Privacy policy

Health and diet data you enter. Your onboarding answers (age, sex, height, weight, activity, goal, and an optional body fat estimate), meals you log, weigh-ins, and the plans Demi builds for you. This is the app; without it there is nothing to plan.

Apple Health data, only if you connect it. If you turn on Apple Health, Demi reads your steps, active energy, workout minutes, sleep duration, and body weight. Nothing is read until you allow it in the iOS permission sheet, and you can disconnect in Profile, which also deletes the health days Demi stored. The activity readings appear beside your weight trend on Progress and are display only. A weight from Health is saved as a check-in exactly like one you typed, and it never overwrites a weight you entered yourself. Because check-ins are how Demi learns your real burn rate, a weight read from Health can change your calorie targets; the activity readings never do. If you allow it, Demi also writes the calories and macros you log back into Apple Health. Nothing read from Health is sent to Anthropic, to analytics, or to anyone else.

An account id and your email. Demi accounts are created with an email address, which is stored so you can sign in with a one-time code. There are no passwords.

A push token, if you turn on reminders. It lets Apple deliver meal reminders to your phone and is deleted when you disable notifications or delete your account.

A coarse location, only if you use the takeout feature. Demi asks for location only when you ask it to find takeout. The precise fix is used once to search nearby, rounded to roughly a kilometer before anything is stored, and kept as a single value that each use overwrites. Demi never keeps a location history.

Technical telemetry. Request logs (which API route, how long it took, status code) and crash reports (the error and its stack trace). Crash reports are deliberately stripped of your content: no request bodies, no tokens, no user ids.

Which features you use. A short, fixed list of actions: the app was opened, an onboarding question was reached, food was logged, a barcode was scanned, a food's numbers were corrected, a day was closed. Each one records that it happened and nothing about what it was: no food names, no barcodes, no calories or macros, no weights, no notes. They are filed under a random id belonging to this installation, not to your account, so they cannot be traced back to you or to anything you ate, and location lookup is switched off on them. This is how Demi learns which parts of the app work and where the food database lets you down. You can switch it off in Profile under Usage sharing.

Free-text notes run through an automated safety screen; notes it flags are discarded rather than stored.

Your data is stored with Supabase (Postgres, encrypted at rest) in the United States (us-east-1), behind row-level security that limits every query to your own account. The app itself runs on Vercel.

A few narrow jobs use other processors: Anthropic's API turns meal descriptions and label photos into nutrition estimates (Anthropic does not train on this API data; photos are processed for the estimate and not stored by Demi), the USDA FoodData Central database answers food searches, Resend delivers sign-in code emails, Apple delivers push notifications, Sentry receives the stripped crash reports described above, and PostHog receives the feature-usage list described above.

One more, and only if you share a cooking video to Demi: turning its narration into text uses Apple's speech recognition. That usually runs on your iPhone, but Apple's service may receive the audio when your device cannot do it alone, which is Apple's own behavior and is covered by their privacy policy. The video file never leaves your phone, and Demi deletes it as soon as it has been read.

That is the whole list. Nothing is sold, shared for advertising, or used to track you across apps or websites.

Export everything. Profile → Export your data downloads a complete JSON copy of your account: profile, logs, plans, weigh-ins, any Apple Health days, all of it.

Delete everything. In the app, go to Profile → Delete account, type the confirmation, and your account and every row of data tied to it are permanently deleted on the spot. Prefer email? Write to hntrbeeny@gmail.com from your account email (or include your account id from the export) and the same deletion happens within 72 hours.

Demi gives general wellness guidance, not medical advice, and it is built to keep you safe rather than hooked: it will not coach below safe calorie floors, and its safety rules run on the server where no setting can switch them off. Demi is not directed at children.

If this policy changes, the effective date above changes with it, and material changes are called out in the app. Questions, requests, or anything unclear: hntrbeeny@gmail.com.