Privacy policy
Grami is a meal tracker. It needs your meals to work — and nothing else. This page says exactly what is stored, who touches it, and how to get rid of it.
Last updated 24 October 2026
Who we are
Grami is built and operated by Softlance (Euvoia, Greece), the data controller for the personal data described here. For anything on this page, write to info@softlance.dev.
What Grami stores
| Data | Why |
|---|---|
| Email address and password (stored hashed) | To create your account and keep your history across devices and reinstalls. |
| Meals: photo, description, calories, protein, carbs, fat, fiber, sugar, weight, meal type, date and time, favourites | This is the product. It is what your Today screen, history and progress charts are made of. |
| Optional profile: first name, daily nutrition goals | Only what you choose to type in, used to personalise your targets. Leave it blank and Grami uses standard daily values. |
| Preferences: app language, notification settings | So the app behaves the same on every device you sign in on. |
| Subscription: plan, status, renewal or expiry date, and the number of AI analyses you run each day | To give you the analyses your plan includes. Payment happens entirely at Apple or Google — we never see your card or bank details. |
Grami contains no advertising, no analytics SDK and no third-party tracker. There is no profile of your behaviour built anywhere, and nothing is sold or shared for marketing.
Who processes it
- Supabase — hosting, database, authentication and photo storage, on servers in the European Union. Your rows are protected by row-level security, so one account cannot read another’s data.
- OpenAI (OpenAI Ireland Ltd) — the meal photo, or the text you dictated or typed, is sent for analysis and comes back as nutrition numbers. It is sent through our own server function via a business API account, is used only to answer that one request, and is not used to train models. We ask OpenAI not to store the request, so it is not kept in their logs; like all API traffic it may be held for up to 30 days for abuse monitoring and is then deleted.
- Open Food Facts — when you scan a barcode, the barcode number alone is looked up in this public food database. No account information is sent with it.
- RevenueCat (RevenueCat, Inc., United States) — manages subscriptions. It receives your account’s random ID and the store’s purchase record, to confirm what you bought and when it renews. It receives no meals, photos, name or email.
- Apple and Google — app distribution and payment. When you subscribe, Apple or Google takes the payment and handles billing, renewals and refunds under their own terms. They never receive your meal data from us.
Where your data is processed
Your account, your meals and your photos are stored in the European Union, on Supabase servers in Ireland. The one thing that can travel further is the meal photo or description sent for analysis: our processing agreement for that is with OpenAI Ireland Ltd, an EU company, because we are based in the EEA. OpenAI Ireland may pass the request to its affiliates outside the EEA, including in the United States, and does so under the European Commission’s Standard Contractual Clauses or an adequacy decision. Barcode lookups send only the barcode number, which is not personal data.
Subscription records held by RevenueCat in the United States contain only your account’s random ID and the purchase details, and are transferred under the European Commission’s Standard Contractual Clauses.
Photos
Meal photos are stored in a private bucket tied to your account and are served to your device through short-lived signed links. Deleting a meal deletes its photo. Photos you take for a meal you never save are removed automatically.
Voice and camera
Dictation uses your phone’s built-in speech recognition (Apple on iOS, Google on Android) under the permission you granted. Your phone decides whether to recognise the words on the device or on Apple’s or Google’s servers, under their terms, exactly as it does for the keyboard microphone. Grami never receives or keeps the audio: it receives only the resulting text, and sends only that for analysis. The camera is used only while you are photographing a meal or scanning a barcode. You can revoke either permission in your phone’s settings at any time.
Notifications
Notifications, including the evening goal check, are scheduled on your device. There is no push server and no notification content leaves your phone.
How long it is kept
Meals are kept until you delete them or delete your account. Deleting your account removes your meals, photos, profile and login immediately and permanently from the live system: we keep no database backups, so there are no residual copies left to age out. See how to delete your account.
The daily count of your AI analyses is kept to apply your plan’s limits: for the life of the account on the free plan (it is what limits the free analyses to three), and for 90 days once you subscribe. Deleting your account also deletes your subscription record at RevenueCat; it does not cancel a store subscription, which you cancel in your App Store or Google Play settings.
Your rights
Under the GDPR you can ask for a copy of your data, correct it, delete it, receive it in a portable format, restrict or object to processing, and withdraw consent. Most of this is immediate inside the app; for anything else, email info@softlance.dev and we will answer within 30 days. You may also complain to the Hellenic Data Protection Authority.
Legal basis
- Contract — your account and the meals you log; without them the app cannot function. The same applies to your subscription and to the daily count that applies its limits.
- Consent — camera, microphone and notification permissions, each revocable in your phone settings.
- Legitimate interest — keeping the service secure and preventing abuse.
Children
Grami is not intended for people under 16, and we do not knowingly collect their data.
Changes
If this policy changes materially, the date at the top changes and the app will tell you. Continuing to use Grami after a change means the updated policy applies.