Cindarby Hestia Studios

Privacy Policy

Last updated: October 6, 2026

At Hestia Studios ("we", "our", "us"), we believe tracking your nutrition shouldn't mean sacrificing your privacy. This policy explains what data we collect, how we use it, who we share it with, and the rights you have over it. It applies to the Cindar mobile app and the hestia.fit website.

1. Data We Collect

  • Account information: name, email address, and the authentication identifier returned by your sign-in provider (Apple, Google, or Clerk email/password).
  • Profile and goals: daily calorie goal, diet preset, macro targets, and any preferences you set inside the app.
  • Food and nutrition data: the meals you log, restaurant names, calories, macros, fiber, sugar, sodium, the time of each entry, and the source (photo, receipt, manual, or chain restaurant).
  • Food photos and receipt images: photos you take or upload to be analyzed by our AI. Photos are processed to extract nutrition information and stored alongside the resulting entry; you can delete them at any time.
  • Health data (optional): if you grant permission to Apple Health (iPhone) or Health Connect (Android), we read your active energy burned to compute a more accurate daily budget. If you turn on sync, we write the nutrition you log (calories, protein, carbs, fat, fiber, sugar, sodium) and your weigh-ins back to Apple Health or Health Connect. On iPhone, with your permission, we also read your height and body composition (body-fat percentage and lean body mass) to personalize your calorie goal.
  • Fitness data (optional): step count and activity data from Apple Health or Health Connect, used only to refine your daily energy balance. Not shared with third parties.
  • Purchase history: your subscription tier, renewal status, and transaction identifiers, received from the Apple App Store or Google Play through our purchase processor, RevenueCat, so we can grant or revoke premium access. We never see your payment card.
  • Approximate location (optional, transient): if you use the "find nearby restaurants" feature, your device location is sent to OpenStreetMap to look up nearby places. We do not store your coordinates.
  • Diagnostic logs: minimal server logs (timestamp, route, status code, anonymized request id) used to diagnose errors. Logs are retained for 30 days and contain no food, photo, or health data.
  • App events: a short, fixed list of moments in the app — finishing setup, opening or closing the upgrade screen, sharing a meal card, and whether the Find tab returned results — recorded on our own servers so we can see where the app is confusing or broken. See section 11.

2. How We Use Your Data

  • To provide the core service: logging meals, computing remaining calories, and rendering your history.
  • To run the AI analysis on photos, receipts, and text descriptions you submit.
  • To sync nutrition and weight data with Apple Health or Health Connect when you enable it.
  • To respond to support requests you send us.
  • To detect abuse, debug crashes, and keep the service secure.

We do not sell your personal data. We do not share it with advertisers or data brokers. We do not use your data to train third-party AI models.

3. Apple HealthKit and Health Connect Disclosure

Cindar uses Apple HealthKit (on iPhone) and Health Connect (on Android) only with your explicit permission. In compliance with Apple's HealthKit policy and Google's Health Connect policy:

  • We never use health data for advertising or any other use-based data mining purpose.
  • We never sell, share, or disclose health data to third parties.
  • Health data is only used inside the app to compute your effective daily calorie budget and calorie goal, and to write back the nutrition and weigh-ins you log.
  • Cindar's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.
  • You may revoke access at any time: on iPhone in iOS Settings → Privacy & Security → Health → Cindar; on Android in Health Connect → App permissions → Cindar.

4. Camera, Photo Library, and Location Permissions

  • Camera: used only when you tap the camera button to photograph a meal or receipt. Images are sent for AI analysis and stored against the resulting log entry.
  • Photo library: used only when you choose to import an existing photo for analysis.
  • Location (when in use): used only when you tap the "find nearby restaurants" feature, and only for the duration of that lookup.

You can revoke any of these permissions at any time in iOS Settings → Privacy & Security → Cindar, or on Android in Settings → Apps → Cindar → Permissions.

5. Third-Party Processors

We use a small number of trusted third parties to power the service:

  • OpenAI (United States): processes your food photos, receipts, and text descriptions to estimate calories and macros. Per our agreement, OpenAI does not use this data to train its foundational models.
  • Clerk (United States): handles authentication, including Sign in with Apple and Sign in with Google.
  • Replit (United States): hosts our API server and PostgreSQL database.
  • Apple App Store and Google Play: process all subscription and one-time purchases. We receive only the transaction identifiers and entitlement status needed to grant access; we never see your payment card.
  • RevenueCat (United States): keeps track of your purchases and subscription status across the App Store and Google Play. It receives your account identifier and the stores' transaction records, never your payment card.
  • Google Analytics (United States): measures visits to the hestia.fit website. It is not used in the app. See section 11.
  • OpenStreetMap (community-operated): powers nearby-restaurant search. Only your transient query coordinates are sent.

6. Data Retention and Deletion

We keep your data for as long as your account is active. You can delete your account and all associated data at any time — either from inside the app (Settings → Account → Delete Account) or by emailing support@hestia.fit. See our Account Deletion page for full details.

After deletion, we may retain minimal records required by law (e.g. anonymized financial records, abuse-prevention logs) for the period required by applicable regulations.

7. Your Rights (GDPR, UK GDPR, CCPA)

Depending on where you live, you have the right to: access the personal data we hold about you, correct inaccurate data, export your data in a portable format, delete your data, restrict or object to processing, and (for California residents) opt out of the "sale" or "sharing" of your data — though we do not sell or share personal data as those terms are defined under CCPA.

To exercise any of these rights, email support@hestia.fit. We will respond within 30 days. We will not discriminate against you for exercising these rights.

8. International Data Transfers

Our processors are located in the United States. If you access Cindar from outside the U.S., your data will be transferred to and processed in the U.S. We rely on Standard Contractual Clauses or equivalent safeguards where required by law.

9. Security

All traffic between the Cindar app and our servers is encrypted in transit using TLS 1.2+. Data at rest is encrypted by our hosting provider. Authentication tokens are short-lived and rotated automatically. We follow industry best practices, but no system is perfectly secure; if you discover a vulnerability, please report it to support@hestia.fit.

10. Children's Privacy

Cindar is not directed to children under 13, and we do not knowingly collect personal data from anyone under 13. The App Store age rating for Cindar is 17+. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it promptly.

11. Analytics and Marketing

We do not embed third-party advertising SDKs. We do not use cross-app or cross-site tracking. We do not show ads, and we do not sell or share your data with advertisers or data brokers.

We do not use a third-party analytics SDK. Cindar records a short, fixed list of product events on our own servers — finishing setup, opening or closing the upgrade screen, sharing a meal card, and whether the Find tab returned any results — so we can see where the app is confusing or broken. Each record holds only the name of the moment, an optional one-word qualifier such as which screen opened the upgrade page, your platform, and the app version. It never contains meals, photos, health data, or anything you typed.

These events are linked to your account, because they are recorded from your signed-in session; that is also how deleting your account deletes them. They carry no advertising identifier, are not used to track you across other apps or websites, and are never shared with advertisers or data brokers. We also receive automatic crash reports (error message, stack trace, app version, platform) when the app closes unexpectedly. Event records are kept for up to 180 days and crash reports for 35 days.

The hestia.fit website is different: it uses Google Analytics to measure visits — which pages are viewed, the site you came from, and general device, browser, and location information. Google Analytics sets cookies in your browser to do this. It is not connected to your Cindar account, and the app does not use it.

12. Changes to This Policy

If we make material changes to this policy, we will notify you in the app and update the "Last updated" date above. Continued use of Cindar after a change constitutes acceptance of the revised policy.

13. Contact

If you have questions about your privacy or data rights, contact us at support@hestia.fit.