TwentyGrams
Menu

Privacy Policy

Last updated October 11, 2026

TwentyGrams is built to be precise and trustworthy, and that includes how we handle your data. This page says plainly what we collect, why, and what we never do with it.

The waitlist (this website)

If you join the waitlist, your email address is stored with Kit (ConvertKit), our email provider. You'll get one confirmation email (double opt-in) and, later, one email when TwentyGrams launches. If you checked "I'm curious about how food affects my blood sugar," we tag your signup so we understand demand for that use case — nothing more.

We never sell or share your email with advertisers, and we never use it for ad targeting. You can unsubscribe from any email we send, at any time, with one click.

This website's analytics

We use Google Analytics (GA4) to see aggregate, anonymised traffic — how many people visit, which pages they read. We don't build individual visitor profiles from it, and we don't use it to retarget you with ads elsewhere.

GA4 doesn't run until you say yes: on your first visit to this website (not the app) you'll see a cookie banner with an Accept and a Reject option, and no analytics script loads until you choose Accept. You can change that choice anytime from the "Cookie preferences" link in the footer.

The TwentyGrams app

The app itself is anonymous-first: it works with no account, and your food log lives in a local database on your own phone. Apart from crash reports, update checks, install counts, the text and photo processing described below, the requests listed under “What the app sends without an account”, and what you send once you create an account (see “Cloud sync”), the app also sends us daily counts of how often you used specific features, such as barcode scans, label scans and water logs. The app sends these only when you are signed in. The counts contain no food entries. Our server adds each count to a daily total for that feature, in a table that has no account column. The request carries your sign-in token. Our server uses the token to check the request and to keep a rate-limit counter keyed on your account ID for about a minute. None of this is sold or used for ad targeting.

The app also reports crashes and errors. When the app crashes, hits an error, or a request to our servers fails, it sends a report to Sentry, our crash-reporting service, so we can find and fix the problem. Each session it also sends Sentry a basic signal (that the app opened and whether it ended normally) so we can see how stable each version is. A report contains technical details about the error, your device model, operating system and app version, a random identifier for this installation (not your name, email or account), and a short trail of recent app activity leading up to it: screens and buttons used, and network requests the app made. The app is built so that its own diagnostic messages do not contain what you type or dictate, and those messages are left out of these reports. The technical details of an error come from the app and its software libraries; we filter them for text that looks like something you entered, but that filtering is not perfect, so we cannot promise that no detail will ever contain some of it. The app does not attach screenshots or session recordings and does not include your IP address in the report, although Sentry’s servers necessarily see the network address a report arrives from. We use these reports only to find and fix problems, not for analytics or advertising. Sentry says it keeps crash reports for 30 days on the plan we use, and for 90 days on its paid plans. The period is set when a report is received, so if we change plans, reports sent afterwards may be kept longer. Deleting the app or your account does not remove reports already sent; they expire on that schedule.

Text and photos are processed by our server and by OpenAI, our AI provider. When you log food by typing or speaking it, the text is sent to our server and on to OpenAI, which reads it into food items. This works with or without an account. Questions about a recipe are sent the same way and need a signed-in Premium account. Nutrition-label scans need a signed-in account: the photo of the label is sent to our server and on to OpenAI to be read, and free accounts have 5 scans a month. Our server does not write the text of food-logging requests to its logs and does not keep label photos. What OpenAI keeps, and whether it uses the data to train its models, is set by OpenAI’s own API terms and data settings. Your food log itself stays on your phone unless you create an account, which turns on cloud sync.

Install counts. To learn which channels bring people to the app, the app sends our server one request per installation with your platform (iOS or Android), the install date (the day, not the time), and how the install was counted. This request carries no account identifier, no advertising identifier and not the installation identifier described under “What the app sends without an account”. We use the network address the request comes from only to limit repeated requests: it sits in a short-lived counter (about a minute) and is not saved with the record. On iPhone, if you installed after seeing an ad, Apple’s AdAttributionKit may also send our server a signed notice of that install. We store only the ad network and campaign source it names, a fixed number our app sets, and Apple’s random notice ID, which we delete after 90 days. On Android, if you allow it during setup, the app reads the Google Play install referrer and sends only three standard campaign fields (source, medium and campaign) in that same request. We use these counts in aggregate, to see which channels reach people, and not for ad targeting.

Update checks. The app checks for updates through Expo’s update service (u.expo.dev). Each check sends Expo your platform, the app’s version, an identifier for the update installed, and a random identifier that Expo’s update software creates for this installation. If the app failed on its previous launch, the check also sends a short error message about that failure. Expo’s servers see the network address the check comes from. The app does not add your account or your food log to these requests.

What the app sends without an account. These requests are made with or without an account, in addition to those described above.

Food-text requests: Each time you log food by typing or speaking it, the request includes a random identifier that the app created for this installation and keeps on your phone (the installation identifier). We use it to limit abuse. A hashed form of it goes to OpenAI as a safety identifier. Our server keeps a short-lived counter keyed on the installation identifier, which expires up to two days after your last such request.

Subscriptions: In builds with subscriptions enabled, when the app opens it also starts RevenueCat, our subscription provider. RevenueCat uses an anonymous customer ID until you sign in.

Wrong-number reports: If you choose “Report wrong number” on a food, the app sends the food’s name and source ID, the amount and net-carb figure it showed, and your platform and app version. Our server saves the report and posts it to a private team chat channel (Discord). The network address it comes from is used only in a counter that expires after about an hour.

Community recipes: The app also asks our server for new community recipes. That request carries a position marker and a page size, and no account or installation identifier.

If you delete the app without ever creating an optional account, your food log is gone with it. Deleting the app does not remove what it already sent (all described above). That includes crash reports and update checks, and install-count records, which are not linked to you. It also includes the anonymous RevenueCat customer record, any wrong-number reports you sent, and the counter for your installation identifier, which expires up to two days after your last food-text request. Text already sent for processing is handled by OpenAI under its own retention terms, and deleting the app does not recall it. Settings tells you that without an account, entries stay on this phone and are not backed up.

Cloud sync (only if you create an account)

Creating an account is optional and is what turns on cloud sync — it's how TwentyGrams Premium gets your data onto the web dashboard and keeps a second device in step. If you never create one, cloud sync does not apply to you: your food log, settings and health metrics are not copied to our servers. The text you type or say to log food, and the requests listed under “What the app sends without an account”, are still sent. Accounts are handled by Clerk, our sign-in provider; we never see or store your password ourselves.

Once you do create an account, here's exactly what syncs to our server: your food log entries, your app settings and goals (like your daily carb target), and banked carb allowance. If you log or connect them, we also sync health metrics — step count, water intake, weight, active energy, resting heart rate, and sleep — plus your saved recipes (name, ingredients, instructions, photo, notes), your meal templates (each template's name and the foods, amounts, and meals it contains), your fasting log (each fast's start and end time, its target, any note you add, the name and length of any fasting schedule you save along with its planned days and times, any single planned fast you skip or move, and the daily fasting window start time if you set one), and your shopping list state (pantry staples, checked items, and anything you've added or dismissed manually). Nothing syncs that you haven't logged yourself or connected via Health/Health Connect.

Two more names worth knowing: your synced data is stored on Turso, our database host, and RevenueCat, our subscription/billing provider, receives your account's Clerk ID so it can check whether you have Premium — it doesn't get your food log or any of the health data above.

Billing notices. If a Premium payment fails, we may email you up to three notices about it over the following 14 days, at the email address stored with your account. When this notice service is switched on, a daily check with RevenueCat, our subscription provider, finds failed payments. If we send a notice, it goes through Cloudflare’s email-sending service, which receives your address and the message. The notices are about the payment problem and what it means for your Premium access.

When you log food by typing or speaking it, we send that text to OpenAI to process it, with or without an account. When you ask a question about a recipe, which needs a signed-in Premium account, we send the question to OpenAI in the same way. When you scan a nutrition label, which needs a signed-in account, we send the photo of the label to OpenAI to read it. What OpenAI keeps, and whether it uses the data to train its models, is set by OpenAI’s own API terms and data settings. Voice dictation is transcribed by Apple’s or Google’s speech-recognition service, which may receive the audio, depending on your device and settings; only the resulting text comes to us.

Scanned labels. When you are signed in and save a food from a nutrition-label scan, the app also sends us the food name, brand, barcode if there is one, serving size and nutrient amounts, together with the full text of the AI provider’s reply that read the label. There is no setting in the app to turn this off. We use it to review products our food database is missing, and an entry may be added to that database. The photo is not part of this request, and our server does not keep it. We do not store your account ID with the record, so deleting your account does not remove it. Entries that pass our automated checks are marked approved, and the others wait for us to review them.

Export log. When a signed-in Premium account creates a PDF export, the app tells our server that an export happened (your account ID, the format and the time), not its contents. We use this to count how often exports are used.

Deleting your account (Settings → Delete account, or by deleting your Clerk account directly) erases everything synced above from our database and photo storage — every table it's stored in, not just the parts you'd notice missing. We don't run a separate countdown or "grace period": we keep synced data only for as long as your account exists, and deletion is real deletion of our copies, not a soft flag (one caveat about cached photo copies follows). Connections to our server and to Clerk are encrypted (HTTPS/TLS) the whole way.

Photos you add to your recipes are stored with your account, and deleting your account deletes them from our storage. Copies held in a content-delivery cache can remain reachable by their exact web address for up to a year afterwards (the cache’s maximum setting; it may be sooner).

Want a copy of everything we have stored about you? Email us at the address below and we'll send it to you.

Support messages

If you are signed in and send a message from Contact support in the app, we store the message, the category you chose, your account ID, and the email address on your account, so we can read it and reply by email. If you leave “Include app details” on, we also store the app version and build, your phone’s platform and OS version, and whether your plan was Premium, Free or unknown when you sent it. The app adds nothing from your food log or health data to a message; what you write in it is up to you. We don’t sell support messages or use them for advertising.

When a message arrives, a short notice goes to a private team chat channel (Discord). It contains the category, a reference number and a link to our admin page, not your message and not your email address. If our database can’t save a message at that moment, the notice may carry the first part of your message (up to 600 characters) and your account ID so the message isn’t lost.

We keep support messages for as long as your account exists, and deleting your account deletes them too. A copy that exists only in the team-chat notice (if the database save failed) and emails we exchange with you are not in that database, so account deletion does not remove them automatically; email us and we will delete them. If you email us instead, the address is below and the same rights described on this page apply.

Public reviews

If you write a review — of a recipe or of the app itself — it's genuinely public: anyone can see it, along with your display name and, if you've set one, your profile photo and a short bio. By default those come from your account; you can change or remove them anytime in Settings.

Deleting your account takes your reviews down from public view immediately — the same thing happens if you use the "withdraw my review" option yourself — and permanently deletes your profile (email, display name, photo, bio). We keep an internal, non-public record of what was posted rather than purging the review text outright. That's a deliberate policy choice, not a loophole: it protects the integrity of the review system — so a review can't quietly disappear and reappear, and so we have a record if a review's authenticity is ever disputed — the same principle behind the FTC's rules against businesses manipulating their own review record. It isn't sold, shared, or shown publicly again. If you want us to reconsider retention in your specific case, email. Any likes you'd given other people's reviews are removed completely when your account is.

Why we're allowed to process this

Joining the waitlist relies on your consent — you opt in, and the confirmation email makes sure it was really you. This website's GA4 analytics also relies on your consent — the cookie banner described above — before it ever runs. The app’s feature counts rely on our legitimate interest in understanding whether TwentyGrams works for people; they are added to daily totals per feature that are stored without an account ID, and are sent only when you are signed in. Creating an account and using cloud sync relies on the contract you're asking us to perform — syncing your data is the service. The optional parts on top of that — connecting Health/Health Connect, writing a public review — additionally rely on your consent to switch them on in the first place. Support messages rely on the contract you’re asking us to perform when you write about your account or the service, and otherwise on our legitimate interest in answering people who contact us; the notice sent to our team chat relies on that same legitimate interest. Crash reports rely on our legitimate interest in keeping the app working and finding bugs; you can object at any time by contacting us. Processing the text and photos you submit to log food, ask about a recipe or scan a label relies on the contract you are asking us to perform when you use those features. Logging food by text works without an account; recipe questions and label scans need one. Billing notices rely on the same contract. Install counts and update checks rely on our legitimate interest in knowing which channels reach people and in delivering fixes; you can object by contacting us. The Android install referrer is read only if you allow it, and relies on your consent.

Your privacy rights

Wherever you are, you have the right to: know what we hold about you (access), fix it if it's wrong (rectification), have it deleted (erasure), get a copy in a portable format (portability), ask us to pause processing it (restriction), and object to processing based on our legitimate interest, like analytics. Emailto exercise any of these — that's the one mechanism for all of them, there's no separate portal to hunt for. You can withdraw any consent you have given at any time (for example by turning off a Health connection), without affecting what was done before. You can also complain to your data protection authority; in the EU, that is the authority in the country where you live or work. We do not make decisions about you by automated means that have legal or similarly significant effects. Giving us data for an account or sync is your choice; without it the app works on your phone and those features are off.

California residents (CCPA/CPRA)

Do Not Sell or Share My Personal Information: there's nothing to opt out of, because we don't do it — see "What we never do" below. That's not a setting we could turn off; it's a standing choice about how we operate.

California residents also have the right to know what we collect, request its deletion, correct it if it's wrong, and not be discriminated against for exercising any of these rights. Some of what syncs — weight, steps, sleep, heart rate — counts as "sensitive personal information" under CPRA; we don't limit our use of it beyond everything else this page already says, because we never sell it, share it, or use it for advertising in the first place. Same request, same address:.

How long we keep it

Synced account data — everything listed under Cloud sync, plus your profile — is kept only as long as your account exists; deleting your account deletes it from our database and photo storage, not a soft flag (see above, including the note on cached photo copies). Public reviews follow the rule described above: taken down from view on deletion, kept internally rather than purged. Waitlist emails stay with Kit until you unsubscribe or ask us to delete the record — we don't run a separate countdown on top of that. Support messages follow your account, as described under "Support messages" above. Crash reports sent to Sentry are not tied to your account and are kept for the period described under "The TwentyGrams app" above. Install counts are kept as anonymous rows with no link to you. Billing-notice records are deleted with your account. Analytics events on this website are aggregate and anonymised from the moment they're collected, and sit inside the bounded retention window the analytics platform itself enforces automatically. The app’s feature counts are kept as daily totals with no account ID.

Where your data lives

TwentyGrams has users everywhere, and the providers we use to run it are US-based: Turso (our sync database) runs on AWS infrastructure in the US; Clerk (accounts) runs on Google Cloud in the US; RevenueCat (billing), Kit (waitlist email), Google Analytics, and OpenAI (which processes recipe questions, the text you type or dictate when logging food, and the nutrition-label photos you scan) all process data in the US too. None of them offer EU-only data residency — instead, each covers the transfer under GDPR-recognised mechanisms (Standard Contractual Clauses and/or the EU-US Data Privacy Framework) named in their own Data Processing Agreements. That's lawful transfer, not in-region storage — worth knowing the difference if it matters to you. Separately, Discord, which delivers the support-message notice and any reports you choose to send from the app to our team chat, is a US service, and the support notice carries a message only if a database save failed. Separately, Cloudflare, a US company, runs our website and the servers behind the app. Requests to us pass through Cloudflare, which sees the usual request details such as your IP address. It also stores the recipe photos you add and serves them through its content-delivery cache, and keeps rate-limit counters and a cached copy of your Premium status that expire automatically. Separately, Cloudflare also sends the billing notices described above. Separately, Sentry, a US company, receives crash reports at its US region. Sentry states that it has self-certified to the EU-U.S. Data Privacy Framework and the UK Extension to it, and that it also offers the European Commission’s Standard Contractual Clauses as an alternative transfer mechanism.

Children's privacy

TwentyGrams is built for adults managing their own diet and isn't directed at children. We don't knowingly collect data from anyone under 13 (or under 16, where GDPR sets that higher bar). If you believe a child has an account, email us and we'll delete it.

What we never do

Who's behind TwentyGrams

TwentyGrams is built and run by Martin Eisath, a solo developer — not a registered company. For GDPR purposes, that makes Martin Eisath the data controller for everything described on this page. Mailing address: 1601 Scottsdale Lane, #3105, Austin, TX 78754.

Questions

Reach us at .