI has no accounts. There is no sign-up, no email address, no password, and no profile of you anywhere. Your food log, your weight, your photos and your notes live on your phone and are not uploaded.

Keto Tracker AI is a trading name of Keto Tracker LLC, an Arizona limited liability company. "We" and "us" in this policy mean Keto Tracker LLC. This policy covers the Keto Tracker AI app and this website. It takes effect on 3 October 2026.

The short version

These things leave your phone, and only these:

What you ask the AI to look at — a meal photo, a photo of your fridge, a description you typed, or the figures a question is about — sent so a model can answer it, and only after you have said yes (§2).
An identifier for the app on your phone, so we can count how many AI requests it has made and keep your allowance and purchases with it. It is not linked to you, because we have nothing to link it to.
Anything you choose to send us: a report about an AI answer, a suggestion for the app, or a message from our Support page. Nothing is sent until you press Send.
A barcode, when you scan one, to look the product up.
Purchase information, if you subscribe, handled by the app stores and RevenueCat.
A routine check for app updates, with a random number for your installation and the app's version.

We do not sell anything about you, we do not run advertising networks, and there is no analytics or tracking SDK in the app. This website sets no cookies. It counts visits with software we run on our own server, which never stores your IP address and shares nothing with anyone (§5). You can verify the app part: its dependency list is short and public.

1. What stays on your device

All of it, unless a section below says otherwise. Specifically:

Every meal, portion and macro figure you log
Weigh-ins, ketone readings, waist measurements
Your profile: age, sex, height, and pregnancy status if you entered it
Progress photos, meal photos and fridge photos
Workouts, routines and training history
Water, fasting windows, streaks and non-scale wins
Your goals, targets and settings
Saved recipes, meal plans, shopping lists and your fridge
Your conversation with the coach

This is stored in your device's own app storage. It is included in whatever device backup you have switched on with Apple or Google — that backup is between you and them; we have no access to it and no copy of it.

2. What leaves your device, and when

What	When	Where it goes	What is included
A meal photo	You tap to estimate a photo	The AI provider, via our managed proxy or your own key	The image, downscaled; an app identifier
A fridge photo	You tap to scan what is in your fridge	The AI provider, via our managed proxy or your own key	The image, downscaled; the names and counts already on your fridge list, so it can tell you what has changed; an app identifier
A meal description	The food table can't place it and you tap "Ask AI"	The AI provider, via our managed proxy or your own key	The words you typed; an app identifier
Your figures for a question	You ask the coach, request a recipe, plan meals or a workout, or when a weekly note or plateau read is generated	The AI provider, via our managed proxy or your own key	The details the answer needs — carbs left, targets, recent meals and weights, training, and your age, sex and height if you entered them. For recipes and meal plans, what's in your fridge (for meal plans, with how many of each) and whether you are pregnant, so unsafe foods are left out. Never your name, because we don't have it
A report about an AI answer	You report an answer and press Send report	Our server	The answer you are reporting (up to 1,200 characters), the reason you picked, anything you typed (up to 400 characters), which screen it came from, and your app identifier. Never your log
A suggestion	You send one from Settings → Ideas	Our server, and a Google Sheets spreadsheet we sort suggestions in	The words you typed; the app version, operating system and plan unless you switch those off. No app identifier
A support message	You send the form on our Support page	Our server, and a Google Sheets spreadsheet we answer support messages from	The topic you picked and what you wrote; your phone, operating system and app version if you add them; and your email address, only if you give one for a reply. No app identifier
A barcode	You scan a product	Open Food Facts (a public, open food database)	The barcode number only
An update check	The app starts	Expo, the service that delivers app updates	A random number for your installation, the app's version and your phone's platform
Purchase events	You subscribe, restore, or the app checks your subscription	Apple or Google, and RevenueCat	Handled by them; see §6
Nothing at all	You tap a shop link	Your browser opens the retailer's site	An ordinary web visit; see §8

Permission first. Nothing in the four AI rows above is sent until you agree. The first time you use an AI feature, the app asks in plain words what is sent, to whom, and what is kept. Saying no leaves every other feature working. You can withdraw at any time in Settings → AI and your data; that stops anything further being sent, though it cannot recall what has already been answered.

AI answers are labelled. Everything a model writes in the app is marked as AI-generated: coach replies, recipes, meal plans, workout suggestions, training reviews, weekly notes, plateau reads and photo or description estimates. A weekly note you share carries a line saying an AI wrote it.

What is never sent: your weight history in bulk, your photo library, your contacts, your location, your device advertising identifier, or any of the log in §1 beyond the specific figures a specific question needs.

Every connection the app and this website make is encrypted (HTTPS).

3. The app identifier — the part worth reading twice

Free use of the AI features is a fixed allowance granted once. To hold you to that allowance without an account, the app gives itself an identifier on your phone and sends it with each AI request. RevenueCat, which checks whether you have a subscription (§6), uses the same identifier.

Being straight about what this means:

It stays with the app on your phone. If you delete Keto Tracker AI and install it again on the same phone, it has the same identifier, so your remaining allowance and anything you bought are still there, with no account and no sign-in.
Where it comes from. On an iPhone it is a random value the app creates and keeps in the phone's keychain. On Android it is worked out from the ID Android gives this app on your phone, scrambled one way before it leaves the phone, so we never receive that ID itself. It is not your device's advertising identifier on either.
It is a permanent record on our server. We keep a row for that identifier holding how many AI requests it has made, per feature. It has to outlive any single session, because the allowance never resets — that is the mechanism, not an oversight.
It is not linked to you. We do not have your name, your email, your device's advertising identifier, or anything else to connect it to, and our server logs do not record it next to your IP address (§5). We cannot identify you from it and we do not try.
It is not used to track you. It is not shared with advertisers, not joined to anything, not combined with other details about your phone, and not used to build a profile. Its only job is arithmetic.

4. What the AI provider sees

The AI features are answered by a third-party model provider. On the free and Pro plans that is always xAI (Grok), in the United States. With your own key (BYOK) it is the provider you choose: xAI, or MiniMax, which is headquartered in China. What you send them is the content of the request: your photo, your words, or your figures.

How long xAI keeps it. xAI stores API requests and answers for up to 30 days for auditing, and does not train its models on them.

What we require of them. We send your data only to providers whose terms commit them to keep it confidential and to use it to answer your request. We check those terms before we use a provider and when they change, and we will stop sending data to any provider that does not protect it at least as well as this policy does. Their own terms also apply, so do not put anything in a coach message you would not want a third-party model provider to receive.

BYOK changes who is in the path, not who sees it. With your own key, requests go directly from your phone to the provider — we see nothing, and your key never leaves your device except to the provider it belongs to. Your key is stored in your phone's own secure keychain (iOS Keychain / Android Keystore), never in the app's ordinary storage, and it is never written to a log.

5. Our server (the managed proxy)

Unless you use your own key, the app does not have a direct line to the AI provider. On the free tier and on Pro it talks to our managed proxy, which holds the provider's API key, enforces your allowance, and forwards the request on your behalf. It runs at DigitalOcean, in New York, United States. Two things are worth being specific about:

The proxy is a relay, not a destination. The contents of your request and the model's response pass through it but are not stored.
The provider still sees what you sent. The proxy does not anonymise the request before forwarding — your photo, your words, or your figures reach the model exactly as the app sent them. The "managed" in managed proxy refers to the key and the cap, not to the privacy of the request body.

What our server keeps, and for how long:

The allowance counter for your app identifier (§3), for as long as that allowance exists.
Reports about AI answers (§2), for 12 months from when we receive them, after which they are deleted automatically. We read them to find answers the app should not give.
Suggestions (§2), for as long as they help us decide what to build. They carry no app identifier. We sort them in a Google Sheets spreadsheet, so a copy is also held by Google, which stores it for us under its own terms.
Support messages (§2), for 12 months from when we receive them, after which they are deleted automatically, from our server and from the Google Sheets spreadsheet we answer them from, which copies what our server holds. An email address you give is used only to reply to that message.
Server logs, for this website and the app alike: the time, the address requested (such as /privacy or an AI feature's path), and whether it succeeded. They do not record your IP address, your app identifier or your device's details, and they are overwritten as they fill, at most 30 MB at a time.
Website visit statistics, for 12 months: the page you visited, the site that sent you, any campaign tag in the link (such as utm_source), your browser, operating system, device type, screen size, language and country. There are no cookies and nothing is stored in your browser. Your IP address is used for a moment, to work out the country and to count repeat visits on the same day as one visitor, and is never stored. The code that counts you changes every day, so a visit today cannot be linked to one tomorrow. Advertising click identifiers in links, such as fbclid, are discarded. The software is Umami, running on our server, and no one else receives this data. If your browser sends Do Not Track, nothing is counted.
Your IP address is held in memory for up to an hour, to stop any one address flooding the service. It is never written to disk.

If you would rather we were not in the path at all, switch to BYOK. The choice is yours and you can change it at any time in Settings.

6. Purchases

If you subscribe or buy the one-time unlock, the payment is handled entirely by Apple or Google. We never see your card details, and no one at Keto Tracker AI can.

We use RevenueCat to tell the app whether a subscription is active. RevenueCat receives the app's identifier on your phone (§3), purchase information from the store, and the basic device and app details needed to check it, and processes them on our behalf under their own privacy policy. It does not receive your food log, your photos, or anything else from §1.

7. Photos

Meal photos are sent to the AI provider when you ask for an estimate, and are downscaled and re-encoded before sending. We do not keep a copy on our servers. On your phone, the app deletes the smaller copy as soon as it has been sent, and deletes the photo itself when you save the meal, retake it, or tap Remove photo.

Fridge photos are sent to the AI provider when you tap to scan your fridge, and are downscaled and re-encoded before sending, on the same terms as a meal photo. A scan also sends the names and counts already on your fridge list, so the model can report what has changed rather than handing you a fresh inventory every time. That list is a row of words and numbers — it carries no purchase history, price, or store — and it is sent only for the scan you asked for, never in bulk. We do not keep a copy on our servers. On your phone, the app deletes the smaller copy as soon as it has been sent, and deletes the photo itself when you take another one, tap Done, or tap Remove photo.

Progress photos are never sent anywhere. They stay on your phone until you delete one or uninstall the app. To delete one, press and hold it in Progress → Photos → All; that deletes the picture from your phone, not just the entry.

8. Shopping links

Some product links earn us a commission at no extra cost to you. The app discloses this where the links appear. As an Amazon Associate I earn from qualifying purchases.

Tapping a shop link opens your browser at the retailer's site. From that point you are on their site under their privacy policy, exactly as if you had typed the address.

No referral program. We do not pay anyone for sending people to the app, and nothing in the app or on this website records where an install came from. If that ever changes, this section will say how it works before it starts.

9. Notifications

Reminders are scheduled on your device, by your device. They are not push notifications, nothing is sent from a server, and we do not know whether one fired.

10. What we never do

Sell or rent your information, or share it for advertising
Run third-party analytics or advertising SDKs
Set cookies on this website, or use analytics that sends anything to another company
Ask for your location
Read your contacts, your photo library beyond what you pick, or your other apps
Create an account for you, or ask for an email address
Use your food log to train a model

Do Not Track and Global Privacy Control. The app and this website do not track you across other apps or sites, and we do not sell or share personal information, which is what Global Privacy Control opts you out of. The website's visit counter also switches off entirely when your browser sends Do Not Track.

11. Your control and your rights

Export. CSV and PDF export are built in, unlimited and free, on every tier. Your data is yours and you should never have to pay to read it.
Delete. Uninstalling the app deletes everything in §1 — it is on the device and nowhere else. The allowance counter row in §3 remains, holding a number and no way to reach you, and so do any reports you sent, until they expire (§5).
The allowance counter. If you want that row removed, contact us and we will delete it, along with any reports sent from the same phone. You will need to tell us the identifier, which the app shows under Settings → Plan → See what's counted.
A suggestion. Suggestions carry no identifier, so we cannot look yours up by phone. If you want one removed, email us its wording and we will delete it from our server and the spreadsheet.
A support message. If you want one deleted before its 12 months are up, write to us from the email address you gave, or tell us its wording, and we will delete it from our server and the spreadsheet.
AI permission. Withdraw it at any time in Settings → AI and your data (§2).
Bring your own key. If you would rather we were not in the path at all, this option exists and is the reason it exists.

Your rights. Depending on the US state you live in, you can ask what we hold about you, get a copy, have it corrected or deleted, restrict or object to how we use it, and withdraw consent. Because we hold no name, and no email address unless you gave one with a support message, your app identifier is how we find your records: send it with your request to support@ketotracker.ai. We answer within 30 days, it costs nothing, and we will not treat you differently for asking. If you disagree with our answer, reply and ask us to reconsider. You can also complain to your state attorney general.

If you live in Washington, Nevada or Connecticut, our Consumer Health Data Privacy Policy sets out your rights over health information specifically.

12. Children

Keto Tracker AI is for adults aged 18 and over, and is not directed at children or teenagers. It is rated 18+ on the App Store, its Google Play audience is 18 and over, and it is available in the United States only. Your age is optional, but the app will not accept an age under 18, either when you set it up or in Settings. There is also no in-app social media, no user-to-user communication, no public user-generated content, no advertising network, and no account creation.

We do not knowingly collect anything from anyone under 18. There is no account to close, but if you believe someone under 18 has used the app, contact us and we will help.

13. Health information

The app records information about your body and your eating, including pregnancy status if you enter it. It is not a medical device, it does not diagnose anything, and nothing in it is medical advice. Everything you record stays on your phone (§1). The figures shared with the AI provider (§2) are only the ones a specific question needs, and only after you have agreed. Our Consumer Health Data Privacy Policy covers this information in more detail.

14. Who processes your data, and where

Company	What for	What it receives	Where
DigitalOcean	Hosts our server and this website	Everything in §5, on our behalf	New York, United States
xAI	Answers AI requests on the free and Pro plans, and on your own xAI key	The content of the AI requests you make, kept up to 30 days and not used for training	United States
MiniMax	Answers AI requests only if you add your own MiniMax key	Requests your phone sends straight to MiniMax, never through us	China, where MiniMax is headquartered
RevenueCat	Subscription status	See §6	United States
Expo	Delivers app updates	See the update check in §2	United States
Google	The spreadsheet suggestions and support messages are kept in	The suggestions and support messages in §2	Google's data centres
Open Food Facts	Barcode lookups	The barcode number	France
Apple and Google	App delivery and payments	What their stores collect under their own policies	Their own

AI requests on the free and Pro plans are answered by xAI in the United States. If you add your own MiniMax key, your requests go from your phone to MiniMax in China, where courts and authorities may be able to reach them under local law; we are not part of that transfer. The other companies act for us under their service terms.

15. Security, and if something goes wrong

Every connection is encrypted, and the website and server require HTTPS.
The AI providers' keys live on our server, never in the app. A key you bring lives in your phone's secure keychain.
The server is reachable only through its web front door. Its database is never exposed to the internet, and administrative access needs a cryptographic key.
Messages about purchases are accepted only with a valid signature.
We keep as little as we can, which is the best protection there is: most of what the app knows about you never reaches us.

No system is perfectly secure. If a breach affects data we hold, we will post a notice on this website and in the app and tell the authorities, within the time the law requires.

16. Legal bases (EU and UK)

Consent: the AI features, including the health information they carry (explicit consent) and the transfers in §14. You can withdraw it at any time.
Contract: counting your allowance and providing a subscription or unlock you bought.
Legitimate interests: keeping the service secure (the rate limit and server logs in §5), reviewing reports about AI answers, reading suggestions, and answering support messages.
Legal obligation: anything the law requires us to keep or disclose.

17. Changes to this policy

If we change what leaves your device, we will update this page and say what changed and when, below. Material changes will be surfaced in the app rather than only here — a privacy change nobody is told about is a privacy change nobody consented to.

13 September 2026. AI requests on the free and Pro plans now go only to xAI, in the United States; MiniMax is used only if you add your own MiniMax key. The app is now for adults aged 18 and over, and is available in the United States only.

14 September 2026. The identifier the app sends with AI requests now stays with the app on your phone, including after you delete and reinstall it, and RevenueCat uses the same identifier (§3, §6). The table of what leaves your phone now names what's in your fridge, which recipe and meal plan requests carry, and meal plan requests now include how many of each. Messages sent from our Support page now come to our server instead of opening your email app; an email address is optional, and messages are kept for 12 months (§2, §5).

21 September 2026. §8 now says that we run no referral program and do not record where an install came from. Nothing the app sends has changed.

18. Contact

Keto Tracker LLC, Arizona, USA · support@ketotracker.ai — for any question, request, or complaint about this policy or your data. We read every message; average response time is under 24 hours on weekdays.

The person responsible for protecting personal information at Keto Tracker LLC is our privacy officer, who can be reached at the same address.

Effective 13 September 2026 · Last updated: 21 September 2026