Privacy Policy - Avocando

This Privacy Policy ("Policy") describes how Hekato Pty Ltd (ACN 702 732 152) ("Hekato", "we", "us" or "our") collects, holds, uses and discloses your personal information (defined below) when you use Avocando (the "App"), our app for the web and for mobile devices that helps you track your food, fitness and habits, and plan your workouts and routines, and when you otherwise deal with us. It also explains the choices and rights you have over your personal information. This Policy forms part of our Terms of Service, which are at avocando.app/terms (the "Terms"); terms used but not defined in this Policy have the meaning given in the Terms.

The App also includes:

recipes, which you can share with your household or, if you are a creator, publish;
a kitchen that keeps track of the food you have, your shopping list and your food spending; and
AI assistance, including reading photos of meals, labels and receipts you scan.

In this Policy, the App includes the Avocando web app (the "web app"), the Avocando app for iOS and Android (the "mobile app"), and our websites at avocando.app and its subdomains, including the public recipe, creator and tag pages that anyone can open there without an account. "Personal information" means information about you as an identified or reasonably identifiable person. It has the meaning given in the Privacy Act 1988 (Cth) (the "Privacy Act") and, where the EU General Data Protection Regulation (the "GDPR") or the UK General Data Protection Regulation (the "UK GDPR") applies to you, it also means "personal data" under that law. "Sensitive information" has the meaning given in the Privacy Act and includes health information, which the GDPR and the UK GDPR call a "special category" of personal data. Where this Policy says "your data" or "your information", it means your personal information.

1. Summary

When you create an account, your nutrition, recipe, workout, and routine data is stored in private cloud storage tied to your account, so it is available across your devices. The App needs an internet connection to load and save this data.
To open faster, the App keeps a copy of your latest screens on your device. It is removed when you sign out or delete your account.
Your private synced data is protected by database-level access rules (Row-Level Security), so other users of the App cannot read or change it, except for:
- shared food definitions, which any signed-in user can see, but only the person who added an entry can change or remove;
- a recipe you publish, with its tags and its approved photo, and your creator page if you are a creator, which anyone on the web can read (see Section 3);
- a meal or recipe you send to a member of your household, which they can read;
- your kitchen, if you and a member of your household both choose to merge your kitchens, which each of you can then see and draw from (see Section 2); and
- the foods you choose for receipt lines, which count towards matching the same lines for other users. They see only counts, never who chose, though a count can be as low as one (see Section 2). You can stop your receipt choices counting for other users in Settings → Consent & data (see Section 4).
Our own systems also process your data to run the features you use, for example when Avo, the App's chat assistant, answers you, when your daily summary is written or when a notification is sent. Your data is also included in our encrypted backups (see Section 7). Access to our production systems is limited to the people who need it to run the App. Nobody at Hekato browses your private data. We look at it only when we need to: to review a photo, a creator request or a report, to act on a request you make to us, to fix a problem you report or that affects your account, to protect the App and its users, or when the law requires it.
You can permanently delete your account and your private data at any time from Settings → Danger zone → Delete account; Section 7 explains what remains.

2. Information we collect

We collect and hold the following personal information, depending on the features you use:

Account information: the email address and password you use to sign up (your password is never stored in plain text; authentication is handled by our backend provider, Supabase). If you sign in with Google instead, Google shares your email address and basic profile details with us, such as your name and profile picture, and we keep them with your account. On an iPhone or iPad, you can also sign in with Apple; Apple then gives us an email address for your account, which can be a private relay address that Apple forwards to your own if you choose to hide your email, and we do not ask Apple for your name. In the web app, the sign-in screen may also load Google's sign-in service so it can offer one-tap sign-in with Google, at most once every 30 days on each device. Loading it lets Google see your IP address and browser details, and Google may recognise you if you are signed in to Google in that browser, even if you do not use one-tap sign-in. We receive nothing from Google unless you choose to sign in with Google.
Ratings, saves and follows: the stars you give a published recipe, the recipes you save, and the creators and tags you follow.
Premium access and creator codes: whether you have a free trial of Premium or other Premium access and when it ends, and any creator code you enter when you sign up or later, including which creator's code it was and when you redeemed it. A creator whose code you redeem sees how many people have redeemed it, never who. We keep a code you redeemed until you delete your account, or for longer if you subscribe (Section 7). If you subscribe to Premium, we also keep your subscription's status, plan, price and renewal dates and the store's transaction identifiers, but never your payment details, which only the store holds. We also keep a record of each payment you make for it (the store's transaction identifier, the date and the amount), which is how the fee a creator earns from a subscription bought with their code is worked out (see "Creator payout details" below).
Nutrition data: shared food definitions, such as ingredients; your own recipes (private unless you publish them as a creator); and your private daily food logs.
Household: the members of your household, who join by accepting an invite link; any nickname or avatar you give a member, which only you see; and the meals and recipes you send to a member, which they can read. A meal or recipe a member accepts becomes their own copy, which stays with them if you later change or delete yours, remove them from your household, or delete your account.
Kitchen data: the food on your shelf, your leftovers and your to-buy list, including items you have finished or thrown out, which stay in your kitchen's history; a record of how much each food you log or cook took from your shelf and leftovers, or from a household member's when your kitchens are merged; and, while "Track food spend" is on, what you paid for each item, what each leftover batch cost, and what the food you eat or throw out cost. If you and a member of your household both choose to merge your kitchens, each of you can see the other's shelf, leftovers and to-buy list, including items finished or thrown out and what was there before you merged. This includes each item's price, what anything finished or thrown out was worth and each leftover batch's cost, so each of you can see what gets used and when. Food one of you logs or cooks can then be taken from the other's shelf and leftovers, and food one of you adds to their own shelf can clear a "ran out" line from the other's to-buy list. This lasts until either of you turns the merge off. A household member never sees your purchase history or your receipt memory, and sees entries from your food log only when you send them a meal.
Your safety in a household: joining a household, sharing a kitchen and sending a meal are always your own choice. Either of you can end them at any time without the other's agreement: remove a member on the Household screen, or turn off kitchen sharing with Stop sharing. Kitchen sharing stops straight away, and we do not send the other person a notification, though they will see that you are no longer in their household. Meals and recipes you have already sent stay with them, as described above. If someone is pressuring you to share, or you feel unsafe, you can also change your password and sign out of your other devices. In Australia, 1800RESPECT (1800 737 732, 1800respect.org.au) offers free, confidential support; in an emergency, call 000.
Purchase history (while "Track food spend" is on): when you save a scanned receipt, we keep a record of that shop so the App can show you what the food you eat costs: the store, branch, date and time, the total, any receipt-wide discount, the currency and the number of items the receipt says you bought. For each line you put on your shelf, we keep its text, quantity, price and any discount, and the food it became. Unticking a line marks it as not food: for that line we keep only that it is not food, its quantity and what it cost, never its text or what it was. Remove a line before saving and we keep nothing of it. Together, the branch, date and time show where and when you shopped. We do not keep card or payment details, loyalty or membership numbers, names (yours or a staff member's), addresses or phone numbers, or receipt and register numbers printed on a receipt. "Track food spend" is on by default, and you can turn it off at any time (see Section 7).
Receipt memory: for each receipt line you put on your shelf, the App remembers the line's text without its size or price, which food it became, at which shop, whether you chose that food yourself, when you first and last saved it, and, where it was worked out, how many grams one unit of it weighs, so the same line is recognised the next time you scan it. It remembers nothing of a line you untick. When you choose the food for a line yourself, and it is one of the App's own foods, a packaged product from the barcode database, or a community food someone else added, that choice also helps match the same line for other users: when someone scans that line, the App counts at that moment how many people chose each food for it, and how many of them at the same shop, counting only accounts at least 7 days old. Other users receive only those counts, never who made each choice, though a count can be as low as one, so someone who already knows you are the only user who shops somewhere could work out what you chose. You can stop your choices counting for other users in Settings → Consent & data (see Section 4). You can also ask us to delete your receipt memory at any time (see Section 12); your earlier choices then stop counting for other users.
Fitness data: workouts, exercises, routines, habits, and your completion history for them.
Profile and goals: your name; your date of birth (used to work out your age for your calorie targets and to confirm you are 18 or over, see Section 9); your height, sex (the App's "Gender" field) and activity level, and the weight and body-fat readings you log over time (used to calculate your calorie and macro targets and to show your trends); and the goals you set.
Reports: if you report a tag or other shared content, the report itself: what you reported, the reason you wrote, and the account that filed it. We keep it while your account exists so we can review it and act on it, and it is deleted with your account. If you report one of Avo's replies, the report also keeps that reply, the message you sent just before it and any note you add, which can include health information, while your account exists. A person at Hekato reads them to check the reply, and a photo is never part of a report (see Section 4).
Recipe photos (verified creators only): if you are a verified creator, you can add a photo of the dish to a recipe you have published. Your device re-encodes the picture before it is sent, which removes the metadata a phone stores with a photo (such as where and when it was taken, and the device); the original file is never uploaded. We check the photo before it is shown, so it stays private until we approve it; if we do not approve it, we tell you why.
Creators: creators join by invitation, or after asking us and being accepted. If we invite you, we use your name and the business email address you publish, for example on social media or your website: we create an account for that address and send it a sign-in link, and we create a private creator profile that holds only your name and a handle. Nobody else can see the profile until you agree in the App. We do not copy your recipes, posts or photos, and we add no recipes or other content to your profile: anything published there is what you publish yourself. If you decline in the App, we delete the profile and any payout details you gave us; the account stays yours until you delete it. If you do not answer, we delete the profile and any payout details you gave us one year after the invitation, together with the account and your email address if you never signed in. If you ask to become a creator, we keep the name, link, requested handle and note you send us; your request is emailed to us, and we keep it until you delete your account. As a creator you can add a bio, links and a profile picture; we check the picture before it is shown.
Creator payout details (paid creators only): if we invite you to be a paid creator, we need to know who to pay and how, before you can have a creator code. On the Payout details screen in Settings you give us your full legal name (your own, or your company's if your ABN belongs to a company), your postal address, the country where you live for tax (Australia or the United States) and, in Australia, your ABN; in the United States you instead confirm that you are not an Australian resident and do not carry on a business in Australia, and we record when you did. We check an ABN against the Australian Business Register and keep the name and status the register holds for it, whether it is registered for GST, and when we checked; the ABN goes to the register again before each payout we make to you. The register's name for the ABN must match the legal name you give. Your bank details (the account name and, in Australia, the BSB and account number, or in the United States the routing number, account number and account type) go straight to Wise, our payment provider, which holds them; we keep only Wise's reference for the account and the last 4 digits of the account number, and never the full numbers. The account name must match your legal name. Where Wise offers it, Wise also asks your bank whether the account is in that name, and if your bank says it is not, nothing is saved. We keep a record of each fee a subscriber's payment earns you (the amount, the plan, when it becomes payable and the payment it came from) and of each monthly payout: the amount, the currency, the last 4 digits of the account it went to, Wise's references for the transfer, and whether it was sent, failed or came back. If you are in the United States and your payouts in a calendar year would pass US$1,500, we pause them and we ask you for a Form W-9 by email; we keep the form with our tax records, outside the App, and record in the App only the date we received it. You see your fees and payouts in the App as counts and amounts, never who subscribed.
Voice: if you talk to Avo, your device's or browser's speech recognition turns what you say into text, and only the text reaches us. Avo's spoken replies are read aloud by your device or browser. Some devices and browsers do this on their maker's servers, under the maker's own privacy policy.
Calendar and scheduling data: day tags, calendar events, and routine schedules you create.
Avo conversations: what you write to Avo and its replies, kept so you can carry on a conversation and deleted 36 hours after its last message; a meal photo you send to Avo, kept privately for 36 hours after you send it (see below); and a record of each change Avo makes to your data for you, such as a meal it logs, with whether it succeeded, kept for 12 months.
Messages to us: what you write to us by email, such as a support request, a creator request or a request about your privacy, with your email address.
Your choices and settings: each consent you give or withdraw in the App, when, and which version of its wording you saw; your notification settings, such as quiet hours and when your daily summary arrives; and your other settings, such as your units.
Information the App works out: your calorie and macro targets, your trends and summaries, the tips Avo shows you and, if you agree to health inference, Avo's body-composition and fat-loss estimates. These are worked out from what you log.

We never read your device's location, and we do not collect your contacts. Beyond what you enter into the App, we collect technical data: your IP address and device or browser details, which reach our servers whenever the App connects to them; the error reports described in Section 5, and, only if you allow usage analytics, the usage events and feature checks described there; and, when you save your notification settings, your device's time zone and the push address your browser or phone gives us, with its keys and your device and browser type. Notifications to your browser are delivered through its maker's push service, for example Google, Apple or Mozilla, encrypted so that the push service cannot read them. We also keep a count of how much you use Avo and AI photo recognition each day, so we can apply the limits of your plan, and, for up to two hours, a scrambled (hashed) form of your IP address, used only to limit how often Avo can be called from one address.

We receive a photo only when you send one: a recipe photo or profile picture you upload as a creator (described above), or a photo of a meal, a nutrition label or a shop receipt you scan. Your device re-encodes a scanned photo before sending it, which removes the location and other details a phone stores with a photo. A meal or label scan is sent through our server to our AI provider to estimate the food in it; it is not published. A meal photo you send to Avo is kept privately for 36 hours after you send it, so you can see it in the chat and on the food you log, and Avo can look at it again when you ask. Only you can see it, and it is sent to our AI provider again only when Avo looks at it again. When the 36 hours are up it is deleted within the hour, as it is if you delete its chat or your account sooner. If you turn AI photo recognition off, any meal photo we are still keeping is deleted within the hour. Our server keeps no other meal photo, and no label or receipt photo. A receipt photo is sent the same way for our AI provider to read the store, items and prices on it. The photo shows everything printed on the receipt, which can include your name, a loyalty number or the last digits of your card, so our AI provider sees them while it reads the photo; we instruct it to leave them out of what it returns, and the App filters them out again before anything is saved. Any item names the App does not already recognise are then sent to our AI provider a second time, to match each one to a food. Our server discards a receipt photo once it has been read and never stores it; from a receipt we keep only what you save, as described above. What our AI provider may keep is described in Section 6.

How we collect it. We collect most of this information from you, when you enter it into the App or send it to us. We collect technical data automatically when the App connects to our servers. We also receive some information from others: from Google or Apple if you sign in with them; if you subscribe to Premium, from Apple or Google, through RevenueCat, whether your subscription is active; from other users, such as a meal a household member sends you or a report another user files about something you published; for creators we invite, the name and business email address they publish (see "Creators" above); and, for paid creators, from the Australian Business Register, the name and status it holds for your ABN and whether it is registered for GST, and from Wise, its reference for your bank account and, where Wise offers it, whether the name matched what your bank holds (see "Creator payout details" above). We hold it electronically, as Section 3 describes.

What you need to give us. No law requires you to give us personal information, and no law requires us to collect it. To use the App you need an account, which needs an email address or a Google or Apple account, and a password if you sign up with email; your date of birth, so we can confirm you are 18 or over (see Section 9); and your agreement to core tracking (see Section 4). Without these we cannot provide the App to you. Everything else is up to you. When you set up the App, it asks for a name to use in the App, which does not have to be your real name, and your height, weight, sex and activity level, but you can skip that step and add them later. Leaving something out affects only the feature that needs it: for example, without your height, weight, sex and activity level the App cannot work out your calorie and macro targets, and without AI photo recognition you log meals by hand instead. To be paid as a creator you need to give us the payout details described above; without them you can still be a creator, but you cannot have a creator code.

3. How your information is stored and protected

We store your account data in a cloud database operated by Supabase, hosted in the Sydney, Australia region. Data is encrypted in transit (HTTPS/TLS) and at rest. Row-Level Security policies on private tables mean the database itself refuses to return your private logs, profile, routines, workouts and calendar data to any other user's session. These rules apply to the App's users, not to our own server functions that run the features described in this Policy; Section 1 says when a person at Hekato looks at your data. Your kitchen and receipt memory are private in the same way, except as described in Section 2. Shared food definitions, such as ingredients, are community entries: any signed-in user can see them, but only the person who added an entry can change or remove it, and they can also ask us to remove it. A recipe is visible only to you unless you send it to a household member or publish it as a creator; a published recipe can be read by anyone on the web, including people without an Avocando account.

Tags a creator adds to a published recipe are public in the same way. Each tag appears on the recipe and on a public tag page (for example avocando.app/t/highprotein) listing the published recipes that carry it, which anyone can open without an account and which search engines may index. The text of a tag is also kept in a shared list of tags that search can offer, which does not record who added it. A report you file is visible only to you and to us, never to the person whose content you reported. We may withdraw a tag, which removes it from every recipe that carries it.

Complaints about published content. If you believe something published in the App copies your work, pretends to be you, or shows you or your personal information without your permission, email us at support@avocando.app with a link to it and what is wrong; you do not need an account. We review every complaint, may unpublish the content while we do, and tell the person who published it what we decided and why. For a copyright complaint, we may give that person your name and email address so they can respond to you, and we will tell you before we do. For any other complaint, we do not tell them who complained.

Anything you publish is public: anyone can see, copy or share it, and search engines may index it. Do not put anything in a published recipe, tag, bio or link that you do not want to be public.

If you are a creator, your creator page becomes public when you agree in the App to publish it; until then only you can see it. Anyone can then open it at its own address (for example avocando.app/c/yourhandle) without an account, and search engines may index it. It shows your handle, display name, bio, profile picture, links, whether you are verified, and the recipes you have published, together with how many people follow you and how many times other people have logged your published recipes. Each of these figures appears only once at least 5 people are behind it, and only as the step it has passed (5, 10, 25, 50, 100, 250 and so on); the count of logs counts each person at most once a day for each recipe and leaves out your own. A published recipe shows how many people have made, rated, saved or remixed it (made their own copy), each only once at least 5 people have done so and only in the same steps, and its average star rating once at least 5 people other than its creator have rated it. None of these figures shows who. If you follow a creator, log one of their recipes, or rate, save or remix a recipe, you count towards these figures in the same way.

How we protect your information. We protect your personal information with technical and organisational measures. Besides the encryption and Row-Level Security described above, which automated tests check, access to our production systems is limited to the people who need it, and changes reach the live App only through a controlled release. Before a release that makes larger changes to the database, or that follows a longer gap since the last release, we first rehearse it on a copy of the database with names, email addresses and anything you wrote in your own words removed. The copy stays with our database provider. We keep encrypted backups so that data can be restored if something goes wrong. When we no longer need personal information for any purpose described in this Policy, we delete it or de-identify it, as Section 7 describes.

No system is completely secure. If we have reasonable grounds to believe that a data breach involving your personal information is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme in the Privacy Act requires, and, where the GDPR or UK GDPR applies, we will notify the relevant data protection authority and, if that law requires it, you. If you live in the United States, we will also notify you, and where the law requires it the Federal Trade Commission, the media and your state's attorney general, by email to your account address and a notice in the App, within the time the Health Breach Notification Rule and your state's law allow.

4. Purposes and legal bases for processing

Wherever you live, we collect, hold, use and disclose your personal information only for the purposes described in this Policy, or where the law requires or allows it. If the GDPR or UK GDPR applies to you, the list below also shows the legal basis we rely on for each purpose.

We operate the App from Australia and do not currently direct it to the EEA or the UK; the App's interface languages are offered for the convenience of their speakers wherever they live. If you use the App from a place where the GDPR or UK GDPR nevertheless applies to our processing of your data, these are the legal bases we rely on:

Account, nutrition, fitness, profile, and calendar data: to provide the App you asked for (performance of a contract, Article 6(1)(b)).
Premium access and creator codes: to provide the App you asked for (performance of a contract, Article 6(1)(b)); showing a creator how many people have redeemed their code, which never shows who: our legitimate interest in running creator promotions (Article 6(1)(f)); keeping a record of a subscription after it ends: our legal obligations on tax and consumer records (Article 6(1)(c)) or, where the law that requires it is not EU or UK law, our legitimate interest in meeting it (Article 6(1)(f)).
Food logs, weight and body-fat readings, workouts, and anything else you enter that reveals something about your health: your explicit consent (Article 9(2)(a)), which you give when you set up the App by turning on "Core tracking (required)", whose wording reads: "Your food, weight, body fat and workouts, used to run and test the tracker, with help from our hosting, email and error-report providers. Withdraw by deleting your account." This applies together with Article 6(1)(b) above. You can withdraw it at any time by deleting your account (see Section 7).
Kitchen data and your own receipt memory: to provide the App you asked for (performance of a contract, Article 6(1)(b)).
Purchase history, and the prices and costs in your kitchen (while "Track food spend" is on): our legitimate interest in showing you what the food you eat costs (Article 6(1)(f)). You can stop it at any time by turning off "Track food spend", which deletes it.
Shared receipt matching (counting the foods you choose for receipt lines towards matching the same lines for other users): our legitimate interest in recognising receipt items accurately for everyone who scans them (Article 6(1)(f)). You can switch it off in Settings → Consent & data → Use my receipt choices to improve matching for everyone: your choices, both earlier ones and any you make while it is off, stop counting for other users straight away. Your own receipts still use all of them. Switching it back on lets all your remembered choices count again, including those you made while it was off. You can also object by email instead (see Section 12), and we will switch it off for you. Separately, you can ask us to delete your receipt memory (see Section 12): your choices so far then stop counting permanently. Receipts you save after that are remembered again, and count for other users unless the setting is off.
AI photo recognition (sending the meal, nutrition-label and receipt photos you scan to Google Gemini or OpenAI in the United States (Section 6), keeping a meal photo you send to Avo for 36 hours so you and Avo can see it again, and matching receipt items to foods): your consent (Article 6(1)(a)), which you give in the App before your first photo is sent, or with "Agree and start" the first time you open Avo. You can withdraw it at any time by turning off Settings → Consent & data → AI photo recognition; no photo is sent while it is off. If you turn it off, any meal photo we are still keeping is deleted within the hour.
Avo, the AI assistant, and recipe import (sending what you write to Avo, the profile details, logs and trends Avo looks up to answer you, a recipe link or text you paste, and the names of foods to match for an import to Google Gemini or OpenAI in the United States; see Section 6): your consent (Article 6(1)(a) and, for the health information in it, Article 9(2)(a)), which you give with "Agree and start" the first time you open Avo, or with "Agree" when you first import a recipe. Avo relies on this consent when it reads your logs to answer you. You can withdraw it at any time by turning off Settings → Consent & data → Avo, the AI assistant, after which Avo and recipe import stop. The matching of receipt lines stays under AI photo recognition.
Health inference (Avo estimating body-composition and fat-loss trends from your logged food, weight and workouts, sent to OpenAI or Google Gemini in the United States): your explicit consent (Article 9(2)(a)), paired with Article 6(1)(a). Avo does this only after you agree, and you can withdraw it at any time by turning off Settings → Privacy → Health inference.
Usage analytics, including, in the web app, the approximate location worked out from your IP address (see Section 5): your consent (Article 6(1)(a)), which you can give when you set up the App or later. You can withdraw it at any time by turning off Settings → Consent & data → Usage analytics (optional); no usage events are recorded while it is off.
Error monitoring: our legitimate interest in keeping the App secure and working (Article 6(1)(f)).
Testing that updates to the App work correctly before we release them. Before a release that makes larger changes to the database, or that follows a longer gap since the last release, we check it on a temporary copy of our database. First, email addresses, names and anything you wrote in your own words are replaced or removed, and dates are shifted. Your account identifier and the figures you logged, such as weights and calories, stay as they are, because the update has to be tested on real data, so we still treat the copy as your personal information. Where the GDPR applies, the health information in it is covered by your explicit consent to core tracking above. The copy stays with our database provider in Sydney, Australia, and is deleted within 7 days. Legal basis: our legitimate interest in releasing updates that do not break the App or lose your data (Article 6(1)(f) GDPR).
Publishing as a creator and sharing with your household (your creator page, the recipes you publish with their tags and photos, and the meals and recipes you send to a household member): to provide the feature you chose (performance of a contract, Article 6(1)(b)).
Follower, made-it, rating, save and remix figures, which never show who: our legitimate interest in showing how popular a creator or recipe is (Article 6(1)(f)). You can object by email (see Section 12).
Reviewing photos, creator requests and reports about shared content: our legitimate interest in keeping public content safe and lawful (Article 6(1)(f)).
Reported Avo replies (keeping the reply you report, the message you sent just before it and any note you add, and a person at Hekato reading them to check the reply): your explicit consent, which you give by pressing "Agree and send" on the Report sheet after it shows you what we receive (Article 6(1)(a) and, for any health information in them, Article 9(2)(a)). You can withdraw it at any time by emailing us (see Section 12); we then delete the report, unless a complaint, dispute or legal claim needs it (see Section 7). Withdrawing does not undo a review we have already made. Deleting your account deletes every report you filed.
Checking that sign-ups and sign-ins come from a person: our legitimate interest in protecting the App and its users (Article 6(1)(f)).
Technical data (your IP address and device or browser details when the App connects to our servers, and update checks by the mobile app): to provide the App (performance of a contract, Article 6(1)(b)) and our legitimate interest in keeping it secure (Article 6(1)(f)).
Offering one-tap sign-in with Google in the web app (see Section 2): our legitimate interest in offering a quick way to sign in (Article 6(1)(f)).
Asking to become a creator: to take the steps you ask for before you become a creator (Article 6(1)(b)).
Answering messages you send us: to provide the App (Article 6(1)(b)) or, for anything else you write about, our legitimate interest in answering you (Article 6(1)(f)); requests to exercise your rights: our legal obligations (Article 6(1)(c)).
Complying with the law, and establishing, exercising or defending legal claims (see Section 6, "Courts, regulators and the police"): our legal obligations (Article 6(1)(c)) or, where no law requires it, our legitimate interest in protecting our rights and those of our users (Article 6(1)(f)).
A sale or merger of the business (see Section 6): our legitimate interest in being able to sell or reorganise our business (Article 6(1)(f)).
Inviting a creator, using the name and business email address you publish: our legitimate interest in inviting creators (Article 6(1)(f)). If you decline, we delete your creator profile (see Section 2).
Creator payouts (your payout details, checking your ABN on the Australian Business Register and the account name with Wise, paying you through Wise, and the records of fees and payouts): to perform our creator agreement with you (Article 6(1)(b)); keeping those records after the last payout, and a Form W-9: our legal obligations on tax and company records (Article 6(1)(c)) or, where the law that requires it is not EU or UK law, our legitimate interest in meeting it (Article 6(1)(f)).

Automated decisions. Avo's estimates, such as the calories in a meal or a trend in your weight, are suggestions for you to review: a meal Avo logs for you can be changed or deleted like any other entry. They are not a substitute for professional advice (see Section 1, "Health disclaimer", of our Terms). The App also makes some routine decisions automatically, using the personal information named here:

your date of birth decides whether you can create an account (see Section 9);
your IP address and browser details, checked by Cloudflare, decide whether a sign-up or sign-in is accepted as coming from a person;
your plan decides whether you can use Avo and AI photo recognition, and how much you have used them that day decides whether you can use them again before your daily allowance renews; your plan also decides how much of your history the App shows; and
your logged food, weight, height and goal decide whether the App and Avo show weight-loss figures: if your intake looks very low, your weight is low for your height, or your weight is falling while your goal is to gain, they leave those figures out and suggest that talking to a qualified professional can help.

Apart from these, we do not use a computer program to make decisions about you that could reasonably be expected to significantly affect your rights or interests, and none of the App's decisions has legal or similarly significant effects on you. If you think one of these decisions has gone wrong for you, contact us (see Section 12) and a person will review it.

Figures from many users. Figures worked out from many users' activity, such as how many people have saved a recipe, help rank recipes in the App and appear publicly as Section 3 describes; they never show who. We do not try to re-identify anyone from such figures or from information we have de-identified.

5. Error monitoring and usage analytics

We use Sentry to capture technical error reports (such as stack traces, the app version and browser details), timing measurements from a sample of sessions, and reports of anything the web app's security settings blocked, so we can diagnose and fix bugs and keep the App fast. These reports are meant to describe the error, not your nutrition, fitness or health data, but some of that data can reach them: an error message can occasionally include it. Each report also carries a short trail of what the App did just before the error. Before a report is sent, the App removes from that trail the outcome of its safety checks on your logged food and weight, and the names and barcodes of foods it can recognise there, but it cannot promise to catch every detail. Once you are signed in, a report carries your account ID, so we can tell which account an error affected. Error reports are set up not to include your IP address, and they are kept for 30 days.

If you allow usage analytics, when you set up the App or later in Settings → Consent & data, we use PostHog to record how the App is used, such as the screens you open and the features you use, linked to your account. Events describe how you use a feature, such as the kind of food entry you logged or how many exercises a workout had, never the foods, names, amounts, weights or other figures you entered, and no event says which tip the App showed you or what its safety checks concluded. In the web app, each event also records the address of the page you were on, and your analytics record keeps the site you first came from and the campaign tags in the link you followed, such as its source, medium and campaign name. Advertising click identifiers in the App's addresses are removed before anything is sent. We record only the events we have chosen to measure, never what you type or what is on your screen, and we never record your screen. In the web app, our analytics provider uses your IP address to work out your approximate location (country, region, city, postcode, time zone and approximate coordinates) and then discards the IP address; it is not stored. The mobile app sends no location lookup. We use the location to understand how and where the App is used. It is not your device's location, which we never read, and we never use it for advertising. Analytics events are kept for up to 12 months, then deleted automatically. While usage analytics is on, the App also asks PostHog which features are switched on, and PostHog receives your IP address and account ID with that request.

If you do not allow usage analytics, the App does not contact PostHog at all. If you turn it off later, the App stops recording usage events and stops asking PostHog which features are switched on, and the web app deletes the analytics identifiers PostHog kept in your browser. On another device where you are signed in, this takes effect when the App there next loads your account, which it does each time it starts; until then, it may still send PostHog one page view and one feature check.

Cookies and storage on your device. The App does not use cookies for advertising. In your browser, the web app keeps a few small items in local storage to keep you signed in and to remember your settings and choices on that device, such as your theme and an unsent draft, and keeps a copy of its own files so it loads quickly. Only if you allow usage analytics does it also keep PostHog's identifiers, in a cookie and in local storage (see above). On the sign-in screen, Google's sign-in service may also store a cookie in your browser when it offers one-tap sign-in. Cloudflare, which checks that sign-ups and sign-ins come from a person, may set a cookie for that purpose. The mobile app keeps your sign-in and settings on your phone in the same way. Clearing your browser's site data removes all of this and signs you out.

6. Sharing of information

We do not sell your personal information, and we do not share it with advertisers or for marketing purposes. We do not use it to send you direct marketing: the emails and notifications we send are about your account and the features you use. Your data is processed on our behalf by the following service providers, each acting as our processor:

Supabase: authentication, database and file storage (Sydney, Australia), and our server functions, such as the one that passes your Avo messages and scanned photos to our AI provider. A server function runs in the Supabase region nearest to where you are, so when you use the App from outside Australia it can handle your request in another country.
Cloudflare: hosting the web app and our websites, served from Cloudflare's data centres around the world; checking that sign-ups and sign-ins come from a person, not a bot (Turnstile), which sees your IP address and browser details; and storing a copy of our database backups, encrypted at rest, which may be held outside Australia.
Sentry: error monitoring (United States; see Section 5).
Google (Gemini) and OpenAI: the AI providers we use (United States). We use both, and either may do any of the following; "our AI provider" in this Policy means whichever of them does. They write Avo's replies from what you ask and the profile details, food logs and trends Avo looks up to answer you; read a recipe link or text you paste to import it; read the meal, nutrition-label and receipt photos you scan, only after you turn on AI photo recognition in the App, and split a scanned meal into its separate foods; match the foods you log through Avo, import in a recipe or scan on a receipt to foods in the App; and estimate body-composition and fat-loss trends, only after you agree to health inference (see Section 4).
PostHog: product usage analytics that help us understand how the App is used, and the feature checks described in Section 5, only if you allow usage analytics (United States).
Resend: delivery of account emails, such as sign-up confirmation, password reset and creator invitations, and of creator requests to us. It processes your email address and the content of any creator request in the United States.
Google (Workspace): our email, including messages you send to support@avocando.app and creator requests emailed to us, which Google may store in the United States and other countries.
Expo: delivering updates to the mobile app (United States). When the mobile app checks for an update, Expo receives your IP address and basic details about the app and your device.
RevenueCat: confirming subscriptions bought through Apple or Google, so your Premium works on every device you sign in to (United States). It receives your account identifier and the store's record of your subscription, not your payment details.

Under our agreements with them, our AI providers do not use what we send them to train their models, and we do not use your personal information to train AI models. Each may keep what we send it, including a photo, for a limited period to detect and prevent abuse of its service.

Open Food Facts. When you scan a barcode or search for a food, the App also looks it up in the Open Food Facts database directly from your device, so Open Food Facts receives your IP address and the barcode or the words you searched for. It is not our processor, and its own privacy policy applies.

Videos on published recipes. A published recipe can link to a video its creator posted on YouTube, TikTok or Instagram. When you open a recipe with a YouTube video, the App loads its preview image from YouTube, which receives your IP address; the video itself loads from YouTube, in its privacy-enhanced mode, only if you choose to play it. The App uses YouTube's player (a YouTube API Service): YouTube's Terms of Service (youtube.com/t/terms) and Google's Privacy Policy (policies.google.com/privacy) apply when a video plays. A TikTok or Instagram video opens on that site instead.

App stores. If you download the mobile app from Apple's App Store or Google Play, Apple or Google handles the download, and any Premium purchase, under its own terms and privacy policy, and tells us through RevenueCat whether your subscription is active.

Creator payouts. If you are a paid creator, we give Wise (Wise Australia Pty Ltd and the other companies in the Wise group) your legal name, your postal address, whether you are paid as a person or as a company, and your bank details, so that it can hold your bank account as a recipient and pay you; each payout tells it the amount and our payout reference. Wise is a regulated payments company, not our processor: it handles this information under its own privacy policy, and it may hold it in the United Kingdom, the United States and the other countries where it operates. Where Wise offers it, Wise also asks your bank whether the account is in the name you gave, and tells us only the result. We give the Australian Business Register, which the Australian Taxation Office runs, your ABN, to read the public record it holds for it; we send it nothing else about you.

Courts, regulators and the police. We give personal information to a court, a regulator or the police only when the law requires or allows it, for example under a warrant, subpoena or court order, or when we believe it is needed to lessen a serious threat to someone's life, health or safety.

If the business changes hands. If Hekato or the App is sold to, or merged with, another business, your data may pass to the new owner as part of that sale or merger, and this Policy keeps applying to it.

How we protect international transfers. Some of our providers process data outside Australia, the EEA and the UK, for example in the United States. For users in the EEA and the UK, we protect these transfers with the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum or, where a recipient is certified, the EU-US and UK-US Data Privacy Framework. You can request a copy of the safeguards we rely on using the contact details in Section 12. For users in Australia, before we disclose personal information to a service provider outside Australia, we take reasonable steps, including through our contract with it, to make sure it handles the information in line with the Australian Privacy Principles, and we remain accountable under the Privacy Act for how it does so. The countries outside Australia where your personal information is likely to be held or processed are the United States; France, where Open Food Facts is based; the United Kingdom, where Wise is based and where it may hold the details of creators it pays for us; and the other countries where Cloudflare, Google's email service, Supabase's server functions and Wise operate.

7. Data retention and deletion

Delete your Avocando account

In the Avocando app or web app: Settings, Danger zone, Delete account. This deletes your account and private data at once. If you can no longer sign in, email support@avocando.app from the address on your account and we will delete it for you within 30 days. What remains afterwards, and for how long, is described below.

Your data is kept for as long as your account exists. You can permanently delete your account and the private data associated with it at any time from Settings → Danger zone → Delete account. This immediately removes your private data from our cloud database and signs you out; shared food definitions you created may remain in the community library, with the record of who created them removed. Meals and recipes a household member has accepted from you are their own copies and are not deleted with your account.

Purchase history is kept only while "Track food spend" is on. Turning it off in Settings → Kitchen asks you to confirm, then deletes your purchase history and every price and cost in your own kitchen, including prices you entered yourself, and stops keeping new ones; costs already recorded on a merged household member's rows are theirs and stay, even where they were worked out from your prices. Turning it back on starts again from nothing; we keep only the date and time you last turned it back on, so the App does not show earlier food as missing a price. Receipt memory is kept separately; this switch does not delete it, and it keeps the shops you have scanned receipts from. You can ask us to delete it (see Section 12). Receipt memory is deleted when you delete your account, together with your purchase history and kitchen data, and your choices then stop counting towards matching receipt lines for other users. Your kitchen data, purchase history and receipt memory are all included in the App's data export.

An approved recipe photo is public on its recipe, like the recipe itself, until you replace it, delete the recipe, or delete your account; its files are then removed within the hour, though a copy cached by our content delivery network can still be served for up to one day. We also keep private copies of an approved photo until one of those same things happens, including while the recipe is not published and after your creator agreement is withdrawn or your creator page is deleted, so the photo can be shown again without a new review if the recipe is published again; they are then removed within the hour, and you can ask us to delete them sooner (see Section 12). A photo waiting for review, or one we did not approve, is never shown publicly; if we do not approve it, its files are deleted within the hour, and the record of why it was not approved is kept for 90 days so you can see the reason.

A creator's profile picture is kept until you remove or replace it, or delete your creator page or your account. If your creator agreement is withdrawn, its public copies are removed within the hour and private copies are kept, so it can be shown again without a new review if you agree again. A picture we do not approve is deleted within the hour, and the record of why is kept for 90 days.

Avo conversations are deleted 36 hours after their last message, and the record of changes Avo made for you is kept for 12 months. A meal photo you send to Avo is kept privately for 36 hours after you send it, then deleted within the hour, as it is if you delete its chat or your account sooner. If you turn AI photo recognition off, any meal photo we are still keeping is deleted within the hour. Label and receipt photos are not kept.

Backups are deleted automatically 30 days after they are made, so data you delete leaves our backups within 30 days. Temporary test copies of the database have names, email addresses and anything you wrote in your own words removed before anyone uses them, and are deleted within 7 days. Error reports are deleted after 30 days, and analytics events after 12 months. These periods also apply after you delete your account: copies in backups, error reports and analytics events are not deleted with your account, but on these schedules.

When you delete a single entry, it disappears from the App straight away. A deleted food log entry, workout or calendar tag is kept out of sight for 90 days, so it can be recovered if something goes wrong, and is then deleted. Other entries you delete, such as a routine, a habit or a kitchen item, are kept out of sight until you delete your account, so the history that refers to them, such as your habit completions and your kitchen's history, stays complete. A recipe you delete is kept out of sight for 90 days and is then deleted.

If you had a Premium subscription, we keep a record of it (the store's transaction identifiers, the plan, the dates, the price and any creator code used) for 5 years after it ends, even after you delete your account, to meet our tax and consumer law record-keeping duties. It is kept separate from your health data and is then deleted. We keep the record of each payment you made for it (see Section 2) for 7 years after the payment, because a creator's fee rests on it.

If you are a paid creator, we keep your payout details, and the record of each fee and each payout, for 7 years after the last payout we make to you, even after you delete your account, to meet our tax and company record-keeping duties; a Form W-9 you give us is kept with our tax records for the same period. If we have never made a payout to you and owe you nothing, we delete your payout details when you delete your account. Your bank details stay with Wise under its own privacy policy. If you delete your account while we owe you fees, we still pay them at the next monthly payout after they become payable, as long as your payout details were complete and nothing else holds the payout, such as an ABN that is no longer active; your creator code stops earning when your account is deleted. After you delete your account you can no longer see or change your payout details in the App; email us instead (see Section 12). Your payout details and payout records are not in the App's data export; ask us for a copy (see Section 12).

If a complaint, dispute or legal claim involves your account, we keep the information that relates to it, even after you delete your account, until the matter is resolved and for any longer period the law requires, and then delete it. We keep only what that matter needs.

Notifications the App sends you, including your daily summary, are kept for 180 days. The record of each consent you give or withdraw in the App, with when and which wording you saw, is kept while your account exists, so we can show what you agreed to. Emails you send us, including creator requests and privacy requests, are kept for as long as we need them to deal with what you asked and to keep a record of how we dealt with it, and are then deleted.

If you are a creator, deleting your account also deletes your creator page and every recipe you published, with its tags and photo, and they stop being shown straight away, though a copy cached by our content delivery network can still be served for up to one day, and a search engine may show an old result until it next visits the page. Another person's own copy of your recipe, such as one a household member accepted or a remix, stays with them, without its link to yours. Your ratings, saves and follows are deleted too, so you stop counting towards those figures. We cannot remove copies other people made outside the App.

8. Your rights

Depending on where you live (for example, in the United States, the EEA, the UK or Australia), you can:

Access a copy of the data we hold about you (the App also provides a full data export).
Correct data that is inaccurate.
Delete your data (see Section 7).
Export or port your data in a machine-readable format.
Restrict certain processing.
Object to processing we base on our legitimate interests (see Section 4). For shared receipt matching you can do this yourself in Settings → Consent & data, or by email (see Section 12), and we stop counting your choices for other users without asking for a reason.
Withdraw consent you have given, at any time: Avo, the AI assistant, AI photo recognition and usage analytics in Settings → Consent & data, health inference in Settings → Privacy, a report you made about one of Avo's replies by email (see Section 12), and core tracking by deleting your account. Withdrawing consent does not affect processing carried out before you withdrew it.

To exercise any of these rights, contact us using the details in Section 12. You can correct most of your information yourself in the App, including your payout details on the Payout details screen, where new bank details replace the old ones with Wise. We do not charge you for making a request or for giving you access. We may first need to confirm the request comes from you, usually by asking you to write from the email address on your account. We reply to a request within 30 days; if the GDPR or UK GDPR applies and a request is complex, we may take up to two further months, and we will tell you why within the first 30 days. If we refuse a request, in whole or in part, we tell you why in writing and how you can complain. If we do not correct information you asked us to correct, you can ask us to keep a statement with it saying you believe it is wrong, and we will. You also have the right to lodge a complaint with a data protection authority: in the EEA, your local supervisory authority; in the UK, the Information Commissioner's Office (ico.org.uk); in Australia, the Office of the Australian Information Commissioner (oaic.gov.au).

How we handle a complaint. If you are unhappy with how we have handled your personal information, email us at support@avocando.app and tell us what happened. We will acknowledge your complaint, look into it, and reply to you in writing within 30 days with what we found and what we will do about it. If you are not satisfied with our reply, or have not had one within 30 days, you can complain to the Office of the Australian Information Commissioner, or to the data protection authority where you live.

9. Children

The App is for adults aged 18 and over. When you create an account, we ask for your date of birth to confirm this. If the date you enter shows you are under 18, no account is created; if one was already made, for example through Google or Apple, it is deleted, at once, or by a daily clean-up within two days, and the date you entered is not kept. We do not knowingly collect personal information from anyone under 18. If you are under 18 and have created an account, or you are a parent or guardian and believe a child under 18 has given us personal information, email us at support@avocando.app and we will delete it.

10. Changes to this Policy

We may update this Policy from time to time, and each update changes the "Last updated" date above. If we make a material change, we will tell you before it takes effect, in the App or by email, and ask for your consent where the change needs it. We keep earlier versions of this Policy and will send you one on request.

11. United States residents

This section adds to the rest of this Policy if you live in the United States. Our Consumer Health Data Privacy Policy, at avocando.app/health-data-privacy, describes your consumer health data rights under the laws of Washington, Nevada and Connecticut.

We do not sell personal information, we do not share it for targeted advertising, and we do not use it for profiling that produces legal or similarly significant effects on you, so there is nothing to opt out of and the App does not need to recognise an opt-out preference signal. We do not collect, use or sell your personal data to train large language models or other AI models. We process your health information only with your consent, given separately from our Terms, and only as needed for the features you choose (see Section 4).

Whatever state you live in, you can ask us to confirm whether we process your personal data and access it; correct it; delete it; receive a copy in a portable format; and withdraw any consent you have given. You can export your data and delete your account yourself in the App, in Settings, or email support@avocando.app from the address on your account. We respond within 30 days, and in any case within the 45 days US state laws allow, free of charge; if a request is complex we may take up to 45 more days and will tell you why within the first 45. If we refuse a request, we tell you why in writing. You can appeal by replying with "Appeal" in the subject; we decide appeals within 45 days and, if we deny yours, we tell you how to complain to your state's attorney general, including the online complaint route of the Connecticut Attorney General where that applies.

We contact you about your account, including any security incident affecting your data, by email to your account address and by a notice in the App. If a security breach affects your health information, we will notify you, and where the law requires it the Federal Trade Commission, the media and your state's attorney general, within the time the FTC's Health Breach Notification Rule and your state's law allow.

We do not knowingly collect personal information from children under 13, or from anyone under 18 (see Section 9).

12. Who we are and how to contact us

Hekato Pty Ltd (ACN 702 732 152), an Australian company, operates the App, is responsible for your personal information and handles it in line with the Privacy Act and the Australian Privacy Principles; where the GDPR or UK GDPR applies, Hekato is the controller of your personal information. This Policy is published at avocando.app/privacy, where you can read it free of charge; if you would like a copy in another form, such as a PDF, email us and we will send one free of charge. Our Privacy Officer handles every privacy question, request and complaint; we have not appointed a data protection officer, because the GDPR does not require us to. Questions about this Policy, or requests to exercise your rights, can be sent to support@avocando.app. We contact you about your account, including any security incident affecting your data, by email to your account address and by a notice in the App.

← Back to Avocando