What to look for in a privacy-respecting nutrition app

I build a nutrition tracker, so read this with that in mind. The checklist below works on any health app, and I have tried to write it so it stays useful if you choose something other than mine. Where GreaseFit answers a question badly, I have said so. A buyer's guide that scores its author perfectly is not a buyer's guide.

Food logs are unusually revealing. They know when you eat, how much, whether you drink, whether you stopped logging for three weeks in February. Weight history on top of that is a medical record in all but name. It is worth ten minutes of due diligence.

Who pays for it?

This is the first question, because it tells you who the customer is. If an app is free, shows no ads and sells nothing, the money comes from somewhere, and that somewhere is usually you, in a form you never explicitly agreed to.

Look for a clear answer: a subscription, a one-time purchase, a donation model, or ads. Vagueness here is the warning sign.

GreaseFit: the free tier is the whole tracker. Barcode scanning, custom foods, recipes you build by hand, workouts, water, weight and every nutrient it tracks are free. There is a paid tier called GreaseFit Supporter, weekly or yearly. It changes two things: the AI quota goes from five credits a day to twenty-five, and it unlocks the AI recipe scan, which reads a recipe page and creates the recipe and its foods for you. That scan is the most expensive call the app makes, which is the honest reason it is not free. Every new account gets thirty days to use it. Nothing else sits behind the paywall. The people who pay for Supporter fund the app for everyone else.

The honest footnote: that is a small business model, and you should factor that into how long you expect any independent app to be around. More about who builds it is on the about page.

Is there an ad SDK in the build?

This is not the same question as "does it show me ads". An advertising SDK can sit in an app collecting identifiers without ever rendering a banner. The tell is the store privacy label. If it lists advertising, tracking or "data linked to you" for marketing, an SDK is there regardless of what the interface looks like.

Ask specifically whether the app collects your advertising ID, the IDFA on iOS or its Android equivalent. That identifier is what lets a food log be joined to the rest of your online life.

GreaseFit: no ads and no ad SDKs, and ad-ID collection is explicitly disabled in the analytics configuration. You cannot verify that from outside, which is why the general advice above matters more than my say-so.

What analytics are collected, and can you switch them off?

No ads does not mean no telemetry. Nearly every app measures something. The useful questions are what, why, and whether there is a real in-app opt-out rather than a link to an OS-level setting.

GreaseFit: Firebase Analytics and Firebase Crashlytics are both present. Crashlytics tells me when something broke and on which device. Analytics tells me which screens people actually use, which is how a one-person project decides what to build next. Ad-ID collection is off. There is an opt-out toggle in your profile, and it works.

I could claim zero analytics, and it would not be true. The privacy policy also notes these services may process data outside the EU under Standard Contractual Clauses. That is a real caveat, not a footnote to bury.

Can you get your data out?

Export is the difference between a tracker and a hostage situation. Ask what format you get, whether it is self-serve or an email request, and how long the request takes. An app confident in its product does not make leaving hard.

GreaseFit: there is no one-click export button today. Under GDPR you can request access to your data by emailing support, and I will comply, but a self-serve export is a genuine gap. I would rather name it than let you discover it on your way out.

Coming the other way is easier: a Lose It export imports in a single upload, described on the Lose It alternatives page. That is the only importer that exists so far.

Can you actually delete it?

Deletion should mean the account and the data behind it, not hiding the login screen. Ask whether deletion is available in the app or requires an email, what the timeline is, and what is retained afterwards for legal or billing reasons.

GreaseFit: account deletion is supported in the app. You can also send an erasure request by email, and the privacy policy commits to acting without undue delay and within 28 days, extendable by up to two months for complex or repeated requests. Deletion is irreversible.

The point worth copying is not the timeline, it is that it is written in the policy rather than in a blog post. Hold every app to that standard, including this one.

Where does the data live, and under whose law?

Hosting location decides which law applies and who can compel access. Look for a named country and ideally a named provider. "Secure servers" means nothing. Check whether sub-processors are listed too, because the analytics and email vendors are part of the answer.

GreaseFit: the privacy policy names it. Servers in Amsterdam, Netherlands, on DigitalOcean. I am one developer in Amsterdam, so GDPR is not a compliance posture adopted for marketing. It is the law I live under. The exception, again, is Firebase, which may process outside the EU.

In transit everything is encrypted to modern standards. Sessions use signed, short-lived tokens, and passwords are never stored in a readable form. The specific algorithms and libraries are not published, which is deliberate.

What happens on the device itself?

Worth asking, and worth being suspicious of the answer, because "encrypted at rest" is the most abused phrase in app marketing.

GreaseFit: on Android, locally cached credentials get an extra layer of protection from the platform. That is Android-specific. I am not going to inflate it into a blanket claim covering every device, because the iOS side does not have the equivalent in place yet.

While we are being blunt about limitations: GreaseFit requires an account and a connection. There is no offline mode and no local database, so your log lives on the server rather than on your phone. For some people that is a dealbreaker, and it should be. What the app does and does not do is listed on the features page.

What happens if the company is acquired?

Privacy policies survive acquisitions about as well as ice survives August. Almost every policy contains a clause permitting data to transfer in a merger or sale. Read it, expect to find one, then ask the more useful question: does this app have an asset worth buying that consists of your data?

An ad-funded tracker with a large user base has one. A subscription app with no advertising business has much less.

GreaseFit: it is one person's project, and there is no ad business here to sell. But nobody can honestly promise anything about years from now, and you should distrust anyone who does. The practical protection is the same in every case: you can delete the account.

The condensed checklist

Ask any health app these eight things:

1. Who pays for it, and what does the paid tier actually change?
2. Does the store privacy label mention advertising or tracking?
3. Does it collect your advertising ID?
4. What analytics exist, and is there a real opt-out inside the app?
5. Can you export your data yourself, and in what format?
6. Can you delete your account, and is the timeline written down?
7. Which country hosts it, and which sub-processors are named?
8. What does the policy say about a merger or sale?

If an app cannot answer six of those from its own website, that is the answer.

More questions of this kind are covered on the FAQ. If the answers above suit you, creating an account is free.