Privacy Policy

This policy describes how Müsli (formerly DietLab) handles your information. Your food log, weight, body measurements, body composition and photos are stored on your iPhone and, if you use iCloud, in your own private iCloud database, which we cannot read. There are no accounts and no advertising, and we do not sell your data. Apart from iCloud sync, data leaves your device only in the situations described below. Most of them start when you use a feature. Two kinds of request to our server happen in the background: usage statistics, which you can switch off, and, if you do not subscribe, a check of how many free photo scans you have left, made when you open or return to the app.

Who we are

Müsli is published by Not Too Much s.r.o., a company registered in the Czech Republic, company ID (IČO) 22566821, with its registered office at Rybná 716/24, Staré Město, 110 00 Praha 1 (the "Company", "we", "our"), which is the data controller. For any privacy-related questions, write to musli@not2much.com.

What we do not collect

Müsli does not collect, store or transmit:

• Account or sign-up information — there are no accounts.
• Your name, email address, phone number or Apple ID, or an advertising identifier (IDFA).
• Location data. The optional "Where you eat" feature reads your location on your iPhone only (see below); it is never sent anywhere.
• Contacts, or photos other than those you explicitly take or pick inside the app.
• Crash reports, analytics or tracking by third-party services inside the app, or tracking across apps and websites.

The identifiers Müsli does use are described below: a random installation identifier the app creates (see "Abuse and cost protection" and "Usage statistics"), a random identifier for each meal photo scan, and, from version 1.3, identifiers Apple assigns to your download of the app and, if you subscribe, to your purchase (see "Checking Müsli Pro").

What stays on your device and in your iCloud

Everything you log inside Müsli — food entries, saved meals, targets, weights you type in, body measurements, body composition scans you save, progress photos, meal photos, Weekly reviews and settings — is stored on your iPhone using Apple's on-device storage (SwiftData). If iCloud is enabled for Müsli, the same data syncs between your devices through the private database of your own iCloud account (Apple CloudKit). That database belongs to your Apple Account. We have no access to it, and no server of ours holds your food log, weights, measurements or photos.

Readings imported from Apple Health (weight, and body fat and lean body mass if you turn that on) are the exception: they are kept in a separate on-device store that is excluded from iCloud Backup and is not synced to iCloud (see "Apple Health" below).

You can export everything as a file at any time from Settings. Deleting the app removes this data from the device, except the random installation identifier, which iOS keeps in the Keychain so that reinstalling does not reset the free scans and fair-use limits. The iCloud copy can be removed in iOS Settings → your name → iCloud → Manage Storage → Müsli.

From version 2.1, the optional "Where you eat" feature can mark a meal as eaten at home, at work or out. It is off until you set it up, and only then does the app ask for location access ("While Using"). When you log a meal as you eat it, the app takes one location reading on your iPhone, compares it with the places you saved and keeps only the result (for example "Home"); the reading itself is discarded. Your places and these marks are kept in a file on your iPhone that is excluded from iCloud Backup and is not synced, exported, or sent to our server, to Apple's maps or to any AI provider. You can turn automatic marking off, or delete all places and marks, in Settings → App → Places.

From version 1.3, if you use the Apple Watch app, your iPhone sends today's figures (calories and macros with their targets, the day's balance and the app's language) to your watch through Apple's Watch Connectivity. The watch app makes no network requests of its own.

Apple Health

Only after you grant access, Müsli reads body mass (weight), height, date of birth, biological sex, active energy, step count and workouts from Apple Health, to pre-fill your profile and to estimate your calorie target and energy expenditure. If you turn on "Read from your smart scale" (Progress → Body composition), Müsli also reads body fat percentage and lean body mass from Apple Health, to show your body composition next to your weight. Müsli never writes to Apple Health.

Weight, body fat and lean body mass readings imported from Apple Health are stored only on your device, in a separate store that is excluded from iCloud Backup, and are not synced to iCloud, exported or sent to our server. Turning "Read from your smart scale" off stops the reading and deletes the body fat and lean mass readings the app stored. A body composition scan you enter by hand is your own record and syncs through your private iCloud like a weight you type in; if you choose to use that day's weight from Apple Health in it, that weight is saved with the scan and syncs too. The profile values you confirm during setup (sex, age, height, activity level and goal) are saved in the app's settings, which sync through your own private iCloud database. Weights you type in yourself also sync through your private iCloud. The calorie and macro targets set up from your profile, which may be pre-filled from Apple Health, are saved in the app's settings and sync; from version 1.3 the calorie target is also recalculated once a week from your food log and weigh-ins (which may include weights read from Apple Health), and the macro targets with it from your latest weight. The Apple Health readings themselves are not synced. From version 1.3, a Weekly review's weight data (that week's daily weight averages and weight change) is also kept only on the device that created it, and the app removes it from reviews that earlier versions saved in iCloud; the text of a review written by an earlier version may still mention that week's weight change.

Apple Health data is never used for advertising or marketing and never sold. Nothing from Apple Health is sent to our server or to any AI provider, except in the optional Weekly review described below, whose weight trend, maintenance estimate and calorie and macro targets may be calculated from Apple Health readings; Anthropic processes that summary as our service provider, and Apple Health data is not shared with anyone else. You can withdraw the permission at any time in the Health app.

Features that contact external services

The following features make network requests. None of them carries your name, email address, Apple ID or an advertising identifier.

AI features (Müsli Pro)

When you scan a meal, a nutrition label or a menu, photograph a cookbook page to save its recipe (from version 2.3), save a recipe from a post, a website or pasted text as a Müsli Pro subscriber (see "Saving recipes" below), describe a meal in words, ask for an AI nutrition estimate, or scan a body composition printout (such as an InBody result sheet), the photo and/or the text you submit — including any note or correction you add and a portion weight if you enter one — is sent over an encrypted connection to our relay server and forwarded to Anthropic, PBC (Claude API), which returns the estimate to your phone for you to review and edit before saving. Our relay keeps the API credentials out of the app and applies the fair-use limits described below; it does not store your photos or text. Anthropic processes the content as our service provider, does not use it to train its models, and deletes it after the limited retention period set out in its terms. Anthropic is bound by its commercial terms and data processing addendum with us to use this content only to provide that service, to keep it confidential and to protect it with safeguards at least equal to those this policy describes. See anthropic.com/legal/privacy.

A body composition printout is a Müsli Pro feature (Progress → Body composition → Scan an InBody sheet). The photo is sent only when you take or pick it there, and the AI reads the values printed on the sheet, such as weight, body fat, muscle and water, so that you can check and edit them before saving. A printout may also show your height, age, sex, the test date and a name or ID; these are sent with the photo, so cover anything you would rather not send. As with other photos, our relay does not store it and the app does not keep the photo. The values you save are stored in the app and sync through your private iCloud like your other data, and saving can add that day's weight to your weight history. Because this sends something new, the app asks for your permission again before the first printout is read.

Before it sends anything to the AI service for the first time, the app shows what will be sent and that it goes to Anthropic, and asks for your permission; nothing is sent unless you tap “Allow and continue”. You can withdraw it at any time in Settings → Müsli Pro, and the app asks again after an update that changes what is sent. If you don't want photos or descriptions to leave your device, do not use the AI features. Manual entry, barcode scanning, food search and logging saved meals work without them.

Ask your own question (from version 2.1)

In Insights, a Müsli Pro subscriber can type a question about their eating in their own words. The app then sends, over an encrypted connection to our relay server and on to Anthropic, PBC: the question as typed, the app's language, and the names of the foods you logged in the last 90 days (up to 300 names, so the question can be matched to your own foods). Anthropic's model only chooses which of the app's own analyses answers the question; the app then calculates the answer from your log on your iPhone. To write the answer's opening sentence, the app sends a second request with the question, the period, the food or category asked about and the answer's headline figures as shown on screen (for example calories a day, your usual amount, and on how many days). Nothing else from your log is sent: no dates or times, no individual entries, no photos, no weights and no Apple Health data. The question and the answer are kept on your iPhone only and are not synced. Because this sends something new, the app asks for your permission again the first time you use it.

Weekly review

When you tap "Review last week" (and have granted AI consent), the app sends a summary of the past week over an encrypted connection to our relay server, which forwards it to Anthropic, PBC to write the review. The summary contains: per-day calorie and macro totals and item counts; which days landed in deficit, maintenance or gain; your calorie and macro targets, goal and maintenance estimate; your weight trend (start, end and change, which may come from Apple Health readings) and goal weight; and the names of the eight foods that gave you the most calories, with how often you logged them and their share of your calories. It contains no photos, no name, and no sex or age. Anthropic processes it as our service provider to generate the review. We do not store the content on our server; the finished review is saved in the app, together with the facts it was written from, and syncs through your private iCloud like your other data; from version 1.3 its weight data stays on the device that created it. Nothing is sent unless you tap the button; "Translate this review" sends the same summary again to have the review written in the app's current language.

Abuse and cost protection

To keep the AI features available and affordable, the app generates a random installation identifier the first time it needs one and stores it in your device's Keychain. It is not derived from, or linked to, your name, Apple Account, advertising identifier or any other identity. The app sends it with every request to our server: AI requests, the free-scan count and usage statistics. Our server keeps request counters keyed by a hashed form of that identifier, and of your IP address; each counter covers one day (UTC) and is deleted automatically two days after its last use. The number of free photo scans an installation has used is kept under a hashed form of the identifier with no expiry date, because the three free scans are for the lifetime of the installation. Each meal photo scan also carries a random scan identifier, kept for 24 hours so that a retry or a correction of the same scan is not counted twice. The lines our code writes to the server's logs contain no meal content, only technical metadata such as request lengths, error codes and timings; our hosting provider, Vercel, also records the IP address and user agent of each request in its own request logs for a limited period.

Checking Müsli Pro (from version 1.3)

From version 1.3, the app sends our server a record signed by Apple, so that our server can check whether an AI request comes from a Müsli Pro subscriber and count the free photo scans: the record of your active subscription if you have one, otherwise the record of your download of the app. It is sent with each AI request and, if you do not subscribe, whenever the app checks how many free photo scans are left: when you open the app or return to it (but not again for ten minutes after a successful check) and after a purchase or restore, including at first launch, before you have used any AI feature. Neither record contains your name, email address or card details. The record of your download contains Apple's identifier for the download, the app version, the date and platform of your first download, and a value Apple uses to tie the record to a device. The record of a subscription contains Apple's identifiers for the purchase and the download, the plan, its price and currency, the App Store country, the dates of purchase and expiry, whether the current period is a free trial or uses an offer, whether it is shared through Family Sharing, and the same device value. The record is never passed to the AI provider, and it is not used for advertising or to build a profile of you.

Until we switch the check on, our server ignores the record: it neither reads nor keeps it, and fair-use limits and free scans are counted per installation as described above. For a trial period before that, our server may verify the record and log the outcome while still counting limits and free scans per installation. Once the check is on, our server verifies Apple's signature, reads from the record whether there is a subscription and until when, and does not store the record itself; it uses the outcome for up to ten minutes and holds it only in the server's working memory. It then keeps a one-way hash of the download identifier (or, where the record carries none, of the subscription's identifier or of the record itself) in place of the installation identifier: on the request counters, which are deleted two days after their last use; under the free-scan count, which has no expiry, so that the three free scans are counted per Apple Account rather than per device (where the record carries no Apple identifier, they stay counted per installation); and, only if we block an identity for misuse, on that block. The lines our code writes to the logs note that a check took place and how it ended; the only identifier they can contain is the first characters of that hash, on a line written when a daily limit is exceeded or a blocked caller is turned away.

Usage statistics

Müsli records usage statistics that carry no name and no account, for example that the app was opened, that setup was finished, that a meal was logged and how (by photo, by search or by hand), that a recipe was saved and where from (a TikTok or Instagram post, a website, pasted text or a photo), or that the subscription screen was shown, to understand how the app is used and improve it. From version 2.3 the statistics also record which screens of the app are opened and how long they stay open (for example how long a setup step took), and how long the app is in use, grouped into visits by a random visit identifier that starts afresh after 30 minutes away. Each event carries its time, the app version and build, the app language, the iOS version and whether the app came from the App Store or TestFlight, plus at most a few small counts and choices, such as how many items a meal had. Events never contain what you eat, your measurements, anything you type or anything derived from Apple Health. They are stored in a database we operate in the EU (Neon, Frankfurt), together with the random installation identifier, which is stored only as a hash made with a secret key, so it cannot be linked to you as a person; we keep them until we delete them, and we do not share them with advertising or analytics companies. Statistics are on unless you switch them off in Settings → Data → "Share anonymous usage statistics"; switching off stops sending and discards events not yet sent, but does not delete events already sent — write to us for that (see "Your rights under GDPR").

Food search and barcode lookup

When you scan a barcode, the barcode number is sent to the Open Food Facts public database. When you search for a food, the text you type is sent to Open Food Facts and to the USDA FoodData Central API to fetch names and nutrition information (from version 1.3, once the text in the Add Entry search field is longer than six words it is no longer sent to either — words typed before that may already have been searched if you paused — and it goes to the AI service only if you tap "Estimate with AI"). Product images are loaded from Open Food Facts when you search or look at a logged product. These are independent public services and may log requests as part of normal operation. See openfoodfacts.org/privacy and fdc.nal.usda.gov.

Saving recipes

You can save a recipe from a link — by sharing a TikTok or Instagram post or a recipe website to Müsli, or by pasting a link into the app. Your iPhone then fetches that public post or page directly from TikTok, Instagram or the website, much as Safari would, and reads it there. The request does not pass through our server and carries no Müsli identifier; like any web request, it reaches that service with your IP address. Some websites are loaded in a hidden browser view that keeps no cookies. Depending on the post, the app also downloads its cover image, the pictures of a photo post (whose text is read on your iPhone) and the video's subtitles, from which it writes the steps. Text you paste is read on your iPhone. For everyone, the app first reads the recipe on your iPhone. If you subscribe to Müsli Pro and have allowed the AI features, the app also sends the text it read to the AI service as described under "AI features" above: the post's title and caption, the text read from its photos, and the video's subtitles with their timings, or the text you pasted (or, for a website without a structured recipe, the text of the page). The AI service picks out the recipe's title, servings, ingredient lines (each with a plain English food name used to find it in the food tables), steps, tips, and preparation and cooking times. The video itself, its sound and its pictures are never sent, and nothing is sent if you are not a subscriber or have not allowed the AI features. "Read with AI" on a recipe you saved earlier fetches the post again and sends it the same way. A photo of a cookbook page is a Müsli Pro feature too: up to four pages, reduced in size, are sent to the AI service, which reads out the same parts of the recipe; the first page is kept as the recipe's picture.

To work out the calories, the app looks each ingredient up in its own built-in food table and in your saved foods first. The name of an ingredient it cannot find there is sent to USDA FoodData Central, as in a food search. The recipe you save — its title, the creator's name, the link, the ingredient lines, steps, tips and times, and its cover image or the photo of the page — is stored in the app and syncs through your private iCloud like your other data. A post shared from another app waits in Müsli's own storage on your iPhone, together with the text read from it, until you next open Müsli.

When you play a saved post's video, it plays in TikTok's or Instagram's own embedded player, loaded from their servers. They receive that request, may set cookies (kept in a store of their own inside Müsli, apart from anything else in the app) and may ask for your cookie choices, under their own privacy policies: tiktok.com/legal/privacy-policy and privacycenter.instagram.com/policy.

Sharing a meal

When you share a saved meal or recipe, the app sends it to our server, which stores it and gives back a short link. What is stored is the meal itself: its name, its ingredients with their amounts and nutrition values and, for a recipe, the servings, steps and notes you wrote. It is stored with no name, no installation identifier and nothing else about you, and it is deleted automatically one year after it was shared. Anyone who has the link can open the meal. If our server cannot be reached, the meal is encoded inside a longer link instead and nothing is stored. Opening a link loads a page on this website whose only job is to hand it over to the Müsli app; that page loads no analytics or tracking scripts. Like any request to this website or to our server, sharing and opening a link may appear, address included, in our hosting provider's request logs for a limited period.

Subscriptions

Müsli Pro is purchased through Apple's App Store. Apple processes the payment; we receive no card or bank details. When you scan a meal, the app tells our server whether you subscribe, so that free scans are counted only for those who do not. From version 1.3 it also sends Apple's signed record of your download or subscription, as described under "Checking Müsli Pro".

Service providers and where data is processed

• Vercel hosts our relay server and this website; the server runs in the United States.
• Upstash hosts the request and free-scan counters, meal-scan identifiers, blocks and shared meals described above.
• Neon hosts the usage-statistics database in Frankfurt, Germany.
• Anthropic, PBC (United States) processes the content you submit to the AI features.
• Apple provides iCloud (CloudKit), the App Store and StoreKit, and Watch Connectivity.

Where a provider processes data outside the European Economic Area, such as Vercel and Anthropic in the United States, the transfer relies on the European Commission's Standard Contractual Clauses in that provider's data processing terms.

How long we keep data

• Request counters: deleted automatically two days after their last use.
• Meal-scan identifiers (scans by non-subscribers): 24 hours.
• The count of free photo scans used: no expiry.
• Blocks for misuse: until we lift them.
• Shared meals: deleted automatically one year after they were shared.
• Usage statistics: until we delete them.
• Our hosting provider's request logs: a limited period set by Vercel.
• Photos and text sent to the AI features, including questions you type in Insights and the food names sent with them: not stored by us; Anthropic deletes them after the retention period in its terms.

Legal basis

Where the GDPR applies, the content you submit to the AI features (including the Weekly review) is processed on the basis of your consent and in order to provide the service you requested. You can withdraw consent at any time in Settings → Müsli Pro or by no longer using those features. The installation identifier, the hashed request and free-scan counters, the meal-scan identifiers and, from version 1.3, the check of Apple's signed record are processed to provide the app and the subscription you use, and on the basis of our legitimate interest in keeping the service secure and preventing abuse. Usage statistics are processed on the basis of our legitimate interest in understanding how the app is used; you can switch them off at any time in Settings → Data. A shared meal is stored to provide the link you asked for.

Children's privacy

Müsli is not directed at children under 13. Because there are no accounts, we have no way to tell anyone's age; the technical data described above (counters and usage statistics) is handled the same way for every installation, and we do not knowingly collect personal data from children.

Your rights under GDPR

If you are in the European Economic Area, you have the right to access, correct, delete, and export your personal data, and to lodge a complaint with your data-protection authority (in the Czech Republic, the Office for Personal Data Protection, uoou.gov.cz). Because your data lives on your device and in your own iCloud:

• Access: open the app — it's all there.
• Export: Settings → Export & import, anytime.
• Deletion: use the delete actions inside the app, delete the app, and remove its iCloud data as described above.

For the content sent to Anthropic through the AI features, including the Weekly review, and for the data our server holds (usage statistics and counters), write to us at musli@not2much.com. What our server holds is stored only under hashed identifiers that we do not link to you, and content sent to Anthropic is not tied to you, so we may not be able to find the records that belong to you; we will tell you what we can do.

Changes to this policy

We will update this page if we change anything about how Müsli handles data. The "last updated" date at the top will reflect any change.

Contact

Questions, comments, or requests: musli@not2much.com.