Privacy policy.

Three categories. We'll be specific about each.

Account information.

When you sign up: your name, email, and password (hashed). Optional: date of birth, gender, and timezone, used to estimate calorie targets.

Health and meal data.

What you log in the app:

• checkMeal entries (text or photo)
• checkPhotos you take of meals
• checkWeight entries
• checkGoal and target preferences
• checkComments and reactions in your feed
• checkNotes you write yourself

Device and usage data.

Standard app telemetry:

• checkDevice type and OS version
• checkApp version and crash reports
• checkAnonymized usage events (which screens you open, in aggregate)
• checkApproximate IP-based country (never precise location)

What we don't collect.

• closePrecise location or GPS
• closeContacts or address book
• closePhotos other than ones you intentionally log
• closeMicrophone or audio
• closeBrowsing data from outside the Lemonmint app

Three purposes, in order of how much data each touches:

To run the service.

Show you your meals, weight history, and agent reactions. Send the push notifications you enabled. Sync across your devices.

AI processing.

Meal photos and text are sent to a third-party AI provider for recognition and agent reactions. That provider processes inputs in real time and does not retain them for training. The same applies to text-based meal logs and the responses shown to you as Nora and Sage's comments. We will tell you the provider's identity on request — write to the address in section 08.

To improve Lemonmint.

Anonymized, aggregated telemetry — never tied to your account — helps us understand which features work and which don't. You can opt out in Settings → Privacy.

We share only what's needed, only with vetted subprocessors, only for the service to work.

Legal requests.

We respond to valid legal requests from authorities. We review every request, push back on overbroad ones, and notify users when permitted by law.

We never.

• closeSell your data to advertisers, brokers, or anyone else
• closeShare your meal logs or weight data with employers, insurers, or marketers
• closeProvide bulk data access to third parties

Lemonmint data is hosted on Cloudflareinfrastructure with primary data centers in the EU and US. Meal-photo processing happens via our AI provider's regional endpoints.

International transfers.

If you're in the EU or UK, your data may be transferred to the US for processing. We rely on Standard Contractual Clauses and adequacy decisions where applicable. Contact support@mylemonmint.com for the full transfer mechanism details.

Active accounts.

As long as your account exists, plus the rolling history you can see in the app.

Deleted accounts.

When you request account deletion (via mylemonmint.com/delete-account or in the app), we enter a 30-day grace period. During those 30 days you can restore your account by signing back in. After day 30, all your data is permanently deleted except:

• arrow_rightRequired tax and financial records (per legal minimum)
• arrow_rightAnonymized telemetry that was already aggregated
• arrow_rightThe audit record of the deletion request itself

Inactive accounts.

If you haven't signed in for 24 months, we'll email you a reminder. If you don't respond within 30 days of the reminder, we delete the account.

Wherever you live, you can:

• visibility

  Access

  Request a copy of everything we have about you. We send it within 30 days.

• edit

  Correction

  Fix anything inaccurate. Most things you can edit in the app yourself.

• delete

  Deletion

  Delete your account and data. See section 06 for the timeline.

• file_download

  Portability

  Get your data in a machine-readable format (JSON export).

• block

  Object / restrict

  Ask us to stop processing your data for specific purposes (like analytics).

• gavel

  Complaint

  File a complaint with your local data protection authority. Contact info on request.

For EU/UK residents these rights come from GDPR. For California residents from CCPA/CPRA. For other regions, equivalent local laws apply. Email support@mylemonmint.com to exercise any right.

We take the boring stuff seriously:

• checkTLS 1.3 everywhere — your data is encrypted in transit
• checkAt-rest encryption on all databases
• checkPasswords stored as bcrypthashes — we can't read them
• checkRole-based access enforced in the API itself, not just the interface — and security-relevant actions are written to an audit log
• checkIncident response within 72 hours, with user notification when required

Lemonmint is not for users under 18. We do not knowingly collect data from children. If you're a parent and believe your child has signed up, contact support@mylemonmint.comand we'll delete the account immediately.

We may update this policy. Material changes are announced via email at least 30 days before they take effect, with a summary of what changed and why. The current version date is at the top of this page. Historical versions are available on request.