privacy policy
Last updated 4 November 2026.
In short
No ad trackers, no ads, we never sell your data. have this keeps your answers, food log and weigh-ins to give you food ideas that fit your day. We treat these as health data and use them only with your consent, which you can take back at any time. To read your photos and write ideas and recipes, we send what each request needs to our AI providers, who may keep it for up to 55 days to check for misuse. Photos are deleted once they’ve been read, and your voice is turned into words on your iPhone. You can see, export, clear or delete your data in the app.
Who we are
have this is made by Nerdy Sloth Studios Ltd ("we", "us"), a company registered in England and Wales (company number 17531099), registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. We are the controller of your personal data: we decide how and why it’s used. For anything about your data, email havethisprivacy@
What we collect
- Account: your email address, or your Sign in with Apple identifier and the email you chose to share.
- Your answers: goals, sex, age (and the date you gave it), height, weight, goal weight and pace, activity, diets and diet days, allergies, foods you don’t eat, what’s always in your kitchen, the cooking appliances you have, cooking time, budget, holiday dates, country, units and time zone.
- Your plan: your calorie and nutrient targets, meal sizes, calorie rollover, badges and streaks.
- What you log: food and drink, water, weigh-ins, saved meals and leftovers.
- What you ask for: what you type or say, the ideas we show you, your yes and no swipes, and the recipes we write for you and any changes you ask for.
- Photos you take or choose of menus, fridges, cupboards, shopping receipts, recipes, products, plates and labels. A photo is sent as it is, so crop out names, addresses or card numbers first. From a receipt we keep only the names of the foods and drinks on it.
- Details about someone else that you choose to give, such as a friend’s allergy when you ask for ideas for them. We use them only for that request.
- Your subscription: from Apple and our payments provider, whether it’s active, your purchases and its dates (when it started, renews or ends), and our record of the subscription emails we send you.
- A record of each AI request (which feature and when), so Kitchen magic, your daily AI allowance, can count it and keep use fair.
- Sign-in and app records: when you signed in, the internet address and app details the sign-in came from, and the app’s version number, which each request carries so we can ask you to update an old version.
- Feedback you send from Settings (with the app’s version and your phone’s system, such as iOS 26), complaints, privacy requests and emails you send us.
- Your agreements: each time you agree or take your agreement back, with which wording and when.
- Usage counts, unless you turn them off: which features are used, how long things take, and what went wrong when the app has a problem (the error and where in the app’s code it happened), with your country, the app’s version and that it’s an iPhone. They don’t include what you eat or log, your weight, your answers or anything about your health. They use a random ID kept on your phone, not linked to your account. “Share usage counts” starts ticked when you set up have this (or when we ask again): you can untick it then, or turn it off any time in Settings > Privacy choices.
- From Apple: if you use Sign in with Apple, a message if you delete that Apple Account or stop using it with have this. We then delete your have this account if Sign in with Apple was its only way in, or otherwise sign you out.
Only on your phone
- Your username and profile photo.
- Your reminder settings and any fasting days you mark.
- Fridge memory: the names of the foods your fridge and cupboard photos and receipts showed, kept for up to 7 days so you don’t have to photograph them again. When you use them for ideas or a recipe, they go with that one request.
- What you’re still typing, and where you left off.
- Your usage counts choice, with when you made it and which wording you saw. When counting starts, one “yes” is also sent to our analytics provider under your phone’s random ID.
- If setup ends because the age given is under 18: the date it ended (never the age), kept in this iPhone’s keychain for 30 days so setup can’t simply start again with a different age. iOS may keep it even if the app is deleted.
Where Apple says age rules apply, setup may also ask Apple’s own age check. Its answer isn’t kept or sent.
Photos aren’t kept on your phone either: your phone’s copy is deleted once it’s been read.
Signing out clears all of this except the under-18 date. Settings > Your data > Clear my history also clears the fridge memory, and Delete my health data clears it and your fasting days.
How we use it
- To give you meal ideas and recipes that fit your day, your diets and your allergies, and to keep your food log and show your progress. Your own yes and no swipes help rank your ideas.
- For safety checks: allergies, diets, alcohol, age and food safety, and a check of what you type for worrying words.
- To check and improve our numbers and ideas, using totals across everyone’s food logs.
- To count AI use for Kitchen magic, keep use fair, and keep accounts and have this secure.
- To send the emails have this needs: sign-in codes, account and security notices, and subscription reminders and notices.
- To answer your feedback, questions, complaints and privacy requests.
What you type into Ask, Just tell us and the food boxes is checked for worrying words (for example about not eating, or feeling unsafe) by an automatic check, which can use our AI providers. If something sounds worrying, we show a calm note instead of ideas, and that request isn’t kept.
If you mention pregnancy or breastfeeding, we don’t keep it.
We don’t sell your data or use it for advertising.
Our legal bases
- Our contract with you (the terms): your account, ideas, recipes, food log and subscription, and the emails have this needs.
- Your explicit consent (UK GDPR Article 9(2)(a)), for health data: your food logs, water, weight, height, age, sex, goals, targets, diets, allergies and the foods you avoid. You give it with the tick when you create your account, or when we ask again, and we don’t save health data to our servers before you do. It covers giving you ideas, the safety check of what you type, and checking and improving our numbers and ideas using totals across everyone’s food logs. have this can’t give you ideas or keep your food log without it, so agreeing is needed to use the app.
- Our legal duties: handling complaints and privacy requests, showing what you agreed to, and the subscription notices the law requires. If you include health details in a complaint or privacy request, we use them only to deal with it, under the law’s condition for handling complaints and requests (Data Protection Act 2018, Schedule 1, paragraph 6).
- Our legitimate interests, which we balance against yours: keeping accounts and have this secure (sign-in and security records, the security check, and the record that stops a deleted account being made again at once for a fresh day of AI use); keeping use fair and our costs in check (records of AI requests); seeing how have this is used and what goes wrong, so we can improve it (usage counts, which you can turn off at any time); backups; the warning before an unused account is deleted, and security notices; and answering feedback and emails. If you include health details in feedback or an email, we use them only to reply.
Who we share it with
We share your data only with suppliers who process it for us. Our contracts let them use it only to provide their service to us, and require them to protect it at least as well as this policy does.
- Our hosting provider runs our database, photo storage, server and sign-in, in London, UK. Its support and operations teams may reach the data from the United States and Singapore.
- Our AI providers read your photos and what you type (or say, as words), write ideas and recipes, estimate a dish’s vitamins from its name and ingredients, and help check what you type for worrying words. Each request carries only what it needs, such as your diets and allergies, the meal and its calories and, when you cook from what you have, what’s in your kitchen. We don’t add your name, email or account ID, but a photo is sent as it is. They may keep requests for up to 55 days to check for misuse, and their staff may review requests flagged as possible misuse. They may not use your data to train their own AI models. We use a second provider only when the first is unavailable. Both are in the United States; the second may also use other countries where it has facilities.
- Our payments provider handles subscriptions with Apple. Once you have an account, it gets your account’s random ID and your purchases and, to check purchases, a device ID from Apple, your phone’s model, its iOS version and language, and your App Store country. It gets no health data. It’s in the United States.
- Our email provider sends our emails: sign-in codes; account, security and subscription notices; the confirmation of a complaint you send in the app; and copies of complaints and feedback to our own inbox. It sends from the European Union and is a US company.
- Our inbox provider holds the emails you send us, the copies of your complaints and feedback, and our replies. Its servers may be in the UK, the European Union or the United States.
- Our analytics provider counts usage, unless you turn it off. It gets no health data. It stores the counts in the European Union and is a US company.
- Our security provider may run a check when you ask for a sign-in code, to make sure a person, not a program, is signing in. It gets your phone’s internet address and technical details from the sign-in screen, through its worldwide network.
- Professional advisers (such as lawyers) and insurers, when we need their help; and the police, courts or regulators, when the law requires it.
- If the company or have this is sold, your data may pass to the new owner so they can keep providing have this.
Apple handles Sign in with Apple and App Store payments as its own business, under its own privacy policy.
Your voice is turned into words on your iPhone: we receive only the words.
Where it goes
Your account is kept in the UK. When a supplier handles your data outside the UK, the transfer is protected by:
- UK adequacy regulations: for the European Union, and, for US companies certified to it, the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), which covers our second AI provider, our email provider, our inbox provider and our security provider; or
- the UK’s International Data Transfer Addendum to the EU standard contractual clauses, in our contracts with our hosting provider (for its teams in the United States and Singapore), our main AI provider, our payments provider, our analytics provider (for its US staff), and our second AI provider for countries outside the data bridge.
Email us for a copy of these safeguards.
How long we keep it
- Your account (your answers, settings and what you’ve saved): until you delete it. If an account isn’t used for 2 years, we delete it: we email you first, and signing in keeps it. Accounts with an active subscription aren’t deleted this way.
- An account whose setup was never finished: 30 days (7 days if its email was never confirmed).
- Food logs, weigh-ins and water: 2 years (or 1 year, if you choose that in Settings > Your data).
- Your history (the ideas we showed you, your yes and no swipes, and recipes you didn’t save): 90 days. Anything in Saved stays.
- The details behind each set of ideas (what you typed or said, and the answers it used): 30 days. After that we keep only the foods we spotted, the ideas we showed you and the one you chose, until the 90 days are up.
- Photos: deleted once they’ve been read; one that’s never read is deleted within 3 hours.
- Records of AI requests: 90 days.
- A new sign-in email you’re changing to: up to a day, until the change is done.
- Logins: one you don’t use for 60 days ends, with the internet address it came from. Security logs: 60 days.
- Feedback and support emails: 12 months.
- Complaints, privacy requests and our replies: 2 years after they’re closed.
- Your agreements, your subscription’s dates and our record of the subscription emails: until your account is deleted.
- Backups: up to 90 days.
- Usage counts: our analytics provider deletes them after about a year.
- Our AI providers’ copies: up to 55 days. Our email provider’s: up to 30 days.
When you delete your account, we delete it and its data, except that: records of AI requests stay for the rest of their 90 days, no longer linked to you; a complaint’s record stays for its 2 years, without the link to your account or your own words (our inbox keeps its copy for the same time); a scrambled copy of the account’s email address and Sign in with Apple identifier, with how much of that day’s AI allowance it had used, stays for up to 3 days, so the account can’t be made again at once for a fresh day of AI use; and copies in backups and with our suppliers go within the times above. Our payments provider’s record is deleted with your account. If you used Sign in with Apple, you can also remove have this from the Sign in with Apple list in your iPhone’s Settings.
Keeping it safe
We protect your data with measures such as encryption when it travels and limits on who can reach it. Other people using have this can’t see your data. In the company, only people who need it to run have this and answer you can reach it.
Your rights
You have the right to see the data we hold about you and get a copy; to have it corrected or deleted; to take it with you in a file; to ask us to pause using it (to restrict it), for example while we check something you’ve told us is wrong; to object (below); and to take back your consent at any time. Requests are free.
In the app: Settings > Your data > Export my data (one file of what you gave us or chose to keep: your account email and date, your answers and settings, what you’ve logged, saved and sent us, and your agreements; not the ideas and recipes we suggested), Clear my history (the ideas you were shown, swipes and recipes you didn’t save) and Delete my health data (your food log, water, weigh-ins and answers, keeping your account and subscription); and Settings > Delete account. You can correct your answers in Settings, edit or remove entries in your food log and weigh-ins, and change your sign-in email in Settings > Sign-in email; you can remove any single entry whether or not you subscribe. Deleting your account doesn’t cancel an App Store subscription.
For anything else, including a copy of anything the file leaves out, email havethisprivacy@
To take back your consent: delete your health data in Settings > Your data (have this then asks you to set up and agree again before you use it), or delete your account. Taking back your consent doesn’t affect what we did before.
Your right to object
You can object at any time to the uses that rely on our legitimate interests (listed under Our legal bases) by emailing havethisprivacy@
To stop usage counts, turn off Analytics in Settings > Privacy choices: new counts stop at once and any not yet sent are dropped (counts already sent can’t be linked to you, and our analytics provider deletes them after about a year). The usage counts choice is yours, not the phone’s: signing out, deleting your account or another account signing in ends it.
Computer-made decisions
Computer programs make some decisions on their own, using your answers, what you log and what you type or say: the ideas and recipes we show you and their order; your suggested calorie and nutrient targets; whether a request gets ideas or a calm note instead; whether you can use have this (the age check when you set up, or in Ask); when Kitchen magic pauses AI for the day; ending a login unused for 60 days; and deleting an account unused for 2 years. Our ideas, targets and recipes are for you to choose from, not medical or nutrition advice. You can ask us about any of these decisions, tell us what you think of one, or ask for a person to look at it again, at havethisprivacy@
Complaints
Not happy with how we’ve handled your data? Please tell us first, in Settings > Your data > Make a complaint or by email to havethisprivacy@
Our social media
We run have this accounts on Instagram, TikTok and X. Each platform handles your data under its own privacy policy. We use messages and comments you send us there only to reply, and delete them 12 months after the last one where the platform lets us. If you send a privacy request or complaint there, we move it to our privacy inbox and deal with it from there.
Children
have this is for adults (18+). If you give an age under 18 while setting up, setup ends: we clear the app and delete any account already made (within 30 days, if it can’t be deleted at once). If you tell us in Ask that you’re under 18, we ask your age again: under 18, we delete your account and its data; 18 or over, nothing about it is kept.
Changes to this policy
We may update this policy; the date at the top shows when it last changed. We’ll tell you in the app about changes that matter to you, and if we want to use your health data in a new way, we’ll ask you first.
Contact
Your data: havethisprivacy@