How No Nonsense Fitness collects, uses, and protects your personal data under Irish and EU data protection law.
This website uses Cloudflare as a content delivery network and security layer. Cloudflare may process your IP address and request metadata to protect the site from malicious traffic. See Cloudflare’s Privacy Policy.
Last updated: 14 October 2026
This policy covers nononsensefitness.ie and FoodSussed (previously NoNonsense Fit Calorie Tracker, No Nonsense: Calorie Counter, No Nonsense Tracker or NNTracker). The tracker requires an account. Diary records are cached on your device and sync to your account subject to health-data consent; progress photos stay on your device. Online features, including photo recognition, food lookups and optional analytics, send information to services described below.
Keith O'Beirne, trading as No Nonsense Fitness in Ireland, is the data controller. Contact keith@nononsensefitness.ie for privacy questions, access, export or deletion requests.
Account required: sign in to use the tracker. The app keeps diary entries, calorie and nutrient targets, weight, measurements and preferences in local storage and IndexedDB as part of account caching. Progress photos are stored on your device only. Clearing site storage, browser eviction or losing your device can lose device-only records and changes that have not synced. Export records and save photos you need to keep.
Account sync: Supabase processes your email, account identifier and authentication details to provide sign-in, recovery and account security. Optional Google sign-in also involves Google processing your sign-in request and returning your provider identity to Supabase. Access and refresh tokens are stored on your device to maintain the session and are sent to the account service when needed; they are not included in ordinary account exports. With health-data consent, diary entries, targets, weights and preferences sync to its Ireland database (eu-west-1). Preferences include profile details, measurements, exercise records and saved foods. Row-level security restricts account records to their owner. Existing records from earlier, pre-account versions remain on that device unless you import or remove them; they do not provide a signed-out diary mode in the current app.
The account mode keeps a copy on your device and an IndexedDB queue for pending changes. Importing an original device diary requires your explicit confirmation and is allowed only into an empty account diary. Signing out retains the account's cached records for your next sign-in. On a shared device, clear site storage after exporting anything you need. Progress photos are excluded from account sync and diary exports; save photographs separately.
We use requested service provision as the Article 6 basis for diary/account functionality. Diet, weight and related records can reveal health information. We ask for explicit consent under GDPR Article 9(2)(a) before remotely storing or syncing those records, or analysing them for Coach guidance and Food processing reports. Account-mode tracker functionality requires sign-in when enabled.
Coach and Food processing: FoodSussed analyses your diary, nutrition, weight and target data to provide FoodSussed Coach guidance and Food processing reports. Coach reviews and Food processing report totals are calculated on your device and are not sent to an AI provider. Optional photo recognition is separate and works as described below. Coach and Food processing are on from the start after you accept the current health-data consent. You can turn either one off at any time in Account. Turning one off stops its future analysis but does not delete your synced records or saved preferences. Use Account → Your data → Withdraw health-data consent to withdraw consent; this pauses sync and erases your synced tracker records.
FoodSussed Coach: when Coach is on, your goal, selected difficulties, suitability answer, general safety-pause flag, chosen action, check-ins and confirmed diary dates save with your account preferences. A one-way SHA-256 digest checks whether a confirmed diary day has changed; it does not store a second copy of the food names or nutrient values. Turning Coach off stops its personalised guidance but does not delete saved preferences; the account export and deletion controls also cover these preferences. For changes saved after the consent-evidence update, a protected server record also captures the Coach settings, suitability or pause state and confirmed targets actually saved, linked to the relevant health-consent receipt and a server timestamp. It records saved account state, including when an existing default was saved; it is not proof that you read a particular suggestion or separately opted into Coach. These saved-state records are erased when you withdraw health-data consent or delete your account. Coach is automated education, not a human coaching or medical service.
Optional Android watch import: in compatible Android releases, you can explicitly permit Health Connect to share today's active-calorie total. The app reads that aggregate only when you request an import; it does not request heart rate, location, full workouts, background access or write access. The latest imported daily total and its import time save with your account preferences under your health-data consent. They are not used for advertising. Account export/deletion includes this total. Remove it under Account → Connected watch; revoke access separately in Android Health Connect settings.
When Google Play billing is enabled, Google handles the payment and subscription purchase. FoodSussed receives a purchase token associated with your account, product and base-plan identifiers, trial status, subscription state, expiry, renewal and acknowledgement details. The app sends the token and sign-in authorization to our Cloudflare billing service, which checks the subscription with Google and keeps restricted purchase-token and entitlement records in Supabase for access, restoration and subscription reconciliation. Verified subscription records are associated with your signed-in FoodSussed account. We do not receive or store your card or bank details. This processing supports the subscription contract and prevents unauthorized access. Deleting the FoodSussed account does not cancel a Google Play subscription; cancellation is managed through Google Play.
Meal, nutrition-label or ingredient-list scan: choosing a scan sends the selected image and its format, scan identifiers and your sign-in token to our own Cloudflare Pages Function. It forwards the metadata-stripped image to Google Gemini, with one model attempt per scan, to estimate foods or read a label. Google receives the image and the recognition instructions; we do not include your account identifier, email, diary or IP address in that recognition request. This differs from saving a progress photo in your diary.
To enforce scan allowances and prevent duplicate requests, we store your account identifier, a random request identifier and the request date/time. These records contain no image, ingredient text or nutrition result. A daily scheduled cleanup and subsequent scanner requests prune older request records; account deletion removes your request records. Anonymous daily totals may remain. Scanner diagnostics record outcome, duration and model, without your account identifier or image.
You can take a photo or upload an existing image, including a screenshot of the complete ingredients list for the exact food. Both choices use the same recognition service. Crop out personal details before uploading.
Image retention: for all three scan modes, our scanner uses the image in memory for the request and does not save it to a photo store, database or application log. There is no saved scan-image copy in our application to retain after the request. This is not a guarantee of immediate memory erasure or zero retention by Google or Cloudflare; their infrastructure and security-log retention periods are not established by our code. Use food-only images without people, documents or identifying details; manual food entry is available instead. Check estimates before saving them.
Photo-scanning lawful basis: we rely on your consent under GDPR Article 6(1)(a), and your explicit consent under GDPR Article 9(2)(a) where the image or diet information can reveal health data. The health-data consent notice names optional ingredient-list, meal and nutrition-label scanning through Cloudflare to Google Gemini. Accepting it does not send a photo: you choose each scan. Food search and manual entry remain available without photo scanning. To withdraw, use Account → Your data → Withdraw health-data consent. This blocks future scan reservations and health-data sync and erases your synced diary, targets, weights and preferences, including saved ingredient text. It does not recall an image already sent to Gemini. See Google's Gemini API terms and Cloudflare's Data Processing Addendum for provider processing.
Scan records: our database keeps your account identifier, request identifier, UTC date, creation time, scan mode and refund token/time to manage scan allowances and prevent repeat requests. These rows contain neither the image nor extracted text. A daily cleanup is being introduced with the security release to remove request rows whose UTC date is more than 32 days old and account-linked scan-event and ingredient-contribution rows older than 32 days. Until that job is deployed and runs successfully, those rows can remain longer. Request-time cleanup provides an additional check. Withdrawing health-data consent does not erase these allowance rows; deleting your account removes them. Separate daily provider-budget totals contain no account identifier and are cleaned up at the same step when their dates are more than 62 days old. Application scan logs contain provider/model, outcome, duration and attempt count, not the image or extracted text; their infrastructure retention is not defined in this code.
Service protection counters: we keep account-linked request counts for catalogue lookups, billing checks and missed-barcode reports, plus daily sync write and byte counts, to protect the service from abuse. They contain identifiers, operation/time and counts, without a second copy of diary contents. Daily cleanup removes counter rows whose UTC date is more than seven days old; delays can extend this period. Account deletion removes these counters, and account export includes them.
The current scanner does not create account-linked photo scan-started or OCR-result telemetry. Any earlier account-linked scan events and contributions are erased when you withdraw health-data consent or delete your account.
Food search downloads catalogue data and can send your search text to our food service. Barcode lookup sends the product code to our barcode service and/or Open Food Facts. Hosting and lookup services receive connection details such as your IP address and request metadata. With current health-data consent and Community food sharing on, successful supported barcode lookups also create private scan-event records linked to your account so we can measure food-data coverage. Withdrawing health-data consent erases those linked events.
The extracted ingredient text returns to your device for checking and classification. A standalone Snap result is displayed without automatically saving a diary entry. In the diary-entry flow, the confirmed text and processing result are saved to that diary entry and sync with your private account diary. They stay with the entry until you remove it, withdraw health-data consent or delete your account; entry deletion can leave a sync deletion marker, and backup limits are described in section 7. Answers to the three quick questions stay in the diary entry. Optional missing-product submissions are separate and described below. Choosing Wrong level? sends ingredient text, the shown level, optional expected level and rules version as feedback without an account identifier in the feedback row. Pending or rejected feedback is scheduled for deletion after 180 days; accepted feedback has no automatic expiry in the code.
Missed barcode scans: when you are signed in, have accepted health-data storage and Community food sharing is on, an online missed scan sends the barcode, an Ireland or UK device-language hint when available, the reason it was missed, app version and UTC day to our Supabase service. A miss record has no account or scanner identifier. We keep each record for 90 days; after that we keep only weekly totals per barcode and country, for up to 24 months. We use them to improve product coverage and do not sell or publish them. The app suppresses repeat reports for the same barcode on the same device on the same UTC day. Turn Community food sharing off in Account settings to stop future missed-scan reports. Because the stored miss has no account link, account deletion cannot identify and remove an individual miss record.
Community food sharing is off unless you explicitly turn it on under Account settings. Ingredient scans and private diary results still work with sharing off. Turning it off stops future linked scan-event records and missed-scan reports. It does not erase earlier records. Withdrawing health-data consent or deleting your account removes linked events and ingredient contributions; daily cleanup otherwise bounds them to 32 days, subject to job completion. You can also contact us to request removal. This setting is separate from your explicit health-data consent for account diary storage.
We ask before the first submission. If you agree, products you add after a missed barcode scan, or ingredient text you confirm for a barcoded food, can be sent for checking and possible addition to the shared food database. Future qualifying products are sent while the setting remains on.
A submission contains the barcode, product name, brand if given, nutrition per 100 g or 100 ml or the ingredient text you confirmed, source type, an Ireland or UK device-language hint when available, and app version. It does not contain your diary entry, account details, photo or answers to the three quick questions. The product rows hold no account identifier. A separate per-account daily counter is used only for rate limiting and kept for up to 8 days.
Unreviewed and rejected submissions are deleted after 90 days. Accepted product facts may be kept as part of the shared food database. Submissions are product facts, not your health data. The lawful basis is your consent under GDPR Article 6(1)(a). Where a submission could reveal information about your diet, we rely on your explicit consent under GDPR Article 9(2)(a), given through the card. Use Send missing product details in Account settings to withdraw consent. Turning it off stops future submissions and clears the device submission queue. Withdrawal does not remove product facts already accepted into the shared database.
On pages loading our cookie controls, Google Analytics 4 (Google Ireland Limited / Google LLC) and Microsoft Clarity (Microsoft Ireland Operations Limited / Microsoft Corporation) load after you accept analytics. They process browser identifiers, page views, device information, interactions and approximate location. Clarity also records page sessions. These records can identify a browser. Masking alone does not establish that all sensitive page content is excluded.
The new tracker account page has no GA4 or Clarity loader. Other website pages reached from the app can use them. Analytics is optional and based on consent. Decline on the banner or use the button below to withdraw consent for this site and reload with analytics disabled. Withdrawal stops future loading; contact us about previously collected data.
cookie_consent choice lasts 365 days unless removed sooner._ga and session cookies default to 2 years, subject to browser limits and settings. Cookie lifetime is separate from server retention. Google cookie documentation (read 5 September 2026).You can also remove cookies in your browser. Clearing all site data additionally deletes local diaries and photos: export first. Google's privacy policy and Microsoft's privacy statement explain their processing.
Contact and feedback forms send your email address and the fields you submit through Cloudflare and Resend to Keith's inbox. We use them to respond to your request and investigate problems, on the basis of our legitimate interest in providing support. Do not submit passwords, health records or unredacted diary screenshots. Messages remain for handling and necessary follow-up; privacy requests are retained only as necessary to demonstrate how the request was handled. Marketing requires a separate consent.
If you contact us through WhatsApp, Meta processes your contact details and messages under its own privacy terms. See also Resend's privacy policy.
Some pages link to partner businesses and mention their discount codes. A partner may recognise a visit from our site or use of a code. Once you follow a link, the destination site is governed by its own privacy policy and may set its own cookies.
Our configured production service endpoints use HTTPS. This protects data in transit; it is not end-to-end encryption that hides your records from the service operator. Cloudflare provides website delivery/security and our scanner endpoint, Google Gemini provides photo recognition, Supabase provides accounts, and Google/Microsoft provide optional analytics. Providers may process IP addresses and operational records to deliver and secure their services.
The Ireland database location does not mean all processing stays in Ireland or the EEA. Hosting, recognition, support and provider subprocessors can involve other countries. Applicable contracts and transfer safeguards must cover that processing. See Supabase's DPA, Cloudflare's DPA and Vercel's privacy policy. We do not sell your personal data.
Request deletion without installing or signing into the app: email keith@nononsensefitness.ie with the subject “Delete FoodSussed account”. Use the account email if possible. We will verify ownership proportionately and handle deletion of the account and associated records. You may request erasure of particular records while keeping your account; we will confirm the scope and any applicable limits when handling your request. Do not send your password.
In the tracker: use More → Save backup file or Export as spreadsheet for device records. In account mode, More → Account → Export my data includes server records and this device's pending changes/conflicts. More → Account → Delete account requests erasure of the account and its server diary, targets, weights and preferences, then clears its cache on this device. The account export also includes health-consent receipts and their exact notice text, saved Coach/target-state evidence and relevant private subscription metadata. Reusable purchase tokens, credentials and scanner refund capabilities are excluded. The account controls are available in account mode.
Consent receipts: we preserve the account reference, purpose, acceptance or withdrawal, platform channel, server receipt time and the exact notice version, SHA-256 and wording associated with health-data consent. Receipt records remain after withdrawal or account deletion so that we can demonstrate the consent history; they do not contain your diary or progress photos. This differs from the saved Coach/target-state records, which are erased on withdrawal or account deletion. We have not set an approved automatic expiry for health-consent receipts; necessary retention and erasure requests are assessed rather than assuming an indefinite or fixed legal period. A receipt preserves the notice you accepted even if this policy later changes.
Local records stay until you delete them or browser storage is cleared/evicted. The application has no scheduled inactive-account purge. Its account-deletion action targets the primary account records; provider backups and operational logs have separate lifecycles. We also keep encrypted tracker-record recovery snapshots on a seven-day rotation in our existing Google Drive backup storage. Older snapshots are removed when a backup run completes successfully; outages can delay removal. These are restricted to recovery, and any recovery must respect account deletions and consent withdrawals recorded after the snapshot. Snapshots do not contain progress photos or authentication passwords. Removing an individual diary entry can retain a deletion marker for synchronisation until account erasure. We have not set a verified provider-backup/log expiry for the account service; no immediate erasure of every infrastructure copy is promised. Any necessary legal/security retention will be explained in response to a request.
Original pre-account diaries, original photos, copies on other devices and files you exported need separate removal on those devices. Signing out or uninstalling the Android wrapper is not an account-deletion request and may leave browser storage intact. Clear the site's local storage on each device when you want those copies removed. We cannot recover an unbacked-up local diary.
We only collect personal data that we need for the purposes described below. Under GDPR we must have a lawful basis for each processing activity. The table summarises what we collect and the legal basis we rely on.
| What we collect | Purpose | Legal basis |
|---|---|---|
| Account email, identifier and authentication records | Create, secure and recover the tracker account | Contract / steps prior to a contract |
| Synced food, nutrition, weight, measurement, exercise, target and preference records | Provide multi-device tracker storage and synchronisation, FoodSussed Coach guidance and Food processing reports | Contract for the account service; explicit consent under GDPR Article 9(2)(a) for health-related storage, sync and analysis |
| Purchase token, account binding and subscription/access records | Verify, restore and maintain subscription access; prevent subscription abuse | Contract for the subscription service; legitimate interests in service security |
| Optional ingredient-list, meal and nutrition-label images and recognition results | Read ingredients or estimate nutrition using Google Gemini via Cloudflare | Consent under GDPR Article 6(1)(a); explicit consent under GDPR Article 9(2)(a) where health information is revealed |
| Website usage data (via Google Analytics) | Understand how the site is used and improve it | Consent |
| Page interactions — clicks, scrolling, mouse movement, tied to a browser/session identifier (via Microsoft Clarity) | Find broken and confusing parts of the site, such as buttons that do nothing | Consent |
| Launch notification email and consent evidence (when enabled) | Confirm the request and send one FoodSussed Android launch message | Consent |
| Contact details and message content (contact form / WhatsApp) | Respond to your query | Legitimate interests / consent |
Launch notifications are a separate, optional email signup, not an app account or a newsletter. The form stays closed until this service is enabled. When enabled, we use your email address only to confirm your request and send one message when FoodSussed launches on Google Play. The checkbox is not pre-selected; email confirmation is required. You can ignore an unwanted confirmation email or use its unsubscribe link. Every launch message will include an unsubscribe link. You can also contact keith@nononsensefitness.ie to withdraw consent or request deletion.
We store your email, the exact consent wording and version, request and confirmation times, and one-way hashes of confirmation/unsubscribe links in our restricted Supabase database. Cloudflare handles the form and Turnstile bot check; Brevo receives the recipient address and message for email delivery. Our rate limiter uses a keyed hash of the connection IP, with short-lived hourly counters, without retaining the raw IP in the signup database. These are pseudonymous security records, not anonymous data. Providers may keep their own security and delivery logs; their separate retention is not established by this code.
The signup service is prepared to remove unconfirmed requests after 24 hours, hashed hourly rate records after two hours (anonymous global quota totals after 25 hours), confirmed requests after 180 days or 30 days after the launch email is sent, whichever comes first. Daily cleanup can delay removal by up to a day, or longer during an outage. Unsubscribing removes the signup immediately; provider backups and delivery logs have separate lifecycles. These limits take effect only after the database migration and cleanup are enabled. We rely on consent for the notification and legitimate interests for proportionate abuse prevention. Signup does not send your email, link tokens, ingredients or health records to analytics; session recording is disabled on the app landing page.
You may request access, correction, erasure, restriction, portability, or object where applicable. You may withdraw consent without affecting earlier lawful processing. Contact Keith at the email above. We respond within one month; if a lawful extension is necessary, we explain it within that month. See GDPR Articles 12–21.
You may complain to Ireland's Data Protection Commission. The tracker is intended for adults aged 18 and over; this statement is not an age-verification control.
Changes to this policy appear here with a revised date. The privacy link remains accessible without an account. Contact keith@nononsensefitness.ie if a data flow or retention period needs clarification.