Privacy Policy

1. Controller and contact

No data protection officer has been appointed. Privacy questions and requests can be sent to the address or email above.

2. The website

Tippy does not operate advertising, profiling or third-party analytics on this website, and does not set non-essential cookies.

When you visit, the hosting and content-delivery infrastructure may process technical request data such as your IP address, date and time, requested URL, referrer, browser and device information, response status, and security events. The purpose is to deliver the site, protect it against abuse, and keep it secure and available. The legal basis is the legitimate interest in operating a secure public service (Article 6(1)(f) GDPR).

3. The Tippy application

Tippy is an AI food logger. To give you estimates it processes the meals you describe, photograph or scan, and stores them in your diary. Some preferences are kept only on your device: language, appearance and theme, text size, tracked facts, the API address, and any Nightscout configuration.

Unless you sign in to an account, data you enter stays on your device. To sync a diary across devices you need an account (see below).

4. Accounts and diary data

If you create an account, Tippy stores a username and a securely hashed password (never the password itself), your role, and the settings and profile information you provide — such as your body metrics, activity level, dietary preferences and allergies, and the nutrition facts you choose to track. If you subscribe, an email address may also be associated with the account for billing.

Your diary — the meal descriptions, ingredients, quantities and nutrition values you save, together with the date — is stored on the Tippy server so your log is available across your devices. The legal basis is the performance of the service you requested (Article 6(1)(b) GDPR) and, where relevant, your consent.

5. AI analysis and food databases

When you describe a meal or submit a photo, the text and/or image is sent to third-party artificial-intelligence providers to extract ingredients, quantities and nutrition estimates. That content is processed to generate your result and is subject to those providers' terms and privacy policies. Do not submit information you are not comfortable sharing with those providers.

Nutrient values are then looked up in public food-composition databases (for example Open Food Facts, USDA and the Canadian Nutrient File) and, where enabled, a decision model is used to pick the most suitable database entry. Results are estimates and may be inaccurate or incomplete — always verify them.

6. Nightscout (optional, device-only)

If you enable Nightscout, Tippy writes the meals you log to your own Nightscout site directly from your device. Your Nightscout URL and token are stored on your device and are never sent to Tippy's servers. Whether and how Nightscout processes that data is governed by your own Nightscout setup.

7. Subscriptions and payments

Subscriptions may be offered through a payment provider (for example Stripe on the web) or, later, through the Apple App Store and Google Play. Purchases are processed by those providers under their own terms and privacy policies. Tippy receives only the information needed to determine whether your subscription is active, such as a customer or purchase reference and its status. Tippy does not receive or store your payment card details.

8. Support messages

If you contact Tippy, the email address, message, attachments, technical headers and any information you include are processed to answer your request, handle bug reports, and protect legal interests. The legal basis is taking steps at your request and the legitimate interest in support and service security (Article 6(1)(b) and (f) GDPR). Support correspondence is kept only as long as needed to resolve the request and, where applicable, to meet legal record-keeping or limitation periods. Public GitHub issues are processed by GitHub under GitHub's policies.

9. Recipients and international transfers

Depending on how you use Tippy, recipients may include the hosting and content-delivery providers that run the website and server, the AI providers that analyse meals and the public food databases consulted, the payment provider for subscriptions, and the email providers used to exchange support messages. Some of these services may process data outside the European Economic Area. Where that happens, transfers rely on the safeguards described by the relevant provider, such as an adequacy decision or standard contractual clauses.

10. Your rights

Subject to the applicable legal conditions, you may request access, rectification, erasure, restriction of processing, or data portability, and you may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time; this does not affect processing carried out before withdrawal.

You can exercise these rights by contacting the controller above. You also have the right to complain to the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at).

11. Retention and required data

Personal data is retained only for the period needed for the purpose it was collected for, to provide the service, to resolve disputes, and to comply with legal obligations. Account and diary data is kept for as long as your account exists; you can ask for it to be deleted. Data stored only on your device remains under your control until you delete it or uninstall the app.

Providing personal data is generally voluntary. Without technical request data the website cannot be delivered; without account and diary data the sync service cannot function; and without payment-provider processing a subscription cannot be completed or restored.

12. Changes

This policy may be updated when the website, applications, providers or legal requirements change. The current version is always published on this page.