Privacy Policy

1. Scope and controller

This Policy explains how data is processed through ogur.app and the Ogur mobile app for iOS and Android (“Service”). The controller (“Controller”, “we”) is George Babayan, individual developer; address: 305 Adams Ave, State College, PA 16803-3606, United States; privacy email: privacy@ogur.app.

The Service is intended for users aged 16 or older and provides nutrition and wellness tracking. Users aged 16–17 can keep a diary and receive general nutrition information. Automatic calorie, macronutrient and weight-change targets are available from age 18; users under 18 should discuss individual eating and weight-change plans with a health care professional. The Service is not a medical device and does not provide diagnosis or treatment.

2. Data we process

Depending on the features used, we process:

1. Account information: email address, name (if the sign-in profile has one), account identifier, sign-in method and session data. Sign-in uses a one-time code sent to the email address; there are no passwords. For accounts created through Yandex sign-in before 1 October 2026, we keep the name, email address, date of birth and Yandex account identifier that Yandex passed at that time. The mobile app can also be used without signing in, as a guest: after the consent screen the Service creates a guest account without an email address or name, with a random identifier, the date of birth and the consents, and every feature except purchases in Ogur’s room shop works with it as with an account. Together with the guest account we process the app installation identifier: a random identifier the Service uses to limit how many guest accounts, recognitions and chat messages with Ogur one installation gets per day. When a guest signs in, the guest account becomes a regular account with the same identifier and data. If the chosen sign-in method already has an account, the user signs in to it and the guest account is deleted with all its data, as when an account is deleted; the data is not merged.
2. Profile and wellness information: date of birth and age, sex selection, height, current and target weight, goal, activity level, pace of weight change, daily weight and wellbeing records.
3. Diary information: meals, foods and portions, calories, macronutrients, the user’s own foods, weekly summaries and progress. Searches in the food database are processed when made and not stored.
4. User content: text describing a meal, food and receipt photos and voice recordings voluntarily submitted for recognition, and the transcript of a voice recording; messages the user writes in the chat with Ogur, Ogur’s replies, meal options suggested in the chat and links to diary entries created from the chat.
5. Technical data: IP address, device and browser type, OS/app version, language, device time zone, diagnostic logs and security events.
6. Notification data, if the user allows notifications: the push notification token of the device, the notification settings (which reminders are on, how many a day, quiet hours) and a delivery log (type of reminder, time, delivery result and whether it was opened; without the text).
7. Product analytics: usage events, viewed pages and screens, referral source, a pseudonymous identifier and approximate location (country and city derived from the IP address) (Section 5, PostHog). Health parameters, meal texts, chat messages, texts of notifications, names and emails are not sent to analytics.
8. Support requests and consent records.
9. Apple Health data on iPhone, if the user allows access in the system dialog: step count and active energy for the day and by day, and the names of the devices that recorded them (for example, iPhone or Apple Watch). This data is only read and processed by the app on the user’s device: it is not sent to the Controller, the Service’s server, language models, the chat with Ogur, analytics or any third party. The app writes only workouts to Apple Health, and only if the user turned this on in the Workouts screen: a workout (functional strength training) with its start and end time, without calories, heart rate or other measurements. The app writes it on the device; nothing from Apple Health is sent to the Controller or any third party. Active energy is an estimate by Apple Watch or iPhone and does not change the calorie target; it is not shown to users aged 16–17. Access can be changed at any time in the Health app.
10. Food at home, if the user keeps this list in the app: the names of the foods, how many grams were bought and how many are left, how a food was added (from a receipt, by voice or manually), the purchase date, a link to the recognized receipt it was added from, and the basic foods (salt, oil, spices) the user switched off. From a receipt, only the items the user marked go to the list, with name and weight, without prices or the purchase total.
11. Website statistics collected by Yandex Metrica (on ogur.app only, not in the app): IP address, device, browser and operating system type, screen size, language, referral source and campaign tags, viewed pages, clicks, scrolling and pointer movement, from which the Webvisor service plays back a recording of the visit. The website has no input forms; account, profile, diary, chat and health data are not sent to the counter (Section 5, Yandex Metrica).
12. Advertising and reminder measurement data collected by AppMetrica (in the mobile app; the Service’s server sends the notification events): the AppMetrica device identifier, on Android also the Google advertising ID (GAID), device type and model, OS and app version, language, IP address, install source (the campaign tags of the Google Play link), the install and app launches, and usage events: registration (the sign-in method: email, Google, Yandex ID or Apple), the first and every later saved meal entry (how it was logged: photo, text, voice, receipt, chat or a repeated meal; every entry also carries the meal: breakfast, lunch, dinner or snack, whether it was saved within 2 hours after opening a notification and the type of that notification), the first goal chosen (only the goal type: lose weight, maintain weight or gain mass), the first permission for notifications, the first and every later chat message with Ogur that received a reply (only whether it was typed or picked from a suggestion, without the message text), meal-logging streaks of 3, 7 and 14 days, the first purchase for points in Ogur’s room shop (the item and its price in points), and notification events, one per notification: a notification was sent; a notification was not sent because the user is in the control group of the reminders experiment (10% of new users receive no reminders); Apple Push Notification Service or Firebase Cloud Messaging accepted the notification (this does not confirm that the phone showed it); the user opened the notification. Notification events carry only the Service’s internal notification number (a random identifier that is not linked to the account in AppMetrica), the notification type, the step of the reminder chain, Ogur’s personality and the experiment group, without the text of the notification. The Service’s server sends notification events to AppMetrica and links them to the device by the hash of the AppMetrica device identifier, which is stored in the Service’s database next to the device’s push notification token (Section 7). Every event carries the platform: Android or iOS. On iOS the advertising identifier (IDFA) is not collected and no tracking permission is requested. On Android the advertising ID can be reset or deleted in the device settings. The AppMetrica device identifier is also saved in product analytics to link an install from an ad with use of the Service. The account identifier, name, email, what was eaten and its calories, photos, voice, chat texts, texts of notifications, weight, height, age, weight and calorie targets and health data are not sent to AppMetrica (Section 5, AppMetrica).
13. Weekly reviews and Ogur’s notes: once a week the Service sums up the diary for the week (the review cards, Ogur’s first chat message about the week, a task for the next week and how it went) and keeps short notes about the user’s eating habits and preferences, such as “has oatmeal for breakfast” or “prefers praise to criticism”. Weight, diagnoses, medication and calories are not written into notes. The user sees the notes in the app on the “Ogur remembers” screen and can delete any of them.
14. Workouts, if the user does them: the date, the chosen plan and level, quiet mode, how many exercises out of how many were done, the start and end time, the answer to “How did it go?”, a mark that the intro before the first workout was shown, and the trainers chosen and bought for points. Workouts are picked by rules without language models, and this data is not sent to any model; product analytics receives only the facts that the screen was opened, a workout started and finished, an answer was given and a trainer was bought, without minutes or calories.
15. The day card on the lock screen: on iPhone, the Live Activity tokens (the token for the morning start of the card and the token of each card) with the app identifier, the environment and the link scheme, a log of card sends (date, kind of send, whether it was delivered, error) and the dates when the user swiped the card away. To show and update the card, the Service’s server sends the streak, the daily calorie target and the calories for breakfast, lunch, dinner and snack, without dish names, through Apple Push Notification Service. On Android the app draws the card and the widget on the device and sends nothing to the server for them.

The user’s device stores: on the website, analytics markers with the PostHog identifier and the Yandex Metrica cookies (cookies and local storage); in the mobile app, sign-in session data, including that of a guest account, and the app installation identifier in the device’s secure storage, analytics markers (including AppMetrica) and the daily step goal, as well as the latest day card for the notification and widgets and a mark of consent to write workouts to Apple Health. On Android a copy of the guest account session data and of the installation identifier is also kept in the Block Store of Google Play services on the same device, so that the guest can continue after reinstalling the app; the Service does not turn on backup of this copy to the Google cloud. The copy of the guest account session data is deleted on sign-in, on sign-out and when the guest deletes their data. Apple Health values are not stored on the device or in iCloud: they are kept only in the app’s memory while it is open and are cleared on sign-out.

We do not request precise location, contacts, medical records or payment credentials unless a clearly disclosed feature is introduced and this Policy is updated first. Apple Health access is requested only after the user chooses to connect it, and only to read steps and active energy; permission to write workouts is requested only after the user turns on workout logging.

3. Purposes and legal bases

We use data to create and secure accounts; provide approximate nutrition calculations; recognize submitted images, audio and text; maintain diaries and progress; keep the list of food at home and suggest meals from it in the chat with Ogur; show steps and active energy from Apple Health next to nutrition on the user’s device; personalize suggestions and replies in the chat with Ogur; send reminders from Ogur as push notifications; provide support; prevent abuse, including limiting the number of guest accounts, recognitions and chat messages per app installation per day; comply with law; measure the app’s advertising (which advertising campaign brought an install, a registration, meal entries and the other events in item 12 of Section 2); measure whether reminders help keep the diary (compared with a control group that is sent no reminders); and improve the Service using aggregated statistics, product analytics and website visit statistics, including measuring the effectiveness of advertising.

Reminders are sent only after the user allows notifications in the system dialog of the device. They can be switched off or limited in the app settings at any time. The Service sends no more than two reminders a day and none during the user’s quiet hours (22:00–08:00 by default). The text of a reminder is composed on the Service’s server from the diary (for example, how much protein is left until the daily target or how many days of the week have entries) and the chosen personality of Ogur; for users aged 16–17 reminders use the gentle tone and never mention calories.

Legal bases include performance of the Terms, separate informed consent, legal obligations and other bases permitted by applicable law. Sensitive wellness or health-related data is processed only after separate affirmative consent; the consent wording is published at https://ogur.app/consent/en. Marketing consent, if introduced, is optional and separate.

4. AI processing

A meal description typed by the user, a voice recording of a meal and a photo of a meal or a receipt are sent to the Service’s server and from there to language models and a speech recognition model through the AI model gateway operated by the contest organizers. The gateway and the models run in Russia. The models used are deepseek-v4.1-flash (meal descriptions, voice transcripts and the chat with Ogur), qwen3.6-35b-a3b (meal and receipt photos) and whisper-large-v3 (speech recognition). For recognition, the models receive only what needs to be recognized: the text, the image or the sound, and, to pin down the foods, the names and calories of matching items from the food database, including the user’s own foods; without the account identifier, name, email or profile.

In the chat with Ogur, the user’s message is sent to the Service’s server and from there to the deepseek-v4.1-flash model through the same gateway. So that the reply takes the user’s goal, day and week into account, the model receives together with the message: up to 12 recent chat messages, the goal with the starting and target weight and the pace of weight change, the daily calorie and macronutrient targets, what was eaten today (meals and their times, dish names, calories and macronutrients), a summary of the last 7 days (the number of entries, calories and protein per day, the names of foods that repeated and on how many days), Ogur’s notes and the headline and task of the latest weekly review, favourite and usual foods, the names of the food at home and of the basic foods the user did not switch off, food preferences including allergies, the chosen personality of Ogur and whether the user is 16–17; without the account identifier, name or email. Messages about illness, medication, pregnancy or breastfeeding and about signs of an eating disorder that the server recognizes in the text are not sent to the model: the server answers them with a prepared text. Such messages are not included in the chat history used for later replies. If the model itself recognizes such a topic, the message has already been sent to it, but it is likewise not included in the chat history used for later replies.

The weekly review is written by the Claude Opus 4.8 model through the same gateway, once a week, without the user’s involvement. The model receives: the week’s facts calculated by the server (days with entries, average calories, how often the daily target was met, protein, dinner times, the most frequent and new foods, how the previous task went), the week’s diary (time and meal, food names, calories and protein), sex and name for addressing the user, the goal with the starting and target weight, the daily calorie and protein targets, the reviews of the three previous weeks, Ogur’s current notes and the user’s messages in the chat with Ogur during that week; without the account identifier or email. Steps, active calories, data from the Health app and weigh-ins are not sent to the model. For users aged 16–17 the review contains no calories or targets. If there are fewer than three days with entries or the model does not answer, the review is put together from a template without the model. 10% of users do not receive weekly reviews: this is the control group used to check whether the feature helps.

When the user writes in the chat with Ogur what they ate (“I ate…”), the text of the message is broken down into foods and portions in the same way as typed text and is kept in the diary entry as the meal description.

A voice recording is converted to text, and the recognized text is broken down into foods and portions in the same way as typed text. The recording is not stored: the server deletes it right after recognition, and the transcript is kept in the diary entry. Before recognition, a photo is downscaled and its metadata (EXIF, including location) is removed. A photo of a meal or a receipt is deleted from the server automatically within 24 hours after upload: every half hour the server deletes photos older than 23 hours.

The list of food at home can be dictated. The voice recording is likewise converted to text by the whisper-large-v3 model, and the deepseek-v4.1-flash model picks out the names of the foods and their weight from the transcript; without the account identifier, name, email or profile. The recording is deleted right after recognition, and the transcript is shown to the user for review and is not stored on the server: only the foods the user confirms go to the list. A receipt for the list is recognized in the same way as a receipt for a meal entry.

Outputs are probabilistic and may be inaccurate. The Service does not make decisions producing legal or similarly significant effects. The Controller does not use identifiable user data to train public general-purpose models.

5. Processors and recipients

We disclose only necessary data to providers acting on our instructions:

• Selectel (Moscow, Russia) — hosting of the website and server, PostgreSQL database, object storage, backups and technical logs: account, profile and diary data, the food at home, the chat history with Ogur (kept for no longer than 30 days), technical data, meal and receipt photos (kept for no longer than 24 hours).
• AI model gateway of the contest organizers (Russia) — forwards requests to the language and speech recognition models. For recognition: the meal description text or voice transcript, including a dictated list of food at home, the meal or receipt photo, the voice recording, the names of matching food database items; without the account identifier, name, email or profile. For the chat with Ogur: the user’s message, recent chat messages and the data about the goal, the meals of the day and of the last 7 days, preferences and food at home listed in Section 4; without the account identifier, name or email. For the chat with Ogur also Ogur’s notes and the headline and task of the latest weekly review. For the weekly review: the data listed in Section 4; without the account identifier or email.
• Auth0 (Okta, United States; tenant in the US region) — sign-in and account management: email address, name, account identifier, sign-in records (IP address, device, time); for accounts created through Yandex sign-in before 1 October 2026, also the date of birth passed by Yandex.
• Resend (United States) — delivery of the emails with sign-in codes that Auth0 sends: email address and message text.
• Cloudflare (United States) — DNS for ogur.app and forwarding of email sent to @ogur.app addresses: support emails pass through Cloudflare.
• PostHog (EU region, Frankfurt, Germany) — product analytics for the website, mobile app and server: funnel and usage events (for example, a page opened, a questionnaire step completed, a meal entry saved, the outcome of a recognition, a reminder sent or opened), page addresses and screen names, referral source and UTM tags, a pseudonymous identifier (the account identifier after sign-in), device type, browser, OS, language, app version and IP address, which PostHog uses to estimate approximate location (country, city). Health parameters, meal texts, chat messages, texts of notifications, names, emails and other contact details are not sent to PostHog.
• Yandex Metrica (Yandex LLC, Russia) — website visit statistics and recordings of visits (Webvisor): the data in item 11 of Section 2. Account, profile, diary, chat and health data are not sent to Yandex Metrica; the counter runs only on the website.
• AppMetrica (Yandex LLC, Russia) — measurement of the mobile app’s advertising and reminders: the data in item 12 of Section 2; the Service’s server sends the notification events. AppMetrica determines which advertising campaign brought an install and the events in item 12 of Section 2, and passes the facts of the install and of these events to the Service’s advertising accounts in Yandex Direct and VK Ads (Russia); notification events are not passed to the advertising accounts. On iOS installs are not matched with advertising networks, the advertising identifier is not collected and the user is not tracked across apps and websites of other companies. The account identifier, name, email, what was eaten and its calories, photos, voice, chat texts, texts of notifications, weight, height, age, weight and calorie targets and health data are not sent to AppMetrica.
• Expo (Expo, Inc., United States) — delivery of push notifications: the push notification token of the device, the type and text of the reminder. Expo passes the notification to Apple Push Notification Service (Apple, United States) for iOS devices and to Firebase Cloud Messaging (Google, United States) for Android devices, which deliver it to the device. These providers receive no account identifier, name or email.
• Apple Push Notification Service (Apple Inc., United States) — on iPhone the Service’s server sends the day card directly: the Live Activity token and the card data listed in Section 2, item 15 (streak, daily calorie target, calories per meal). Apple receives no account identifier, name or email.

We do not sell personal data or use health/wellness data for advertising or unrelated profiling. Apple Health data is not disclosed to anyone and is not used for advertising, marketing or data mining.

6. International transfers

Data is stored on Selectel servers in Moscow, Russia, together with the backups, and recognition and the chat with Ogur run in Russia. Sign-in data is processed by Auth0 and Resend in the United States, emails to @ogur.app addresses pass through Cloudflare in the United States, product analytics is processed by PostHog in the European Union, website visit statistics are processed by Yandex Metrica in Russia, measurement of the app’s advertising is processed by AppMetrica in Russia, and push notifications and the iPhone day card are delivered through Expo, Apple and Google in the United States.

7. Retention

• Account, profile and diary: while active; removal from the primary database occurs within 30 days after a verified request.
• Guest account and its data: while the guest uses the Service. A guest account with no activity for 180 days is deleted automatically with all its data, as when an account is deleted.
• App installation identifier: on the server together with the guest account; the daily limit counters kept by it (how many guest accounts were created, how many recognitions and chat messages in a day) are kept for 2 days and deleted automatically, including after the guest account is deleted. On the device: while the app is installed; on Android the copy in Block Store may remain after the app is reinstalled on the same device.
• Diary/content: until deleted by the user or with the account.
• Meal and receipt photos: deleted automatically within 24 hours after upload.
• Voice recordings: deleted right after recognition; the transcript is kept in the diary entry.
• Recognition log (the typed meal description, the voice transcript, the recognized items and the edits made to them): 90 days to improve recognition, then deleted automatically; deleted immediately with the account.
• Chat history with Ogur: 30 days, then deleted automatically; the user can clear it earlier, and it is deleted immediately with the account. A chat message that logs a meal is kept in the diary entry as the meal description until the entry is deleted.
• Weekly reviews: while the account exists; deleted together with it. Ogur’s message about the review in the chat is kept like the rest of the chat history, 30 days.
• Ogur’s notes: until the user deletes them and while the account exists. When a note is deleted, its text is erased at once; a service string of its words in lower case without punctuation is kept so that Ogur does not write the same note again, and is deleted together with the account.
• Food at home: while the food is on the list and the account exists. A food the user removed from the list or marked as used up is deleted automatically after 90 days; the whole list is deleted immediately with the account. The link to a recognized receipt disappears with the recognition log after 90 days, while the food stays on the list.
• Push notification token of the device: until the user signs out on that device, deletes the account or the delivery provider reports that the device is no longer registered.
• Notification delivery log (type, time, delivery result, opened or not; without the text): 90 days, then deleted automatically; deleted immediately with the account.
• Ordinary technical logs: 30 days; security logs: 12 months without the content of entries, photos or audio.
• Website statistics in Yandex Metrica, including Webvisor recordings: for the periods Yandex sets for the service; they are not stored in the Service’s database.
• AppMetrica data: for the periods Yandex sets for the service. Of this data, the Service’s database stores only the hash of the AppMetrica device identifier: next to the device’s push notification token, where it is deleted together with the token (when the user signs out on that device or the token is no longer valid), and in the notification delivery log, where it is deleted together with the log entry after 90 days; it is deleted immediately with the account. The AppMetrica device identifier in product analytics is deleted together with the account.
• Closed support requests: 12 months.
• Consent records (version, date and time): while the account exists; deleted together with it.
• Record of an account deletion request (account identifier, time of the request and of the deletion): kept indefinitely as evidence that the request was fulfilled.
• Workouts: while the account exists; deleted together with it.
• Day card tokens: the token of a card until the card ends and no longer than the next day; the morning start token until the user signs out on that device, deletes the account or Apple reports it is no longer valid. The card send log and swipe dates: 30 days, then deleted automatically; deleted immediately with the account.
• Apple Health data: not stored; kept in the app’s memory while it is open and cleared on sign-out.
• Backups: overwritten within 35 days after removal from the primary database.

Longer retention is limited to legal obligations, disputes and fraud prevention. Data is then deleted or irreversibly anonymized.

8. Security and rights

We use access controls, encryption in transit, logging, backups and component updates. No method guarantees absolute security. Users may request information, access, a copy, correction, restriction or deletion, withdraw consent and object or complain where applicable by contacting privacy@ogur.app. We may verify identity to protect the account.

The account can be deleted in the app under Profile; if signing in is not possible, a deletion request is sent from the account email address to privacy@ogur.app. A guest deletes their data under Profile or on the new consent screen with «Удалить мои данные» (Delete my data), without an email code. The procedure is described at https://ogur.app/delete-account/en. Uninstalling the app deletes neither the account nor the guest’s data.

9. Changes and contact

The current date and version appear above. Material changes are announced in the Service and renewed consent is requested where required. The Controller’s details are listed in Section 1; privacy: privacy@ogur.app; support: support@ogur.app; security: security@ogur.app.