Privacy policy

Sloe helps you log recipes, nutrition, and discover meals. This policy describes what we process, who we share it with, and your choices.

Data controller

• Controller: Sloe is currently operated by Grace Howse as a sole operator pending incorporation. We will update this notice when the operating entity is formed.
• Privacy contact: privacy@getsloe.com
• UK Representative (UK GDPR Art. 27): To be appointed before UK public launch. Required for non-UK controllers offering goods or services to individuals in the UK.
• EU Representative (EU GDPR Art. 27): To be appointed before EU public launch. Required for non-EU controllers offering goods or services to individuals in the EU.

What we collect

• Account: email and profile fields you provide (e.g. display name, goals, measurements) when you create an account and sign in.
• App usage data: nutrition logs, saved recipes, and preferences you store in the application or synced to our database.
• Technical: standard server logs (e.g. IP address for rate limiting and abuse prevention), device type, and optional analytics or error reporting if you do not opt out.

How we use data

To provide the service (logging, meal planning, barcode and recipe features), improve reliability, and comply with law. We do not sell your personal data.

AI, voice, and images

If you use optional features, we send the minimum content needed to operate them to our servers and, where described below, to model providers:

• Photo meal logging: images you upload are processed to suggest food items and nutrition estimates. This processing uses third-party AI (primarily Anthropic Claude; OpenAI as a fallback).
• Voice / text meal logging: text you submit (typed or transcribed) is processed to parse foods and estimates and uses third-party AI (primarily Anthropic Claude; OpenAI as a fallback). On the web, browser-based speech recognition (Web Speech API) may run on your device or via your browser/OS vendor before text reaches us; review your browser and OS privacy settings if you use that path.
• Recipe and social import: URLs or shared links you provide may be fetched or parsed to extract recipe content. Images from imports are treated like other uploads when you choose image-based flows.

Imported recipes from public posts

When you share a public post from Instagram, TikTok, or YouTube to Sloe, our app reads the caption text you sent us. We never fetch the original post or video from those platforms ourselves. We store the caption text you supplied, plus the URL, plus the creator’s public handle (when available) — so the recipe is attributed back to its source.

Creators can request removal of any recipe imported from their public post by emailing dmca@getsloe.com or by submitting the form on /dmca. We’ll remove within 7 business days.

Community food database

When you correct or add a barcode product, Sloe stores the product data with your account as the submitter so the community database can be reviewed for quality and abuse. Other users may see the product name, barcode, brand, nutrition values, verification status, and community votes; they do not see your email or profile details. You can remove products you shared from Settings → Privacy & Security → Barcode contributions on web, or Settings → Account → Barcode contributions on mobile.

Sub-processors

We use the following third-party service providers to operate Sloe. We require a data-processing agreement (or equivalent contractual terms) with each provider before it processes personal data on our behalf, and each processes your data only on our instructions. We are completing these agreements as part of our launch preparations.

Community food database

When you scan a barcode we can’t find and enter the product’s nutrition yourself, we offer you an optional choice to contribute that entry to Sloe’s shared food database so other people who scan the same barcode can use it too. This is strictly opt-in: it only happens if you explicitly choose “Share it” — never automatically, and never as part of logging food to your own tracker.

• What’s shared: only the food name and the nutrition values you entered (calories, protein, carbs, fat, fibre, serving size) and the barcode. Your submission is linked to your account as the submitter internally, but your identity is not shown to other users. Nothing else from your account is shared.
• Purpose: a shared lookup so the next person who scans that barcode gets nutrition info instead of a dead end.
• Visibility: your contribution is visible only to you until it is confirmed — once enough independent submissions agree on the same values, it becomes the entry everyone sees when they scan that barcode.
• Eligibility: you must be 16 or older to contribute to the shared database. Logging food privately to your own tracker has no such restriction.
• Withdrawal: you can delete your own contributions at any time from your saved items.

International transfers

Several sub-processors listed above are located in the United States (Vercel, Anthropic, OpenAI, fal.ai, Supadata, Stripe, Upstash, RevenueCat, Expo, Edamam, FatSecret, USDA). Where we transfer personal data of EU or UK users to a country not covered by an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (SCCs) and, for UK transfers, the UK International Data Transfer Addendum or the UK IDTA, together with supplementary technical and organisational measures (encryption in transit, access controls). A copy of the relevant transfer safeguards for any specific sub-processor is available on request by emailing the address at the foot of this page.

Legal basis (EU/UK)

• Providing the service (account, logging, planning): performance of a contract.
• AI features, analytics, error reporting: our legitimate interests in improving and securing the service (you can opt out of analytics and error reporting; AI features are opt-in per action).
• Health & wellness data (weight, body measurements, HealthKit metrics, and food logs in a nutrition context): your explicit consent (GDPR Art. 9(2)(a)). These special-category data are processed by Supabase (weight, measurements, food logs) and Apple HealthKit (device metrics you choose to share); you can withdraw at any time by turning off the relevant sync or deleting your data.
• Contributing to the shared food database: your consent (opt-in, 16+; you can withdraw at any time by deleting your submission).
• Marketing email (if any): your consent.
• Legal and safety: compliance with legal obligations.

Automated processing

AI-derived nutrition matches, meal photo identification and ingredient parsing are automated but are estimates — a human (you) reviews and edits every saved entry before it enters your tracker. These features do not make decisions that produce legal or similarly significant effects about you.

Apple Health (iOS)

If you enable the Apple Health integration on iOS, Sloe reads the following data to keep your tracker in sync: steps, active energy, basal energy, workouts, weight, body fat percentage, and any dietary entries already in Apple Health (for example logs you created in other apps). Sloe writes the calories, protein, carbohydrates, fat, and fibre of the meals you log back to Apple Health so other apps on your phone can read them. Data shared with Apple Health is governed by Apple’s privacy policy and stored on your device; Sloe does not send your Health data to our servers unless you explicitly log a meal. You can revoke Sloe’s Health access at any time in iOS Settings → Privacy & Security → Health → Sloe.

Data retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law (e.g. billing records may be retained for up to 7 years for tax compliance). Anonymised, aggregated analytics data from which you cannot reasonably be re-identified may be retained indefinitely.

Your rights and choices

• Export your data: You can export locally stored data from Settings (Download your data).
• Delete your account: You can permanently delete your account and all associated data from Settings on web or mobile. Deletion is processed immediately for app data; billing records may be retained as required by applicable tax and accounting law (typically up to 7 years in the UK).
• Withdraw consent: You can sign out at any time and disable optional analytics or error reporting via your cookie preferences.
• Barcode contributions: You can remove products you shared with the community food database from Settings on web or mobile.
• Access and correction: You can view and update your personal data in your profile at any time, or request a copy by contacting support.
• EU/UK residents: Under GDPR / UK GDPR you have the right to access, rectify, erase, restrict processing, data portability, and to object to processing. You also have the right to complain to your national data-protection authority (in the UK, the Information Commissioner’s Office at ico.org.uk). To exercise these rights, contact the support channel below.

Contact

For questions about this policy, data requests, or to exercise your rights, email us at privacy@getsloe.com. We aim to respond within 14 days.