Privacy Policy

Last updated: October 24, 2026

1. What types and categories of data we collect, process and use?

We collect, process, and use personal and non-personal data.

1.1 Personal and non-personal data

The term "personal data" is defined by the General Data Protection Regulation (GDPR) and the Turkish Law on the Protection of Personal Data (KVKK No. 6698). You can think of your personal data as any data that allows you to be identified or that can be correlated to you. On the other hand, "non-personal" data cannot be correlated to any specific person. By removing identifiable parts from and anonymizing personal data, personal data may be converted into "non-personal data."

1.2 Data we collect, process and use

We collect, process and use three types of data:

  • data you provide to us voluntarily,
  • data we receive when you use our Services, and
  • data we receive from third parties.

Typically, we collect, process and use the following categories of data:

  • Identity Data: Your name, surname, and username.
  • Contact Data: E-mail address.
  • Profile Data: Your workout goals, dietary preferences, weight, height, age, and gender.
  • Health & Nutrition Data: Information about meals logged, calorie consumption, macronutrients (carbs, protein, fat), and diet plans generated.
  • Voice Input: When you dictate a meal, your speech is converted to text by your device's speech recognition service (provided by Google or Apple, depending on your device). EatLog receives only the resulting text and does not store audio recordings.
  • Technical Data: Your IP address, operating system, browser type, device model, and other relevant information regarding your internet connection to ensure proper use of the EatLog application.
  • Usage Data: Which screens you visit, your clickstream, transaction history, and subscription status (Free, Weekly, Monthly, Quarterly, Annual).
  • Content Data: Photos of food plates you upload for analysis.

1.3 Photo & Camera Data (Plate Analyzer)

Our Services use artificial intelligence algorithms to provide you with nutritional analysis of your food.

  • Food Analysis: When you use the "Photo-based Plate Analyzer," we collect the images you upload via your camera or camera roll. These images are processed to identify food items and estimate portion sizes/calories.
  • Facial Recognition: We do not use facial recognition technology. Our AI is trained to recognize food, not people. If a person appears incidentally in a photo of food, we do not process their identity.
  • Analysis: To analyse a photo, we send it to our artificial intelligence service provider, OpenAI. OpenAI may also use the photos and meal descriptions it receives to improve its services and train its models (see “OpenAI” in section 8). We do not add your name, e-mail address or account ID to these requests. Where possible, photograph only the plate and avoid capturing people, documents or other personal details.
  • Storage: We store your food photos on Cloudflare R2 (Cloudflare, Inc.) so that we can show them in your meal history. We have asked Cloudflare to store them in its Eastern Europe region; Cloudflare treats this as a preference and does not guarantee the exact location. EatLog itself does not use your photos to train AI models. Authorised members of our team may view a photo when handling a support request or checking the quality of an analysis.
  • Consent: We obtain your explicit permission before accessing your camera or photo library. You may revoke this permission at any time in your device settings.

2. How is data collected?

Personal data is collected by us only if you provide such data to us on your own initiative by choosing to use our Services.

2.1 Login

You may create an EatLog user account through our login system. To register, you must provide us with at least your e-mail address and a password.

2.2 Adding information to your user profile

EatLog enables you to provide us with additional information, such as your weight goals and dietary habits. If you create a diet log, we will receive information about which foods you consume.

2.3 Enabling access rights to your device

For you to be able to use EatLog to the full extent, we will need certain access rights to your smartphone:

  • Camera/Photos: Required for the Photo-based Plate Analyzer and profile photos.
  • Microphone: Required for logging meals by voice. Your speech is converted to text by your device's speech recognition service; EatLog does not store audio recordings.
  • Notifications: Used to send meal reminders or diet plan updates.

3. What are our legal bases for processing of your data?

We process your data in accordance with the GDPR (EU) and KVKK (Turkey).

  • Performance of Contract (GDPR Art. 6.1.b / KVKK Art. 5.2.c): To provide the diet tracking, AI analysis, and subscription features you requested.
  • Legitimate Interest (GDPR Art. 6.1.f / KVKK Art. 5.2.f): To improve our app security, fix bugs, and analyze user trends to build better features.
  • Consent (GDPR Art. 6.1.a / KVKK Art. 5.1): For optional features like marketing newsletters or accessing sensitive device permissions (Camera/Microphone).
  • Legal Obligation (GDPR Art. 6.1.c / KVKK Art. 5.2.ç): To comply with tax laws and consumer protection regulations.

4. What do we use your data for (purposes of processing)?

We collect, process and use data for the following purposes:

  • To provide, operate, and maintain the EatLog app;
  • To process your subscription payments (Weekly, Monthly, Quarterly, Annual);
  • To provide personalized diet plans and calorie reports;
  • To convert your voice notes into text for meal logging;
  • To analyze photos of food to extract nutritional data;
  • To respond to your support inquiries;
  • To detect and prevent fraud or abuse.

5. How long and where are data stored?

We keep your personal data only for as long as we need it for the purposes described in this policy. The table below shows how long each type of data is kept. Where each service provider stores data is described in section 8.

DataHow long we keep it
Account, profile, meal, weight and exercise records, diet plansAs long as your account exists. They are deleted when you delete your account.
Food photos (Cloudflare R2)As long as your account exists. When you delete your account, they are deleted automatically shortly afterwards.
Records of your acceptance of this Privacy Policy and the Terms of UseDeleted together with your account.
Photo and text analysis quality records (on our web server, see section 8)180 days. When you delete your account, they are unlinked from your account.
Server logs (Cloudflare)Up to 7 days. These logs may contain your account ID and the meal descriptions you typed or dictated.
Product analytics (PostHog)For the retention period applied by PostHog. They are not deleted automatically when you delete your account; you can ask us to delete them at [email protected].
Support correspondence (e-mails with [email protected] and messages sent through the contact form on our website)2 years from the last message. It is kept separately from your account and is not deleted when you delete your account; you can ask us to delete it earlier at [email protected].
Website statistics (clicks on app download links, including your IP address)1 year.
Website cookie consent records2 years.
Subscription and payment recordsFor the period required by tax and accounting law. These records are also kept by Google Play, the App Store and RevenueCat under their own policies.
Content shared with OpenAISee “OpenAI” in section 8.

Deleted data may remain in our service providers' backup copies for a limited time until those backups are overwritten.

6. Cookies and Tracking

We use standard tracking technologies to understand how users interact with our app. This helps us see which features (like the Plate Analyzer) are most popular. You can manage your cookie preferences in your device settings.

7. Transfer of data to third parties

We do not sell your data. We transfer data to third-party service providers only when necessary to operate the app (e.g., database hosting, payment processing).

One exception is described under “OpenAI” in section 8: content we send to OpenAI for analysis may also be used by OpenAI to improve its own services.

Transfers abroad: Our service providers store or process data outside Türkiye, mainly in the European Union (Germany) and the United States. The location of each provider is given in section 8. When you use EatLog, your data is therefore transferred abroad.

8. Data processing – third-party services and partners

Below is the description of the key third-party services we use:

8.1 Google Analytics (website only)

On our website (eatlog.app) we use Google Analytics (Google) to understand how visitors use the site, for example which pages are viewed and from which type of device and browser. Google Analytics runs only if you accept analytics cookies; you can change your choice at any time via “Cookie Settings” in the site footer. The EatLog app does not use Google Analytics or Firebase.

More information: https://policies.google.com/privacy.

8.2 Supabase

We use Supabase (Supabase, Inc.) as our backend-as-a-service provider.

  • Purpose: Supabase hosts our database (your account, profile, meal, weight and exercise records) and manages user authentication (login/signup). Food photos are not stored on Supabase; see section 1.3.
  • Data Security: Supabase encrypts data in transit (using TLS) and at rest (using AES-256).
  • Location: Our Supabase database is hosted in the European Union, on servers in Frankfurt, Germany. This applies to all users, wherever they are located.
  • Privacy: For more information on how Supabase handles data, please visit: https://supabase.com/privacy.

8.3 PostHog

We use PostHog (PostHog Inc.) for product analytics, to understand how the app is used and to improve it.

  • Purpose: PostHog helps us see which features are used and where users run into difficulties (for example during onboarding, meal logging or photo analysis), fix errors, improve the subscription flow, and understand the issue when you contact our support team.
  • Data Collected: In-app events (such as screens viewed, features used, meals logged, analyses performed and subscription steps); your onboarding answers and the plan calculated from them (such as gender, goal, activity level, body mass index, daily calorie and macronutrient targets and target weight change); device and app information (device model, operating system, app version, language); and approximate location derived from your IP address (country and city level). Once you sign in, these events are linked to your account ID, and your name and e-mail address are associated with your analytics profile.
  • What we do not do: We do not use PostHog's session recording (screen recording) feature. We do not use this data for advertising and we do not sell it.
  • Location: Data is stored on PostHog Cloud EU, on servers located in Frankfurt, Germany.
  • Privacy: For more information on how PostHog handles data, please visit: https://posthog.com/privacy.

8.4 OpenAI

We use OpenAI (OpenAI, L.L.C.) as our artificial intelligence service provider.

  • Purpose: Analysing your food photos and the meal descriptions you type or dictate (identifying foods and estimating portions and nutritional values), creating your diet plan, and translating food names.
  • Data Sent: Food photos; meal descriptions you type or dictate (sent as text); food names; and, for your diet plan, the foods you have chosen and your daily calorie and macronutrient targets. The app does not add your name, e-mail address or account ID to these requests.
  • Use by OpenAI: We have chosen to share inputs and outputs with OpenAI. This means OpenAI may also use the content listed above to develop and improve its services, including to train its models. For this use, OpenAI processes the data for its own purposes and not only on our behalf.
  • Retention: According to OpenAI, abuse-monitoring logs are kept for up to 30 days. OpenAI determines how long it keeps content shared for improving its services.
  • Location: OpenAI is based in the United States. Your data may be processed in the United States and in other countries where OpenAI or its service providers operate.
  • More information: https://developers.openai.com/api/docs/guides/your-data.

8.5 Cloudflare

We use Cloudflare (Cloudflare, Inc.) for our server infrastructure.

  • Purpose: The app's server functions run on Cloudflare Workers, so every request the app sends to our servers passes through Cloudflare. Our website eatlog.app is also delivered through Cloudflare. Cloudflare stores your food photos (Cloudflare R2, see section 1.3) and protects our services against attacks and abuse.
  • Data Processed: The data the app exchanges with our servers, including your IP address, your account ID and the content of your requests; food photos. Our server logs at Cloudflare may contain your account ID and the meal descriptions you typed or dictated; they are kept for up to 7 days.
  • Location: Cloudflare operates a global network, and requests are processed in data centres around the world. Food photos are stored as described in section 1.3.
  • Privacy: https://www.cloudflare.com/privacypolicy/.

8.6 RevenueCat

We use RevenueCat (RevenueCat, Inc.) to manage subscriptions.

  • Purpose: Checking your subscription status, linking purchases made through Google Play or the App Store to your EatLog account, and managing trials and renewals.
  • Data Processed: Purchase and subscription information (such as the product, price, purchase and renewal dates and the store) and the account information needed to link your subscription to your EatLog account. RevenueCat does not receive your payment card details.
  • Location: RevenueCat is based in the United States.
  • Privacy: https://www.revenuecat.com/privacy.

8.7 Google Play and Sign in with Google

We use the following Google services.

  • Google Play: On Android, subscriptions are bought and paid for through Google Play. Google processes the payment; we do not receive your payment card details. Google Play's own terms and privacy policy apply to the purchase.
  • Sign in with Google: If you sign in with your Google account, Google shares the basic profile information you allow, such as your name, e-mail address and profile photo, with us so that we can create your account and sign you in.
  • Privacy: https://policies.google.com/privacy.

8.8 Apple

We use the following Apple services (Apple Inc.).

  • App Store: On iPhone and iPad, subscriptions are bought and paid for through the App Store. Apple processes the payment; we do not receive your payment card details.
  • Sign in with Apple: If you sign in with Apple, Apple shares the name and e-mail address you choose to share with us. If you use “Hide My Email”, we receive an Apple relay address instead of your real address.
  • Privacy: https://www.apple.com/legal/privacy/.

8.9 Google AdMob (advertising)

The free version of the EatLog app for Android shows ads through Google AdMob (Google). The iOS app does not show ads.

  • Purpose: Showing banner and rewarded ads and measuring their performance. Premium subscribers do not see banner ads.
  • Data Processed: Your device's advertising ID, IP address and device information. Google acts as an independent controller for this processing.
  • What we do not share: Your health, meal and profile data are not shared with Google AdMob or any other advertising partner.
  • Your choices: On Android you can reset or delete your advertising ID in your device settings.
  • More information: https://policies.google.com/technologies/ads.

8.10 Open Food Facts

When you scan a product barcode, our server looks the product up in the Open Food Facts database (Open Food Facts, a non-profit association based in France).

  • Data Sent: Only the barcode number and the app language. The request is sent from our server, so your IP address and account information are not shared with Open Food Facts.
  • Privacy: https://world.openfoodfacts.org/privacy.

8.11 Our web server

Our website eatlog.app, our support mailbox ([email protected]) and some service records are hosted by our web hosting provider on a server in Germany.

  • Data Stored: Messages you send through the contact form on our website and e-mails exchanged with [email protected]; photo and text analysis quality records (when you analyse a meal: your account ID, the foods detected, nutritional totals and, for text analyses, the text you entered); website cookie consent records and website statistics.
  • E-mails: The service e-mails described in section 14 are sent from this server.
  • Retention: See section 5.

9. Data security

We maintain state-of-the-art measures to guarantee data security (SSL/TLS encryption). However, no mobile application is 100% secure. You are responsible for keeping your password confidential.

10. Changes to this Privacy Policy

We may update this policy as our app and services change. The date of the latest update is shown at the top of this page. We will inform you of significant changes, such as a new purpose of processing or a new type of recipient, through a notice in the app.

11. Your Rights

Under Article 11 of the KVKK you have the right to:

  • learn whether your personal data is processed and request information about it;
  • learn the purpose of processing and whether your data is used accordingly;
  • know the third parties in Türkiye or abroad to whom your data is transferred;
  • request correction of incomplete or inaccurate data;
  • request deletion or destruction of your data under Article 7 of the KVKK;
  • request that corrections and deletions be notified to the third parties to whom your data was transferred;
  • object to a result against you arising solely from automated analysis of your data (for example, an AI-generated diet plan you believe is harmful);
  • claim compensation for damage caused by unlawful processing.

If you are in the European Economic Area or the United Kingdom, you also have the rights of access, rectification, erasure, restriction of processing, data portability and objection under Articles 15–22 of the GDPR, and the right to withdraw your consent at any time without affecting the lawfulness of processing before the withdrawal.

How to exercise your rights: Send your request from the e-mail address registered to your account to [email protected] with the subject “Privacy Request”, or send it in writing to the postal address in section 12. You can delete your account at any time in the app (Profile > Delete Account) or at eatlog.app/delete-account. We respond to requests free of charge within 30 days at the latest.

Complaints: If you are not satisfied with our response, you can lodge a complaint with the Turkish Personal Data Protection Authority (www.kvkk.gov.tr). If you are in the European Economic Area, you can also contact the data protection authority of your country (list of authorities).

12. Contact details of the Data Controller

For any privacy-related questions or to exercise your rights, please contact:

Enes Öztekin
Address: KARAPINAR BELDESİ YUKARI ÇUKUR MAH. TEMENLER ÇUKUR CAD. NO: 49 ÇAYCUMA / ZONGULDAK 67975, Türkiye
Email: [email protected]

13. Children

EatLog is not intended for people under 18, and people under 18 may not create an account. If we learn that we have processed personal data of a person under 18, we will delete it. If you become aware of such a case, please let us know at [email protected].

14. E-mails we send you

We send only service e-mails that are necessary for your account and our services: password reset and account deletion confirmation e-mails, a reminder before your free trial ends, and replies to your support requests. We send them to perform our contract with you, and they do not contain advertising. To personalise them we may use your name and app language and, for the trial reminder, your country and subscription details (end date, price and the store where you subscribed).

We do not send marketing e-mails. If we decide to do so in the future, we will send them only with your separate prior consent.

Website Cookies

This section applies to the eatlog.app website only; tracking technologies inside the mobile app are described in section 6 above.

We use four cookie categories. Essential cookies are required for the site to work and rely on our legitimate interest (GDPR Art. 6(1)(f)); they do not require consent. Analytics, marketing and functional cookies are set only with your explicit consent (GDPR Art. 6(1)(a) and ePrivacy Directive Art. 5(3)). Until you consent, these cookies are not written and the corresponding scripts — including Google Analytics — are never executed in your browser.

You can withdraw your consent at any time, without giving reasons, by clicking “Cookie Settings” in the site footer. Withdrawal does not affect processing carried out lawfully before it.

Your choice is stored in your browser under the name eatlog_cookie_consent and is asked again after 180 days. To meet our obligation to demonstrate consent (GDPR Art. 7(1)) we also keep a record of your decision on our server, consisting of a random consent identifier, the categories you selected, the text version and your truncated IP address; this record is kept for 24 months.

Essential Cookies

Required for core site functionality such as page routing, language selection and security. These cannot be turned off.

Cookie Type Expiration
PHPSESSID Native to PHP. Stores the session identifier used for contact form rate limiting and spam protection. Session
eatlog_cookie_consent Stores your cookie preferences so this dialog is not shown again on your next visit. 6 months
eatlog_lang Remembers the language you picked from the language menu, so the home page takes you to that version. Only set when you choose a language. 6 months

Analytics Cookies

Help us understand how visitors use the site so we can improve it. Includes Google Analytics.

Cookie Type Expiration
_ga Google Analytics. Distinguishes visitors by assigning a randomly generated identifier. 2 years
_ga_T9F0K4TDT0 Google Analytics. Persists session state so visits can be measured for this property. 2 years

Marketing Cookies

Used to measure campaign performance and show more relevant ads.

Cookie Type Expiration
_gcl_au Google Ads. Measures ad conversions, i.e. whether a visit that came from an ad ended in a download. 90 days
_gcl_aw Google Ads. Stores the click identifier of the ad that brought you to the site. 90 days

Functional Cookies

Remember your choices, such as preferred language or interface settings.

This category does not currently set any cookies on this site.

Transfers to third parties: Analytics and marketing cookies are set by Google Ireland Limited (and its affiliate Google LLC). Data may therefore be transferred to the United States on the basis of the EU–US Data Privacy Framework and/or Standard Contractual Clauses. Fonts and images used on the site are served from our own servers; unless you consent, the page sends no request to any third-party server.

Server-side logs: Clicks on app store links and blog page views are recorded for statistical purposes. These records store your IP address in truncated form (last segment zeroed), use no cookies, and are deleted after 12 months. The legal basis is our legitimate interest in measuring the use of our service (GDPR Art. 6(1)(f)).