This policy explains what Nodesto collects, why we collect it, who we share it with, and the controls you have over your information.
1. Introduction
Nodesto Inc. ("Nodesto," "we," "us," or "our") runs Nodesto's apps, websites and related features and services, now or in the future (together, the "Services"). This Privacy Policy explains how we handle personal information when you use them. Nodesto Inc. is responsible for that information.
This policy is a notice of how we work, not a request for blanket consent. Where we rely on your permission, for example for your location, camera, photo library or Apple Health data, we ask separately. Your use of the Services is governed by our Terms of Service.
Features vary by app version, device and settings, so not everything here applies to everyone. If we use personal information in a new way, we'll update this policy and ask for any permission the law requires first.
2. Information we collect
The table lists what we collect, with examples and sources.
| Category | Examples | Source |
|---|---|---|
| Account and identifiers | Name, username, email, password, date of birth, account ID, sign-in tokens, phone number if you use phone sign-in | You; Apple or Google if you sign in with them |
| Profile | Profile photo, bio, gender if you give it, and the city or area we save from your location (not shown to other users) | You; your device |
| Content and messages | Posts, photos, captions, ratings, comments, saved places, direct messages, reports you file | You, with camera or photo library permission where needed |
| Location | Precise location when you allow it; places you search for, view or tag | Your device, with your permission; you |
| Health and fitness | Food and calorie logs, weight, workouts (including ones imported from Apple Health), and goals or body details you enter, such as age, height and diet | You; Apple Health, with your permission |
| Connected services and linked content | Account details and posts from a service you connect; public details of posts you link (see Section 2.5) | You; the other service, with your permission |
| Usage and inferences | Likes, saves, follows, searches, time spent, and the taste profile and recommendations we infer from them | Your device; created by us |
| Device and diagnostics | Device type, app version, device identifiers, push token, IP address, crash reports, logs | Your device |
| Communications and other users | Support emails, feedback, messages other users send you, reports about you or your content | You; other users |
We also use public restaurant information, such as place names, addresses and map links, from mapping and places providers. It is about businesses, not about you.
2.1 Sign in with Apple and Hide My Email
If you sign in with Apple and choose Hide My Email, we store and contact you at the private-relay address Apple gives us. You can manage forwarding at appleid.apple.com.
2.2 Apple Health
If you give Nodesto access to Apple Health, we read your workouts, including the calories each one burned, to list them in the app. That list stays on your device and isn't sent to our servers. If you choose to import a workout, its summary is saved to your account on our servers, the same as a workout you log manually. The summary includes the activity type, duration, calories, start and end time, the name of the source app and an Apple Health identifier for the workout. We don't use information from Apple Health for advertising or marketing, and we don't sell it.
2.3 Crash reports
When the app crashes, we receive a crash report with a stack trace and the device's state at the time. It isn't linked to your name, email, username or account ID, only to an identifier the crash-reporting service creates for your installation. We use it only to fix stability problems, never for advertising or profiling.
2.4 Sensitive information
Under laws such as the California Privacy Rights Act, some of what we collect is sensitive: precise location, health and fitness information, login credentials and message contents. We use it only to provide the features you use, keep the Services safe and meet legal obligations, never for advertising, and we don't sell it.
2.5 From services you connect and content you link
You can connect an account you hold with another service, such as TikTok, or paste a link to a public post. When you connect an account, we receive the basic account details and the list of your posts that you allow that service to share, and we keep what we need for the posts you choose to link. We keep the connection's access tokens so you can browse your posts, until you disconnect, remove Nodesto's access in that service, or delete your account. Posts you've already linked stay on Nodesto after you disconnect, until you remove them.
When you link a post, we receive its public details, such as the link, caption, cover image and the creator's handle. Our AI and places providers use the caption and cover image to work out which restaurant the post is about, and you confirm the place. We don't download or host the videos; they play through the other service's own player.
2.6 People who aren't Nodesto users
When a user links a public post from another service, we hold some information about the person who made it, even if they don't use Nodesto. This is our notice to them.
- What we hold: the link to the post and its public details, such as the creator's handle and a link to the cover image; the restaurant we identified; and which Nodesto users linked it.
- Where it comes from: the public post, and the user who linked it.
- Why: to show the post on the page of the restaurant it's about. Our legal basis is our legitimate interest in letting people share public posts about restaurants, and in keeping Nodesto safe.
- Who sees it: Nodesto users who view that restaurant, and the AI and places providers in Section 4, which help identify the restaurant.
- How long: while the post is linked on Nodesto. If the post is removed at its source, we stop showing it. If a creator asks us to take a post down, we keep a minimal record so it isn't linked again.
- Your choices: email support@nodesto.com with a link to the post to ask us to remove it or to object. The rights in Section 8 apply to you too.
3. How we use information
The last column shows our legal basis if you're in the EEA or the UK.
| Purpose | Information used | Legal basis |
|---|---|---|
| Run your account, posting, linking, messaging, feed, maps and search | Account, profile, content, location | Contract |
| Personalize your feed, search results and recommendations | Usage, content, inferences | Contract; legitimate interests |
| Provide AI features (see Section 4) | As described in Section 4 | Contract; consent where the law requires it |
| Provide nutrition and fitness tools | Health and fitness, photos | Contract; consent where the law requires it, including for Apple Health |
| Keep Nodesto safe and enforce our Terms | Reported or flagged content, account, device, usage | Legitimate interests; legal obligation |
| Send the notifications you've turned on, and account messages | Push token, account | Consent (notifications); contract |
| Answer support requests, fix bugs and improve Nodesto | Communications, diagnostics, usage | Contract; legitimate interests |
| Comply with the law and valid legal requests | As relevant to the request | Legal obligation |
Our legitimate interests are keeping Nodesto secure, improving it, and showing you relevant content.
3.1 Personalization and profiling
To personalize your feed, search results and recommendations, we use automated processing, including machine-learning models, to build a "taste profile" from what you engage with. This has no legal or similarly significant effect on you. You can email support@nodesto.com to ask how it works, to stop us using these signals, or to delete the profile.
4. AI and mapping providers
We share personal information with third-party AI service providers and with mapping and places providers, to power AI features such as search, recommendations, photo analysis, nutrition estimates, taste profiles and safety review.
4.1 What we share, and when
Depending on the feature, we share:
- your location
- photos, captions and other text you post, import or submit, including the caption and cover image of a post you link from another service
- what you type for a calorie or energy estimate or into AI search, with short-term context from the same search
- your activity, taste and dietary signals
- content that has been reported or flagged, with the reporter's description
Some of this happens on its own. Photos you post are checked by an image-safety service and analyzed when you publish them, and the Nodesto AI tab may request location-based results as soon as it's shown, without you tapping anything. Other AI features run when you use them.
Safety review protects other users, and users can't switch it off. Every photo you post gets an automated image-safety check when you publish it, whether or not you've agreed to AI processing, and automated review of reports can hide content.
4.2 What providers may do with it
These providers process the information on our behalf, only to deliver, secure and support the feature involved. We do not allow these providers to use your information to train their general models. A provider may keep information for a limited time under its terms with us, to deliver the feature and to detect and prevent misuse.
4.3 Your choices
You agreed to this sharing when you accepted our Terms. To limit it, turn off location access in iOS Settings, skip the optional AI features, such as calorie scans, AI search and the Nodesto AI ask box, ask us to delete your taste profile, or delete your account. Some features then won't work as well.
7. Retention and deletion
We keep personal information only as long as we need it for the purposes in this policy, which for most information means while your account is open.
| Information | How long we keep it |
|---|---|
| Account, profile, posts, comments, saved places, health and fitness logs, taste profile | Until you delete them or delete your account (you can also ask us to delete your taste profile). Posts you delete go to Recently Deleted and are permanently removed after 7 days. |
| The city or area saved to your account | Until your location updates it or you delete your account |
| Connected-account details and linked content | Access tokens: until you disconnect, remove Nodesto's access in the other service, or delete your account. Other connection details: until you delete your account. Links you added to posts: until you remove them or delete your account; they stay after a disconnect. |
| Information sent to AI and mapping providers | As long as the provider needs it to deliver the feature and prevent misuse, under its terms with us |
| Reports, safety records and support communications | As long as needed to handle the report or request, enforce our Terms and meet legal obligations |
| Crash reports, server logs and backups | Kept for a limited time, up to one year, then deleted |
7.1 Deleting or deactivating your account
You can remove your account two ways, both inside the app under Profile → Help & Support. Delete Account is immediate: your account and associated personal information start deleting as soon as you confirm, and it can't be undone once complete. Deactivate Account hides your profile and content right away but doesn't delete anything yet. Sign back in within 7 days to reactivate; if you don't, your account and associated personal information are permanently deleted.
Either way, we delete your profile, posts, photos, comments, taste profile, health and fitness history, saved places, follow connections, links to posts from other services, connection data and uploaded media. A shared record of a post that other users still have linked can remain until they remove it too; we remove your account ID from it.
7.2 What may remain after deletion
| What | How long |
|---|---|
| Messages you sent. A conversation belongs to everyone in it, so the other person keeps the thread; your account is no longer linked to it and shows as "Deleted user". | Until the other person deletes the conversation |
| Backups and server logs, which roll over on a schedule | Up to one year |
| Aggregated, de-identified statistics that no longer identify you | Indefinitely, in aggregated form only |
| Court orders, legal requests and safety records. Reports and safety records may be kept after an account is deleted, as long as needed for safety and legal reasons. | For as long as the obligation lasts |
8. Your rights and choices
8.1 Controls in the app
In the app you can edit your profile, delete your content, disconnect a linked account, block users, report content, and deactivate or delete your account (Profile → Help & Support). Location, camera, photo library, Apple Health and notification access can be changed in iOS Settings.
8.2 Rights you can use wherever you live
You can ask us for a copy of the personal information we hold about you, to correct it, to delete it, or to give it to you in a structured, machine-readable format. You can ask us to stop using your activity to personalize Nodesto, or to delete your taste profile. You can change device permissions at any time; processing that already happened isn't affected.
8.3 California and other US states
Depending on your state, you may also have the right to know the categories, sources, purposes and recipients of the personal information we collect, and to limit our use of sensitive personal information to what's needed to provide the Services. You can opt out of sale or sharing for cross-context behavioral advertising, but we do neither (Section 5.6). We won't treat you differently for using these rights.
In the past 12 months we collected the categories in Section 2, which under the CCPA are identifiers, customer records, protected characteristics (age, and gender if you provide it), network activity, geolocation, photos, inferences, and sensitive personal information. We disclosed them for business purposes to the provider categories in Section 5.2 and didn't sell or share any of them. We don't collect payment information, because Nodesto is currently free.
An authorized agent can make a request for you; we may ask for signed permission and verify your identity directly. If we turn down your request, you can appeal by replying to our decision, and then contact your state attorney general.
8.4 EU, EEA and UK
If you're in the EU, EEA or UK, you also have the right to restrict processing while we look into a concern, to object to processing based on legitimate interests (including profiling), and to withdraw consent at any time without affecting earlier processing. You can complain to your data protection authority: in the EU, find yours at edpb.europa.eu; in the UK, the Information Commissioner's Office at ico.org.uk.
8.5 How to make a request
Email support@nodesto.com from the address linked to your account, tell us which right you want to use, and give us enough information to verify it's you. You don't need a Nodesto account to make a request.
We respond within the time the law requires, for example 45 days under California law and one month under the GDPR, extendable for complex requests if we tell you. Requests are free, though where the law allows we may charge for or decline ones that are repetitive or clearly excessive.
9. Data security
We protect your information with safeguards that fit its sensitivity, such as encryption in transit and at rest and access controls.
No system is completely secure, so we can't guarantee against unauthorized access. If a breach affects your personal information, we'll notify you and the relevant authorities as applicable law requires.
10. Minimum age
Nodesto is only for people 18 and older, everywhere. We don't knowingly collect personal information from anyone under 18. We ask for your date of birth at sign-up and stop it if you're under 18.
If you believe someone under 18 has given us personal information, email support@nodesto.com and we'll delete it.
11. International transfers
Nodesto Inc. is based in the United States, and we store information there. Some service providers may also process it in other countries where they operate. Whether you use Nodesto or we hold information about you because someone linked your public post, and wherever you are, your information is transferred to and processed in the United States, where data protection laws may differ from yours. We take the steps applicable law requires for these transfers.
12. Changes to this policy
When we make material changes, we'll tell you in the app before they take effect and ask you to accept the new version before you keep using Nodesto. Other changes take effect when we post them. The "Last updated" date shows the current version.
13. Contact us
If you have questions about this policy or how we handle your information, or you want to use any of the rights in Section 8, contact us:
Nodesto Inc. has no establishment in the EU or the UK. If you're there, use the same email address for data protection questions.
You can also complain to a data protection authority (see Section 8.4) or, in California, the California Privacy Protection Agency.