Privacy Policy

Chomp is a fitness and nutrition tracker. It stores what you put into it (your training, your meals, and the body measurements needed to calculate calorie targets) so it can show them back to you. It is not funded by advertising. Your data is never sold, and it is never used for advertising or shared with advertisers or data brokers.

Chomp is run by a sole trader in Australia, ABN 86 835 241 048 (“Chomp”, “we”). Chomp follows the Australian Privacy Principles in the Privacy Act 1988.

Chomp calculates estimates: calorie needs, macronutrient targets, calories burned, and the nutrition content of recipes and meals. These are estimates produced by general-purpose formulas and AI models, not clinical measurements, and Chomp is not a medical device or a healthcare provider. Nothing in the app is medical, nutritional or professional advice. Do not use it to diagnose, treat or manage any medical condition. Talk to a qualified professional before making significant changes to your diet or exercise, especially if you are pregnant, have an eating disorder or a history of disordered eating, or have any medical condition.

Only what you enter, plus the minimum needed to run the service:

• Account: a username, a password (stored only as a bcrypt hash, never in readable form), and an email address (required for new accounts; some older accounts have none). The email is used solely to confirm it is yours and to reset a forgotten password.
• Body and health information: the figures the calorie maths needs: age, sex, height, body weight over time, and optionally body-fat percentage, along with your stated goal and activity level.
• Training: workouts, exercises, sets, weights, reps, cardio sessions, session durations and any notes you add.
• Location (iPhone and Apple Watch apps, GPS cardio only): when you record a run, walk or ride with GPS, the app records your precise location for the duration of that session only, and saves the route (with timings and altitude) to your account so you can see the map later. Before your first recording, the app explains this and asks you to agree; we keep the date you agreed. Location is never collected at any other time. You can delete a route by deleting the session, or have maps deleted automatically after 30 days, 90 days or a year (Settings → Runs, walks & rides). The distance, time, pace and splits stay. Your friends see a map of a finished route with its start and finish hidden: by default everything within roughly 200–300 metres of where you started or finished is left off. You can widen that to about 500 m or 1 km, or switch it off, in Settings → Runs, walks & rides. Friends never see the times or altitudes of individual points. If you allow it, the app also saves the workout and its route to Apple Health. Chomp reads two things from Apple Health, each only if you allow it: your heart rate while you record on your Apple Watch (shown on the Watch and saved with the workout in Apple Health, not sent to Chomp); and, if you switch on “Bring in workouts from Apple Health”, the cardio workouts other apps and watches save there (for example Garmin Connect or Strava). Their type, start and end time, distance and the app’s name are sent to your Chomp account, so they appear in your history like any other session, together with the route if that app saved one to Apple Health and you have agreed to route recording. Nothing else is read, and strength workouts are left alone.
• Food: recipes, meal plans, logged meals and drinks, and shopping lists.
• Photos: only ones you choose to upload: recipe pictures and a profile picture. When you scan a barcode or a nutrition label, the camera image is read on your phone and is never uploaded or saved.
• Social: if you use the optional friends features: your friend connections, anything you explicitly share with a friend, your reactions and comments on their activity, recipes you ask a friend for (and their answer), people you have blocked, and any reports you make. Comments stay until you delete them (or the person whose activity they are on does), or until either account is deleted. A report includes a copy of what you reported, so it can be reviewed even if the content is later changed or deleted.
• Purchases (iPhone app): if you subscribe to Chomp Pro, Apple handles the payment. Chomp receives only what it needs to switch Pro on: which plan, whether it is a free trial, when it renews or expires, and Apple’s transaction reference. Chomp never sees your card or billing details.
• Crash reports (iPhone app): when the app crashes, freezes or uses too much power or storage, iPhone produces a technical report (Apple’s MetricKit). The app sends it to Chomp the next time it opens, so we can find and fix the problem. A report holds the app and iOS version, the iPhone model and a record of what the code was doing. It does not include your name, account, data or location, and Chomp stores it without linking it to your account. Reports are deleted after 90 days.
• Security and technical: sign-in attempts (the attempted username, time, and IP address) to block password guessing, active sign-in sessions so they can be revoked, a count of AI feature uses to enforce fair-use and free-plan limits, and when you last opened the app (so friends can see you have been active recently).

Chomp has no advertising or analytics trackers, and does not track you across other apps or websites.

Your body measurements, weight, and the food and training you log are health information under Australian privacy law, which gives them extra protection. Chomp collects them only with your consent: you give it when you create an account (a separate box from agreeing to the Terms), or, for accounts made before that box existed, the first time you open the app after it was added. We keep the date you agreed. Chomp uses this information only to run the app for you: your targets, suggestions, history and progress. You can stop at any time by deleting your account, which deletes it all.

You do not have to use your real name. Your display name and username can be anything you like; only the email address has to be real, so you can reset your password.

Five features use an external AI service, Anthropic (Claude). They run only when you actively tap the button for them, never automatically or in the background:

• importing a recipe from a screenshot or a TikTok video: the images you select, or the video’s caption, are sent;
• importing workout notes from a photo: the images you select are sent;
• calculating a recipe’s nutrition: the ingredient list is sent;
• estimating a meal or drink from a description: that description is sent;
• estimating calories burned from a session: the session’s exercises, sets and cardio are sent, together with the body figures the estimate depends on (sex, age, height, weight and body-fat percentage where you have provided them).

That last one means body measurements are shared with Anthropic when you use it. Your name, username, email and account identifier are never included in any of these requests. Anthropic processes the request and returns a result; their handling is governed by their own privacy policy. If you would rather nothing be sent, don’t use those five features. To read a TikTok video’s caption, your phone asks TikTok for it directly when you tap Import; TikTok’s own privacy policy covers that request. Everything else in Chomp works without them.

Results from these features are estimates and are labelled as such in the app.

Some things in Chomp are worked out automatically by Chomp’s software, using what you have entered, without a person checking them:

• your daily calorie and macro targets, from your age, sex, height, weight, body-fat percentage (if you gave it), activity level and goal;
• the weight and reps suggested for your next session of each exercise, from the sets you have logged;
• which food in the food database matches each line of a recipe, with lines it is not sure of marked as not an exact match.

These can shape what you eat and how you train, so each one stays in your hands: you can set your own targets or switch a target off, lift whatever weight you choose, and pick a different food or enter your own numbers. None of them affects your account, what you can use in Chomp, or anything outside the app.

When you scan a barcode in the iPhone app, the app looks the product up in Open Food Facts, a free public food database. Only the barcode number is sent, directly from your phone. Nothing about you or your account goes with it, and Chomp’s own servers are not involved. Open Food Facts’ handling of that request is covered by their privacy policy.

Some features work entirely on your phone and send nothing anywhere: reading a nutrition label from a photo, finding your recipes in iPhone search, reminders you turn on, the rest timer, and the workout shown on your Lock Screen.

Saying what you ate. When you tap the microphone, your iPhone turns your speech into text. Where your iPhone can, this happens on the phone itself; otherwise Apple’s speech recognition service does it, under Apple’s privacy policy. Chomp never receives or keeps the recording. The text appears for you to check, and is sent to Chomp only if you then tap to estimate the meal (see AI features above). In the web app your browser does this instead, and Google Chrome sends the audio to Google to turn it into text.

Apple Reminders. If you send a shopping list to Reminders, your iPhone asks you to give Chomp full access to Reminders, because iOS has no “add only” option. Chomp only adds the list it makes, and later updates or replaces that same list. It does not read your other reminders, and nothing from Reminders is sent anywhere.

Chomp runs on Vercel with a Neon PostgreSQL database hosted in Sydney, Australia. Uploaded photos are stored on Vercel Blob storage, also in Sydney. Account emails (confirming your address, password resets) and notices of new reports to Chomp’s operator are sent through Resend. These providers process data on Chomp’s behalf in order to run the service; they are not permitted to use it for their own purposes. Chomp Pro subscriptions are sold and billed by Apple through the App Store, under Apple’s privacy policy.

Where in the world. Your account data lives in Australia: the database is in Sydney, uploaded photos are kept in Sydney, and Chomp’s servers run in Sydney. Some information does go overseas: what an AI feature needs goes to Anthropic in the United States when you tap it; emails Chomp sends you go through Resend’s servers in Japan; emails you send to support pass through Cloudflare and are kept in Google’s Gmail, which may store them in the United States or other countries; and Vercel, a US company, may keep its operational logs (which include IP addresses) outside Australia. Each provider handles the data under business terms that limit it to providing its service to Chomp. Anthropic does not use these requests to train its models.

One thing to be aware of about photos. Uploaded images are served from long, effectively unguessable web addresses, but those addresses are not themselves password-protected: anyone who has the exact link can view that image. This is how the pictures load throughout the app. Please keep it in mind and avoid uploading anything sensitive.

Your account is private by default. Other people see your information only when you choose to involve them: adding a friend, or sharing a recipe, workout or session with one. A friend can see your display name, profile picture, bio, goal, whether you have been active recently, and anything you have shared with them. Your friends also see your recent activity: finished workouts (their names, duration, sets, volume and best set per exercise), cardio sessions (distance, time, pace, climb and splits, with a GPS map whose start and finish are hidden unless you switch that off), and new recipes. They cannot see your logged meals, body measurements or calorie targets. Anything you share is copied to the recipient at the moment you share it, so deleting your copy afterwards does not remove theirs.

A comment you write can be seen by the person whose activity it is on, and by those of their friends who are also your friends; it stays until you or they delete it. If you block someone, they are not told. If you report someone, Chomp’s operator sees the report and the copy of the reported content in order to review it; the person you reported is not told who reported them.

Chomp does not sell personal information, does not share it with advertisers or data brokers, and does not use health or fitness information for advertising. Data may be disclosed if required by law.

Your data is kept for as long as your account exists, except GPS maps if you choose to have them deleted after a set time (see Location above). You can export your data (your profile, training, meals and recipes) as a single JSON file (Settings → Export my data), and you can delete your account from inside the app at any time. Deleting is permanent and immediate: it removes your profile, training history, meals, recipes, photos, friend connections, blocks, reports you made or that were made about you, subscription records and sessions. It cannot be undone, and copies you previously shared with friends stay with them. Deleting the account does not cancel an App Store subscription. Cancel that in your iPhone’s Settings.

Security records are short-lived by design: sign-in attempt logs are discarded within about a day, expired sessions and unused password-reset codes are cleared automatically, and AI usage counts are kept for about 90 days.

Depending on where you live (including under the Australian Privacy Act and, for users in the UK and EU, the GDPR), you may have the right to access, correct, export or erase your personal information, and to object to or restrict certain processing. The export and delete features above cover access, portability and erasure directly, and you can correct almost everything yourself in the app. For anything else, including a copy of information you cannot export or a correction you cannot make yourself, email us (see Contact). We will reply within 30 days and will not charge you for it. If we refuse, we will tell you why and how to complain.

If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the law requires.

If you think Chomp has mishandled your personal information, email us (see Contact) and say what happened. We will acknowledge it within 7 days, look into it, and give you a written answer within 30 days. If you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).

Chomp is not intended for children. Do not create an account if you are under 13 (or the minimum age required in your country). Calorie and weight tracking is not appropriate for young people without professional guidance.

If this policy changes, the effective date at the top will change with it and the current version will always be published at this address.

Questions, or want to exercise any of the rights above? Email support@letschomp.com.