Your data, in plain words

Who we are

Akari is operated by Akari GbR, Singapurstraße 4, 20457 Hamburg, Germany, represented by its partners Jan Pfeiffer and Rafael Polutta. You can reach us by email at support@joinakari.com. Akari GbR is the controller within the meaning of the GDPR for the processing described in Part B.

Apple Health

With your permission, Akari reads the categories you select for health, activity, sleep, nutrition and body measurements. When you enter supported information in Akari, the app can save it to Apple Health only once you have granted the corresponding permission.

Google Health

When you connect Google Health, Akari requests read-only access to activity and fitness, health metrics and measurements, and sleep. This can include data from Fitbit, Pixel Watch and other sources available through Google Health. The data goes directly from Google to the app on your iPhone, not through any server of ours.

Data accessed. Akari reads Google user data only when you connect Google Health, and only with read-only access to three categories: activity and fitness, health metrics and measurements, and sleep. Akari never requests permission to write, change or delete anything in your Google account.

How it is used. Google user data is shown to you in Akari and used on your iPhone to fill gaps left by Apple Health and to calculate your readiness and health age. It is not used for any other purpose.

Sharing. Google user data is not transferred to anyone: not to us, not to service providers, not to advertisers and not to any AI or analytics service. It leaves your iPhone only if you share something from the app yourself.

Protection. Google user data is kept in the app’s own storage on your iPhone and protected by the iPhone’s encryption. The access token is kept in the iOS keychain. Akari has no server that stores health data.

Retention and deletion. Google user data stays on your iPhone as long as Google Health is connected. When you disconnect Google Health in Akari, the Google data is removed from the app and Akari’s access is revoked with Google; when you delete the app, the Google data is removed. The access token is kept in the iOS keychain, which iOS does not clear when an app is deleted; Akari removes it the first time it starts after a reinstall. You can also revoke Akari’s access at any time at myaccount.google.com/permissions.

Akari’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Your entries

Nutrition and water entries, goals, settings and other information you add yourself are stored by Akari only on your iPhone.

How Akari uses this information

Akari uses the information you share to show your daily health overview, calculate trends and goals, generate explanations and reveal connections between activity, recovery, sleep, nutrition and body measurements. Apple Health remains the primary source. Google Health is used to fill suitable gaps and to avoid duplicate entries where possible.

Location and weather

If you allow location access, Akari uses your approximate location while the app is open to show relevant weather information. To do this, the app requests the weather directly from Apple’s weather service (WeatherKit) and sends your approximate location to Apple. We don’t receive your location, and Akari doesn’t use it for advertising. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by allowing location access in iOS. According to Apple, it uses the location only for the weather forecast, doesn’t associate it with data that identifies you and doesn’t track it across requests.

So that the water display reacts to how you hold your iPhone, Akari also uses the motion sensors while the app is open. This data is used only on your iPhone and is not stored. Reading the sensors is necessary for this display (Section 25(2) No. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act). You can turn off motion effects at any time in Akari’s Settings.

Your consent

Before Akari processes health data, we ask for your explicit consent in the app. We do this as a precaution, even to the extent that we are not responsible for the processing on your iPhone (Art. 6(1)(a) and Art. 9(2)(a) GDPR). You can withdraw it at any time with effect for the future, in Akari’s Settings under “Privacy”, or by removing the permissions in iOS Settings or the Health app, disconnecting Google Health in Akari or deleting the app.

Changing permissions and deleting data

You can change Apple Health permissions in iOS Settings or the Health app. When you disconnect Google Health in Akari, the Google data is removed from the app and Akari’s access is revoked with Google. You can also revoke Akari’s access in your Google account permissions.

You can remove information stored locally in Akari by deleting entries in the app, where available, or by uninstalling the app. Information already saved in Apple Health remains under your control there.

Meals and meal photos

You can log a meal by typing or saying it, taking a photo or choosing one. If you speak, you use the iOS dictation feature, for which Apple is responsible; Akari only receives the finished text. Data is sent only when you log a meal. Akari still reads packaging and nutrition labels on your iPhone; only a meal you type, say or photograph leaves it, so that Akari can work out what you ate.

What is sent: the words you typed or said, the photo if there is one (reduced in size and without metadata such as the location where it was taken), the foods from Akari’s catalogue that the app found as possible matches, the app’s language and version, a few words about foods that your iPhone’s image recognition found in the photo, and a random identifier. None of this contains Apple Health data, an account or your location. A photo shows everything in the picture, so keep people and documents out of it.

Your meal goes to our server, which runs on Cloudflare. The server passes it to Anthropic’s Claude API, which reads it and sends back to the app what the meal contains. The legal basis is your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), which we ask for in the app before you send your first meal.

Neither your meal nor the response is stored on our server. To limit how many meals can be sent per day, our server keeps daily counters under a one-way hash of the random identifier and your IP address, created with a random value that is deleted at the end of the day. The IP address is not stored, the counters expire after two days, and nothing else from the request is kept. We base the counters on our legitimate interest in preventing misuse and overloading of our server (Art. 6(1)(f) GDPR). The app stores the random identifier in your iPhone’s keychain; it remains there even if you delete the app, so that the daily limit cannot be bypassed by reinstalling. The legal basis for storing it on your iPhone is your consent to AI meal recognition (Section 25(1) TDDDG). If you withdraw this consent in Akari’s Settings, the app deletes the identifier. If you only delete the app, the identifier remains in the keychain; to remove it, withdraw your consent in Akari’s Settings before deleting the app.

Anthropic processes your meal under its Commercial Terms, which don’t allow Anthropic to use it to train models. By default, Anthropic deletes what was sent and the response within 30 days. Anthropic keeps them longer, for up to two years, only if its safety systems flag a request as violating its usage policies, or if the law requires it. In this case, too, Anthropic acts as our processor. Anthropic receives neither your IP address nor any identifier from you. You can find details on Anthropic’s privacy pages.

Food search and barcodes

When you search for foods, the app queries Open Food Facts, an open food database run by the non-profit association Open Food Facts in France, through our server in addition to its own database on your iPhone. It sends a scanned barcode there the same way if it can’t find it in its own database. Our server passes on only your search term or the barcode. Open Food Facts receives neither your IP address nor an identifier, an account or health data. Our server doesn’t store the requests. The legal basis is our legitimate interest in showing you nutritional values for packaged foods (Art. 6(1)(f) GDPR).

Updating the food database

Once a day, the app checks whether there is a new version of its food database and downloads it if so. The files are hosted by our service provider Cloudflare in the EU. Cloudflare receives your IP address and technical information such as the app and iOS version, but no identifier and no health data. Cloudflare stores this data only as long as necessary for delivery and protection against attacks; we don’t store it ourselves. The legal basis is our legitimate interest in keeping the food database up to date (Art. 6(1)(f) GDPR).

Food reports

If a recognised food looks wrong, or right, you can send us a food report from the app. It is sent only when you tap send. Reports are the part of Akari that deliberately leaves your iPhone: they reach our server so that we can improve how Akari recognises food.

A report contains your rating and the reasons you chose, your comment if you write one, what you typed or said, the recognised foods with amounts and nutritional values, anything that wasn’t recognised, a scanned barcode if there is one, and the app’s language, region and version. It contains neither your name nor an account, your Apple Health data or your location, unless you write something like that in your comment. The legal basis is your explicit consent, which you give by tapping “Agree and send” (Art. 6(1)(a) and Art. 9(2)(a) GDPR).

To protect against misuse, the app attaches a random identifier that exists only for food reports; our server stores only a one-way hash of it and uses it to limit how many reports an installation can send per day (Art. 6(1)(f) GDPR, our legitimate interest in preventing misuse). The app stores the identifier on your iPhone until you delete the app; the legal basis for storing it is your consent given with “Agree and send” (Section 25(1) TDDDG). Our server doesn’t store IP addresses. Reports are kept by our hosting provider Cloudflare and read only by us in our review tool. We delete each report as soon as we have used it to improve food recognition, and no later than 12 months after receipt. If you want a report deleted sooner, write to support@joinakari.com with the date and what you reported.

Visiting this website

The pages of joinakari.com are provided by our service provider Cloudflare. Cloudflare processes your IP address and the information your browser sends with each page request in order to deliver the page to you and protect it against attacks. Cloudflare stores this data only as long as necessary for this; we don’t store your IP address ourselves. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

To count visits, our server records, when delivering the page, which page was requested and which website or campaign you came from, if any; Cloudflare adds the country your connection comes from. No script runs on your device for this. Based on the language your browser sends, the server also redirects you to the matching language version.

To tell visitors apart without cookies, our server combines your IP address and browser information with a random value that changes daily and keeps only a short one-way hash. The IP address is not stored, and each day’s random value is deleted once the day is over. Until then, the hash is pseudonymous personal data; afterwards, it can neither be linked to you nor connected across days. We delete visit data after 24 months. Nothing is stored on your device for counting, and nothing is passed on to advertising or analytics companies. The legal basis is our legitimate interest in measuring how our website is used (Art. 6(1)(f) GDPR). If your browser sends a “Global Privacy Control” or “Do Not Track” signal, we don’t count your visit.

If you switch the language, colour theme or light/dark mode on the website, your browser saves your choice in local storage (localStorage) so that it is kept for your next visit. This happens only when you switch yourself and is necessary for this function (Section 25(2) No. 2 TDDDG). We don’t receive these settings. You can delete them at any time in your browser settings.

When you write to us

When you write to us by email or through the contact form on our website, we process your email address and the content of your message to answer your request (Art. 6(1)(f) GDPR; for requests about your rights, Art. 6(1)(c) GDPR). We delete the correspondence once your request has been dealt with and no statutory retention obligations apply. We receive and store emails through Apple’s iCloud Mail. Apple uses its own and third-party data centres for this, including in the USA. According to Apple, it bases transfers to the USA on the European Commission’s standard contractual clauses. Messages from the contact form are stored on our server at Cloudflare in the EU until we have answered them, and deleted 30 days after that, at the latest 12 months after they were sent. Please send us only what we need for your request and no information about your health.

Service providers and transfers to the USA

For the app, website and server, we use two service providers that work on our behalf. Cloudflare runs this website and our server, which passes on the meals you log, forwards search requests to Open Food Facts, receives food reports and counts website visits, and hosts the app’s food database. Anthropic reads the meals. Neither receives Apple Health data or Google user data, and both may use what they receive only to provide their service to us, never for advertising. For our mailbox, we also use Apple’s iCloud Mail (see “When you write to us”).

Our contractual partner for the AI analysis is Anthropic Ireland, Limited, Ireland. The analysis itself takes place outside the EU, in particular in the USA, and Anthropic stores what was sent and the response there for the period stated above. Cloudflare, Inc. is based in the USA; the databases for food reports, counters and visits are located in the EU, while our server runs on Cloudflare’s global network, so requests may also be processed outside the EU. Both process your data on our behalf under a data processing agreement (Art. 28 GDPR). For Anthropic, transfers to third countries are safeguarded by the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). For Cloudflare, we rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework; if the certification lapses, the standard contractual clauses apply. You can request a copy of the standard contractual clauses at support@joinakari.com.

Sharing with third parties

We don’t sell data and we don’t create advertising profiles. We share information with third parties if we are legally required to, for example by order of a court or law enforcement authority (Art. 6(1)(c) GDPR). To investigate and prevent fraud or misuse of our service, we share information to the extent necessary with law enforcement authorities and our legal advisers; the legal basis is our legitimate interest in protecting the service and its users (Art. 6(1)(f) GDPR).

Downloading from the App Store

When you download Akari, Apple processes data such as your Apple Account, the time of the download and, where applicable, payment data. Apple alone is responsible for this; we don’t receive any data that identifies you. The same applies to in-app purchases and subscriptions: Apple handles the payment, and the app only learns from Apple whether a subscription is active. You can find details in Apple’s Privacy Policy. For the app on the App Store, we receive only aggregated figures from Apple that don’t allow any conclusions about you. If you take part in our beta test via TestFlight, Apple shows us information about your participation in App Store Connect, such as your device, iOS version and the number of your sessions and crashes, and, if we invited you by email, your name and email address. If you send us feedback or a crash report via TestFlight, we also see your comment, a screenshot or the crash report where applicable, and technical information about your device, such as battery level, mobile carrier, time zone and free storage. We use this information only to improve Akari (Art. 6(1)(f) GDPR) and delete feedback as soon as we have reviewed it, and no later than after 12 months. We see the other information about your participation for as long as you take part in the beta test or until we remove you as a tester.

Your rights

You have the right of access to your data (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR) and to data portability (Art. 20 GDPR). To exercise them, write to support@joinakari.com. Because you don’t have an Akari account, we can only identify data on our server if you help us, for example with the date and content of a food report (Art. 11(2) GDPR).

Where we process data based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). The easiest way is in Akari’s Settings under “Privacy” or in iOS Settings. We act on a withdrawal by email to support@joinakari.com for all data on our server, such as food reports already sent; without an account, however, we can’t change the setting on your iPhone for you. Withdrawal doesn’t affect the lawfulness of processing carried out before it.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information.

Your right to object

Where we process data based on our legitimate interest (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). This applies in particular to the delivery of the website, counting website visits, the daily counters for food reports and meals, the search at Open Food Facts, updating the food database, handling your emails and sharing to prevent fraud or misuse. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. To object, write to support@joinakari.com.

Security, children and changes

Akari uses the platform’s security features and limits access to the information required for the app’s health features. No system is completely secure, but we protect your data and keep the amount of data that leaves your device as small as possible.

Akari is not intended for people under 16. We may update this privacy policy as Akari changes. The date at the top will then be updated; we will inform you of material changes in the app or on this website.

Contact

You can send questions about privacy or about access to Google Health to support@joinakari.com.