Privacy

Data we keep

• Account: your WhatsApp number, your profile name when WhatsApp sends it, your language and time zone.
• Conversations: the messages you send and the replies, and the voice notes and photos you send (plates, labels, barcodes).
• Diary: meals, foods, recipes, pantry, workouts and fasting.
• Health data: weight, height, age, sex, activity level, goals and weigh-ins. Brazil’s data protection law (LGPD) treats this data as sensitive.
• Acceptance: which version of the terms you accepted and when.
• Payment: the plan, the charges and the subscription status. The payer’s name, ID document and card stay with Pagar.me, not with us.
• Origin: when you arrive from a Meta ad, the ad identifier.

What we use it for, and on what legal basis

We do not sell your data, do not use it for third-party advertising and do not profile you for other purposes.

• To provide the service you signed up for: logging, adding up, replying, reminding and billing (performance of a contract, LGPD art. 7, V).
• To keep and use your health data to build your diary, with your specific and highlighted consent, given when you tap "I accept" (art. 11, I). You can withdraw it by deleting your account.
• To keep the service secure, prevent abuse and fix faults, with technical logs that do not contain the text of messages (legitimate interest, art. 7, IX).
• To measure visits and ads on the website, only with your consent in the cookie notice (art. 7, I).

Who we share it with

• Meta (WhatsApp): carries the messages between you and the diary.
• OpenAI, through Portkey: reads the messages, transcribes voice notes and interprets photos to log what you said. Under OpenAI’s policy for its API, what we send is not used to train models.
• Amazon Web Services (AWS): hosts the server, the databases and the files.
• Pagar.me (Stone): processes payments.
• Open Food Facts: receives only the barcode looked up, with no data about you.
• The team’s internal notification tool: receives the support requests you make in the chat (what you told us, your plan and language), so the team can read and follow them up.
• Authorities, when the law or a court order requires it.

International transfers

Our servers are in the United States (AWS, us-east-1 region), and OpenAI, Portkey and Meta also process data outside Brazil. These transfers are made to perform the contract with you, with providers that adopt data protection safeguards (LGPD art. 33).

How long we keep it

• Diary data is kept for as long as the account exists.
• Voice notes and photos are deleted automatically 90 days after they are sent; what was logged from them stays in the diary.
• Technical logs are kept for 30 days. Backups are kept for up to 7 days.
• Payment tax records stay with Pagar.me for as long as the law requires.

How to delete everything

Say "delete my data" in the chat and confirm. You have 7 days to change your mind; during that time, nothing new is logged. After that, we delete the account, the diary, the messages, voice notes, photos and payment records. Backups are gone within 7 days. In total, within 15 days no data of yours remains with us.

We only keep a record that a deletion was requested and when it was carried out, without your number. The copy of the conversation in your WhatsApp and on Meta’s servers follows Meta’s rules.

Your rights

Under the LGPD (art. 18), you can ask for: confirmation that we process your data, access to it, correction, anonymization, blocking or deletion, portability, information about who we share it with, and to withdraw your consent. Ask in the chat or at privacy@codart.dev; we reply within 15 days. You can also complain to Brazil’s National Data Protection Authority (ANPD).

Security

Data travels encrypted, is stored on servers with restricted access, and technical logs do not keep the text of messages or your number. Found a vulnerability? Write to security@codart.dev.

This website

The website does not ask for or keep personal data. With your permission in the cookie notice, Google Analytics and the Meta pixel count visits and measure ads; without it, nothing from them is loaded. Your choice stays only in your browser and can be changed from the Cookies link in the footer.

Minors

The service is for people aged 18 or over. Anyone who gives an age under 18 has no health data stored and is offered to delete the account.

Changes to this policy

When this policy changes, we publish the new version here and ask for your acceptance again in the chat.