Privacy Policy

Effective 13 October 2026 · Applies to the Satoa app for iPhone

Summary

Satoa keeps your data on your iPhone, plus a backup in your own iCloud. There are no accounts, no developer-operated servers, no analytics and no advertising. Your journal, photos and goals are never sent to us. The coach can optionally use Apple's cloud model. That is off by default and described below.

iCloud backup

Satoa keeps an automatic backup of your journal in your own iCloud (the app's private iCloud Drive container, protected by your Apple Account). The backup lets a new install, after the app is deleted or on a new device, restore your data. Apple stores it on your behalf. It is never stored on a Satoa server.

The backup holds your journal, water, goals, Routine, weigh-ins, the photos your entries still use, and your settings. It never holds values filled in from Apple Health or the API key of a custom AI server. Satoa keeps the latest backup and the one before it. Turning off iCloud for Satoa stops new backups. To delete the existing ones, open Settings, then your Apple Account, iCloud and its storage list, and choose Satoa.

What is stored on your device

• Journal entries: logged foods, portions, photos, water and weigh-ins. Deleting an entry also deletes its photo.
• Goals and preferences: macro targets, Routine foods, favourites, frequently logged foods.
• Coach conversations: generated by Apple Intelligence on your iPhone, or on Apple's Private Cloud Compute if you choose Apple cloud (see below). Satoa does not save them. They disappear when you close the app or start a new chat.
• Widget data: a small daily summary shared with the Satoa widgets through a standard iOS App Group on the same device. On the Lock Screen it is hidden while the iPhone is locked if you hide sensitive data.
• Reminders: the meal, water and weekly review reminders you turn on are local notifications that your iPhone schedules and shows. They use no push service and nothing about them leaves your iPhone.
• Custom AI server key: kept in your iPhone's keychain. It is never backed up.

Deleting the app deletes all of this from your iPhone. The only other copy is the iCloud backup described above.

Apple Health (HealthKit)

With your permission, Satoa reads your height, weight, date of birth and sex from Apple Health when you tap Fill in from Apple Health, to suggest your daily targets, and writes energy and nutrient values for the foods you log, and the water you add with the water counter. Values filled in from Apple Health stay on your iPhone and are left out of the iCloud backup: Satoa never sends HealthKit data anywhere.

Dishes estimated from a photo go to Apple Health only if you turn on Include photo estimates in Data & sync, and they are marked as estimates there. A Routine food that Satoa logs ahead of its meal time is sent to Apple Health once that time has passed. Samples Satoa wrote stay in Apple Health if you delete Satoa; you can remove them in the Health app.

Open Food Facts (network)

To show product information, Satoa queries the community-run Open Food Facts database. Requests contain only the barcode you scan, the words you search for, the name of a dish Satoa recognized (to suggest packaged matches), or a product category when Satoa looks for alternatives. They contain no personal data, identifiers or location, though like any web request they show your IP address to Open Food Facts. Product photos are loaded from Open Food Facts too. Open Food Facts' own privacy policy applies to their service.

On-device food recognition

By default, dish recognition uses a machine-learning model bundled in the app, and nutrition labels are read with Apple's on-device text recognition. These photos are processed entirely on your iPhone. Apple Intelligence's vision model, which also runs on your iPhone, names the dish in a dish photo.

Apple cloud for the coach (optional)

By default the coach runs on your iPhone and nothing leaves it. In Profile, under Coach, you can choose Apple cloud. Satoa then sends the coach's requests to Apple's Private Cloud Compute, the server model behind Apple Intelligence. A request holds what the coach needs to answer: your question and the journal summary it reads (foods, nutrient totals and goals for the last seven days), a product's details with your goals and advice settings for a product tip, a meal you type in a sentence, a dish photo to be named, or the name of a dish for a nutrition estimate. Satoa's developer receives none of it. Apple states that Private Cloud Compute does not keep these requests and that Apple staff cannot read them; Apple's own terms apply. Apple cloud needs a connection and has a daily limit. When it can't answer, the coach answers on your iPhone and says so. Switching back to your iPhone in Profile stops all requests to Apple cloud. After a restore from iCloud this setting starts on your iPhone.

Your own AI server (optional)

If you set up a custom AI server (any OpenAI-compatible vision server) in Profile, Satoa sends each dish photo and a fixed prompt directly to the server you enter, with the API key you provide. There is no default server, so nothing is sent until you enter one. Plain http is used only for addresses on your local network; anything else needs https. Satoa's developer has no access to that server and sees none of that traffic. Services such as OpenRouter pass the photo on to the model's provider, whose privacy policy applies. After a restore from iCloud, this setting starts switched off.

Donations (optional)

Satoa has no in-app purchases and takes no payments. The Support link in Profile and on this website opens Ko-fi (ko-fi.com) in your browser. Satoa sends nothing to Ko-fi, and Ko-fi's own privacy policy applies to what you do there.

Siri, Shortcuts and exports

"Log my weight with Satoa", "Log food with Satoa" and "Log water with Satoa" run through Apple's speech handling and write to the same journal on your iPhone. CSV exports and shared day summaries go only where you choose to send them.

What we never do

• No accounts or sign-in.
• No analytics, crash reporting or telemetry.
• No advertising or trackers.
• No sale or sharing of personal data.

Children

Satoa collects no data from anyone, of any age, including children.

Changes

If a future version of Satoa changes any of this, this page will be updated and the app will ask before enabling anything that sends new data anywhere.

Contact

Satoa is developed by Nicolò Campari. Questions or data requests: [email protected]