Privacy Policy

Who is responsible

Sabzy is developed and operated by Boburmirzo Khudoyberdiev, an independent developer based in Uzbekistan. For anything in this policy, including requests about your data, write to mirzo.7767@gmail.com.

What the app stores

Everything you enter is written to a database on your device:

• Your profile — height, current weight, target weight, date of birth or age, sex, activity level and the goal you chose. These are what the daily calorie target is calculated from.
• Your log — meals and their foods, calories and macronutrients, the time each was logged, and any photo you attached.
• Water and weigh-ins — the glasses you tick off and the weights you record over time.
• App settings — units, language, reminders, and how many AI analyses you have used.

If iCloud is signed in on your device, this database is mirrored to the private iCloud database of your own Apple Account. That storage belongs to you: it is covered by Apple's privacy policy, it counts against your iCloud storage, and the developer of Sabzy has no way to read it. Signing out of iCloud, or turning iCloud off for Sabzy in Settings, stops the mirroring.

Signing in

Sabzy works with no account at all, and that is how it starts: everything above stays on your phone and in your own iCloud, and none of it reaches us. Signing in is something you choose in Profile, and it exists for two things — reading the same log on a second device, and joining a group.

Signing in goes through Apple or Google. There is no password anywhere in the app, so there is none for us to hold or to lose. What Firebase Authentication keeps on our behalf is an account identifier and the email address the provider passes on — with Sign in with Apple that may be a relay address you can switch off at any time, and the app works the same either way.

Once you are signed in, your profile, meals, weigh-ins and water are mirrored to Cloud Firestore, and meal thumbnails and your profile picture to Cloud Storage, in a folder that the security rules open to your account and to no other. The profile document carries four more things that are not part of your log: whether a subscription is active, on which product and until when; the push tokens of the devices you are signed in on; a pointer to the group you are in; and a stamp of which platform and app version wrote last. The database is hosted in the European Union — Belgium and the Netherlands — and the functions that run groups are in Frankfurt.

Signing out stops the mirroring and leaves the copy where it is. Profile › Account › Delete account removes it: every meal, weigh-in, water entry and published day, then the profile document, the photo folder and the account itself. If you signed in with Apple, the app also revokes the token Apple issued, which is what makes the deletion whole rather than half done.

Groups

A group is a shared subscription: one person pays, and everyone they invite has Premium for as long as the plan runs. The person paying is not covered by it — a plan for five is five people besides them — and subscribes to Sabzy Pro like anybody else if they want it. Joining takes an invite code from whoever runs the group, so nobody can be added without asking. One person is in one group at a time, and leaving is a button.

What the others in your group can see about you:

• The name and picture you set in Profile — a group member with no name set is shown as “Member”.
• Your streak, your best streak, your goal, and how your weight has moved over the last thirty days as a single figure.
• For each day: calories, protein, carbohydrate, fat and fibre, your targets for that day, water, your step count from Apple Health, how many meals you logged, and whether the day landed inside your calorie band.
• The meals themselves — dish names, times and photos.

There is no switch that narrows that list, and there never has been. What somebody in your group sees is what the join screen shows you before you type the code: your calories and macros, your meals with their photos, which way your weight is going, your streak and your activity — and it stays that way for as long as you are in the group. Leaving is what stops it.

Sabzy writes three short paragraphs for a group: one about the week, one about the day so far, and one about a single member on that member's page. They name people and dishes, and they are meant to — “somebody went over on two days” helps nobody, while “Aziz had a big slice of cake at breakfast on Tuesday” is something a trainer can act on. Names appear exactly as they are set in Profile, and meals exactly as they were logged. Only the people in your own group ever read them, and those same meals and photos are already open to those people, so a paragraph shows them nothing they could not open for themselves.

Joining a group publishes your last thirty days at once, so the group is not looking at an empty screen. Leaving stops any further publishing, and deleting your account deletes the published days along with everything else. Nobody outside your own group can read any of it: the database rules admit no one else.

Group notifications — somebody joined, somebody's streak reached a milestone, the plan is about to lapse — are delivered through Firebase Cloud Messaging, which means the app registers a push token against your account and records which language to write to you in. Group notifications can be switched off in Profile, and signing out removes the token.

What leaves your device

Google

Photos, audio and meal descriptions are sent to Google's Gemini models through Firebase AI Logic and processed there to produce the result you see. Sabzy keeps no copy of the photo, the audio or the text on any server it controls, and such a request carries no name, email or account identifier — only the image, audio or text and the instruction to analyse it. Google's handling of that data is governed by Google's Privacy Policy.

A group's paragraphs go to the same models, and they are the exception to that. To write one, the app sends Google the display name of every member it will mention and the names of the meals that stood out, alongside figures the device has already worked out. It sends no email address, no account identifier and no photograph. The paragraph comes back to the others in your own group, who can already open those meals themselves — but writing it is a request to Google, and this is what that request carries.

Usage and crash reports

Sabzy uses two Google Firebase services: Analytics, which counts what happens in the app, and Crashlytics, which captures a stack trace when the app stops. They are what tell us that a screen is confusing or that a build fails on one iOS version, without anyone having to write in.

They are on by default, and there is no setting inside the app to turn them off. Version 1.4 had one and 1.6 removed it. Deleting the app stops them. We would rather say that plainly than describe a control that is not there.

What is sent:

• Events from a fixed list the app defines — that onboarding finished, that a photo was analysed, that a meal was logged, that the paywall was shown, that a purchase succeeded or failed, and which of a named set of controls was pressed. There is no free text anywhere in them: every value is either a number the app worked out or one of a small set of words chosen in advance.
• The name of the screen you are on, from a closed list of about twenty.
• A few facts about the installation rather than the moment: whether a subscription is active and on which term, roughly how far you have got in using the app, whether reminders are on, whether AI features are allowed, whether the camera is allowed, and the app's language.
• Figures that could pin down a person or a moment are deliberately banded rather than exact. An age arrives as “35–44”, and the time it took to log a first meal as “under 5 minutes” or “same day”.
• What the Firebase SDK adds on its own: an identifier for this installation, the device model, the iOS version, the language, and an approximate location — city level at most — worked out from the IP address of the connection.
• From Crashlytics, when the app stops: the stack trace, the device model and iOS version, and how long the app had been running.

What is not sent: nothing you photograph, say, type, weigh or eat. No height, no weight, no calorie target, no goal, no meal name. The facts attached to the installation identifier deliberately exclude every health attribute, because an identifier that outlives a session is the wrong place for one.

There is no advertising identifier. The app does not link Apple's AdSupport framework and never asks for tracking permission, because it does not follow you into other companies' apps or websites. Its App Store privacy manifest declares exactly this.

Firebase is operated by Google, which processes these reports on our behalf on infrastructure that may be outside your country, under Google's own terms and privacy policy. They go nowhere else, and nothing in them is sold. Google deletes the analytics events automatically once the retention period set on the project expires; crash reports are kept while the crash is still worth fixing.

Firebase attaches its installation identifier to these reports, and we have no way to connect that identifier to you — which is the point, and also the limit: we cannot find your rows to remove them on request. Deleting the app stops new ones, and the identifier does not survive it.

The shared product catalogue

When you scan a barcode that Sabzy has to look up, the product's details — barcode, name, brand, calories and macronutrients per 100 g, and serving size — are written to a catalogue in a public iCloud database, so that other people scanning the same product get an answer immediately. This entry is about the product, not about you: it carries no identifier of the device or the person who scanned it, and it cannot be traced back to your log.

Payments

Subscriptions are sold by Apple through the App Store. Apple handles the payment; card numbers, billing addresses and your Apple Account details are never seen by Sabzy or its developer. What the app receives is Apple's signed record of the purchase. For a group plan it passes that record to a Cloud Function of its own in Frankfurt, which checks Apple's signature and reads the plan out of the signed payload rather than believing what the app claims. Apple also writes to that same function directly, through App Store Server Notifications, so a renewal or a cancellation reaches a group whose owner has not opened the app in a month.

How these third parties are held to this policy

Every party named above is required, under the terms it is engaged on, to protect the data it receives to the same standard this policy sets out, and none of them is permitted to use it for its own purposes, to build a profile, or to pass it on further. Nothing is sent to any of them beyond what the table describes.

The app links ten third-party software development kits, and every one of them is Google's. Nine come from Firebase: Analytics and Crashlytics, described above; App Check; AI Logic, which carries a photo, a voice note or a description to Gemini; Authentication, Cloud Firestore, Cloud Storage and Cloud Functions, which between them are the account, the sync and the groups; and Cloud Messaging, which delivers a group's notifications. The tenth is Google Sign-In, one of the two ways to sign in. There is no advertising or tracking kit of any kind, and no parent, subsidiary or affiliated company with access to your data — Sabzy is one independent developer, so there is no one else for data to reach.

App Check deserves a paragraph of its own, because it runs on your device on every call to a Google backend and nothing else here describes it. Before each call it asks Apple to attest that the request comes from a genuine copy of Sabzy on a genuine Apple device — through App Attest where the hardware supports it, and DeviceCheck where App Attest is unavailable — and sends the short-lived token Apple issues along with the call. The token says something about the app and the device and nothing about you. It is what lets Sabzy ship with no API key of its own for anybody to lift out of it.

One name in the table above is not Google's. A barcode you scan goes to Open Food Facts, an open database of food products run by a French non-profit association. It receives the barcode number and nothing else — no account, no device identifier, no part of your log — and answers with the product. What comes back is published under the Open Database License, and what Open Food Facts does with the request is governed by its own terms and privacy policy.

The Health app

Health integration is optional and off until you turn it on. When it is on:

• Sabzy reads what your day already contains: the active energy you have burned, your step count, walking and running distance, and workouts recorded by any app on your phone or watch. The Activity screen shows them, and the calories left in your day account for how active you have been.
• Sabzy writes the energy, protein, carbohydrate, fat and fibre you log, and any weigh-in you record, so your other apps stay in sync.

With one exception, Health data is exchanged only between the app and Apple Health on your device. Everything else the app reads is never sent to Google, never written to the shared catalogue, and never stored in iCloud — these figures are read when a screen needs them and are not saved anywhere. They are never used for advertising.

The exception is your step count. If you are in a group, the steps you took that day are published with the rest of your daily totals, and the other members of your group see them just as they see your calories and your water. That one figure is the only thing from Health that leaves your device — nothing else in the list above goes with it, and the weight your group sees is worked out from the weigh-ins you record in Sabzy, not from Health. If you are not in a group, nothing from Health leaves your device at all.

Permissions the app asks for

• Camera — to photograph a meal or scan a barcode.
• Photo library — only to let you pick an existing photo of a meal. The app reads the picture you choose and nothing else.
• Microphone — to record a spoken description of a meal.
• Notifications — reminders you set up yourself, such as the weekly weigh-in, and the group's own notifications if you are in one. They are two separate switches in Profile.
• Health — as described above.
• AI features — your agreement that a photo, a voice note or a typed description may be sent to Google. The same switch governs the written notes, including the ones a group gets. Nothing is sent before you give it.

Every one of these can be refused. The first five can be withdrawn in the Settings app; AI features are switched off in Sabzy itself, under Profile › Settings. Refusing one disables the feature that needs it and nothing else.

What Sabzy does not do

• No advertising kits and no tracking kits. The app links ten third-party kits, all of them Google's; they are listed above, and none of them is there to follow you.
• No advertising, and no advertising identifiers.
• No tracking across other apps or websites.
• No profiles built about you, and no automated decisions with legal or similar effects.
• No sale or sharing of personal information, under any definition, for any purpose.

How long data is kept

Your log stays on your device until you delete it. Deleting the app removes the on-device database. If iCloud mirroring was on, the copy in your iCloud is removed through Settings › your name › iCloud › Manage Account Storage › Sabzy.

If you signed in, the copy in Cloud Firestore and Cloud Storage is kept for as long as the account exists. It is not kept afterwards: Profile › Account › Delete account erases it before the account goes, and we run no backup of it from which it could come back. Daily totals published to a group go with it, and leaving a group stops new ones being written.

Usage events and crash reports held by Firebase are deleted by Google when the project's retention period expires, and deleting the app stops any new ones. Entries in the shared product catalogue are nutrition facts about commercial products and are kept indefinitely; because they contain nothing about you, deleting your data does not affect them.

Children

Sabzy is not directed at children under 13, and does not knowingly collect anything from them. If you believe a child has provided personal information through the app, write to the address above and it will be removed.

Your rights

Because the app keeps your log on your own device, you exercise most rights directly: you can see everything in the app, change or delete any entry, and remove all of it by deleting the app and its iCloud data. If you signed in, Profile › Account › Delete account does the same for the copy on our side, in one step and without writing to anybody.

For readers in the European Economic Area and the United Kingdom, the legal bases under Article 6 of the GDPR are these. Everything the app does to give you what you asked for — storing your log, recognising a photo, syncing an account you created, running a group you joined — is performed under Article 6(1)(b), the performance of a contract with you. Usage and crash reports are processed under Article 6(1)(f), our legitimate interest in knowing that the app works, which is why they carry nothing about your health and why the switch in Profile exists. Health data is a special category under Article 9 and is processed only with your explicit consent, given in the Health permission sheet and withdrawable there.

If you are in the European Economic Area or the United Kingdom, the GDPR gives you the right to access, correct, erase, restrict and object to the processing of your personal data, and to data portability. If you are in California, the CCPA gives you the rights to know, delete, correct and opt out of sale or sharing — noting that Sabzy does not sell or share personal information. To exercise any of these, or to complain, write to mirzo.7767@gmail.com.

Changes to this policy

If this policy changes, the date at the top changes with it, and a material change is posted here before it takes effect. The app has no way to send you a message, so this page is where it appears. The current version always lives at this address.