Privacy Policy

Temmy is developed by KhanhKom. This policy is effective from 2026-11-12. For privacy questions, email khanhgarbygarby@gmail.com.

If you don't sign in, the following data stays on your device and is not sent to us: meal photos, dish stickers, notes, dish names, collections, dish prices; saved calories and nutrition, weight, weight goals, and information used to calculate calorie goals (biological sex, birth year, height, activity level); eating locations when you grant location permission, and place names.

Accounts are optional (see below). The app has no ads, no tracking for advertising, and does not sell data. It measures anonymous usage with Google Analytics for Firebase (you can turn it off, see below). On Android, some other Google components the app uses send diagnostic data to Google on their own.

Signing in is optional. You only need an account to sync your diary across phones and to add friends.

Sign-in: with Apple or Google. We receive an account identifier, your email (with Apple this may be a private relay address) and a display name if provided. We never receive your password.
Sync: once signed in, your diary is backed up to the Temmy server so you can use it on another phone: moments, dishes (name, time, rating, notes, calories and nutrition, price), place names and coordinates, tags, collections, companions, weight history (the numbers only, not weigh-in photos), and a few preferences (body profile, calorie goal, the Calories switch). Cut-out dish sticker images (not the original photos) are stored on Cloudflare R2. Original photos and weigh-in photos never leave your phone.
Where it's stored: the API server and database run in Vietnam; images and encrypted database backups are stored on Cloudflare R2 (Asia-Pacific). Connections are always encrypted (HTTPS through Cloudflare).
Friends: friends only see what you choose under What friends see. By default they see dishes and sticker images only; calories, places, prices, thoughts and weight are off unless you turn them on. Moments set to “Only me” never show. Weigh-in photos are never shared. You can remove, block or report anyone at any time.
Verification: when you sign in, the app sends a Firebase App Check token (as in the abuse-prevention section) to stop automated sign-ups.

Calories and weight are health-related data. They are used only to sync for you and to show friends exactly what you choose — never for advertising, never sold, and never shared with any other third party.

When you use AI dish reading

Temmy uses AI dish reading only after you agree in the in-app prompt. You can also enable “Auto-read dishes” in settings.

The app sends to Temmy's server on Cloudflare Workers:

An extracted dish photo as a JPEG around 448px with a plain background.
If extraction fails, the entire photo is sent after being resized to around 896px. It may show the whole table, including people or objects in the frame.
A pre-guessed dish name if available; language and country code from device settings, not GPS; and whether nutrition estimates are requested.

The server forwards this content to Microsoft Azure OpenAI to identify the dish and estimate calories, then returns the result to your device. Temmy's server does not store photos and calls Azure with storage disabled (store: false). According to Microsoft's documentation, data is not used to train models. Content flagged by the abuse monitoring system may be stored by Microsoft and reviewed by Microsoft staff.

AI results, including dish name, dish category, and estimated calories, are saved on your device.

Abuse prevention and daily AI limits

The app sends a random device ID created by the app, not a hardware ID; the platform type, iOS or Android; and a device attestation token from Firebase App Check. Android uses Google Play Integrity and iOS uses Apple App Attest. This confirms requests come from the real app.

The server stores the number of AI uses that day under the device ID. This counter is overwritten daily and resets at 0:00 UTC. Cloudflare processes IP addresses and technical request logs to operate the service. The server logs errors only, without photo content.

Usage data (Google Analytics for Firebase)

To learn which features are used and what needs fixing, the app sends usage data to Google Analytics for Firebase:

What is sent: the names of screens you open and actions such as opening the camera, saving dishes, AI dish reading (success or error), sharing, backing up, turning Calories on or off, logging a weigh-in, setting a goal, and the path you picked at the start (diary only / with calories / with a weight goal), with counts (for example how many dishes were saved). Firebase adds a random app installation ID (app instance ID), device model, OS version and an approximate region derived from a masked IP address.
Never sent: photos, dish names, notes, search text, place names or coordinates, prices, calories, weight, weight goals, height, birth year or sex.
No advertising: the app does not collect advertising IDs (Android Advertising ID, IDFA), denies all advertising uses of the data, keeps Google signals off and is not linked to Google Ads. Data is kept for at most 2 months.
Turn it off: go to Settings → Share anonymous usage data. When off, the app stops sending and deletes Analytics data stored on the device.

See how Firebase handles data.

Operating system and other third-party services

Maps: Google Maps on Android and Apple Maps on iOS display places where you ate. On Android, the Google Maps SDK sends Google device information (brand, model, OS version), crash reports, IP address, an SDK-specific identifier and map interactions, so Google can run and improve its service (details).
On-device dish cut-out and text reading (Android): Google ML Kit runs on your device to cut dishes out of photos and read text on receipts; ML Kit does not send the photos. It does send Google device and app information, identifiers, performance metrics and error codes for diagnostics (details). On iOS this uses Apple's built-in frameworks.
Place names: Android Geocoder or iOS CLGeocoder looks up a place name from coordinates. Coordinates are sent to the operating system provider.
Optional app fonts: When you choose a font pack that is not already installed, the app downloads it from jsDelivr. jsDelivr sees your IP address.
Backups: A backup is a local file. If you enable “Copy to Google Drive” on Android, the app writes it to the location you choose through the system file save dialog. We do not access your Google Drive.
Sharing: A photo or poster leaves your device only when you share it through the system share sheet.
Notifications: Reminders are local notifications on your device, without a server.

Your choices, retention, and deletion

Deleting your account: go to Settings → Account → Delete account, or follow the account deletion guide. Your account, synced data, images on Cloudflare R2, friends and reactions are deleted right away, and Sign in with Apple access is revoked. Database backups expire within 35 days. The diary on your phone is not deleted unless you choose to remove it.

Access / export: your synced data is the diary in the app; export a backup in Settings → Backup → Export, or email us for a copy of the data on our server.

You can delete on-device data in Settings → Delete data. Delete saved backups separately in Backup Management. Uninstalling the app also deletes on-device data.

The server does not retain photos sent for AI. The AI usage counter tied to the device ID lasts for the day and is overwritten daily. You can email khanhgarbygarby@gmail.com to request deletion of the counter.

Stopping AI: turn off “Read every table automatically” in Settings and don't tap dish reading. The app then sends no photos to the AI. You can also contact khanhgarbygarby@gmail.com.

Contact: khanhgarbygarby@gmail.com.

Children: Temmy is for people aged 13 and over. It is not directed at children and does not knowingly collect data from children under 13. If you learn that a child under 13 has used AI dish reading, contact us and we will delete the device counter.

When this policy changes, the effective date on this page will be updated.

Health note

AI calorie numbers are estimates and can be wrong. They are not medical advice. Ask a doctor or registered dietitian before making health decisions.