Privacy Policy

1. Who we are

Carve AI (“Carve”, “we”) is based in Amsterdam, the Netherlands, and makes the Carve iOS app and the website carve.wiki (together, the “Service”). This policy explains what personal data we collect, how we use it, and the rights you have. By using the Service you agree to this policy.

2. What we collect

2.1 What you give us

• Account: your name, email address and profile photo. If you sign in with Apple or Google, we receive the identifier and email they share with us.
• Food: the meals you log, including photos of food you take in the app, barcodes you scan, and portions and macros you enter or correct.
• Training: workouts, exercises, sets, weights and the muscle groups they cover.
• Body and goals: weight, height, target weight, calorie and protein targets, your training split and training days.
• Coach messages: what you type to the coach in the app.

2.2 What we read with your permission

• Apple Health: your daily step count, and only that. We do not read sleep, heart rate, workouts or any other Health data. You can revoke this in the Health app at any time.
• Camera: used to photograph food and scan barcodes. Photos are only stored when you log the meal.

2.3 What we collect automatically

• Usage data: which screens and features you use, and errors that occur.
• Device data: device model, iOS version, app version and language.
• Website analytics and advertising: which pages you visit on carve.wiki and which ad or link brought you here, via Google Analytics and the Meta pixel. The Meta pixel also records when you tap through to the App Store, so we can tell which ads lead to downloads. Both run only after you accept cookies. Decline and we measure nothing.

3. How we use it

• To run the Service: store your log, show your muscle map and your week, and sync between your devices.
• AI features: to recognise the food in a photo and to answer your coach questions, we send the photo or your message, together with the relevant parts of your log, to an AI provider (see section 4). The answer comes back to you; the provider does not use it to train its models under the API terms we use.
• To improve the Service: understand which features are used and where the app fails.
• To keep it safe: detect and prevent abuse and security incidents.
• To reach you: account, security and support messages. No marketing email unless you ask for it.
• To comply with the law and enforce our Terms of Service.

4. Who sees your data

We do not sell your personal data. We share it only with the providers we need to run the Service, and only what they need:

• Supabase (database, authentication, file storage): everything you log. Privacy policy
• OpenAI and Anthropic (AI): food photos, coach messages and the parts of your log needed to answer. OpenAI · Anthropic
• FatSecret (food database): the barcode or search term you look up. Not your identity. Privacy policy
• RevenueCat (subscriptions): an anonymous app user id and your purchase status. Privacy policy
• Apple (App Store, Sign in with Apple, payments, push notifications, Apple Health). Privacy policy
• Vercel (website hosting) and Cloudflare (bot protection on the website). Vercel · Cloudflare
• Google (Analytics and Ads, website only): which pages you visit and which ad brought you here, once you have accepted cookies. Privacy policy
• Meta (Facebook and Instagram ads, website only): which pages you visit and whether you tapped through to the App Store, once you have accepted cookies. Privacy policy

We may also disclose data if the law requires it, or as part of a merger or sale of the business, in which case we will tell you first.

5. Your rights

Under the GDPR you can:

• Access a copy of your data
• Correct data that is wrong or incomplete
• Delete your account and all data in it, from Settings in the app or by emailing us
• Export your data in a machine-readable format
• Object to certain processing, and withdraw consent (for example Apple Health access) at any time
• Complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens

To exercise a right, email privacy@carve.wiki. We respond within 30 days.

6. How long we keep it

• Account and log data: until you delete your account, plus up to 30 days in backups.
• Food photos: as part of your log, until you delete the meal or your account.
• AI requests: we do not keep a separate copy of what was sent; the provider's own retention applies (typically 30 days for abuse monitoring).
• Website analytics: kept by Google Analytics for up to 14 months and by Meta for up to 12 months, and only if you accepted cookies.

7. Security

• Encrypted in transit (HTTPS/TLS) and at rest in our database
• Row-level security so that one account can never read another's data
• Sign in with Apple and Google, or email with verification
• Bot protection via Cloudflare Turnstile on the website

No system is perfectly secure. If we learn of a breach that affects you, we will tell you.

8. Cookies

Signing in and keeping the site secure needs a few cookies. Those are always on, because the site does not work without them.

Google Analytics, Google Ads and the Meta pixel set cookies to measure which pages you visit and which ad brought you here. Those stay off until you accept them, and you can change your mind here at any time.

9. Children

The Service is not for people under 16. We do not knowingly collect data from children under 16. If you believe a child has given us data, email privacy@carve.wiki and we will delete it.

10. International transfers

Some providers above process data outside the EU, notably in the United States. Where that happens we rely on the EU-US Data Privacy Framework or Standard Contractual Clauses.

11. Changes

When this policy changes, the date at the top changes with it. For material changes we notify you in the app or by email. Continuing to use the Service after that means you accept the new version.

12. Contact

• Privacy questions: privacy@carve.wiki
• Support: support@carve.wiki