Privacy policy
Last updated: 26 October 2026
NAWAI is a nutrition tracking app published by DALIA IT. This policy explains what data is processed, why it is processed and how you can delete it.
Controller and contact
Data controller: DALIA IT.
Privacy contact: [email protected].
Data processed
NAWAI may process the following information when you use the app:
- Account: first or display name, email address, Supabase user ID and sign-in method.
- Nutrition profile: age or date of birth, height, weight, biological sex if provided, goal, activity level, training frequency, calorie and macro targets.
- Meals: foods entered, photos, written descriptions or voice messages voluntarily submitted for analysis, transcripts, nutrition estimates, corrections and history. A correction can include the photo and previously analysed meal items.
- Guest discovery in earlier versions: guest session ID, meal and attempt status before account creation. Current versions no longer offer this first photo analysis without an account. Any subsequent account link remains verified to preserve existing meals and prevent reassignment.
- Apple Health: date of birth, biological sex and height for your profile; weight and average steps to prepare your plan; steps, workouts, active energy and resting energy for local tracking, only with the corresponding iOS permissions. Plan references and parameters are saved after confirmation. Enabling Weight tracking in Health and data reads the latest and future measurements and saves them to the account. A weight selected for a plan is saved as disclosed in its confirmed summary. Workout details and energy totals stay on iPhone; a minimal game event can be linked to your account to award Nawa without duplicates.
- Security and operation: session status, dated AI permission decision, cloud sync, Firebase App Check attestation material and technical tokens, together with App Attest and DeviceCheck signals depending on the app version, attempt limits and technical diagnostics needed to operate the app and prevent abuse.
- Subscriptions: verified Apple transactions, subscription status, offer reference and campaign attribution when available. Optional commercial journey measurement uses opaque IDs and usage events; it contains no foods, photos, voice messages, weight, macros or Apple Health data.
- Companion: progress, rewards, outfits and equipped items saved with your account so you can return to your character.
- Product search: search terms, entered or scanned barcodes, response status and duration, linked to your account ID to operate and diagnose the search service.
- Apple Search Ads attribution: only after you agree to optional measurement and in the production environment, NAWAI may obtain the Apple Ads source, campaign and ad-group references, and attribution type through AdServices. This flow uses no IDFA or matching with activity in other apps.
NAWAI does not collect data for advertising tracking and does not sell user data.
Purposes
Data is used to create and secure your account, sync across devices, estimate calories, protein, carbohydrates, fat and portions, personalise nutrition targets, import Apple Health information when authorised to prefill your profile, show workouts and calculate energy progress, provide support, prevent abuse and improve reliability.
NAWAI’s nutrition estimates are indicative. They are not medical advice, a diagnosis or a treatment recommendation.
Service providers
- Supabase: authentication, databases, storage and server functions.
- Resend: confirmation, sign-in and security emails.
- OpenAI: meal photo recognition, description and correction analysis, voice message transcription and AI nutrition lookup, only after your explicit permission. Guest discovery data from earlier versions remains covered by this policy.
- OpenFoodFacts: lookup and enrichment of the public food catalogue when this source is used.
- Apple HealthKit/iOS: Apple Health access only with your explicit permission.
- Google Firebase App Check: verifies app and device integrity to help prevent abuse. This verification exchanges attestation material and technical tokens with Google.
- Google Cloud Functions for Firebase: verifies Apple-signed purchase evidence in a private function called by NAWAI’s Supabase servers. This evidence may include transaction and product identifiers, subscription dates and status, and an identifier linking the purchase to the NAWAI account. This service does not receive meals, photos, voice messages or Apple Health data.
AI analysis permission
Before the first transmission, NAWAI asks for one shared permission covering photos, descriptions, voice messages and corrections. The data and service provider are explained before you accept and remain available in Profile. Permission is not requested for every meal or input method. It does not replace iOS camera and microphone permissions or the separate choices for Apple Health features and optional usage measurement.
Without permission, no new AI analysis starts and no content is sent to OpenAI for that analysis. You can reconsider during a new attempt you choose to make, or withdraw permission in Profile. Withdrawal blocks new AI transmissions; it does not by itself delete previously saved results. Dated decisions are kept so restoring an old backup cannot reinstate withdrawn permission.
Analyses support your diary and coach advice. Current coach reviews are calculated within NAWAI; Apple Health data is not sent to the meal analysis service.
Apple Health
Apple Health is optional and NAWAI does not write any data to it. Personal info import reads only date of birth, biological sex and height to estimate energy needs. Reading alone does not replace saved details. A complete, usable import is shown on the same page for review before Save. If a detail is missing, unusable or outside the shared history, the field is named and explained; manual entry starts from the last confirmed profile without merging an incomplete import.
Save sends the confirmed personal details to the NAWAI account. The app only reports them as saved after server acknowledgement; an error keeps the edits on the page so the user can retry. Cancel discards them. If date of birth, biological sex or height changes while a plan exists, the Programme journey then allows the user to review and confirm the plan. Saving personal details does not silently change its targets.
Plan import can read date of birth, biological sex, height, weight and average steps. Date of birth and biological sex help estimate energy needs; height and weight help prepare the goal; average steps help estimate daily activity. Averages use the available complete days within the previous 14 days. After the plan confirmation action, the selected references and parameters — including the weight and activity parameters used in the calculation — are saved with the plan to the NAWAI account. This import does not automatically enable tracking of future weigh-ins.
In Health and data, Weight tracking reads the latest and future Apple Health measurements and saves them to the NAWAI account for progress tracking. This action discloses both reading and account storage; it does not require a second cloud-sync control. A decision specific to this use is acknowledged in the canonical profile before these measurements are transferred. Turning Weight tracking off stops new imports and uploads; measurements and receipts already saved are kept. A Health weight selected when confirming a plan can also be saved as disclosed in that plan summary. Raw HealthKit identifiers are not sent.
Activity is independent of Weight tracking. It uses steps, workouts, active energy and resting energy to support tracking and Coach suggestions. Workout details and energy totals stay on this iPhone. An eligible workout can help Nawa progress: the account receives a game event with its type, award date and a derived identifier to prevent duplicates, without workout duration, calories, route, heart rate or a raw HealthKit identifier.
iOS category-specific read permissions and NAWAI feature choices are distinct. Missing data does not establish that permission was denied. The history shared by iOS can limit access to older measurements, including height. Permissions are managed in Apple Health or iPhone Settings. Health information and its available or missing categories are not used for usage analytics, advertising, tracking or AI training, and are not sent to the meal analysis service. The current Coach uses confirmed references and deterministic calculations. AI meal analysis consent remains separate. Previously saved data can be deleted through the available controls or with the account.
Retention
The application logs for this verification function contain a request identifier, the operation type and status, and timing measurements. Signed evidence and its contents are not recorded in these logs. Google/Firebase’s service-specific processing and retention practices are described in its privacy documentation.
Account information, including accepted activity summaries, is kept for as long as your NAWAI account exists or until you explicitly delete it. Turning off sync stops new transfers without deleting history. Local and cloud data is deleted when you delete the account.
Dictation uses OpenAI’s Realtime API. The NAWAI relay forwards audio content without storing it. This does not mean OpenAI retains no data: its data-retention documentation describes default abuse-monitoring logs that may contain submitted content and are kept for up to 30 days, with exceptions including legal or safety needs. Specific retention controls are available subject to conditions; NAWAI does not promise zero retention by this provider.
Guest discovery data from an earlier version remains associated with that session until it is linked to an account. Records needed for security and discovery limits are separate from the food diary. You can request deletion of your guest data directly in the app: Profile > Delete my guest data, then explicitly confirm; creating an account is not required. The request is durably recorded so cleanup can resume if interrupted. Meals already transferred to an account remain in that account. You can still contact [email protected] with any questions.
Account deletion
You can request account deletion directly in the app: Profile > Account > Delete my account, then explicitly confirm.
After the request is accepted, NAWAI closes your local session. Durable server-side processing deletes the account, associated cloud data and cloud backup; it may finish asynchronously. Deleting your NAWAI account does not automatically cancel an Apple subscription, which you can still manage with Apple.
Your rights
You can request access to, correction of or deletion of your data through the app or by contacting [email protected].
Security
NAWAI uses encrypted connections, secure authentication and established cloud providers. No system is infallible; data is handled with safeguards appropriate to its sensitivity.
Changes
This policy may evolve with the app. The version published at https://nawai.ai/privacy is the applicable version.