Privacy Policy

Effective date: March 29, 2026 · Last updated: March 29, 2026

KushAI: Eat Healthy ("KushAI", "we", "us", "our") is a nutrition tracking mobile application developed by Rustam Azizov, an individual developer based in Azerbaijan. This Privacy Policy explains what data we collect, how we use it, and what rights you have.

By using KushAI you agree to the practices described below. If you do not agree, please do not use the app.

1. Data We Collect

1.1 Account Information

When you create an account we collect:

• Email address
• Display name (if provided)
• Authentication identifiers from Firebase Auth (email/password, Google Sign-In, or Apple Sign-In)

If you sign in with Apple and choose to hide your email, we only receive the private relay address Apple provides.

1.2 Profile Data

To calculate nutritional targets you may voluntarily provide:

• Gender, date of birth, height, weight
• Activity level and dietary goal (lose, maintain, or gain weight)
• Weight history entries

1.3 Nutrition & Activity Data

• Food diary entries (meal descriptions, calories, macronutrients)
• Food photos you upload for AI analysis
• Water intake records
• AI nutritionist chat messages and responses

1.4 Subscription Data

Subscription purchases are processed entirely by Apple (App Store) or Google (Google Play), depending on your device. We use RevenueCat to manage subscription status. We do not collect or store your payment card details. RevenueCat receives an anonymous app user ID and purchase receipt data from the respective platform.

1.5 Referral Program Data

If you participate in the referral program, we store your promo code and referral commission records linked to your account.

1.6 Device & Technical Data

• Firebase Cloud Messaging (FCM) token for push notifications
• Language/locale preference (via the Accept-Language header)
• Timezone (for notification scheduling)

We do not use third-party analytics SDKs, advertising identifiers, or device fingerprinting.

2. How We Use Your Data

3. Third-Party Services

We share data with the following service providers, solely to operate the app:

We do not sell your personal data. We do not share data with advertisers.

4. Data Storage & Security

• Account and nutrition data is stored in a PostgreSQL database hosted on Railway.
• Food photos are stored on Cloudflare R2 under the path photos/{userId}/{uuid}.jpg.
• All communication between the app and our servers uses HTTPS/TLS encryption.
• Firebase Auth tokens are validated on every API request.
• API endpoints are rate-limited to prevent abuse.

5. Data Retention

• Your data is retained as long as your account is active.
• If you delete your account, we will delete your personal data, food entries, photos, and chat history within 30 days. Anonymized, aggregated data may be retained.
• AI chat logs sent to OpenAI and DeepSeek are subject to their respective data retention policies.

6. Your Rights (GDPR & Applicable Law)

If you are in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with similar data protection laws, you have the right to:

• Access — request a copy of your personal data.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data ("right to be forgotten").
• Restriction — ask us to limit processing of your data.
• Data portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interest.
• Withdraw consent — for processing based on consent (e.g., push notifications), at any time.

To exercise any of these rights, contact us at privacy@kushai.app. We will respond within 30 days.

7. Children's Privacy

KushAI is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

8. Push Notifications

We send push notifications for water reminders, food logging reminders, low-protein alerts, and streak encouragement. These are delivered via Firebase Cloud Messaging and scheduled according to your timezone. You can disable notifications at any time in your device settings.

9. International Data Transfers

Your data may be processed in countries outside your country of residence (including the United States) through our third-party providers. Where required by law, appropriate safeguards (such as Standard Contractual Clauses) are in place.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the app or by email. The "Last updated" date at the top reflects the most recent revision.

11. Contact Us