What to look for in a privacy-respecting nutrition app
A checklist for judging any health app: who pays for it, what it collects, where the data lives, and whether you can get it back. With honest answers for GreaseFit, including the awkward ones.
I build a nutrition tracker, so read this with that in mind. The checklist below works on any health app, and I have tried to write it so it stays useful if you choose something other than mine. Where GreaseFit answers a question badly, I have said so. A buyer's guide that scores its author perfectly is not a buyer's guide.
Food logs are unusually revealing. They know when you eat, how much, whether you drink, whether you stopped logging for three weeks in February. Weight history on top of that is a medical record in all but name. It is worth ten minutes of due diligence.
Who pays for it?
This is the first question, because it tells you who the customer is. If an app is free, shows no ads and sells nothing, the money comes from somewhere, and that somewhere is usually you, in a form you never explicitly agreed to.
Look for a clear answer: a subscription, a one-time purchase, a donation model, or ads. Vagueness here is the warning sign.
GreaseFit: the free tier is the whole tracker. Barcode scanning, custom foods, recipes you build by hand, workouts, water, weight and every nutrient it tracks are free. There is a paid tier called GreaseFit Supporter, weekly or yearly. It changes two things: the AI quota goes from five credits a day to twenty-five, and it unlocks the AI recipe scan, which reads a recipe page and creates the recipe and its foods for you. That scan is the most expensive call the app makes, which is the honest reason it is not free. New accounts do get twenty-five credits a day for their first week, but the recipe scan is not part of that. Nothing else sits behind the paywall. The people who pay for Supporter fund the app for everyone else.
The honest footnote: that is a small business model, and you should factor that into how long you expect any independent app to be around. More about who builds it is on the about page.
Is there an ad SDK in the build?
This is not the same question as "does it show me ads". An advertising SDK can sit in an app collecting identifiers without ever rendering a banner. The tell is the store privacy label. If it lists advertising, tracking or "data linked to you" for marketing, an SDK is there regardless of what the interface looks like.
Ask specifically whether the app collects your advertising ID, the IDFA on iOS or its Android equivalent. That identifier is what lets a food log be joined to the rest of your online life.
GreaseFit: no ads and no ad SDKs, and ad-ID collection is explicitly disabled in the analytics configuration. You cannot verify that from outside, which is why the general advice above matters more than my say-so.
What analytics are collected, and can you switch them off?
No ads does not mean no telemetry. Nearly every app measures something. The useful questions are what, why, and whether there is a real in-app opt-out rather than a link to an OS-level setting.
GreaseFit: Firebase Analytics and Firebase Crashlytics are both present. Crashlytics tells me when something broke and on which device. Analytics tells me which screens people actually use, which is how a one-person project decides what to build next. Ad-ID collection is off. Usage statistics are on by default. There is a toggle in your profile to switch them off, and it works. Crash reports are always on, because I need them to keep the app working. None of this is anonymous: it is linked to a random identifier rather than your name or email address, which makes it pseudonymous.
I could claim zero analytics, and it would not be true. The privacy policy also notes that these services, like several others it names, may process data outside the EU under the EU-US Data Privacy Framework or Standard Contractual Clauses. That is a real caveat, not a footnote to bury.
Can you get your data out?
Export is the difference between a tracker and a hostage situation. Ask what format you get, whether it is self-serve or an email request, and how long the request takes. An app confident in its product does not make leaving hard.
GreaseFit: there is no one-click export button today. Under GDPR you can request access to your data by emailing support, and I will comply, but a self-serve export is a genuine gap. I would rather name it than let you discover it on your way out.
Coming the other way is easier: a Lose It export imports in a single upload, described on the Lose It alternatives page. That is the only importer that exists so far.
Can you actually delete it?
Deletion should mean the account and the data behind it, not hiding the login screen. Ask whether deletion is available in the app or requires an email, what the timeline is, and what is retained afterwards for legal or billing reasons.
GreaseFit: you can delete your account in the app under Profile > Settings > "Delete account", or ask by email. The privacy policy spells out what happens next. Personal data is removed as far as possible, and what cannot be removed, such as logs, scan photos and AI chats, is anonymised. Your username, which is your email address, is kept for one year to prevent misuse, so it cannot be used for a new account in that time. Payment and invoice records are kept for up to seven years for tax. Email requests are answered within one month, or up to two months longer for complex or numerous requests. Deletion is irreversible.
The point worth copying is not the timeline, it is that it is written in the policy rather than in a blog post. Hold every app to that standard, including this one.
Where does the data live, and under whose law?
Hosting location decides which law applies and who can compel access. Look for a named country and ideally a named provider. "Secure servers" means nothing. Check whether sub-processors are listed too, because the analytics and email vendors are part of the answer.
GreaseFit: the privacy policy names it. Servers in Amsterdam, Netherlands, on DigitalOcean. I am one developer in Amsterdam, so GDPR is not a compliance posture adopted for marketing. It is the law I live under. The exceptions are named too: usage statistics and crash reports (Firebase and Apple), server error reports (Sentry), internal notifications (Slack), website payments (Stripe) and website hosting (Vercel) may be handled outside the EU, and so may AI processing.
In transit everything is encrypted to modern standards. Sessions use signed, short-lived tokens, and passwords are never stored in a readable form. The specific algorithms and libraries are not published, which is deliberate.
What happens on the device itself?
Worth asking, and worth being suspicious of the answer, because "encrypted at rest" is the most abused phrase in app marketing.
GreaseFit: on Android, locally cached credentials get an extra layer of protection from the platform. That is Android-specific. I am not going to inflate it into a blanket claim covering every device, because the iOS side does not have the equivalent in place yet.
While we are being blunt about limitations: GreaseFit requires an account and a connection. There is no offline mode and no local database, so your log lives on the server rather than on your phone. For some people that is a dealbreaker, and it should be. What the app does and does not do is listed on the features page.
What happens if the company is acquired?
Privacy policies survive acquisitions about as well as ice survives August. Almost every policy contains a clause permitting data to transfer in a merger or sale. Read it, expect to find one, then ask the more useful question: does this app have an asset worth buying that consists of your data?
An ad-funded tracker with a large user base has one. A subscription app with no advertising business has much less.
GreaseFit: it is one person's project, and there is no ad business here to sell. But nobody can honestly promise anything about years from now, and you should distrust anyone who does. The practical protection is the same in every case: you can delete the account.
The condensed checklist
Ask any health app these eight things:
- Who pays for it, and what does the paid tier actually change?
- Does the store privacy label mention advertising or tracking?
- Does it collect your advertising ID?
- What analytics exist, and is there a real opt-out inside the app?
- Can you export your data yourself, and in what format?
- Can you delete your account, and is the timeline written down?
- Which country hosts it, and which sub-processors are named?
- What does the policy say about a merger or sale?
If an app cannot answer six of those from its own website, that is the answer.
More questions of this kind are covered on the FAQ. If the answers above suit you, creating an account is free.
