Privacy.
WellSavvy is two things: this website, where you can join the waitlist, and an app that helps you understand what you eat. This page covers both. The app comes first, because that is where almost everything happens.
Health information has its own page too: our Consumer Health Data Privacy Policy. Some US states ask for one. It sets out in one place what health data we hold, who handles it, and how to use your rights over it.
Who we are
WellSavvy is run by its two founders, Michael Solomonik and Anna Nosova. You can write to hello@wellsavvyapp.com about anything on this page, and one of the two founders will read it.
The short version
- We collect what you tell the app and what you let it read from your phone, so that it can show you your own numbers.
- We treat all of it as health information, wherever you live.
- We never sell it, never use it for advertising, and never use it to train AI models. Google, which runs the app's AI features, does not use it to improve its products. There is one narrow exception: Google's misuse checks, described under Where AI comes in.
- A short list of companies handle it for us. Their contracts let them use it only to do that work, apart from those two exceptions. All of them are named below.
- You can see it, download your daily totals, correct it and delete it. Every yes you give us you can take back, in your Profile or in your phone's settings.
What the app collects
Your account. You can create an account with your email address, or sign in with Google or with Apple. Either way we keep your name and your email address. If you sign in with Google or Apple, we receive from them a number that identifies your account with them, your name and your email address, and nothing else. Apple sends your name and email only the first time you sign in. Apple also lets you hide your email. If you do, we receive an address that forwards to you. If you tell us how you heard about us, we keep that answer in your account too. We also keep a record of your choices: which terms you agreed to, and your yes or no to each question the app asks about your data, with the time.
About you. Your date of birth, height, weight and sex. How active you are, how much sun your skin gets, and what you are aiming for. Any allergies or diet you tell us about. And two things only if you choose to tell us: whether you are pregnant or breastfeeding, and whether a doctor or a blood test has told you to watch a nutrient, such as iron. These set your targets, because a nutrition target that ignores who you are is not much use. The app asks you before it collects any of this, and asks separately before it records pregnancy or breastfeeding.
What you log. Meals and what was in them, supplements, drinks and water, exercise, your weight, how you are feeling, the habits you set, with any reminder time, and your check-ins on them, which habit suggestions we showed you and what you answered, notes, recipes, shopping and fridge lists, foods you mark "Not for me", how you rate tips, and what you ask Savvy, the app's assistant. That is the substance of the app, and it stays yours.
What we work out from it. Your nutrient targets, your averages, and a few plain words on how each nutrient has been going, which the app calls readings. These are estimates from what you log, never measurements of your body.
Health data from your phone. Only if you connect Apple Health (on iPhone) or Health Connect (on Android). The section called Apple Health and Health Connect, below, covers it.
Photos and voice. Once you have said yes to AI features, a photo of a meal, a receipt or a bill, or a screenshot of an order, goes to Gemini, Google's AI model, to be read. Anything printed on it goes too, such as a store's address, the last digits of a card or a delivery address, so you can crop those out first. We keep only the text it produces: the foods, the amounts, the nutrients. We never keep that photo, and Google deletes its copy within 55 days, as Where AI comes in explains. Before any photo leaves your phone, its location and other hidden details are removed. In older versions of the app, a photo it cannot clean, because the format is unusual or the file is damaged, is sent as it is.
One kind of photo is kept: a photo you add to a recipe you save. It is stored with the recipe, and anyone who has its link can open it. The link is a long random address that the app gives only to you. The photo is deleted when no recipe of yours shows it any more, after you delete the recipe or replace or remove its photo, and with your account.
When you speak instead of typing, your phone's own speech recognition (Apple's or Google's) turns your words into text. To do that, it may send the recording to Apple's or Google's servers, under their terms. The audio never comes to us.
Your subscription. Once subscriptions open: which plan you chose, when it started, whether you are in your free month, when it renews or ends, and the store's transaction numbers. Never your card details: the App Store and Google Play take the payment.
Where you found us. From the app's version of October 26, 2026, if you use WellSavvy on an iPhone and have said yes to usage counts, Apple tells us whether an ad in the App Store led to your install and, if one did, which: its campaign, ad group, search keyword and ad, whether you tapped it or only saw it, whether it was your first download, the country the campaign ran in, and where in the App Store it was shown. We keep Apple's answer in our own database with your account, use it only to count which of our ads work, and give it to no one. If you say no, it is deleted and only a daily count with no one attached remains. It is also deleted with your account.
Usage counts and crash reports, only if you say yes. The app asks once whether you will share them, and you can change your answer in Profile at any time. If you say no, Firebase receives none of them. If you change a yes to a no, we also ask Google to delete the usage counts it has that are linked to you, and Google says it deletes them within 63 days of our asking. Totals with no one attached stay as they are. The app asks this from its version of October 16, 2026. An older version sends them without asking, so update the app to be asked.
If you say yes, Firebase (part of Google) counts a handful of moments:
- that an account was created, and whether with email, Google or Apple;
- that setup was finished;
- that a first meal was logged;
- that the app was opened again on the second day, about a week later, and about four weeks later;
- that the app asked about notifications, where it asked, and what you answered;
- that the subscription screen was shown, and from where;
- that a free month or a subscription started, and on which plan;
- from the app's version of October 16, 2026, which screens of the app you open, by the screen's name only, never what is on it.
If you are testing the app for us, the counts and any crash report also say which kind of tester you are.
With your yes, Firebase also records a few things automatically, as it does in any app that carries it. It records that the app was opened and roughly for how long, the phone model, and the versions of the app and the system. It also records roughly where you are, which Google works out from your internet address. If the app crashes, Firebase receives what the app was doing when it failed.
From October 22, 2026, if you said yes to usage counts, our own database also keeps the time of each app open, so that we can count how many people come back. If you say no, it is deleted and only a daily count with no one attached remains. It is also deleted with your account.
Each count travels with two random numbers: one for your account and one for the app on your phone. A crash report carries no number for your account, only one for the app on your phone. None of this travels with your name, your email or an advertising ID, the number ad networks use to follow a phone. The app is built not to collect one.
The counts and crash reports never include what you eat, what you weigh or any other answer about your body. They never include how you heard about us either.
Notifications. If you turn them on, we keep a token for your phone, which is the address Firebase uses to reach it. The text of each notification passes through Firebase, and on an iPhone through Apple too. It can include your first name and a food, never a nutrient. A habit's reminder is different: your phone sets it and shows it, and nothing passes through Firebase. On the lock screen it shows the habit's name only while its switch is on. The switch starts on for most habits from our list and off for a habit you wrote yourself; while it is off, the reminder shows a line that does not say what the habit is.
Feedback. If you use Send feedback, the app opens a draft in your own email app. The draft already holds the app's version, your phone's model and system, and a reference number for your account. Nothing is sent until you send it, and you can delete those lines first.
Reports of what the AI wrote. If you use Report on an answer from Savvy, an AI recipe or a tip, we keep a copy of what you reported with the reason you picked and any note you add, so that we can look into it. Only the two founders read it, and it is deleted with your account.
Apple Health and Health Connect
If you connect Apple Health (on iPhone) or Health Connect (on Android), the app reads these measurements, and only these: steps, heart rate, resting heart rate, sleep, active calories, blood oxygen, and recorded workouts. The app asks before it reads anything and shows you exactly which measurements it wants. You can withdraw permission at any time in your phone's settings, and you keep your account.
A daily summary of them is stored in your account, so the app can show your days side by side. A workout joins your exercise log only when you choose to import it. We use this data only for the features you see in the app. We never use it for advertising, marketing or data mining. We never sell it, and we never give it to a data broker. We never store it in iCloud. We only read: WellSavvy never writes anything into Apple Health or Health Connect. If you have said yes to AI features, parts of that summary go to Gemini: the last seven days of sleep and steps, and today's active calories, when you ask Savvy something; your sleep, deep sleep, steps, resting heart rate and active calories for your tips; and your sleep and steps for the notes in Analytics. Your heart rate readings through the day and your blood oxygen never do. A workout goes only once you import it, like any exercise you log. Disconnecting stops the app from reading anything new. The summaries already saved stay in your account until you delete it or ask us to remove them.
What we use it for
We use it to:
- calculate your targets and readings and show them to you, and now and then suggest a habit that fits what you log and, if you connect Apple Health or Health Connect, your steps;
- run the features you choose, including the AI features if you say yes;
- send the reminders you ask for;
- run your subscription;
- answer you when you write to us;
- keep the service secure and working;
- count totals across all members, such as how many still log after four weeks;
- do what the law requires of us.
We do not build a profile of you from your health information for anything other than showing you your own numbers. For the totals above, we look only at a few facts about each account, and when each happened, never at what you logged: the week it was made, its time zone, whether it is a tester's, whether a birth date was saved, the answers on how you heard about us and on sharing usage counts, which days have a meal saved, and the steps of a subscription with the store's details of them (a free month started, the plan chosen, an offer code, a cancellation and its undoing, a payment, a billing problem, a refund, the end). We keep only totals, each for everyone who joined in the same week (a week with fewer than five people is joined to the weeks after it), and never read a group of fewer than five people on its own.
An email about your subscription, such as the reminder before a free month ends, can name the nutrients whose averages have arrived or are still to come, with the dates. It never says how a nutrient is going, and it never names a food you logged or anything else about your body. Emails about a purchase, such as the note when a free month starts, the reminders before it ends or a year renews, and receipts, still come if you unsubscribe from our other emails, because they tell you about a charge.
Where AI comes in
Working out that "two eggs and toast" is roughly 320 calories, or reading a photo of a plate, takes an AI model, and we do not run our own. Gemini, Google's AI model, does it for us, and only after you say yes to AI features. Until then nothing goes to it. The app asks you once, and asks again only if what a feature sends changes.
Gemini reads meal descriptions, photos, spoken meals (as text) and scanned products. It answers what you ask Savvy, creates the recipes you ask for, and writes some of the tips on the Home screen and the notes in Analytics.
Three things use no AI: searching our food database, logging a food we match there exactly, and logging a saved meal. A food we cannot match exactly goes to Gemini to work out its nutrients. That holds whether you typed it or picked it from your recent foods, a recipe or a search. If AI features are off, the app tells you the food needs AI and sends nothing.
What reaches Google is what each feature needs: the meal or exercise you described, the photo you took, the name and amount of a food we could not match, or the recipe or question you asked. Reading a meal also sends the names of foods you log often.
A recipe request also sends your allergies, the ones you picked and the ones you typed, so that the recipe leaves them out. It also sends the nutrients your averages show as low, any ingredients you list, and any limit you went over on your last full day. A limit is a nutrient with a ceiling, such as sodium.
When you ask Savvy something, the app also sends what a good answer depends on:
- about you: your age, sex and weight, your weight goal and the weight you're aiming for, activity level, calorie target and energy estimate, your diet and allergies, and whether you are pregnant or breastfeeding;
- your numbers: your daily aims, your nutrient averages and weight change;
- today: your meals, water and exercise and, if you have connected Apple Health or Health Connect, your sleep, steps and active calories;
- how you have been feeling;
- your tips, your fridge list and your earlier messages;
- the time of day, and which numbers you have set the app to hide. Those numbers are then left out;
- the foods you logged in the last 30 days that gave you the most of each nutrient. The AI features question names these foods, and they are sent only when your yes was to that question.
Tips and the notes in Analytics are written without your asking, once AI features are on. For them, what reaches Google is:
- your goals and targets;
- your diet and allergies;
- your recent logs, mood and energy;
- your weight change and nutrient averages;
- your saved recipes and fridge list;
- foods you have marked "Not for me";
- how you have rated past tips;
- if you have connected Apple Health or Health Connect, your sleep, deep sleep, steps, resting heart rate and active calories for tips, and your sleep and steps for the notes.
We never send your name or your email. What we send can describe you, and anything you type goes as you typed it.
Google uses it only to do what we ask, and does not use it to improve its products, with the one exception below. Google keeps it for up to 55 days, to check for misuse and for legal reasons, and then deletes it. In those 55 days, Google's safety systems may flag something. If they do, authorized Google staff can review it, and only to check for misuse. The only AI models it may help train are the ones Google uses to catch misuse.
You can turn AI features off in Profile at any time. From then on nothing goes to Gemini, and the app uses its own tips instead.
Barcode lookups go to FoodData Central, the US Department of Agriculture's public food database. When it does not have the product or cannot be reached, the lookup goes to Open Food Facts, an open food database. Both receive the barcode and nothing about you: the lookup comes from our server, not from your phone. If AI features are on, the product's name and brand then go to Gemini, like a typed meal, to work out its nutrients.
Who receives your data
This is the complete list. Amazon Web Services, Google, RevenueCat and Resend work for us under contracts. The contracts let them use your data only to provide their service to us, with the two exceptions under What we never do, and require them to keep it secure. When you sign in with Apple or Google, pay through the App Store or Google Play, or dictate with your phone's speech recognition, you deal with Apple or Google directly, under their own terms. The others receive only what the table shows.
| Company | What it does for us | What it receives |
|---|---|---|
| Amazon Web Services | Keeps your account and everything in it, in an encrypted database in the United States (Virginia), with recipe photos in encrypted storage beside it. Runs our servers. Handles sign-in (Amazon Cognito), so we never see your password. Sends the app's emails (Amazon SES). | Everything in your account |
| Google: Gemini | The AI features, only after your yes | What each feature needs, as described under Where AI comes in |
| Google: Firebase | Delivers notifications. Usage counts and crash reports, only after your yes. | Your phone's token and the notification text. The counts and reports described under What the app collects. |
| Google: Analytics on this website | Counts visits to wellsavvyapp.com, without cookies | That a page was viewed or a sign-up happened, and roughly where the visitor is. Never your email. |
| Google: our mailbox | Receives what you send to hello@wellsavvyapp.com | Whatever you write to us |
| Google: our testers' group | For testers on Android: a Google Workspace group that our server adds you to, which Google Play uses to give you the test build. Testers cannot see each other there | The Play Store email you give us |
| Apple | Sign in with Apple, if you use it. Delivers notifications to an iPhone. App Store payments. | Your Apple sign-in, the notification text, your purchase. If you test on an iPhone, your name and the email for your TestFlight invitation |
| Google Play | Payments on Android. | Your purchase |
| RevenueCat | Keeps track of your subscription | A random account number. Your purchase records. Which kind of tester you are, if you are one. Its software also adds some details to every request by itself: your phone's model, system and app version, language, store country and internet address, and on an iPhone an identifier the phone assigns to our app. RevenueCat says it does not keep the internet address: it works out a country from it and then drops it. Never your name, email or anything you log. |
| Resend | Sends this website's emails | Your email address, if you joined the waitlist, and what you wrote in the tester form, which it delivers to us |
| FoodData Central, Open Food Facts | Barcode lookups | The barcode only |
| Spoonacular | Sends the pictures in our recipe catalogue from its own servers | Your phone's internet address when a picture loads, and which picture |
| BetaTesting.com | For paid beta testers only: recruits and pays testers, and runs the test's surveys | What testers tell it directly. We send it nothing from the app. |
If this list ever changes, this page changes first. If the change means health information goes somewhere new, we ask you before it does.
What we never do
We do not sell your data, rent it, or share it for anyone else's marketing. There is no advertising in WellSavvy, and nobody receives anything about you for advertising. We do not track you across other companies' apps or websites. We do not use your personal data to train AI models of any kind, large language models included. The companies that handle it for us may not use it to improve their own products, with one exception: Google's misuse checks, described under Where AI comes in.
How we protect it
Your data is encrypted when stored and whenever it travels. Our database is not reachable from the public internet. Only the two founders can reach it, and only to run the service or to answer you. Recipe photos are stored outside the database, as What the app collects describes. HIPAA, the US law for doctors, hospitals and health insurers, does not cover WellSavvy, because we are none of those. What protects your data here is this page, which the Federal Trade Commission can hold us to, and your state's health data law where it has one. Our Consumer Health Data Privacy Policy is written to meet those laws, and we apply it to everyone.
How long we keep it
| What | How long |
|---|---|
| Your account and everything you log | Until you delete your account, because the app is a record over time |
| The time of each app open (if you said yes to usage counts) | Until you say no or delete your account; after a no, only a daily count with no one attached |
| On an iPhone, Apple's answer on which App Store ad led to your install (if you said yes to usage counts) | Until you say no or delete your account; after a no, only a daily count with no one attached |
| Database backups | 7 days, then overwritten |
| Our server logs, which can hold parts of what the app sent us | 30 days |
| What Gemini receives | Up to 55 days at Google, for misuse checks and legal reasons |
| Crash reports (if you said yes) | 90 days at Firebase |
| Usage counts (if you said yes) | 14 months at Firebase, and after that only totals with no one attached. After you delete your account, or change a yes to a no, Google says it deletes them within 63 days of our asking. |
| The record of your subscription (when a free month started, any change of plan, cancellation, payment, billing problem or refund) | As long as tax law requires for the payments in it, with your identity removed when you delete your account |
| What you agreed to when you subscribed, and a record of the emails we sent you about your subscription | For as long as your subscription lasts and 3 years after, with your account removed when you delete it |
| Your waitlist email address | Until you ask us to remove it |
| Your testers' sign-up details | Until the test ends, you ask, or you delete your account. Your answers to its consent questions, with their time, the email you signed up with and your confirmation that you are 18 or older, until the test has ended and you have answered the same questions in the app, or until you delete your account; if you withdraw one, which one and when, with those answers, until you delete your account. If you never make an account with that email, everything goes when the test ends |
| What you send to hello@wellsavvyapp.com | About a year, then deleted from our mailbox, or sooner if you ask |
| A record of each privacy request you make (what you asked, how and when it came, how we checked it was you, what we did and when) | 24 months, under the random number your account had, even after you delete your account |
Deleting your account
You can delete your account from inside the app, in your Profile, or at wellsavvyapp.com/delete-account.html. It is not a request that lands in a queue. It removes your profile, every log, your habits, every calculated target, your recipe photos, the record of when you opened the app, Apple's answer on which App Store ad led to your install, your phone's notification token, and your sign-in identity. Our server logs are not deleted early: each line expires 30 days after it was written. Within 30 days we ask RevenueCat to delete your subscription record, and Google to delete the usage counts Firebase linked to your account. It cannot be undone and we cannot recover it afterwards, which is the point.
A few things outlive your account for a while, and the table above lists them:
- backups, for up to 7 days;
- server logs, for up to 30 days;
- what Google keeps from AI requests, for up to 55 days;
- the usage counts at Firebase, until Google deletes them, within 63 days of our asking;
- crash reports, which carry no account number, for up to 90 days;
- anything you wrote to hello@wellsavvyapp.com, for about a year, or less if you ask us to delete it;
- the record of your subscription (when a free month started, any change of plan, cancellation, payment, billing problem or refund), with your identity removed, for as long as tax law requires for the payments in it; it still shows whether it came from one of our testers, so that test purchases stay out of our sales figures; we count it, with no one attached, in our weekly totals, and never try to tie it back to you;
- what you agreed to when you subscribed and a record of the emails we sent you about your subscription, with your account removed, for 3 years after the subscription ends.
An email we have already sent you stays in your own mailbox. Deleting your account does not remove it. We also keep a record of each privacy request, deleting your account included: what was asked, how and when it came, how we checked it was you, and what we did and when, under the random number your account had and nothing else about you. We delete it after 24 months.
Deleting your account does not cancel a subscription. You cancel that in the App Store or Google Play, and the app reminds you before you delete.
Your rights and choices
Wherever you live, you can ask us to confirm what we hold about you, give you a copy, correct it, or delete it. You can also take back any yes you have given. If you take back your health data consent, we stop using your health data within 15 days, in the app and in everything we run without you, until you say yes again. The two founders who run WellSavvy live in Israel, so Israel's Privacy Protection Law may also apply to your data, and it gives you these same rights to see and correct it.
In the app, Profile holds these settings: AI features, Share usage counts, your health data consent, Export your data (your daily totals, as a spreadsheet), and Delete account. What you can delete yourself, entry by entry, and what to ask us for instead is on our deletion page. For anything else, or if you would rather ask us, you can write to hello@wellsavvyapp.com from the address on your account. [A copy of your data comes as a link we email you, to one zip file, which works until the end of the seventh day after we made it, UTC time.] We answer within 30 days. There is no charge.
If we turn down a request you can appeal, as our Consumer Health Data Privacy Policy explains. If you live in Texas or Nebraska and we still say no after your appeal, you can complain to your state's Attorney General: Texas at texasattorneygeneral.gov and Nebraska at nebraska.gov/apps-ago-complaints. We never charge more or give you a worse service because you used one of these rights.
Nevada residents: hello@wellsavvyapp.com is also our address for requests not to sell your information, although we sell nothing.
Children
WellSavvy is for adults. It is not meant for anyone under 18, and the app does not let anyone who says they are under 18 create an account. If you believe someone under 18 has an account, please tell us and we will delete it.
The website and the waitlist
When you join the waitlist, we store your email address, the time you joined, which form you used (or which link brought you here), and the short description your browser sends to every website: which browser it is and what kind of device. If you fill in the tester form, we also store the answers you choose to give. The waitlist and the tester form do not ask for your name.
If we invite you to test the app, as a friend of ours or from our waitlist, our testers' sign-up form asks for your name, the email you will use in the app, your phone type, your country (and your state, in the US), that you are 18 or older, and, for an iPhone, the email for your TestFlight invitation or, for Android, the Google account email your Play Store uses. We use it only to invite you to the test and to know who is testing, and your state also to know which state's privacy laws apply to you, including whom we would have to tell if your information were ever exposed. The two founders get an email when you sign up, with your first name, phone type and country. If you join our paid test through BetaTesting.com, it sends us, for each tester we take, the email for the invitation, the phone type and the US state from its sign-up questions, and we keep them the same way. We do not buy or add any other data about you.
When you join, we send one short welcome note. After that we email only when there is something worth reading: early access and real updates. Every email has an unsubscribe link, which takes you off the list at once, and replying to say stop works too. Resend sends these emails for us. Your email is never sold or rented, and no one gets it for their own use.
This website uses Google Analytics without cookies: no cookies are set and nothing is stored on your device. Google receives that a page was viewed or that something happened on it, such as a sign-up, and roughly where the visitor is, which it works out from the internet address. It never receives your email. Google keeps what it records of a visit for 14 months; after that only totals with no one attached remain. If you open our site from an ad inside Instagram or Facebook, the page opens in their own built-in browser, which may record your visit under Meta's own policies. We send Meta nothing. The site is served from Amazon Web Services in the United States. Its standard logs (your internet address, the time of the request) are kept briefly for operations.
If something goes wrong
If your information is ever exposed or disclosed in a way this page does not allow, we will tell you without delay, and within 30 days at most. We will tell you by email, at the address on your account, and in the app. We will also tell the regulators the law requires us to tell.
Changes
If we change how any of this works, we update this page and its date. If the change matters, we tell you in the app before it takes effect. If we already hold health information, we never start using it in a new way without asking you first.
Contact
Questions about any of this, or about your own data: hello@wellsavvyapp.com.
Last updated: October 24, 2026