Consumer Health Data Privacy Notice

Washington’s My Health My Data Act and Nevada’s SB 370 treat a broad range of information as consumer health data — including data that identifies your physical condition, your diet, your exercise, and health information derived or inferred from other data. Most of what Crumb Count stores falls into that definition, so this notice covers nearly the whole app rather than some narrow corner of it.

If you are not a Washington or Nevada resident, our Privacy Policy is the notice that applies to you. Nothing here reduces the rights described there.

Categories of consumer health data we collect

• Body and profile measurements — height, weight, age, sex, body-fat percentage, activity level and goal
• Diet information — meals and food items, quantities, calories and macronutrients, daily totals and targets, saved favourites, and your chosen diet style
• Exercise information — workouts, routines, gym sessions, sets and weights, and per-exercise history
• Measurements over time — weight entries and activity entries, and your logging history by date
• Bodily functions and vital signs, where you connect Apple Health or Health Connect — steps, active and total energy burned, heart rate, and exercise sessions
• Health data you volunteer in conversation — anything you type into AI meal analysis, activity or workout descriptions, or the AI coach. This is unstructured, and people often share far more here than the app asks for.
• Inferred health data — calorie and macro estimates produced by AI from a photo or description, calorie-burn figures computed from your profile, and the observations surfaced in periodic reviews

We do not collect precise location, and we do not collect biometric identifiers such as fingerprints or face templates.

Where the data comes from

• From you directly — everything you log or enter
• From your device, with your permission — Apple Health (iOS) or Health Connect (Android), read-only
• Derived by us — calorie-burn and nutrition figures computed from what you logged
• Derived by our AI processing providers — food items and nutrition estimates returned from a photo or description

We do not buy consumer health data, and we do not obtain it from data brokers or advertising networks.

Why we collect it

• To provide the tracking features you are using — logging meals and workouts, and computing daily totals, targets and burn
• To turn a meal photo or description into food items and nutrition numbers
• To sync your history across your devices and restore it after a reinstall, when you are signed in
• To generate the insights, reviews and coach replies you ask for
• To monitor the cost and reliability of AI requests, and to enforce usage quotas
• To understand which features are used, so we can improve the app — see the opt-out below
• To keep accounts secure and to meet our legal obligations

We do notsell consumer health data, and we do not use it for targeted advertising. The app contains no advertising SDKs. Under MHMDA, “sale” is defined broadly — we do not engage in any of it, and we would need your separate, specific written authorization before we could.

Who we share it with

We share consumer health data only with the service providers below, each under a contract that limits them to processing it on our instructions. These are the specific recipients, not a generic category:

• Google LLC (United States) — Firebase Authentication, Cloud Firestore, Cloud Functions and Secret Manager. This is where your synced account data is stored.
• OpenAI, L.L.C. (United States), Anthropic, PBC (United States) and Google LLC (United States) — AI analysis of meal photos, meal descriptions and coach conversations. Which of these handles a given request is set by our server configuration and can change; this notice names all providers we may route to.
• Google LLC (United States) — Firebase Analytics, for app-usage measurement. Events are limited to screen names and bucketed, non-identifying counters; your meals, photos, messages and body measurements are never sent as analytics parameters.

We do not share consumer health data with advertisers, data brokers, or social networks. If we ever add a recipient, this notice will name them before the change takes effect.

How long we keep it

Your logs are kept for as long as your account exists, because the app’s purpose is a long-running history you can look back through. You can delete individual records at any time, or delete the whole account.

Meal photos are not retained by us. A photo is held in memory, sent for analysis, and discarded — it is never written to your phone, your account, or our cloud storage. It is not stored in the meal record; only the resulting text is. Our AI processing providers, however, may hold a copy briefly in their own environment for abuse monitoring before deleting it — currently up to 30 days for OpenAI and 7 days for Anthropic. Your content is not used to train their models or ours.

Your rights

Under MHMDA and Nevada SB 370 you have the right to:

• Confirm whether we collect, share or sell your consumer health data
• Access it, including a list of who we shared it with
• Withdraw consent to its collection and sharing
• Delete it — including from our backups and archived systems, which we action on the schedule below

How to exercise them

The fastest route is in the app: Settings → Data exports your data as JSON, and Settings → Account → Delete Account erases it. Deletion runs server-side and removes your records, your sign-in, and the local database on the device. It is permanent.

You can also write to xerosbynevish@gmail.com from the address on your account. We respond within 45 days, and will tell you if we need a further 45 days for a complex request, as the statute allows. Backup copies are purged within 30 days of the primary deletion, or on the next scheduled backup cycle, whichever comes first.

If we refuse

You may appeal by replying to our decision, or by writing to the same address with “Appeal” in the subject line. We will respond within 45 days with our reasoning. If we deny your appeal, you may complain to the Washington State Attorney General. Washington’s Act also gives you a private right of action.

Age

Crumb Count is an 18+ product. Setup asks you to confirm you are 18 or older before any consumer health data is collected, and we do not knowingly collect it from anyone under 18. We run no advertising and build no behavioural profiles, so no consumer health data is used for targeted advertising at any age.

Contact

Crumb Count is provided by Xeros (by Nevish), a sole proprietorship established in India. Health-data requests and appeals go to our named privacy contact:

• Shiven Upadhyay, Software Engineer
• shiven302@gmail.com
• A003, Sarla Mansion, Sector 44, Noida 201301, Uttar Pradesh, India

See also our Privacy Policy, our Terms of Service, and our legal and data-protection overview.