Privacy Policy

01The short version

• There is no sign-up. Heliva knows you by a random ID made on your phone, not by your name or email.
• Your food log, weights, goals and Apple Health data stay on your phone. We don't keep them on our servers.
• When you ask the AI to read a meal, a recipe or a plan, the photo or words go through our server to Google's AI in the EU. We don't store them. Google may keep flagged requests for up to 90 days, in the EU, to check for abuse.
• Everything we store or process stays inside the EU. No route goes outside it, not even as a backup.
• No advertising, no data sales, no training of AI models on your meals.
• Apple handles payment. We never see your name, card or Apple ID.

02Who we are

CA Systems runs Heliva and is the data controller for the personal data described here.

• Address: Kexvägen 8, 128 69 Sköndal, Sweden
• Email: support@heliva.app

Heliva is a food and training logbook for iPhone. This policy covers the app and the website heliva.app.

03What stays on your phone

Most of what you put into Heliva never reaches us. It is saved on your iPhone, protected by the phone's own encryption:

• your meals, portions, photos kept with meals, drinks and notes;
• your weights, goals, calorie and protein targets, and morning check-ins;
• recipes, meal plans and your shopping list;
• what Heliva reads from Apple Health, if you allow it: weight, height, age, sex, steps, active calories, sleep and workouts. Heliva uses these on the phone to work out what you burn and to show your trend. If you allow it, Heliva also saves the weights and drinks you add to Apple Health.

We can't see any of this, and we can't recover it for you. If you turn on iCloud backup for your iPhone, Apple keeps a copy under your Apple account and Apple's own terms. If you delete the app, this data is deleted with it.

Apple Health data is never used for advertising and never shared with anyone. It is not sent to our server or to the AI.

When you speak a meal, the iPhone turns your words into text on the phone where it can. On older iPhones, or in a language the phone can't handle offline, Apple's speech service does it under Apple's terms.

04What passes through our server, and isn't stored

Some features need an AI model. These are part of Heliva Plus:

• reading a meal photo, or a meal you type or say;
• your answer to the follow-up question, and corrections in your own words;
• reading a nutrition label when a barcode isn't found;
• reading a recipe from a photo, a link or pasted text;
• matching food names to the nutrition databases;
• "Plan with AI", which uses your plan preferences, foods to avoid, calorie goal, protein target and the recipes you choose.

For these, the app sends the photo or the words to our server, which passes them to Google's Gemini models on Google Cloud in the EU (see section 7). The answer comes back, and we don't save the photo, the words or the answer. Two exceptions, neither linked to you or your Heliva ID:

• A meal plan is held in the server's memory while it's written and for up to an hour after, so the app can collect it, then dropped.
• When a food name (such as "mospotatis") is matched to a database entry, the match is cached on our server so the same name is quicker next time. The cache holds the food name and the entry it matched, nothing else.

Before a photo leaves your phone, Heliva makes a fresh copy without its location, camera details or the time it was taken. No name, email, Heliva ID or other identifier is sent to Google.

Your meals are health data. Under the GDPR, data about what you eat and weigh is special-category data. We only send it to the AI with your explicit consent, which Heliva asks for before the first AI request (Art. 9(2)(a) GDPR). You can take your consent back at any time under Me › Privacy › Estimates with AI. Without it, you can still log by barcode, by searching the food lists and by weight.

A few other requests also pass through our server without being stored:

• Food search. Searches run against the food lists on our own server. To put your usual foods first, the app sends the names of foods you've logged recently with each search.
• Barcodes. Our server looks up the barcode number at Open Food Facts. Only the number is sent, from our server, not from your phone. Product answers are cached on our server; they hold no data about you.
• Recipe links. When you share a recipe link, our server usually fetches the page, and the recipe site sees our server, not you. Some sites build their recipes with scripts; for those, Heliva opens the page in a hidden browser on your phone, so that site sees your phone as if you'd opened it in Safari, and sends what it read to our server. Heliva keeps no cookies from it.

05What we store about you

To give access and keep the service fair, our server keeps a small record for each Heliva ID:

• Your Heliva ID: a random ID your phone makes. Heliva shows it under Me › Support.
• App version: which version of Heliva, with when the ID was first and last seen.
• AI use per day: how many AI requests of each kind the ID made each day (photo, typed meal, recipe, plan and so on). This enforces the daily limits and protects the service from abuse. It holds counts, never content.
• Subscription: when you buy or restore Heliva Plus, Apple gives the app a signed record of the purchase. Our server checks it and keeps the transaction IDs, the product, the expiry date, the renewal state and Apple's later updates (renewals, cancellations, refunds). It contains no name, card or Apple ID.
• App Attest key: a public key Apple creates for Heliva on your phone, which proves requests come from the real app on that phone. We keep the public key and a counter.
• Restores: when a subscription moves to a new Heliva ID (after a restore on a new phone), we keep a record of which ID it moved from and to, and when. This lets the newer phone take over, and stops a copied purchase from being used elsewhere.
• Apple's notices: Apple tells our server when a subscription renews, lapses or is refunded. We keep a record of each notice so it is handled once.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR) for access and subscriptions, and our legitimate interest in preventing abuse and keeping costs under control (Art. 6(1)(f)) for the daily counts and App Attest.

06Logs

Our server software records each request with its path, which for a barcode lookup includes the barcode number. It never logs search words, meal descriptions or model answers. When something fails, it logs where it failed, and for a rejected purchase or App Attest check, Apple's reason.

In front of it, the HTTPS proxy that serves api.heliva.app and heliva.app records each request: the IP address, the app version (user agent) and the address requested. Food searches are sent so that their words and your recent foods aren't part of that address. Earlier versions of the app sent them in the address, so for those, the proxy's records include the search words and recent foods too. We use these logs to keep the service running and secure. They are kept for no more than 14 days. Legal basis: legitimate interest (Art. 6(1)(f)).

07Where your data goes

Both providers process data only on our instructions, under data processing agreements. The full list, with what each does, is at heliva.app/subprocessors.

Google's abuse monitoring. Google Cloud checks AI requests for misuse. If its automated classifiers flag a request, Google may keep that request for up to 90 days, in the EU, so that it can be reviewed. Google doesn't use it to train its models. Caching of requests is turned off. This monitoring applies to your requests too, which is why we say so here and in the app before you agree. If Google exempts Heliva from it, we will update this policy.

We don't transfer personal data outside the EU/EEA. Our email provider, Migadu, is a Swiss company that stores our mail in France; Switzerland has an EU adequacy decision, which covers any access from there.

Apple is not on this list. Apple handles your purchase, App Attest, Apple Health and iCloud as its own controller under its own terms, which apply between you and Apple.

08Crash reports and usage statistics

Both are off unless you turn them on, in the app's first steps or under Me. Each switch takes effect at once, and turning one off stops it sending.

• Crash reports go to GlitchTip, open-source software we run ourselves on our own server at Hetzner in Finland. A report says where the app failed, the app version, the iPhone model and the iOS version. Before it leaves the phone, Heliva removes everything else: error messages, which could quote something you entered, any ID, the device's name and anything about your food, words, photos or Health data. Crash reports never include session replay, screenshots, screen recordings, the view hierarchy, or anything you type. A crash from while reports were off is never sent.
• Usage statistics go to Umami, open-source software we run ourselves on our own server at Hetzner in Germany. The app sends only the name of a screen or feature from a fixed list (for example "today" or "photo-estimate") and its own version. Umami notes the country and city the connection comes from and keeps no IP address. It uses no cookies or advertising ID, and it records no taps, keystrokes or replays.

Both run on servers we control; no data goes to the projects behind the software. Neither carries your Heliva ID. Crash reports are kept for 30 days and statistics for no more than 90 days. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw under Me at any time.

09Email

The app doesn't ask for your email address, and Heliva sends no marketing email. The two forms on heliva.app are the only places that ask for one (section 10).

If we ever start a newsletter, it will be opt-in: you'll only get it if you sign up. Every email will have an unsubscribe link and our postal address.

When you email us. If you write to support@heliva.app, we keep your email address, your message and our replies so we can help you. Legal basis: our legitimate interest in answering you (Art. 6(1)(f)), or our contract with you where the question is about Heliva Plus. We keep the conversation for 2 years after the last message, then delete it, unless it is needed for a legal claim. Our email is hosted by Migadu (Migadu-Mail GmbH, Switzerland), which stores it in France. Please don't send health details by email; your Heliva ID is all we need.

10The website

heliva.app has no cookies, no advertising and no tracking across sites, and loads no fonts or scripts from other companies. The server logs described in section 6 apply to visits too.

Visit counts. The site counts visits with Umami, on our own server at Hetzner in Germany (section 8). For each page view it notes the page, the page that linked to it, the browser's language and screen size, the kind of browser, system and device, and the country and city the visit comes from. It keeps no IP address and sets no cookie, so one visit can't be linked to the next. If your browser sends Do Not Track, nothing is counted. Counts are kept for no more than 90 days. Legal basis: our legitimate interest in knowing which pages people read (Art. 6(1)(f)).

The site's own script guesses which currency to show prices in from your browser's time zone and language. That happens in your browser; nothing is sent.

The site has two forms. What you send through them goes to our server at Hetzner in Finland and is stored in our database there.

• Contact support: your email address and your message, so we can answer you by email. Legal basis: our legitimate interest in answering you (Art. 6(1)(f)), or our contract with you where the question is about Heliva Plus. Kept for 2 years after you send it, like support email (section 9). Please don't send health details; your Heliva ID is all we need.
• Android: your email address, the words shown beside the button and when you sent it, so we can tell you once when Heliva is on Android. Legal basis: your consent (Art. 6(1)(a)). We send that one email and nothing else. Withdraw any time by emailing support@heliva.app and we delete it. Otherwise it is deleted 2 years after you signed up.

To stop abuse, the server counts the forms sent from each IP address in memory for an hour. The address isn't stored with what you send.

11How long we keep things

• On your phone: until you delete it or delete the app. A full-size meal photo kept for later processing is deleted once the meal is processed, when the meal is deleted, or after 30 days.
• AI requests: not stored by us. Google may keep flagged requests for up to 90 days (section 7).
• Daily AI counts: 13 months, then deleted.
• Crash reports: 30 days, if you turned them on (section 8).
• Usage statistics and visit counts: no more than 90 days (sections 8 and 10).
• Subscription records: for as long as the subscription is active and 13 months after it ends, so that restores, refunds and disputes can be handled.
• Heliva ID, App Attest key and first and last seen: until 13 months after the ID was last used.
• Logs: no more than 14 days.
• Food-name matches (section 4): kept while useful; they hold no data about you.
• Support emails: 2 years after the last message (section 9).
• Support messages from heliva.app: 2 years after they were sent (section 10).
• Android sign-ups from heliva.app: until we've sent the one email, and no more than 2 years after you signed up (section 10).
• Backups: a nightly copy of our database, kept for 15 days.

12Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it or restrict its use. You can object to processing based on legitimate interest, and receive the data you gave us in a portable format. Where we rely on consent, you can withdraw it at any time; that doesn't affect what was done before.

Since we don't know who you are, send your Heliva ID with your request. You'll find it under Me › Support. Email support@heliva.app. We answer within a month.

The data on your phone is in your hands: delete a meal, a weight or the whole app and it's gone.

You can also complain to the Swedish Authority for Privacy Protection (IMY, imy.se), or to the supervisory authority where you live.

13Security

• Traffic between the app and our server is encrypted (TLS).
• On the phone, Heliva's files use the iPhone's data protection.
• Our database is not reachable from the internet.
• Server access is limited to the people who run Heliva and is protected by key-based sign-in.
• Every request carries a short-lived signed token. Where the app has set it up, App Attest ties a Heliva ID to one phone.

No system is perfectly secure. If a breach affects your data, we will tell you and the supervisory authority as the law requires.

14Children

Heliva is for adults. Don't use it if you are under 18: its calorie targets and weight-loss pacing are made for adults, not for bodies that are still growing. If we learn that we hold data about someone under 18, we will delete it.

15Changes to this policy

We may update this policy. Each change is listed here with its date. Material changes are announced in the app before they take effect.

• 6 November 2026: heliva.app counts visits without cookies (section 10); our email host is named (section 9).
• 5 November 2026: crash reports and usage statistics, off unless you turn them on (section 8).
• 4 November 2026: first version.