Privacy Policy

Effective 16 September 2026. Last updated 16 September 2026. Heiki is made by Spatial AI Labs Ltd. (“we”, “us”), a company registered in England and Wales at 71–75 Shelton Street, London WC2H 9JQ, United Kingdom. We are the controller of the data described here.

What we collect

• Meal photos you take or choose, and when they were taken.
• What you say or type about a meal — the sentence you add when you capture it, your answers to the app’s questions, and your notes. Speech is turned into text on your device; only the text is sent.
• Your journal — entries, estimates, ranges, items and their revisions.
• What you write to the coach, and what it answers. See The coach: it is the one place we keep a copy of your own words, briefly and with personal details removed.
• Profile facts you enter or let the app read from Apple Health: age, height, weight, sex, activity level, goal and pace.
• How you use the app — a fixed list of product events, such as “onboarding completed”, “estimate finished” or an error code. Events never carry your photos, your food, your notes or your name.
• Device facts sent with those events: app version, OS version, device model, language, an identifier created when you first install the app, and a session identifier.
• Crash reports, through Apple, if you have chosen to share them with developers in your device settings.
• What you have paid for — which plan you hold and when it ends. We never see your card or payment details.

We do not collect your contacts, your location, your browsing, or any advertising identifier.

Your photos

When you take or choose a photo, the app finds any faces in it and blurs them on your device before the photo is saved or sent. The blurred copy is the only copy that exists in the app and the only copy that ever leaves your device. Your original stays in your camera roll, if that is where it came from.

Nothing is sent until you ask for an estimate. When you do, the app sends the photo to our servers along with your note, the time, your language, and anything you have set up to make estimates more accurate — a dish you calibrated, a place you chose, or a preference the app has remembered (“oat milk”).

Every photo is checked automatically for sexually explicit or violent content before it is estimated. The Terms say what happens if one fails that check.

Photos are deleted from our servers after 30 days. The copy on your device stays until you delete the entry or the app.

The coach

The coach answers questions about a meal, a day or a stretch of your journal. The conversation itself lives on your device. When you send a message, we pass it — together with the entries or days you are asking about, the profile facts that make the answer useful (age, sex, activity, goal, pace, weight, height, diet style, daily target and totals), your language and your time zone — to a model provider, which writes the reply. We do not keep the conversation.

One exception. The first few messages of a conversation may be kept so we can check whether the coach is giving good answers. Before anything is stored, names, places, contact details, dates of birth and similar personal details are removed automatically; if that step fails, the message is not kept at all. What remains — the food, the numbers, the gist — is kept for up to 180 days, linked to your account by a code rather than your name, and deleted sooner if you delete your account. Later messages in the same conversation are never kept.

Apple Health

The app reads from and writes to Apple Health only with your permission, asked separately for each direction. Both are off until you turn them on, and you can turn them off at any time in the Health app.

• Reading: date of birth, height, weight and sex, to work out a starting budget; and, if you allow it, active energy and workouts, to widen a day’s budget.
• Writing: if you allow it, each meal as a food record with energy, protein, carbohydrate and fat. It is updated when the estimate is refined and removed when you delete the entry.

Health data is never sold, never used for advertising, never used for anything except the app’s own features, and never sent to the model providers or anyone else. It stays on your device and in your own synced profile.

Your account

You can use the app without an account. On first launch it creates a random identifier so our servers can tell your requests apart; it is not linked to you.

Sign in with Apple keeps your journal if you lose your phone and carries it to your other devices. We receive the identifier Apple creates for our app, and your name and email only if you choose to share them — Hide My Email works fine. Signing in attaches what you already logged to that account. We keep the Apple identifier so that the same Apple Account cannot claim the free trial twice.

With an account, your journal and profile sync through our servers so your devices agree. We store your entries; we do not look inside them.

Purchases

You pay Apple, not us. We never see your card. RevenueCat, a subscription service, and our own servers record which plan you hold and when it ends, so the app knows what to unlock. That is all RevenueCat is given.

Who else sees your data

Model providers. To estimate a meal we send the blurred photo and your description to third-party providers of image and language models, and they return the estimate. We describe them as a category because which ones we use changes as models improve. The rules do not:

• They receive the photo and your text. They do not receive your name, your email, your Apple Account or your journal.
• Under their terms with us, they may not train their models on your data, and they keep it only briefly, for abuse monitoring, if at all.
• They act on our instructions and may not use your data for their own purposes.

The others, by name:

• Google is our cloud provider. It hosts our servers, your synced journal and profile, your uploaded photos, and the sign-in service, and runs the automated image-safety check.
• RevenueCat keeps track of your plan, as described above. It gets no photos, journal or health data.
• Apple takes payment, provides Sign in with Apple, and sends us crash reports and aggregate App Store analytics.

Each of them works under a written data-processing agreement that allows them to handle your data only on our instructions. We add a provider only when the service needs one, and if this list changes in a way that matters, the date at the top of this page moves and the app tells you. Business customers who need our Data Processing Addendum can write to hello@spatialailabs.com.

Usage data and crash reports

The app records a fixed list of product events — which screens were opened, whether onboarding finished, how long an estimate took, which plan was chosen, which errors occurred — and sends them to our own servers. There is no third-party analytics or advertising kit in the app. We use these events only to understand whether the product works and what it costs to run. They are linked to your account, which is how we can delete them when you ask.

Apple sends us crash reports and aggregate analytics, subject to the sharing choice in your device settings. Those are governed by Apple’s privacy policy.

This website (not the app) uses two measurement tools: Vercel Web Analytics, which counts page views without cookies, and Google Analytics, with IP addresses anonymised and advertising features turned off. Google Analytics sets cookies on this site. The app sets no cookies and sends nothing to either.

No advertising, no tracking

There are no advertising kits in the app, no third-party trackers, and no tracking prompt, because we do not follow you across other companies’ apps or websites. We do not sell or share your personal information, and we do not use your data to train models.

How long we keep it

• Meal photos on our servers: 30 days. The copy on your device stays until you delete the entry or the app.
• Journal and profile: until you delete the entry or your account.
• Usage events: 180 days, or sooner if you delete your account.
• Coach messages: the de-identified record described above, 180 days, or sooner if you delete your account.
• Trial and purchase records: while your account exists. Two things outlive it: the note that your Apple Account has used its one free trial (otherwise deleting an account would be a way to claim it again), and a suspension under the Terms, recorded as a date and nothing else. Accounting records we must keep as a UK company are kept for six years from the end of the financial year they relate to.
• Aggregates — counts, averages, curves that no longer identify anyone — are kept, because they are no longer personal data.

If you delete your account

Profile → Account → Delete account. The app asks you to confirm, then deletes your journal, your profile, your photos and our record of what you have paid for, on our servers and on the device. It cannot be undone. You can also write to hello@spatialailabs.com from the address on your account and we will do the same by hand.

Two things it does not touch. Meals you wrote to Apple Health stay there — they are yours. And a subscription keeps billing until you cancel it in your Apple Account settings (manage subscriptions), because only Apple can cancel it.

Signing out is not deletion. It clears this device — the journal, the photos, the profile and the coach conversations — and the app starts fresh. Nothing is removed from our servers; sign back in and it all comes back. Deleting the app removes the local copy but does not delete anything on our servers or cancel a subscription.

The only records that survive a deletion are the two described under How long we keep it: the trial marker and any suspension. Neither is your content.

Your rights

Wherever you live, you can ask us for any of these. Write to hello@spatialailabs.com from the address on your account, or use the app where it offers a route. We answer within a month and do not charge.

• Access. Ask what we hold about you and get a copy.
• Correction. Your journal and profile are editable in the app; for anything else, ask us.
• Deletion. Do it yourself in the app, as above, or ask us.
• Portability. Ask for a copy of what you gave us in a machine-readable form, or for it to be sent to another provider where that is possible.
• Objection and restriction. Object to the processing we do on the basis of our legitimate interests — the usage events and the de-identified coach messages — or ask us to pause it while a dispute is resolved.
• Withdrawing consent. Turn Apple Health access off in the Health app at any time. Withdrawing does not affect what was lawful before.
• Crash reports. Stop sharing them in your device’s analytics settings.

Complaints. If you think we have got something wrong, tell us first — we would rather fix it. You can also complain to a regulator. Ours is the UK Information Commissioner’s Office (ico.org.uk, 0303 123 1113). If you are in the European Economic Area or Switzerland, you can instead complain to the authority in the country where you live or work.

If you are in California: we do not sell or share your personal information and have not in the past twelve months. What we collect, why, how long we keep it and who receives it are set out above. You have the right to know, to delete, to correct, and not to be treated differently for exercising those rights; the routes above are the routes.

Why we are allowed to do this

If you are in the UK or the European Economic Area, the law requires us to have a legal basis for each thing we do with your data. Ours:

• Our contract with you — estimating your meals, running the coach, syncing your journal, keeping your account and knowing what you have paid for. Without this there is no product.
• Your consent, asked for separately and withdrawable at any time — Apple Health (health data is a special category), and the Google Analytics cookies on this website.
• Our legitimate interests — keeping the service secure and preventing abuse (the image-safety check and the usage limits), learning from usage events whether the product works and what it costs, and reviewing de-identified coach messages to judge the quality of the answers. We have weighed these against your interests; that is why coach text is de-identified before it is stored and why events never carry your food, your notes or your name.
• Legal obligation — keeping the accounting records the law requires.

We get your data from you, and from Apple and RevenueCat when you sign in or buy something. You are not required by law to give us any of it; it is simply what the app needs to work. We make no automated decisions about you with legal or similarly significant effects. An estimate is a number you are invited to argue with, not a decision about you.

Where your data goes

Your data is stored in the United States, with a major cloud provider, and the servers that answer the app run in the United States and in Japan. The model providers, RevenueCat and Apple process data in the United States and elsewhere. So if you are in the UK, the European Economic Area or Switzerland, your data leaves your country.

Those transfers are made under the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum where UK law applies, built into our agreement with each provider and backed by a transfer risk assessment and the protections described on this page: faces blurred before a photo leaves your device, coach text de-identified before it is stored, and encryption in transit and at rest. Where a country has an adequacy decision, we rely on that instead. Ask us at hello@spatialailabs.com for a copy of the safeguards for any transfer.

Children

Heiki is not for children. You must be at least 16 to use it, or older where the law where you live says so. We set that above the usual minimum for online services on purpose: calorie tracking is not a suitable tool for a child, and the App Store age rating matches. If you believe someone under 16 has used the app, write to hello@spatialailabs.com and we will delete the account and everything in it.

Changes

We update this policy when the app changes. The date at the top moves, and anything material is announced in the app before it takes effect.

Contact

Spatial AI Labs Ltd., 71–75 Shelton Street, London WC2H 9JQ, United Kingdom — hello@spatialailabs.com. That address reaches the person responsible for data protection. We are not required to appoint a data protection officer and have not appointed one.