Privacy Policy

1. The short version

• Your tracker data (foods, logs, weight, goals) is stored on your device, in the browser's local storage. It is not uploaded to our servers by default.
• We keep a small account record so you can sign in: your email, your name, and a one-way hash of your password. No health or nutrition data is attached to it.
• AI plate identification uses your own AI provider. Your plate photo and your provider key are sent straight from your browser to that provider — they never pass through our servers. Your browser also keeps a temporary on-device copy of the photo (see Section 2) so you can see it again later; that copy is never uploaded anywhere.
• We do not use any third-party analytics, advertising, or tracking.

2. What stays on your device

openplate is built local-first. Your personal foods, food logs, weight entries, and profile/goals are stored on-device in your browser's IndexedDB. This data is not sent to us and we cannot see it. Because it lives in your browser profile, clearing your browser data (or the site's storage) removes it — so keep that in mind before you clear it, and note that this data is tied to the specific browser and device you use.

When you scan a plate, the photo itself is also kept on your device, in a separate on-device cache from your other tracker data, so you can see it again on that food-log entry. It is never uploaded to us and never leaves your device — it only ever goes to the AI provider you connect, as described in Section 4. This cache is on by default, clears itself automatically after 90 days, and you can turn it off or clear it at any time from your Profile page.

3. What we store on our servers

When you create an account on the hosted instance, we store the minimum needed to operate your login:

• Your email address and display name.
• A one-way hash of your password (never the password itself). We can verify a password, but we cannot read it.
• Hashes of one-time email-verification and password-reset tokens (never the raw links), used only to confirm the links you receive by email.
• Basic account timestamps and status flags (for example, when your account was created and whether your email is verified).

We do not store your foods, food logs, weight, goals, or plate photos on our servers. Those live on your device.

4. AI plate identification (your own provider)

openplate's photo-to-macros feature is bring-your-own-key: you connect your own AI provider (such as an OpenAI-compatible endpoint, OpenRouter, or Anthropic) and supply your own API key. When you scan a plate, your browser sends the photo directly to that provider using your key. The photo and the key never pass through our servers. Your browser does keep an on-device copy of the photo, separate from our servers and described in Section 2, so you can see it again on that entry; it is never uploaded anywhere, it expires on its own after 90 days, and you can clear it or turn it off entirely from your Profile page. Your AI provider is a separate third party that you have chosen and whose relationship is with you under your own account and key — how they handle the photo is governed by that provider's own terms and privacy policy, not by us.

5. Food search

After a scan identifies foods, openplate can look up curated nutrition data by name from the public LowCarbCheck food database. Only the food name is sent for a food search — never your photo, never your account data. The search term travels in the body of the request (not in the URL) specifically so it does not end up in a server access log, and we do not store the search terms. The one signal that does reach our server during a food search is the ordinary web-request metadata every website receives, including your IP address, which is used transiently for rate-limiting and appears in standard access logs; it is not linked to your tracker data.

6. Premium end-to-end encrypted sync

We are building an optional premium tier that will let you sync your tracker data across your own devices. It is not yet available. When premium sync becomes available, it will be end-to-end encrypted: your data is encrypted on your device before it is uploaded, and our server stores only opaque ciphertext that it cannot read or decrypt. The encryption keys are derived on your device from a passphrase only you hold — the server never sees your passphrase, your plaintext, or your decryption keys. The only account-linked information our server can see for a synced account is non-content metadata such as the encrypted blob's size and the time it was stored. We will not describe premium sync as active until it actually ships.

7. Transactional email

The hosted instance sends transactional email only — email verification and password-reset messages. We do not send marketing email. On the hosted instance these messages are delivered through our internal Pigeon email service, which relays them via Amazon SES (in the EU eu-central-1 region). Your email address and the message contents are processed by that delivery chain in order to reach you.

8. Hosting and backups

The hosted instance runs on Hetzner infrastructure in the EU. The server database — which, as described above, holds account records and (once premium sync ships) end-to-end-encrypted sync blobs, but no plaintext tracker data — is included in our routine encrypted backups, stored in Amazon S3 in the EU (eu-central-1 region) for disaster recovery. Encrypted sync blobs remain encrypted in those backups; a backup gives us no more visibility into your data than the live database does. Backups are retained on a rolling basis and rotate out over time.

9. Cookies

We use a single essential session cookie to keep you signed in. We do not use advertising cookies or third-party tracking cookies, and there is no third-party analytics on the hosted instance.

10. Your rights and data requests

Under the GDPR you have the right to access, correct, delete, restrict, or export your personal data, and to object to its processing. In practice, most of your data is already under your direct control:

• Your tracker data lives on your device, so you can view, change, or erase it directly at any time from within the app or by clearing the site's local storage.
• We do not yet offer a self-service button to export or delete your server-side account record. Until we do, you can make an access, correction, export, or erasure request by contacting us at the address below, and we will action it. We are honest about this rather than advertising a self-service flow that does not exist yet.
• If you run a self-hosted instance, you have direct database and CLI access to your own data and can export or delete it yourself.

11. Self-hosting

openplate is open-source and can be self-hosted. This policy describes the specific hosted instance we operate. On a self-hosted deployment, the operator of that instance — not the openplate project — is the data controller and is responsible for its own privacy practices.

12. Changes to this policy

We may update this policy as openplate evolves — for example, when premium sync launches. When we make a material change, we will update the "Last updated" date above.

13. Contact

For any privacy question, or to make a data access, export, or erasure request, contact us at partners@sportsight.de.