Privacy policy

Last updated: 26 October 2026

NAWAI is a nutrition tracking app published by DALIA IT. This policy explains what data is processed, why it is processed and how you can delete it.

Controller and contact

Data controller: DALIA IT.

Privacy contact: privacy@nawai.ai.

Data processed

NAWAI may process the following information when you use the app:

• Account: first or display name, email address, Supabase user ID and sign-in method.
• Nutrition profile: age or date of birth, height, weight, biological sex if provided, goal, activity level, training frequency, calorie and macro targets.
• Meals: foods entered, photos, written descriptions or voice messages voluntarily submitted for analysis, transcripts, nutrition estimates, corrections and history. A correction can include the photo and previously analysed meal items.
• Guest discovery in earlier versions: guest session ID, meal and attempt status before account creation. Current versions no longer offer this first photo analysis without an account. Any subsequent account link remains verified to preserve existing meals and prevent reassignment.
• Apple Health: age, height, weight, biological sex, average steps, active energy, resting energy and a minimal workout summary only with your iOS permission. With separate cloud consent, NAWAI saves daily totals and necessary workout summaries (date, duration, active calories, type and source) to restore tracking across devices. Routes, heart rate and minute-by-minute samples are not backed up.
• Security and operation: session status, dated AI permission decision, cloud sync, Firebase App Check attestation material and technical tokens, together with App Attest and DeviceCheck signals depending on the app version, attempt limits and technical diagnostics needed to operate the app and prevent abuse.
• Subscriptions: verified Apple transactions, subscription status, offer reference and campaign attribution when available. Optional commercial journey measurement uses opaque IDs and usage events; it contains no foods, photos, voice messages, weight, macros or Apple Health data.
• Companion: progress, rewards, outfits and equipped items saved with your account so you can return to your character.
• Product search: search terms, entered or scanned barcodes, response status and duration, linked to your account ID to operate and diagnose the search service.
• Apple Search Ads attribution: only after you agree to optional measurement and in the production environment, NAWAI may obtain the Apple Ads source, campaign and ad-group references, and attribution type through AdServices. This flow uses no IDFA or matching with activity in other apps.

NAWAI does not collect data for advertising tracking and does not sell user data.

Purposes

Data is used to create and secure your account, sync across devices, estimate calories, protein, carbohydrates, fat and portions, personalise nutrition targets, import Apple Health information when authorised to prefill your profile, show workouts and calculate energy progress, provide support, prevent abuse and improve reliability.

NAWAI’s nutrition estimates are indicative. They are not medical advice, a diagnosis or a treatment recommendation.

Service providers

• Supabase: authentication, databases, storage and server functions.
• Resend: confirmation, sign-in and security emails.
• OpenAI: meal photo recognition, description and correction analysis, voice message transcription and AI nutrition lookup, only after your explicit permission. Guest discovery data from earlier versions remains covered by this policy.
• OpenFoodFacts: lookup and enrichment of the public food catalogue when this source is used.
• Apple HealthKit/iOS: Apple Health access only with your explicit permission.
• Google Firebase App Check: verifies app and device integrity to help prevent abuse. This verification exchanges attestation material and technical tokens with Google.
• Google Cloud Functions for Firebase: verifies Apple-signed purchase evidence in a private function called by NAWAI’s Supabase servers. This evidence may include transaction and product identifiers, subscription dates and status, and an identifier linking the purchase to the NAWAI account. This service does not receive meals, photos, voice messages or Apple Health data.

AI analysis permission

Before the first transmission, NAWAI asks for one shared permission covering photos, descriptions, voice messages and corrections. The data and service provider are explained before you accept and remain available in Profile. Permission is not requested for every meal or input method. It does not replace iOS camera and microphone permissions or the separate consent for Apple Health cloud sync and optional usage measurement.

Without permission, no new AI analysis starts and no content is sent to OpenAI for that analysis. You can reconsider during a new attempt you choose to make, or withdraw permission in Profile. Withdrawal blocks new AI transmissions; it does not by itself delete previously saved results. Dated decisions are kept so restoring an old backup cannot reinstate withdrawn permission.

Analyses support your diary and coach advice. Current coach reviews are calculated within NAWAI; Apple Health data is not sent to the meal analysis service.

Apple Health

Apple Health information is used to prefill your NAWAI nutrition profile and, with the necessary permissions, calculate activity summaries for the coach. NAWAI asks for separate consent before sending this information. Only daily energy totals and minimal workout summaries are then linked to your account and encrypted in transit and at rest by the Supabase infrastructure. Raw HealthKit IDs are converted to a server-side fingerprint specific to you. Routes, heart rate and detailed samples are never sent. Withdrawing Apple Health permission stops future imports but does not delete saved history; you can stop sync or separately delete your cloud activity data. This information is not used for advertising, tracking or AI training.

Retention

The application logs for this verification function contain a request identifier, the operation type and status, and timing measurements. Signed evidence and its contents are not recorded in these logs. Google/Firebase’s service-specific processing and retention practices are described in its privacy documentation.

Account information, including accepted activity summaries, is kept for as long as your NAWAI account exists or until you explicitly delete it. Turning off sync stops new transfers without deleting history. Local and cloud data is deleted when you delete the account.

Dictation uses OpenAI’s Realtime API. The NAWAI relay forwards audio content without storing it. This does not mean OpenAI retains no data: its data-retention documentation describes default abuse-monitoring logs that may contain submitted content and are kept for up to 30 days, with exceptions including legal or safety needs. Specific retention controls are available subject to conditions; NAWAI does not promise zero retention by this provider.

Guest discovery data from an earlier version remains associated with that session until it is linked to an account. Records needed for security and discovery limits are separate from the food diary. You can request deletion of your guest data directly in the app: Profile > Delete my guest data, then explicitly confirm; creating an account is not required. The request is durably recorded so cleanup can resume if interrupted. Meals already transferred to an account remain in that account. You can still contact privacy@nawai.ai with any questions.

Account deletion

You can request account deletion directly in the app: Profile > Account > Delete my account, then explicitly confirm.

After the request is accepted, NAWAI closes your local session. Durable server-side processing deletes the account, associated cloud data and cloud backup; it may finish asynchronously. Deleting your NAWAI account does not automatically cancel an Apple subscription, which you can still manage with Apple.

Your rights

You can request access to, correction of or deletion of your data through the app or by contacting privacy@nawai.ai.

Security

NAWAI uses encrypted connections, secure authentication and established cloud providers. No system is infallible; data is handled with safeguards appropriate to its sensitivity.

Changes

This policy may evolve with the app. The version published at https://nawai.ai/privacy is the applicable version.