CiboStart free

Privacy Policy

Effective October 27, 2026 · TunariVPN Sp. z o.o.

Cibo (“we,” “us,” or “our”) is operated by TunariVPN Sp. z o.o., a company registered in Republic of Poland (NIP 7011263037, REGON 541903542, KRS 0001176044). This policy explains what data Cibo collects when you use our iPhone application, Apple Watch companion, Android application, and cibo.health website, why we collect it, and the rights you have under the EU General Data Protection Regulation (GDPR).

We've tried to write this in plain English. Where we use a legal term we define it in line.

1. Data controller

The data controller for personal data processed through Cibo is:

TunariVPN Sp. z o.o.
Zabraniecka 8L / 212
03-872 Warsaw, Poland
Email: [email protected]

Registered with the District Court for the capital city of Warsaw, XII Commercial Division.

2. What we collect

To make Cibo work for you, we collect the following:

Account data

  • The email address associated with your Sign in with Apple or Sign in with Google identity (both on iPhone, Google on Android). If you opt to share a name during sign-in, we store that too. We never receive your Apple or Google password.
  • A randomly generated user identifier we use to attach your meals + profile to your account.

Profile data

  • Optional onboarding answers - sex, date of birth, height, weight, activity level, and goal - used to compute your calorie target via the Mifflin-St Jeor equation.
  • Your daily calorie and macro targets, including the targets you set for particular days of the week or dates, and your weight entries (a weight history by day), kept with your account so your plan can follow your weight.

Meal data

  • Each meal you log: name, kilocalories, protein/carbs/fat (grams), sodium, sugar, the local time you logged it, and a free-text description if you provided one.
  • For meals logged via photo, the resolved nutrition fields above and the photo itself, kept with the meal entry so you can see what you logged. Photos are stored in EU object storage (Cloudflare R2, Germany) and are reachable only through an unguessable URL. A copy is sent to our AI provider for the nutrition read: Google (Gemini API), or OpenAI when Gemini is unavailable. Both process it under their paid API terms, do not use it to train their models and keep it only for a limited period for abuse monitoring (OpenAI: up to 30 days). We never use your photos to train AI models.
  • For meals logged via voice or a typed description, the text. The voice recording is sent to OpenAI for transcription and the text to OpenAI for the nutrition read; we do not retain the audio after transcription.

Payment data

  • The Apple In-App Purchase transaction identifier (iOS) or the Google Play purchase token (Android). We do not see your card details - Apple and Google handle the payment in full. On Android, your Cibo user identifier is attached to the purchase (Google Play's obfuscated account identifier) so a subscription can be restored on the account that bought it; Google Play receives it with the purchase.

Apple Health data

  • When you grant Cibo permission, we read steps, active energy burned, resting energy burned, and body mass from Apple Health on your device. Body mass stays on your device. For your activity in Insights and the Weekly Review, the app sends our servers one daily total of steps, of active energy and of total energy burned. Apple Health data is never used for advertising or marketing and is never shared with analytics or advertising partners.
  • When you log a meal, we write the corresponding nutrition fields back to Apple Health (energy consumed, protein, carbs, fat, fibre, sodium, sugar and water) so other apps you trust can see them. Writes happen on-device using Apple's HealthKit API.

Campaign link measurement (go.cibo.health)

  • When you reach Cibo through one of our short campaign links (go.cibo.health), we log a random click identifier, your operating system family, your country (derived by Cloudflare from your connection - we never see or store your IP address), a coarse browser family (e.g. "Instagram in-app"), and any advertising click identifiers already present in the link URL (such as fbclid, gclid or ttclid). This is used solely to measure which campaigns work. No cookies are set, no device storage is accessed, and records are deleted after 180 days.

Health Connect data (Android)

  • On Android, the same integration is offered through Health Connect by Google, and only when you turn it on in Cibo's Settings and grant the permissions in Health Connect's own consent screen. Cibo reads steps, active energy burned, total energy burned, and body weight to show them inside the app, and writes the meals you log (energy, protein, carbohydrates, fat, fibre, sodium, sugar, the meal name and type) and the water you log so other apps you trust can see them.
  • As with Apple Health, for your activity in Today, Insights and the Weekly Review the app sends our servers one daily total of steps, of active energy and of total energy burned. The total is updated while the day goes on (at most once every five minutes, for up to the last seven days); individual readings and the weight read from Health Connect stay on your device. Health Connect data is never used for advertising or marketing and is never shared with analytics or advertising partners. You can turn the integration off in Cibo's Settings or revoke access at any time in Health Connect; the daily totals are deleted together with your account.

Water tracking

  • If you turn on water tracking, the app sends our servers your daily water total and your daily goal (not each glass you log), so hydration appears in Insights and the Weekly Review.

Weekly Review

  • The Weekly Review (part of Cibo Premium) is written on our servers from your week: the foods and meals you logged, your calorie and macro totals, your water totals and your daily activity totals. To write it, our server sends those weekly figures to OpenAI; your name, email and photos are not sent.

Recipes, weekly menu and shopping list

  • Recipes you create or import are stored with your account: the name, ingredients and amounts, servings and the method. When you import a recipe by link, our server fetches that public page (the website sees our server, not your phone); text you paste is read on your device.
  • Your weekly menu, the portions you prepared and your shopping list (including the items you type in, what you have at home and what you bought) are kept on your device and synchronised with your account, so they survive a reinstall.
  • When you ask Cibo to suggest a menu, our server sends OpenAI the size of your household, the menu style, the favourite ingredients you typed (up to 300 characters), your daily calorie and macro targets and recipe data from our catalogue - no name, email, meal history or photos. The answer is a list of recipe identifiers, and we cache only those identifiers for 24 hours.
  • To fill a shopping list you can point the camera at your fridge or shelf, record a voice note or type a list. The photo, recording or text is read by the same AI providers as meal photos and voice (Google Gemini or OpenAI for photos, OpenAI for voice and text) and is not stored by us; only the product names and amounts come back for you to review.
  • A food report you send (the reason and your text) and the corrected copy of a product you keep for yourself are stored with your account.

Ingredient alerts

  • If you turn on ingredient alerts, the ingredients you want to be warned about (for example allergens) and your switches are stored with your account, and every meal you log is checked against that list on our servers. Only if you also turn on Also check possible recipes with AI are the dish names in a meal and the names of the ingredients you watch sent to OpenAI to find ingredients a recipe may contain; no photo, account data or other health data goes with them.

Together circles (optional)

  • Together is off until you turn it on. In a circle you join, the other members see only what you share there, each behind its own switch: a daily summary, your meal list, and your meal photos. Your first name and the circle name are visible to its members.
  • You can report a member's photo or block a member in the app. A report (the photo, the reason and who reported it) reaches our team at once and is reviewed within 24 hours. A block hides you from each other and takes you both out of the circles you share.

Gifts of Cibo Premium

  • When you give a gift, we store the purchase (the Apple transaction identifier), the gift code, and the recipient name, message and sender name you type. The recipient sees those when they open the gift. When a gift is activated, we record which account activated it.

Notifications and emails

  • If you allow notifications, we store your device's push token (Apple Push Notification service on iPhone, Firebase Cloud Messaging on Android), the model of your device, whether notifications are allowed, your notification switches and the times of the reminders the app schedules, to send reminders, the Weekly Review and Together updates without overlapping our emails.
  • We send emails about your plan, your trial and your account, sent through Resend (EU region). Offers are sent only if you agree to them. Every email has a one-click unsubscribe; we record whether an email was delivered and whether a link in it was clicked, not when it is opened.

Diagnostic data

  • App version, iOS/Android version, device model, and crash and error reports, sent to Sentry (EU region). A report carries a short trail of what the app did just before it (the screens opened and the actions taken, with the same properties as our analytics events, including onboarding answers in ranges) so we can see what led to the error. We use this to fix bugs that affect real users; diagnostics are not linked to your meal history.

Analytics and attribution data

  • The Cibo apps include myTracker, an analytics and install-attribution SDK operated by VK (formerly Mail.ru Group). It collects device information (model, operating system version, language, app version), an SDK-generated device identifier, and a small set of in-app product events: sign-in, onboarding completed, a meal logged (the input method only, such as photo or voice, never the contents or the photo of the meal), trial started, purchase, and Together circle activity. These events are linked to your random user identifier so we can see how Cibo is used and which of our campaigns bring users who stay.
  • The apps also send product events to Amplitude (EU data centre): which screens and features you use, meals logged with their input method and calorie total, onboarding answers in ranges (for example a weight range, never the exact value), paywall and subscription events, and the variant of our paywall experiment. They are linked to your user identifier and carry your device model, operating system and app version, language, mobile carrier and, on Android, the Google advertising ID and App Set ID where available. Amplitude also derives an approximate location (country, region and city) from the IP address of the connection; we do not collect precise location. Alongside the events we set profile properties: your goal, activity level, calorie target, sex, age, weight and height ranges, whether you tracked calories before, how you found Cibo, your cuisines and your Together mode. Amplitude never receives meal photos, voice clips or Apple Health or Health Connect readings.
  • On Android, the app may also access the Google advertising ID (where available on your device) and receives the Google Play install referrer, a string Google Play passes to the app that tells us which ad or link led to the install. We join it to the ad click so we know which campaign the install came from.
  • On iOS, when the app was installed after tapping one of our ads on the App Store, we receive an attribution record from Apple's AdServices framework. It contains only anonymised campaign identifiers (campaign, ad group, ad and country) — no device advertising identifier and nothing about you personally — and we link it to your account so we know which of our Apple Search Ads campaigns brought users who stay. Legal basis: our legitimate interest in measuring our own advertising (Art. 6(1)(f) GDPR). We never pass this record to any third party, and it is deleted together with your account.
  • To measure advertising, our servers report install and subscription purchase events to the ad platforms we buy ads from (currently the Meta Conversions API). These server-side reports contain technical data (IP address, browser or device user agent, ad click identifiers) and may include your email address in SHA-256 hashed form so the platform can match the event to the ad that led you to Cibo. They never contain your meals, photos, health data, or any nutrition information.

What we don't collect

  • We do not sell or rent your personal data. Advertising platforms receive only the campaign measurement events described above, never your meals, photos, health data, or nutrition information.
  • We do not collect contacts, your photo library (the Android app uses only the camera; on iPhone only the single image you point at a meal), calendar events, or microphone audio outside an active voice entry. We do not collect precise location: our analytics provider derives only a coarse location (country, region, city) from the IP address of the connection, as described above.
  • We do not retain voice clips: audio is transcribed and discarded, and only the text is stored. We do not use meal photos to train AI models and never share them with advertisers or data brokers.

3. How we use it

We process the data above for the following purposes:

  • Service delivery - keeping your meals, profile, recipes, menus, shopping lists and subscription state synchronized across your devices (iPhone, Apple Watch, Android phone) and, if enabled, Apple Health or Health Connect.
  • Nutrition resolution - sending meal photos, voice recordings, typed descriptions and shopping-list photos or notes to our AI providers so they can return calorie and macro estimates or product lists, and sending your weekly totals so the Weekly Review can be written.
  • Subscription management - verifying your Apple In-App Purchase receipts or Google Play purchase tokens so we know whether to unlock paid features.
  • Service improvement: usage analytics (which input methods are popular, where errors happen, which features get used) to make the product better. These events are linked to your user identifier as described in section 2.
  • Advertising measurement: counting the installs and purchases that came from a specific campaign so we know which ads work and stop the ones that do not. This uses the analytics and attribution data described in section 2.
  • Customer support - when you email us, we use your account email to find your records and reply.
  • Legal compliance - keeping the records Polish tax law requires us to keep (typically for five years after a payment).

Our lawful bases for processing under Article 6 GDPR are:

  • Contract performance (Art. 6(1)(b)) - for everything you need to actually use Cibo: your account, your meals, billing.
  • Consent (Art. 6(1)(a)) - for Apple Health and Health Connect integration, the AI check of ingredient alerts, promotional notifications and any future marketing emails. You can withdraw consent at any time without affecting service-delivery features.
  • Legitimate interest (Art. 6(1)(f)) - for fraud prevention, security, product analytics, and measuring the performance of our advertising campaigns. We balance our interests against your rights and you can object.
  • Legal obligation (Art. 6(1)(c)) - for tax records and responding to lawful authority requests.

5. Third-party processors

On cibo.health, with your optional analytics and advertising consent, we also use the OpenAI Ads Measurement Pixel to measure page visits and clicks to the App Store and Google Play. These clicks are not reported as app installations or purchases. The pixel uses advertising click and browser references and technical connection data for attribution. The __oppref cookie lasts up to 30 days and __obref up to 365 days, subject to browser restrictions. No meal, weight, allergy, or other health data is included in these website events. You can decline optional cookies using “Essential only”; clearing this site's stored data lets you choose again. For consenting Android visitors, we pass the ChatGPT click reference through Google Play to connect a later trial with its advertising source. The reference stays in browser session storage for up to 30 minutes and is used for trial attribution for up to seven days. Our separate server integration reports verified trial starts to OpenAI; on iOS, a hashed email is included only when App Tracking Transparency permission is granted. These events exclude meal, weight, allergy and other health records and are marked to opt out of future personalization.

We use the following processors, each bound by a Data Processing Agreement and (where relevant) Standard Contractual Clauses:

  • Apple Inc. (USA) - App Store distribution, In-App Purchases, Sign in with Apple, HealthKit. Apple sees your purchase events and your Apple ID; we never see your card details.
  • Google LLC (USA) - Google Play distribution, Play Billing subscriptions, Sign in with Google, Health Connect and Firebase Cloud Messaging (notification delivery) for the Android app. Google sees your purchase events and your Google account identity; we never see your card details.
  • OpenAI, L.L.C. (USA) - text nutrition reads, voice transcription, photo reads when Gemini is unavailable, shopping-list recognition, menu suggestions, the Weekly Review and the ingredient checks you opt into. Photos, voice clips, texts and the weekly totals and menu inputs described in section 2 are sent to OpenAI for inference and processed under OpenAI's API data policy: not used for model training, retained for ≤30 days for abuse monitoring, then deleted.
  • Google LLC - Gemini API (USA) - photo nutrition reads and shopping-list photo recognition, under the paid API terms (not used to improve Google's models). Firebase Analytics on iPhone receives one event when a trial starts, to measure our Google Ads; it never receives meal contents, photos or health data.
  • Amplitude, Inc. (EU data centre) - product analytics and our paywall experiment: the product events, device data, approximate location and profile properties described in section 2, linked to your user identifier; never meal photos, voice clips, Apple Health or Health Connect readings.
  • Functional Software, Inc. (Sentry) (EU region) - crash and error reports, with the trail of recent in-app events described in section 2.
  • Resend, Inc. (EU sending region, Ireland) - delivery of our emails.
  • Stripe, Inc. (USA) - used only for any future web-based checkout. Currently all v1.0 billing flows through Apple IAP.
  • Hetzner Online GmbH (Germany) - hosting our backend servers in Helsinki, Finland (within the EU).
  • Cloudflare, Inc. (USA) - DNS resolution and DDoS protection for cibo.health, api.cibo.health and go.cibo.health; for campaign links Cloudflare also derives the country of a click from the connection (the IP address itself is never stored by us).
  • VK / myTracker (myTracker is an analytics service operated by VK, formerly Mail.ru Group): app analytics and install attribution for the iOS and Android apps, as described in section 2. It receives device data and product events on its own infrastructure; it never receives meal contents, photos, health data, or nutrition information.
  • Meta Platforms, Inc. (USA): advertising measurement. Receives the server-side install and purchase events described in section 2, including technical data, ad click identifiers, and, where used, your email address in SHA-256 hashed form; it never receives meal contents, photos, health data, or nutrition information.

6. Data retention

  • Account + meal data - retained for as long as your account exists. Deleted within 30 days of you requesting account deletion (via Settings → Delete account in the app, or by emailing [email protected]).
  • Photo crops + voice clips sent for AI resolution - processed in memory; deleted from our servers immediately after the resolution returns. OpenAI retains them for ≤30 days for abuse monitoring before deletion.
  • Recipes, menus, shopping lists, ingredient alerts, weight history, daily activity and water totals - retained for as long as your account exists and deleted with it.
  • Payment records - retained for 5 years as required by Polish tax law (Art. 70 of the Polish Tax Ordinance).
  • Diagnostic data - retained for 90 days, then aggregated and the original records discarded.
  • Analytics and attribution events: held by the analytics and advertising partners listed in section 5 under their own retention schedules. When you delete your account we stop linking new events to your user identifier, and you can ask us to pass a deletion request to those partners by emailing [email protected]. Campaign link click records (go.cibo.health) are deleted after 180 days.

7. Your rights

Under GDPR, you have the following rights:

  • Access - get a copy of the personal data we hold about you.
  • Rectification - correct anything that's wrong.
  • Erasure (“right to be forgotten”) - delete your account and all data tied to it. The Settings → Delete account flow in the app does this in one tap; you can also email us.
  • Portability - receive your meal history and profile in a machine-readable JSON export.
  • Restriction + objection - limit how we process your data or object to specific processing (e.g. analytics).
  • Withdraw consent - for anything you've consented to, at any time, with no penalty to features that don't depend on that consent.

To exercise any of these, email [email protected]. We respond within 30 days as required by Article 12 GDPR.

You also have the right to file a complaint with your supervisory authority. For users in the EU, this is the Polish data protection authority UODO (since we're registered in Poland), but you may also file with the authority in your home country.

8. International transfers

Your data is stored on servers in the European Union (Hetzner Helsinki). When we transfer data to processors in the United States (Apple, Google, OpenAI, Stripe, Cloudflare, Meta, Amplitude, Sentry, Resend), the transfer is governed by the EU-US Data Privacy Framework where the processor is certified, or by Standard Contractual Clauses approved by the European Commission. Analytics and attribution data sent to myTracker is processed on VK's own infrastructure; the scope of that data is limited to what section 2 describes and is covered by myTracker's own privacy documentation.

9. Security

We protect your data in transit and at rest:

  • All API calls use TLS 1.3. Apple App Transport Security (ATS) is enforced on the iOS app; certificate pinning is enabled.
  • The database is encrypted at rest (AES-256) and access is restricted to a short list of named engineers behind SSH key + 2FA.
  • Authentication tokens are stored in the iOS Keychain; we never store plaintext passwords (Sign in with Apple does not provide one to begin with).
  • We follow OWASP Top 10 mitigations, run dependency vulnerability scans on every deploy, and rotate secrets quarterly.

No system is invulnerable. If you discover a security issue, please report it to [email protected] with the subject line “Security report” and we will respond within 24 hours.

10. Children

Cibo is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you are a parent or guardian and believe your child has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the product evolves. Material changes will be announced via in-app notification + email at least 30 days before they take effect. The effective date at the top of this page reflects the most recent update.

12. Contact

For any privacy question, request, or complaint:

Email: [email protected]
Postal: TunariVPN Sp. z o.o., Zabraniecka 8L / 212, 03-872 Warsaw, Poland

© 2026 TunariVPN Sp. z o.o.. All rights reserved.