Last updated · 12 September 2026

Privacy.

Plain version: we collect the minimum we need to run the app, store it in Europe, and never sell it. Full version below.

1 · Who we are

Tanin is a meal-planning app for iPhone. The controller of your personal data is:

• Controller. Mathwares by Moody, an eenmanszaak (sole proprietorship) under Dutch law, registered at Monicahof 8, 3513 CX Utrecht, the Netherlands. KvK 42060152. VAT NL005463685B88.
• Contact for privacy questions. privacy@gettanin.app.
• Support. support@gettanin.app · gettanin.app/support. Both are referenced by the shipping app: the Profile row "Write to us" composes a mail to that address, and opens that page instead when no installed app handles mail.
• Data protection officer. None appointed. A DPO is not required at our scale (GDPR Art. 37).

This policy covers the Tanin iOS app and the Tanin backend. It does not cover Apple's own services, which Apple runs as its own controller — see §6.

2 · The short version

• You sign in with Apple. We never see or store a password.
• Your health details are processed only with your explicit consent, and you can withdraw that consent inside the app at any time.
• All of your data is stored in the EU.
• Meal text is sent to Anthropic so it can be read into ingredients and nutrition. Nothing we send trains a model.
• Analytics are off until you switch them on.
• We sell nothing, we show no advertising, and the app carries no third-party tracking SDK.
• You can export everything, and you can delete your account, from the Profile screen.
• Every nutrition figure in Tanin is an estimate, not medical advice.

3 · What we process, why, and on what legal basis

3.1 Account

We do not operate email-and-password sign-in. Those endpoints are disabled on our servers.

3.2 Health and profile data — special category, Art. 9

Date of birth, biological sex, height, weight, target weight, goal, approach, activity level, pace, daily water goal, your nutrient reference set (including a pregnancy or breastfeeding set, if you choose one), and your weight history over time.

• Purpose. Calculating your daily targets, composing meal plans, and showing your progress.
• Legal basis. Art. 9(2)(a) — your explicit consent, together with Art. 6(1)(b).
• How the consent is taken. A dedicated step at the end of onboarding, which names the categories, states the purpose, states that the data is stored in the EU, and offers accept and decline with equal prominence — same size, same weight, same colour. Nothing is pre-ticked. If you decline, we keep nothing you entered and you are signed out.
• What is recorded. An append-only ledger row per decision — the consent type, whether it was granted, the policy version, where you made the choice (onboarding, re-prompt, settings) and the timestamp. Your decisions are part of your data export.

3.3 Apple Health — optional, read-only

If you allow it during onboarding, Tanin reads four values from Apple Health to pre-fill the onboarding form: date of birth, biological sex, height and body mass. Apple Health asks for this permission separately from the consent described in §3.2, and you can refuse it and still use every part of the app.

Afterwards, Tanin keeps reading one of them — your weight. If you allowed Apple Health, Tanin reads new body-mass readings each time you open the app, so your targets and your plan follow your progress without you typing anything. This is the same purpose and the same legal basis as §3.2 — your explicit consent to us processing your health data — at a different cadence. Specifically:

• It happens only while the app is open. Tanin has no background access to Apple Health and asks iOS for none.
• It reads body mass only. The other three values are read once, for the onboarding pre-fill.
• You can turn it off at any time, in Profile → Read weight from Apple Health. Turning it off stops the reading; it does not delete anything already recorded.
• If you have not consented to us processing your health data, or you withdraw that consent, Tanin does not read from Apple Health at all — not even onto your own device.

And, as before:

• Tanin writes nothing back to Apple Health.
• Health data read this way is used only for your profile, your targets and your plan. Once you keep those values, they are your profile data (§3.2).
• Health data is never used for advertising, never sold, and never shared with a third party for their own purposes.
• Apple Health is not a paid feature and is not gated by membership.

Updated 12 September 2026: the ongoing weight read described above was switched on with this version of the policy. Until then Apple Health was read once, during onboarding, and this section said so.

3.4 Meal content

Meal names, ingredients with amounts and units, per-ingredient nutrition, recipe text, an optional photo, the meal types you assign, favourites, and the record of when you ate what. Derived from these: your daily totals, your streak of tracked days, and — for Patron members — your nutrient marker coverage.

• Purpose. The product itself.
• Legal basis. Art. 6(1)(b). Where a meal log feeds a health figure, §3.2's consent applies to that processing.

3.5 Meal-extraction cache

When a meal name is analysed for the first time, the resulting ingredient list is stored in a cache shared across all accounts, keyed on the meal name, so that the next person who adds the same dish gets an instant answer instead of a new analysis. The cached row notes which account triggered the first extraction; that link is severed if the account is deleted. The cache holds the dish name and its ingredients — not your log, your amounts, your photo or your profile.

3.6 Subscription state

Your membership tier, status, renewal or expiry date, trial state, and Apple's transaction identifiers for your purchases.

• We never see your payment details. Apple takes the payment and tells us only whether a subscription is active.
• Legal basis. Art. 6(1)(b), and Art. 6(1)(c) for the invoicing and bookkeeping records Dutch law requires us to keep.

3.7 Usage analytics — consent, and off by default

Analytics are off unless you turn them on, in onboarding or later in Profile. When they are on, the app records screen views, taps, feature use, navigation between tabs, error names, and API timings, together with a session record.

The session record carries, in full:

• the app version, the device model (for example "iPhone17,1") and the iOS version;
• your device language and region setting (locale);
• whether you have dark mode on;
• your membership tier (complimentary, Member or Patron);
• the age of your account in days;
• whether you have finished onboarding.

That is the whole list, and it is the same list declared in the app's privacy manifest (PrivacyInfo.xcprivacy) and in the App Store privacy label.

• Search text is discarded before sending; only the number of results is recorded.
• No meal content, no profile values and no health figures are sent as analytics.
• Analytics go to our own EU servers. There is no third-party analytics or advertising SDK in the app.
• Legal basis. Art. 6(1)(a) — your consent. Switching it off in Profile stops the collection and clears the queue on your device.

3.8 Technical and security records

Request logs (endpoint, method, status, timestamp, IP address, user agent, and request metadata), security events (such as a failed sign-in), and sign-in attempt records keyed on an email address.

• Purpose. Keeping the service working and keeping accounts safe.
• Legal basis. Art. 6(1)(f) — our legitimate interest in the security and integrity of the service, balanced by the short retention windows in §7.

3.9 Operational telemetry

Solver run times, background job outcomes and daily model-usage counters. These records carry no link to any account by construction — they exist to tell us whether the service is healthy.

3.10 What we do not do

• No profiling that produces a legal or similarly significant effect. The meal-plan composer is a mathematical optimiser working on the targets and the library you gave it; you can change, swap or discard everything it proposes.
• No advertising, no ad identifiers, no cross-app tracking, no App Tracking Transparency prompt.
• No sale or rental of personal data, to anyone, ever.
• No processing of your data to train any AI model — ours or anyone else's.

3.11 Support correspondence

When you use "Write to us" in Profile, the app opens a draft in your own mail app addressed to the support address in §1. It does not send anything: you write the message, you can edit every character of the draft — including everything below the separator line — and your mail app sends it when you decide to.

• Nothing from your health profile is pre-filled — by design. Not your weight, height, date of birth, biological sex, goal, pace, approach or any target. The app is built so that the draft cannot carry them: one function decides what the footer may say, it is handed your whole profile, and a test fails if any value of it appears in the draft.
• You may of course choose to tell us something about your health in the message you write — "the plan gives me too little for my weight" — and many support questions cannot be asked any other way. We do not ask you to, the app never adds it for you, and what you tell us is used to answer you and nothing else: we do not copy it into your profile and we do not use it to train anything. Where a message carries health detail, the basis for processing it is Art. 9(2)(a) — your own explicit disclosure — read together with Art. 9(2)(f) where a message concerns a legal claim, and it is kept no longer than the window in §7. Where that mail travels on its way to us, and on what basis, is §5 — which is also why we would rather you left health details out of an email unless you need them to explain the problem.
• Abuse and misuse. We may keep and act on correspondence that is abusive, fraudulent or an attempt to obtain someone else's data, and share it with Apple or a competent authority where we must. Legal basis: Art. 6(1)(f) — our legitimate interest in the safety of the service and of the people who run it.
• Support mail reaches us through a mail-forwarding provider and a hosted mailbox; §4 names them and §5 says where it travels.

3.12 Promoter codes

If you enter a promoter code in the app, we store that entry with your account so we can credit the promoter if you start a subscription (legal basis: performance of our agreement with you and our legitimate interest in running the referral program). This is the only personal-data link in the program, and it is included in your data export and deleted with your account.

Promoters never see who used their code. Their dashboard shows only aggregate statistics (counts, plan types, subscription status, and their commission) with no names, emails, or other identifying details.

Commission bookkeeping records derived from attributed subscriptions contain no personal data and are retained for 7 years under Dutch bookkeeping law (Algemene wet inzake rijksbelastingen, art. 52).

For promoters: we store your name, email, and — encrypted — the bank details you provide, solely to run the program and pay you. On request after the program ends we erase your identity and bank details; anonymized bookkeeping records remain for the statutory period.

4 · Anthropic — our named sub-processor for meal analysis

Tanin uses one AI provider, deliberately: Anthropic PBC (Claude). A single provider means a single data processing agreement and the least data leaving our systems.

What we send. The meal name you typed and, when you edit or add an ingredient, the ingredient text — plus, when you ask for a recipe, the same meal and ingredient text.

What we do not send. Your name, your email, your account identifier, your profile, your weight, your targets, your logs, your photos. Anthropic receives food text and nothing that identifies you.

Training. Anthropic does not train models on the content we send, under the data processing agreement between us.

The agreement. Anthropic's Data Processing Addendum, dated 24 February 2025, is incorporated by reference into Anthropic's Commercial Terms of Service and applies from first use of the API without a separate signature. It has governed this processing since we first used the API in September 2025. Within the EU the service is provided by Anthropic Ireland Limited.

Transfers. The meal text is processed in the United States, so this is a transfer outside the EEA. It rests on the EU Standard Contractual Clauses (Module Two, controller to processor) incorporated in that Addendum. It does not rely on the EU–US Data Privacy Framework. Anthropic publishes the sub-processors it uses in turn at anthropic.com/subprocessors.

Other processors.

That is the whole list. Mail sent to the addresses in §1 does not reach a mailbox we run: ImprovMX relays it and it lands in a Gmail account, which is why a mail forwarder and Google both appear in a table about your data. ImprovMX does not log the content of what it forwards; it keeps delivery metadata — sender and recipient address, subject line, server IP and the delivery events — for 7 days, and a record of changes to our domain for 365 days. Where that mail travels, and on what basis, is §5.

Tanin sends no marketing email and no transactional email at all, so there is no bulk-email provider in this table. If we ever add a processor, this page is updated before the change takes effect.

5 · Where your data is stored

All Tanin user data is stored in the EU region of our hosting provider. Your device also keeps a local copy of your meals, plans, grocery lists and recent totals so that the app works without a connection; that copy lives in the app's own container on your iPhone and goes when the app does.

There are two routine transfers outside the EEA, and they are the only two. The first is the meal text sent to Anthropic, described in §4. The second is your support correspondence (§3.11): mail to the addresses in §1 is relayed inside the EEA by ImprovMX and delivered to a mailbox hosted by Google, which may process it outside the EEA. We have no data processing agreement with either provider at our current scale, so this transfer does not rest on Standard Contractual Clauses. It rests on Article 49(1)(b): it is necessary to answer the message you chose to send us. For that reason we ask you not to put health details in an email unless you need to (§3.11); everything else in the app stays in the EU.

The Anthropic transfer rests on the EU Standard Contractual Clauses incorporated in Anthropic's Data Processing Addendum.

6 · Apple

Sign in with Apple, App Store purchases, subscription management, refunds and Apple Health are Apple's services. Apple decides how it processes data in them, as its own controller. We receive from Apple only what we describe in §3.1 and §3.6. Apple's privacy policy: apple.com/legal/privacy.

If you request a refund from Apple, we may share a minimal, bucketed summary of your account with Apple (account age bracket, subscription and refund history brackets, and whether your subscription was delivered) to help Apple decide your request; we never share your meals, health data, or any other content.

7 · How long we keep things

These windows are enforced by an automatic sweep that runs on start-up and every 24 hours — with one exception: support correspondence lives in a mailbox rather than in our database, so that window is kept by hand. The founder clears the support mailbox on the first working day of each month.

8 · Your rights, and where to exercise them

You can exercise all of these from inside the app. You may also write to us at the address in §1, and we will answer within one month.

8.1 What withdrawing health-data consent does

The app states the consequence before you tap, in these words:

If you do not consent, Tanin stops sending new health data to our servers immediately: profile and progress updates stay on this device only. Nothing already on your device is deleted, and previously synced data remains on our servers unless you delete your account. If you consent, syncing resumes.

And after a withdrawal, the settings sheet says:

You have withdrawn your consent, so Tanin is not syncing new health data. You can change your choice below at any time.

This is honest about what withdrawal does and does not do. Withdrawal stops future processing. It does not erase what was lawfully processed before — for that, use Delete account, or write to us and ask.

9 · Estimates, not prescriptions

Every figure Tanin gives you — a meal's calories, protein, carbohydrate, fat and fibre, its vitamins, minerals, fats and amino acids — is an estimate. It comes from recognised food tables and from how a meal is described, not from a measurement of your plate. Your daily targets and nutrient references are suggestions drawn from published science. They are not a doctor's prescription, and they are not tailored to a medical condition.

You use Tanin on your own responsibility. If you live with a condition, are pregnant or breastfeeding, take medication that affects how you eat, or follow a diet set by a professional, ask that professional before you change how you eat.

The full notice is shown in the app before you begin, and is published at gettanin.app/notice. Its wording is the authoritative version; this section summarises it and does not replace it.

10 · Security

• Everything travels over TLS.
• Your session token is held in the iOS Keychain, not in ordinary app storage.
• Access to the production database is restricted and audited.
• Health-data writes are refused by the app itself the moment you record a withdrawal, without waiting for the server to agree.
• Our operational logs are kept to the minimum needed to run and secure the service. They never contain health data, meal content, or the contents of your profile, and the app on your device writes no personal value to the system console in a release build. Server logs may contain the technical records described in §3.8 — an endpoint, a status, a timestamp, an IP address, and the account identifier the request was made with — and they are retained for the period set out in §7.

No system is perfectly secure. If we suffer a breach that is likely to result in a high risk to you, we will tell you, and we will notify the Autoriteit Persoonsgegevens within 72 hours as Art. 33 requires.

11 · Children

Tanin is not directed at children and we do not knowingly process the data of anyone under 16. The App Store listing is rated 4+ because it contains no objectionable content — that rating is not an invitation to children. If you believe a child has given us personal data, write to us at the address in §1 and we will erase it.

12 · Changes to this policy

Every version of this policy carries a version string, and the app records that string with every consent decision you make — so we can always show which text you agreed to. When we change the policy in a way that affects how we process your health data, we ask for your consent again against the new version.

We announce changes by publishing the new text on this page and updating the version string at the foot of it.

13 · Contact

Mathwares by Moody
Monicahof 8
3513 CX Utrecht
The Netherlands

KvK 42060152 · VAT NL005463685B88

Privacy questions: privacy@gettanin.app
Support: support@gettanin.app · gettanin.app/support