have this
Last updated 2 November 2026.
No trackers, no ads, we never sell your data. We keep what have this needs to give you ideas and keep your food log, for as short a time as we can, and you can see, export, clear or delete it in the app.
have this ("we") provides the have this app. Contact: havethisprivacy@nerdyslothstudios.com.
Our privacy officer, the founder of have this, answers every privacy question, request and complaint at that address.
No photo is kept on your phone either: your phone’s copy is deleted once it’s been read, and photos never go into the app’s image cache.
Signing out clears all of this. Settings > Your data > Clear my history also clears the fridge memory, and Delete my health data clears it and your fasting days.
Our ideas, targets and recipes are made by computer programs and AI models from your answers, food logs and weight; you choose from them. They are ideas, not medical or nutrition advice, and not decisions about your rights.
What you type into Ask, Just tell us and the food boxes is checked for worrying words (for example about not eating, or feeling unsafe), first by our own word lists and, for words they don’t know, by OpenAI. If something sounds worrying, we show a calm note instead of ideas. We don’t keep that request, and we don’t record why.
A question in Ask that says someone is pregnant or breastfeeding gets one card and isn’t kept. Words typed into a menu or list are kept with that request (90 days, or until Clear my history or the account is deleted), with any pregnancy words taken out; no pregnancy reading is stored.
We never sell your data and never use it for advertising. We don’t use ad, attribution or session-recording tools; if we ever measure ads, we’ll use only Apple’s own privacy-preserving tool, which tells us nothing about you. We never put your weight, your diet or what you eat in notifications or emails, and never give your email to an ad platform. We don’t use your data to train AI models, and the AI companies we use don’t train on it either.
To run the service you asked for (contract). Your food logs, water, weight, diets, allergies and answers are health data: we use them only with your explicit consent, given at the end of setting up, which also covers the safety check of what you type. have this can’t give you ideas or keep your food log without them, so agreeing is needed to use the app. Analytics: your consent. Complaints: our legal duty to handle them. Fair-use records, sign-in records, security, backups and feedback: our legitimate interest in running the service safely and answering you.
These companies process data for us, only to provide their service to us, under contracts that require them to protect it at least as well as this policy does:
Apple also handles Sign in with Apple and payments under its own privacy policy.
We look up barcodes and product names in Open Food Facts, a free public food database. It gets only the barcode or the words, never who you are, and product pictures come to you through our server, so it never sees your internet address.
Your voice is turned into words on your iPhone by Apple’s own speech recognition. The recording never reaches us or the AI companies; only the words do, as if you’d typed them.
We keep your account in the UK (Supabase, London). OpenAI, Google, RevenueCat, Resend and Apple process data in the United States; PostHog is in the European Union. When data is in another country, that country’s laws may let its authorities ask for it.
Your account (your answers and what you’ve saved) is kept until you delete it. If nobody uses it for 2 years, we delete it: we email you a month before, and signing in keeps it. If our email can’t reach you, we delete it after 2 years and a month. We never delete it this way while you have an active subscription.
Food logs, weigh-ins and water are kept for 2 years (or 1 year, if you choose that in Settings > Your data), then deleted.
Your history (the ideas we showed you, your yes and no swipes, and recipes you didn’t save) is deleted after 90 days. Anything in Saved stays.
The details behind each set of ideas (what you typed or said, and the answers it used) are kept for 30 days. After that we keep only the foods we spotted, the ideas we showed you and the one you chose, until the 90 days are up.
Photos are used only to read what’s in them. Each one is deleted as soon as it’s been read, usually within seconds; one that’s never read (if you close the app before sending it, say) is deleted within 3 hours.
Records of AI requests are kept for 90 days. If you delete your account, they stay for the rest of that time with nothing linking them to you, so we can keep track of our costs.
Usage counts are kept by PostHog for 1 year.
A login you don’t use for 60 days ends, and the internet address it came from goes with it: just sign in again. Our security logs are kept for 60 days.
Feedback you send is kept for 12 months. A complaint is kept until you delete your account.
If you start setting up but don’t finish, we delete the account after 30 days (7 days if the email was never confirmed).
Your data travels encrypted, and only you can reach your own data in our database. On your phone, your sign-in, your answers and today’s food are sealed with a key kept in the iPhone’s keychain, on this phone only, and the app hides its screen in the app switcher. In Settings > Security you can turn on two-step sign-in with an authenticator app, and a Face ID lock.
If a data breach puts your data at risk, we tell the regulators where the law requires it (in the UK, the ICO within 72 hours) and we tell you without undue delay.
Depending on where you live (UK GDPR, EU GDPR, US state laws, PIPEDA and Quebec’s privacy law, the Australian Privacy Act, the NZ Privacy Act 2020, Bahrain's Personal Data Protection Law No. 30 of 2018), you can access, correct, delete, export, object to or restrict how we use your data, and withdraw consent.
In the app, Settings > Your data: Export my data (one file of what you gave us or chose to keep: your account email and date, your answers and settings, what you’ve logged, saved and sent us; not the ideas and recipes we suggested), Clear my history (the ideas you were shown, swipes and recipes you didn’t save), and Delete my health data (your food log, water, weigh-ins and answers, keeping your account and subscription); and Settings > Delete account. Or email us, including for a copy of anything the file leaves out.
We answer every request within one month. If one is complex, we’ll tell you within that month why we need longer (up to two more months in the UK and EU, or 45 more days under US state laws).
Deleting your account removes everything we hold about you straight away, except the anonymous records of AI requests. To stop a deleted account being made again at once for a fresh day of AI use, we keep a one-way scrambled copy of its email address and Sign in with Apple identifier, made with a secret key, with how much of that day's AI allowance it had used, for up to 3 days. Copies in our security logs and backups go within 90 days. The companies that process data for us delete their copies on their own schedules: OpenAI within 30 days, Google after a limited period, Resend within 30 days. If you used Sign in with Apple, you can also remove have this from the Sign in with Apple list in your iPhone’s Settings.
You can withdraw your consent any time: turn off Analytics in Settings > Privacy choices; delete your health data in Settings > Your data (have this then asks you to set up and agree again before you use it); or delete your account in Settings > Delete account.
Not happy with how we’ve handled your data? Tell us in Settings > Your data > Make a complaint, or by email. In the app we confirm we’ve got it, and we reply to every complaint within 30 days.
You can also complain to your privacy regulator: the ICO (UK), the Data Protection Commission (Ireland), the Office of the Privacy Commissioner of Canada or the Commission d’accès à l’information du Québec, the OAIC (Australia), the Office of the Privacy Commissioner (New Zealand), Bahrain’s Personal Data Protection Authority, or your state attorney general (US).
We treat your food logs, water, targets, weight, height, age, sex, goals, diets, allergies and the foods you avoid as health data. Your answers stay on your phone until you agree to this, at the end of setting up, and our server checks that you’ve agreed before it saves any of it or sends anything to AI. If what we collect, who gets it or why changes, we ask you again before you go on using have this. On your phone, your answers and food are sealed and kept out of your iPhone backups, and none of it goes into iCloud storage. See the Washington and Nevada health data notice.
Health data is sensitive data under US state laws such as Connecticut’s, Washington’s and Nevada’s: we process it only with your consent, and you can withdraw it any time (see Your rights).
We don’t sell personal data, share it for targeted advertising or use it to profile you in ways that have legal or similarly significant effects, so there’s nothing to opt out of. We don’t use personal data to train large language models, and never sell it for that.
You can ask us to confirm, see, correct, delete or export your data. We answer within one month, well inside the 45 days these laws allow. If we say no, you can appeal: reply to our answer, or email us with "Appeal" in the subject. We answer appeals within 45 days, and if we still say no, we’ll tell you how to contact your state’s attorney general.
Washington and Nevada: see our Washington and Nevada health data notice.
Your data is stored and processed outside Canada: in the UK, the US and the EU (see Where it goes). Our privacy officer, the founder of have this, is responsible for it and answers at havethisprivacy@nerdyslothstudios.com. In Quebec, the same person is in charge of protecting personal information.
We disclose personal information to companies overseas that process it for us: in the United Kingdom (our database), the United States (OpenAI, Google, RevenueCat, Resend and Apple) and the European Union (PostHog, only if you turn on Analytics). We take reasonable steps so they handle it in line with the Australian Privacy Principles.
If a data breach is likely to cause you serious harm, we’ll tell you and the Office of the Australian Information Commissioner as soon as we can.
Computer programs make, or help make, some decisions using your personal information: your answers (such as age, sex, height, weight, activity, goals, diets, allergies and foods you avoid), what you log, and what you type or say. Made by a computer program alone: the ideas and recipes we show you and their order; your suggested calorie and nutrient targets; whether a request gets ideas or a calm note instead; whether you can use have this (the age check when you set up); when Kitchen magic pauses AI for the day; ending a login unused for 60 days; and deleting an account unused for 2 years. You can ask us about any of them at havethisprivacy@nerdyslothstudios.com.
have this is for adults (18+). If you give an age under 18 while setting up, we clear the app and delete any account already made (if that can’t happen straight away, within 30 days).