CarnAIvore App Privacy Policy
Effective date: 9 November 2026 · Last updated: 9 November 2026
CarnAIvore's AI service isn't open yet. This policy describes how it will work when it opens. If anything changes, we'll update this page first.
This policy covers the CarnAIvore Mac and iPhone app and its optional AI service. CarnAIvore LLC, a New Mexico company, is responsible. Contact support@carnaivore.ai or CarnAIvore LLC, 1209 Mountain Road Pl NE #13707, Albuquerque, NM 87110. The website waitlist has a separate Website Privacy Policy. See our separate Consumer Health Data Privacy Policy for health data.
The short version
- Your meals, photos, goals, check-ins, trials, chats and other personal records are stored on your device. A chosen AI question can send selected saved records, your own words and earlier chat context; helper jobs can send their disclosed inputs separately. In this version, photos aren't sent to CarnAIvore or to any AI. If we add photo features that use AI, you'll choose with a separate permission first.
- CarnAIvore's AI is optional. The app asks separately for permission to send your question and chosen records to its server and to pass them to OpenAI, which runs the AI model. Record categories start unselected.
- The server does not keep question, chosen-record or answer text. OpenAI may keep it for up to 30 days to check for abuse and does not use it to train its models. It keeps a coded account record for your plan, use, purchases, security checks, terms acceptance, gifts and referrals. It holds no name or email and is tied to your Apple Account only by a code, so it is pseudonymous rather than anonymous.
- Why the App Store lists health data as "collected" and "linked to you": when you ask a question, the records you picked go with it, and OpenAI may keep a copy for up to 30 days to check for misuse (longer only if the law requires). Apple counts any copy that may be kept that long as collected, and counts personal health information as linked to you, even though we send OpenAI no name, account or device ID. Our own server keeps none of it, and your records stay on your device.
- We do not sell information, share it for targeted advertising, or use it for AI-model training. AI answers can be wrong and are not medical advice. CarnAIvore is for adults 18 and over.
- CarnAIvore is a consumer food and wellness app, not a healthcare provider. HIPAA, the US medical-privacy law, generally doesn't apply to what you keep here. Our privacy policies, and the consumer health data laws that cover us, do.
1. What stays on your device
The app stores meals and food amounts, meal photos (a photo you take or choose in the meal log is resized on your device and its location is removed; one added from a file keeps its own details), favourites, drinks, electrolytes, ketones, supplements, weight, goals, notes about you, routines and plans, reports, body-signal check-ins, personal trials, chats, and earlier versions of corrected entries. It also keeps settings, permissions, terms acceptance, a local plan-status copy and a device-key identifier.
You can delete entries or use About you › Your data, on this device › Forget all app data on this device. Full meal photos are removed after the Storage interval you choose (30 days by default). A tiny copy stays with the meal so your logbook keeps its picture, until you delete the meal or photo, or delete all photos under About you › Your data. Turning tiny copies off applies to photos whose full copy expires later. Plate and bowl pictures stay until you delete them. Chats are removed after the inactivity interval you choose (kept by default). Removal runs when the app next opens. Exports, your backups and records on other devices are outside that deletion. CarnAIvore does not sync records through iCloud. A full export writes records and photos to a folder you choose; restore reads a folder you select. Protect exports as sensitive files. Don't rely on an export as a guaranteed backup or a way to move to a new device.
Trial reminders and annual-plan renewal reminders are device notifications; a trial name may appear on the lock screen. You can turn a trial's reminder off in the trial, or hide notification previews in your device's settings. Fixed app help and supported on-device processing do not send your records to CarnAIvore's server. If you use voice, your speech is turned into text on your device and isn't sent to CarnAIvore, and reading aloud also happens on your device. The camera is used only for photos you choose to take.
2. What an AI request sends
After permission, CarnAIvore's AI receives your question, recent chat messages and any older summary, the record categories you choose for the selected days, a short local reference for each meal, time and time zone, missing-log hints, excluded-category names, app instructions and limited device/settings context. Categories include meals and food notes, goals and notes about you, weight, routines, plans, reports, trials and their check-ins, body-signal check-ins and notes, drinks and electrolytes, ketones and supplements. Nothing is selected at first. Leaving a saved-record category unticked excludes its newly assembled record context; it cannot remove details you typed into the question or an earlier message, or details already in a chat summary. Your question can itself reveal health information even with no records selected. Please don't put your name or other identifying details in a chat; CarnAIvore doesn't need them. A request includes only the items listed in this section.
A helper receives the input needed for that job regardless of your chat-category choices. When the app can read a meal on your device, nothing is sent. If it can't, or you approve a meal suggested in chat, the helper sends your words, any chat suggestion about that meal, and the current date, time and time zone. The model returns foods, quantities and units; the app matches its local food list and calculates grams for your review. The food list is not sent. A cancelled draft is not saved; editing its amounts is local until you choose to make another AI request. If on-device naming is unavailable, naming a chat sends the start of its first question and answer; summarizing a long chat sends older messages. A trial reading sends the selected trial and up to 7 days before it started, including their daily food figures, check-ins and notes; a pattern reading sends the displayed days, food figures, check-ins, notes and trial days.
CarnAIvore AI requests go through a service hosted by Amazon Web Services (AWS) in the US to OpenAI's API, which runs the OpenAI model you choose in the app. The service asks OpenAI not to store responses and gives the model no tools. OpenAI says it does not use API content to train its models by default. OpenAI may keep request and response content in abuse-monitoring logs for up to 30 days, subject to exceptions such as legal requirements, and may briefly cache repeated parts of requests to answer faster. OpenAI may process requests outside the United States. We send these requests to OpenAI as a business customer of its API. The server does not write question, selected-record or answer text to its record store or application logs; it does keep coded per-job model, time, cost, status and use information, and a one-way check value that recognizes a repeated request but can't be read back. AWS may generate technical, security or audit records. A crisis response adds to a yearly count without linking its content or account to the count, so we can publish on our safety page how often the safety step is used. If we change our AI provider, we'll update this policy and ask for your permission before sending anything to the new one.
Local USDA food lookups send nothing to the AI.
3. Purchases and the coded server record
Apple handles subscriptions, the Lifetime purchase, payment, refunds and cancellation. We do not receive your card or Apple Account email. The app and Apple may send signed app, purchase and renewal details to the service to apply the 7-Day Trial, Lifetime, Plus or Pro and handle refunds. App Attest may check that requests come from a genuine copy of the app on a real device, which stops others running up costs in your name. The server uses a keyed code derived from Apple's app identifier; the app can link it to your Apple Account. This lets your plan work without an account, email or password.
The record contains plan and period, current and historical use, per-answer cost/model metadata without message text, transaction markers, device security keys, AI-terms acceptance, bonus resets, gift and referral status, and limited safety/abuse counters. Referral links are intended to be removed after the refund window settles; coded markers can remain longer to prevent reuse and resolve refunds. You choose whether to share a gift or referral code. No bonus is given for reviews or ratings.
Settings › AI › Delete my CarnAIvore data offers “delete my history, keep my plan” and “delete everything.” The first keeps the active plan, bonus/referral entitlements, current counters and device security keys. The second removes the ordinary account record but keeps limited coded records: a 13-month deletion note (so the 7-day free look and this week's free use can't restart by deleting), transaction/subscription markers for up to two years after the relevant event (so a purchase is never credited twice and refunds are handled), and terms acceptance for three years (proof you agreed to the terms). An active paid period and its use remain until it ends. Neither choice cancels or refunds an Apple subscription or purchase. The app offers a view and copy of the server record. Delete everything also keeps, for the same 13 months: your devices' security keys (public keys, with their use counts), which gift codes you redeemed, whether you've ever paid, and when you had the free look, a gift week, Lifetime or a paid plan (Lifetime only while unrefunded, as a coded mark, not its ID). These prevent abuse and keep a Lifetime purchase working, and hold no questions, answers or health records.
4. Website, support and reports
The live website and waitlist have separate Website Privacy, Waitlist Privacy and Waitlist Consumer Health Data notices. If you email support@carnaivore.ai, you provide your address and message; avoid unnecessary health details. Report this answer prepares an email with answer details in your email app; it is not sent until you send it. Support mail and privacy-request notes are kept up to two years.
5. Why and with whom we process information
We use information to run an AI response you request, apply your plan and purchases, prevent fraud, provide support, handle rights requests and meet legal duties. We do not sell information, share it for targeted advertising, profile you for legally significant decisions or use it to train AI models.
| Recipient | What it handles | Reason |
|---|---|---|
| AWS | Service records; AI requests pass through its servers; technical connection data | US hosting, storage and security |
| OpenAI | AI requests you choose to send, and the answers | Running the AI model; may keep content up to 30 days for abuse monitoring, subject to exceptions; not used for training by default |
| Apple | App transactions, subscriptions and attestation under Apple's own policies | Payment and app verification |
| Fly.io and Resend | Website visits and waitlist/support email as described in the website notice | Website and email delivery |
We have no affiliates receiving your health records. We may disclose information if law requires it.
6. Your choices and rights
You may choose chat record categories, withdraw AI permission in Settings › AI on each device, see and save the server record, use either server-deletion choice, delete local records and export them. Permission lasts 12 months unless withdrawn earlier. Withdrawal stops new requests on that device, but cannot recall an earlier request. Write to support@carnaivore.ai with “Privacy request” to ask about access, correction, deletion or recipients; reply “Appeal” if dissatisfied. An email alone cannot prove ownership of a coded server record, so we may guide you to the in-app proof. We answer within 45 days, giving notice of any permitted extension, and handle appeals within 45 days. See Your privacy choices.
7. Security, retention and changes
The service uses HTTPS and encrypted AWS storage; app files use device storage protections. We will give any breach notice required by law.
| Information | How long we keep it |
|---|---|
| Local records and settings | Until deleted, subject to chosen photo/chat intervals. Tiny photo copies stay with their meal until you delete them |
| Question, included records and answer text | On our server: not stored in service records or application logs. At OpenAI: up to 30 days in abuse-monitoring logs, subject to exceptions, plus brief caching of repeated parts |
| Per-answer metadata and its check value | 90 days, to show your use and answer billing questions |
| Plan history and monthly counts | Up to 2 years, to apply allowances and check charges |
| Active record and device keys | Until deletion, subject to paid-period and anti-abuse exceptions |
| Terms acceptance after full deletion | 3 years, as proof you agreed to the terms |
| Deletion note | 13 months, so the free look, gift week and weekly use can't restart by deleting; it also keeps device security keys, redeemed gift codes and plan marks, to prevent abuse and keep Lifetime working |
| Purchase and subscription markers | Up to 2 years after purchase or subscription end, respectively, so nothing is credited twice and refunds are handled |
| Earlier server-record versions | 30 days, as a safety net against accidental loss |
| Service audit records | 1 year |
| System logs, without question or answer text | 7 days |
| Bonus, gift and referral records | Bonuses 30 days; gift objects 60 days after expiry; some referral markers up to 2 years |
| Support emails and privacy-request notes | Up to 2 years |
Before collecting or using new categories of health data, we will disclose the change and seek any required permission. Material changes will be shown in the app.