Privacy policy.

Three categories. We'll be specific about each.

Account information.

When you sign up: your name, email, and password (hashed). Optional: date of birth, gender, height, current weight, activity level and timezone, used to estimate your calorie target (see “Health information & sources” in section 03), plus any dietary restrictions you choose to set.

Health and meal data.

What you log in the app:

• Meal entries (text or photo)
• Photos you take of meals
• Weight entries
• Goal and target preferences
• Comments and reactions in your feed
• Notes you write yourself

Device and usage data.

Standard app telemetry:

• Device model, OS version and app version
• Usage events — the screens you open and the features you use, linked to your account (see “To improve Lemonmint” in section 03)
• Masked recordings of how you move through the app (section 03 explains the masking)
• Error reports from our servers when a request fails
• Your IP address, in our server logs, and an approximate location (city or country) inferred from it — never precise location

How we collect it.

• You type it in — your profile, meal descriptions, weight entries and notes.
• Camera or photo library — only the meal or nutrition-label photo you take or pick, and only after you grant the camera or photo permission.
• Microphone and speech recognition — optional. If you dictate a meal, your phone's built-in speech recognition service (Apple on iOS, Google on Android) turns your words into text you can edit. We receive only that text, never the audio.
• Apple Health / Google Fit — not connected today. Lemonmint does not read or write Apple Health or Google Fit data. If we add it, it will be opt-in and we will update this policy first.

What we don't collect.

• Precise location or GPS
• Contacts or address book
• Photos other than ones you intentionally log
• Audio recordings — dictation reaches us as text only
• Browsing data from outside the Lemonmint app

Three purposes, in order of how much data each touches:

To run the service.

Show you your meals, weight history, and agent reactions. Send the push notifications you enabled. Sync across your devices.

AI processing.

Our AI provider is Google LLC, through the Gemini API (Google's developer API, not Vertex AI). Your team's meal analysis and every comment, check-in and review you see from Nora and Sage is generated by it. Here is exactly what we send, and why:

• Meal and nutrition-label photos — the image you snap or pick, plus your app language. To identify the foods and estimate portions, calories and nutrients, or to read the label.
• Meal descriptions — the text you type or dictate, plus your app language. To turn it into meal items with calorie and nutrient estimates.
• Meal comments — your name, app language, the meal you just logged (title, items and their estimates), which meal of the day it is, the names of your earlier meals that day, calories remaining, protein so far, your daily calorie target and any dietary restrictions you set. So Nora can react to that meal in context.
• Daily check-ins — your name, app language, day of the week, your calorie target, the day's meals (name, meal type, relative size and time eaten), calorie totals versus target and, in the morning check-in, your recent weight entries. To write a short note about your day.
• Weekly reviews — your name, app language, the week's dates, days on target, meals logged, average daily calories and protein, weight change and recent weight entries, meals you repeated, and how weekdays compared with weekends. So Sage can spot patterns across your week.

We do not send your email, password, date of birth, gender, height, profile photo, device data or any account identifier.

Your choice.

Nothing is sent to Google until you explicitly allow it in the app. You can withdraw that permission at any time in Settings → Privacy → AI data sharing, and we stop sending from that moment. If you decline or withdraw, AI meal analysis and your team's comments, check-ins and reviews are turned off — manual logging, your diary and weight tracking keep working.

What Google does with it.

We use Google's paid Gemini API. Under Google's Gemini API terms for paid services, Google does not use our prompts or its responses to improve its products, including training its models. Google keeps them only for a limited period, solely to detect and prevent abuse and violations of its usage policies, and for legally required disclosures. Google processes this data as our processor — see section 04.

Health information & sources.

Your daily calorie target is an estimate. It uses the Mifflin–St Jeor equation (Mifflin et al., Am J Clin Nutr 1990;51(2):241–247) and standard activity factors. Calorie and nutrient figures for meals are AI estimates too. None of this is medical advice — talk to a doctor or registered dietitian before making significant changes to your diet. The full list of sources is in the app under Settings → About → Sources & methodology.

To improve Lemonmint.

We use a product analytics provider to learn which features work and which don't. The app records usage events: the screens you open, the buttons you tap, and coarse facts such as your onboarding answers (goal, activity level, units and any dietary restrictions you pick), ranges for your calorie target and meal sizes, whether your weight went up or down (never the number itself) and your subscription status. Each event carries your device model, OS version, app version and an approximate location inferred from your IP address.

These events are linked to your Lemonmint account by an internal account identifier once you sign in, including events recorded earlier in that session on the same device. They never include your name, email address, meal photos, meal descriptions, or your weight and calorie figures.

We also record sessions as screen recordings so we can see where the app gets in your way. Masking happens on your device before anything is sent: all text, images and anything you type are blacked out, and only the app's own navigation bar and header stay visible. A recording shows the layout of a screen, not your meals, photos, weight or messages. Recordings are linked to the same account identifier.

We don't use any of this for advertising and we don't track you across other companies' apps or websites. There's no in-app switch for analytics today; to ask us to stop analytics processing for your account, email support@mylemonmint.com(see “Object / restrict” in section 07).

We share only what's needed, only with vetted subprocessors, only for the service to work.

Service providers.

These are the companies that handle your data for us, by what they do:

• AI — Google LLC, Gemini API. Receives the data listed under “AI processing” in section 03, only after you allow it. Google acts as our data processor under its Data Processing Addendum for Products Where Google is a Data Processor. Those terms only let Google process your data on our instructions and require it to protect your data at least as well as we do. They also cover international transfers with the EU Standard Contractual Clauses (and UK equivalents).
• Sign-in providers — Apple and Google. Only if you choose “Sign in with Apple” or “Sign in with Google”. They confirm who you are and share the account details you allow, such as your name and email address, so we can create and secure your account.
• App stores and payments — Apple and Google. The App Store and Google Play take your subscription payment. We exchange purchase details with them (which plan, transaction and renewal status) to unlock and keep your subscription in sync. We never see your card details.
• Push notifications — Apple and Google. Your device's push token and the text of each notification you've enabled, so the notification reaches your phone.
• Cloud hosting and storage provider. Runs our servers, database and file storage, so it holds all the data we store, including meal photos and backups. To run the service.
• Product analytics provider. The usage events and masked session recordings described in section 03, linked to your account identifier. To understand which features work.
• Crash and error reporting provider. When a request to our servers fails: technical details of the error and the request, basic device and app information, and your account identifier. Passwords, sign-in tokens, cookies and the content you submitted are stripped first. To find and fix bugs.
• Email delivery provider. Your email address and the account emails we send you (verification codes, password resets, security notices and deletion confirmations). To deliver them.
• Server logging provider. Technical logs and system metrics that may include your account identifier, IP address and device information. To keep the service running and investigate problems.
• Barcode food database. Only the barcode number of a product you scan, sent from our servers, never anything that identifies you. To look up that product's nutrition.

Each provider processes your data only on our instructions, under contracts requiring it to protect your data at least as well as we do. Two notes: Apple and Google also act under their own privacy policies for the sign-in, purchase and device accounts you hold with them directly, and the barcode database is a public database that only ever receives a product barcode.

Legal requests.

We respond to valid legal requests from authorities. We review every request, push back on overbroad ones, and notify users when permitted by law.

We never.

• Sell your data to advertisers, brokers, or anyone else
• Share your meal logs or weight data with employers, insurers, or marketers
• Provide bulk data access to third parties

Lemonmint's servers, database and file storage run on our cloud hosting provider. Meal photos and backups of our database are stored in data centers in the United States. Our analytics, error-reporting and email providers also process data in the US. AI processing happens on Google's infrastructure through the Gemini API, which may process data outside your country, including in the US.

International transfers.

If you're in the EU or UK, your data may be transferred to the US for processing. We rely on Standard Contractual Clauses and adequacy decisions where applicable — including for Google, under its processor terms. Contact support@mylemonmint.com for the full transfer mechanism details.

Active accounts.

As long as your account exists, plus the rolling history you can see in the app.

Deleted accounts.

When you request account deletion (via mylemonmint.com/delete-account or in the app), we enter a 30-day grace period. During those 30 days you can restore your account by signing back in. After day 30, all your data is permanently deleted except:

• Required tax and financial records (per legal minimum)
• Usage analytics already recorded with our analytics provider (section 03) — email us if you want that erased too
• The audit record of the deletion request itself

Inactive accounts.

If you haven't signed in for 24 months, we'll email you a reminder. If you don't respond within 30 days of the reminder, we delete the account.

Wherever you live, you can:

• visibility

  Access

  Request a copy of everything we have about you. We send it within 30 days.

• edit

  Correction

  Fix anything inaccurate. Most things you can edit in the app yourself.

• delete

  Deletion

  Delete your account and data. See section 06 for the timeline.

• file_download

  Portability

  Get your data in a machine-readable format (JSON export).

• block

  Object / restrict

  Ask us to stop processing your data for specific purposes (like analytics).

• gavel

  Complaint

  File a complaint with your local data protection authority. Contact info on request.

For EU/UK residents these rights come from GDPR. For California residents from CCPA/CPRA. For other regions, equivalent local laws apply. Email support@mylemonmint.com to exercise any right.

We take the boring stuff seriously:

• TLS 1.3 everywhere — your data is encrypted in transit
• At-rest encryption on all databases
• Passwords stored as bcrypt hashes — we can't read them
• Role-based access enforced in the API itself, not just the interface — and security-relevant actions are written to an audit log
• Incident response within 72 hours, with user notification when required

Lemonmint is not for users under 18. We do not knowingly collect data from children. If you're a parent and believe your child has signed up, contact support@mylemonmint.com and we'll delete the account immediately.

We may update this policy. Material changes are announced via email at least 30 days before they take effect, with a summary of what changed and why. The current version date is at the top of this page. Historical versions are available on request.