Privacy Policy
In short: we store your email and password hash; food photos are sent to an AI provider for analysis and are not stored by us; we do not use advertising trackers. Your account can be deleted in one step directly in the app. Below is the same information in a formal document.
1. Personal Data Controller
The controller is Самозанятый Лежанкин Евгений Александрович, Tax ID (INN) 732716427959, email address support@foodgpt.ru.
This policy is developed in accordance with Art. 18.1 of the Federal Law No. 152-FZ dated July 27, 2006, "On Personal Data" and defines the procedure for processing the personal data of the service users of FoodGPT. Version dated 24 August 2026
2. What data is processed
| Data | When collected | Purpose |
|---|---|---|
| Email address | Upon registration | Account login, sending receipts, responding to inquiries |
| Password hash | Upon registration | Password verification during login. The password itself is not stored and is unknown to the controller |
Device identifier (cookie foodgpt_device) | When used without registration | Tracking free requests. Not linked to identity |
| Request counters, subscription plan, access duration | When using the service | Compliance with limits and provision of paid access |
| Payment details: number, amount, plan, status | Upon payment | Payment accounting, receipt generation, refund processing |
| Fact and date of document acceptance, their version | Upon registration | Confirmation of consent receipt |
2.1. The controller does not process special or biometric categories of personal data, does not collect geolocation, contacts, lists of installed applications, and does not request full name, date of birth, address, or phone number.
2.2. Product data entered manually by users (barcode, name, ingredients) is not personal data: it is information about a product, not a person.
3. Legal Grounds
- Subject's consent (cl. 1, part 1, art. 6 of 152-FZ) — provided upon registration via a separate checkbox; the text of the consent is published here.
- Performance of a contract to which the subject is a party (cl. 5, part 1, art. 6 of 152-FZ) — Public Offer and Terms of Use.
- Fulfillment of duties imposed on the controller by legislation (cl. 2, part 1, art. 6 of 152-FZ) — in particular, tax accounting of received income.
4. Purposes of Processing
Registration and authentication; providing access to service functionality; compliance with free and paid plan limits; accepting payments and generating receipts; handling inquiries, claims, and refund requests; confirming the fact of consent receipt.
Processing is carried out by mixed means — using automation tools and without them. Decisions producing legal consequences are not made solely by automated processing.
5. Where photos go
5.1. This is the most important point to understand: image analysis is performed by a third-party service. The controller does not train its own model but transmits the image via an API to one of the AI providers. The provider is selected automatically from a configured chain: Qwen, HydraAI, OpenRouter, Groq, or a local model on the controller's server.
5.2. Neither the email address, account ID, nor device ID — nothing that could identify you — is transmitted along with the image. The provider receives only the image and the text of the request.
5.3. The controller does not store the image: it resides in the server's RAM only for the duration of the request processing and is not written to disk or object storage. Previously, images were stored for up to one hour for re-analysis; this practice has been discontinued.
5.4. Shooting metadata (device model, coordinates) is removed from the image on the user's device before being sent to the server.
5.5. Image processing on the provider's side is governed by their own policy.
5.6. Food and packaging images are not personal data. This is why the Terms of Use explicitly prohibit uploading images of people and documents: such uploads violate the Terms, and the controller does not consider them as a transfer of personal data on its part.
6. Transfer to Third Parties
6.1. Personal data is transferred only to those without whom the service cannot function, and only in the necessary volume:
- Payment service Robokassa — for accepting payments. The controller does not receive or store bank card details.
- Hosting provider — for hosting servers and the database.
- AI providers — receive the image and request text without any user identifiers (Section 5).
6.2. The controller does not sell personal data, does not transfer it to advertisers, does not use advertising trackers, and does not build profiles for targeted advertising.
6.3. Data is provided to government authorities in cases and in the manner established by the legislation of the Russian Federation.
7. Storage and Cross-Border Transfer
7.1. Databases containing personal data of citizens of the Russian Federation are located within the territory of the Russian Federation in accordance with part 5, art. 18 of 152-FZ.
7.2. Personal data is not transferred outside the Russian Federation. Requests to AI providers, whose servers may be located abroad, contain the image and request text and do not contain personal data (Section 5).
8. Storage Periods
| Data | Period |
|---|---|
| Photos | Not stored. The image lives in server memory for the duration of the request, is transmitted to the AI provider, and ceases to exist after the response; it is not written to the controller's disk or object storage |
| Email, password hash, counters, consent details | As long as the account exists |
| Payment details | Period established by tax legislation |
| Device ID and free request counter (without account) | Indefinitely. Free requests without registration are granted once and do not renew, so the counter does not reset — including when clearing browser data: the identifier is not stored on the device but is recalculated (Section 12) |
| Manually entered product data | Indefinitely — this is information about the product, not about you |
8.1. Data is destroyed upon reaching the processing purposes, upon withdrawal of consent, or upon account deletion — whichever comes first — except for data that the controller is required to store by law.
9. Your Rights
9.1. In accordance with art. 14 of 152-FZ, you have the right to:
- obtain information regarding the processing of your personal data;
- demand the clarification, blocking, or destruction of incomplete, outdated, inaccurate, or unlawfully obtained data;
- withdraw consent for processing;
- appeal the controller's actions to Roskomnadzor or in court.
9.2. Inquiries should be sent to support@foodgpt.ru from the address provided during registration. The response time is 30 calendar days.
10. Withdrawal of Consent and Account Deletion
10.1. The fastest way is to delete your account: in the app, open the "Profile" section — the icon in the top right corner or the side menu item — select "Delete Account" and confirm. The email and password hash are deleted immediately and permanently.
10.2. Consent can be withdrawn by sending an email to support@foodgpt.ru. Processing will cease, and data will be destroyed within 30 calendar days from the moment the withdrawal is received, provided there are no legal grounds for continuing the processing.
10.3. After withdrawing consent or deleting an account, it is impossible to use the service in registered mode.
11. Data Protection
The controller takes measures provided for by art. 18.1 and 19 of 152-FZ: passwords are stored as an irreversible hash, data exchange between the app and the server occurs via a secure connection, database access is restricted, and the volume of collected data is minimized to what is necessary for the service to function.
12. Cookies and Browser Storage
12.1. Reading the site does not create anything on your device. Opening pages, blog articles, the food additives guide, and this document does not set any cookies: these pages are served as-is and do not request your data from the server.
12.1.1. A service cookie appears the moment you send a photo or barcode for analysis — including from a form embedded in a blog article, and before any registration. Analysis is impossible without it: it is used to track free requests, and without such tracking, free requests would have to be canceled.
12.2. Two cookies are used, both for service purposes.
| Cookie | When it appears | Purpose | Lifespan |
|---|---|---|---|
| foodgpt_device | Upon the first photo or barcode sent for analysis, including sending from a blog article | Distinguishes your device from others to count free requests. Contains a random identifier signed by the server and nothing else: it contains no information about your actions or request history | 1 year |
| foodgpt_session | Upon registration or login, and only then | Confirms that you are logged into your account | 30 days |
12.2.1. Both are marked with HttpOnly (inaccessible to page scripts), Secure (transmitted only via secure connection), and SameSite=Lax flags. foodgpt_session is deleted upon logging out or deleting the account. There are no analytical or advertising cookies, nor are there any third-party ones.
12.3. In addition to cookies, the app saves three entries in browser storage. All of them remain on the device and are not transmitted to the server:
| Entry | When it appears | Purpose | Lifespan |
|---|---|---|---|
| foodgpt_theme | If you clicked the light/dark theme toggle | Stores one word — the selected theme. Until the toggle is clicked, the entry does not exist, and the app follows your system settings | Until you clear site data in your browser |
| pwa_banner_dismissed | If you installed the app or closed the installation offer | To prevent the offer from appearing again | Until you clear site data in your browser |
| foodgpt_ref | Automatically, if you followed an invitation link like foodgpt.ru/?ref=CODE | Remembers the invitation code until registration: between following the link and creating an account, the address bar changes, and without this entry, the invitation would be lost | Until the tab is closed |
12.4. The foodgpt_ref entry is the only one that appears without your specific action and the only one that can appear before logging into an account. It is created only when following an invitation link, contains eight characters of the code and no information about you, lives until the tab is closed, and is deleted immediately after the invitation is accounted for during registration.
12.5. Tracking free requests without registration (Section 2) is done via the foodgpt_device cookie. A practical consequence worth knowing: if you delete the site's cookies, the counter will start over. We do not consider this a bypass and do not attempt to link such requests; device identification based on technical characteristics is not used in quota tracking.
12.6. There is no "Accept cookies" window in the service; instead, a notification is shown at the bottom of the screen about which cookies are set and when. There is no "decline" button next to it intentionally: both cookies are service-related and provide the service itself — tracking free requests and login. It is impossible to decline them while continuing to use photo analysis, and a button would offer a choice that does not exist. Declining is possible only in the only honest way — by not sending photos and not logging into an account; nothing is set for reading articles and guides. Consent for personal data processing is obtained where it is truly required — via a separate checkbox during registration (Section 3).
12.7. Cookies and browser storage contents are deleted and blocked via the browser's own tools; the procedure is described in its help section. Deleting foodgpt_session means you will need to log in again; deleting foodgpt_device means the free request counter will start over. Deleting other entries does not affect anything other than the theme settings and the re-display of the installation offer.
13. Minors
The service is not intended for persons under 18 years of age, and the controller does not knowingly process their personal data. Upon discovering such data, the controller deletes it.
14. Policy Changes
The current version is always posted on this page. Significant changes are shown in the app rather than being replaced by silent text edits.
Calorie estimation from a photo is for reference purposes only and does not constitute medical advice.
Requisites
Самозанятый
Лежанкин Евгений Александрович
INN 732716427959
Email: support@foodgpt.ru
Website: https://foodgpt.ru
Version of 24 August 2026
Other documents: Public Offer · Terms of Use · Consent to Personal Data Processing · Contacts and Requisites