Privacy Policy
PlateWay is a nutrition app made by Harding Ventures, LLC. This policy explains what the app collects, why, who helps us run it, and how you stay in control. We’ve tried to keep it plain.
The short version
- We collect what you log so the app can work: meals, photos, water, sleep, meds and so on.
- We don’t sell your data, show ads, or track you across other apps and websites.
- AI (Anthropic’s Claude) reads your meal photos and text to estimate foods and write plans. It never gets your name, email, or medication names or doses, and it doesn’t train on your data.
- Your meal photos are private. You can delete any photo and keep the meal’s numbers.
- You can export or delete everything from Settings › Your data.
- You can turn off usage analytics with Share usage data.
1. Who we are
PlateWay is provided by Harding Ventures, LLC, Arlington, Virginia, USA (“we”, “us”). We are responsible for the personal data described here. This policy covers the PlateWay app and this website, plateway.io.
Questions or requests go to support@hardingventuresllc.com.
2. What we collect
We only collect what you give us or what the app needs to work.
Your account
- Your email address, if you sign in with a magic link. If you use Sign in with Apple or Google, we get the sign-in details they share with us (usually an email address, which with Apple can be a private relay address).
- You can also use PlateWay as a guest, with no email at all. A guest account has a random id and nothing else that identifies you.
- The name you choose to be called in the app, if you add one.
What you log and set up
- Meals and their foods, amounts and nutrients.
- AI estimates for your meals, how confident the AI was, and any corrections you make.
- Water, sleep (entered by you), caffeine and alcohol counts, and energy check-ins.
- Medications and supplements you choose to add, with the reminder times and any food note you write.
- Body basics, all optional: age, sex (used only in the formula that estimates your energy needs), height, weight and activity level.
- Your pathway, targets, food preferences, foods you’d rather skip, and allergens. If you describe your routine in your own words, we keep that text.
- Meal plans, recipes you save, pantry and fridge items, grocery lists, and travel weeks or other changes you tell the app about.
- Household members you add: a first name, an age band (such as “4–8”), and any food restrictions, allergens or meal feedback you enter for them. See section 13.
- Settings such as units, notifications, Hide numbers and Gentle mode.
Photos
When you scan a plate, a menu, a recipe, your fridge or a drink bottle, the photo is uploaded to private storage that only your account can reach. We remove location and other hidden photo details (EXIF data) before upload. You can delete a meal photo at any time and keep the meal’s numbers.
Voice
When you describe a meal out loud, your phone turns your speech into text on the device. Audio is not sent to us or recorded. Only the text is used, the same as if you’d typed it. If your phone can’t do this on the device, the app asks you to type instead.
From your phone
- Usage analytics and crash reports, described in section 6.
- Permissions you grant: camera (for scans), photos (if you pick one from your library), speech recognition and microphone (for voice), and notifications (for reminders). You can change these in your phone’s settings at any time.
What we don’t collect
- We don’t collect your precise location.
- We don’t collect your contacts.
- We don’t take payment details. If you subscribe to PlateWay Plus, Apple handles the payment and tells us only whether your subscription is active.
- This version of PlateWay does not read from or write to Apple Health. A future version may offer health sync. If it does, we’ll update this policy before that feature is released, and it will only work if you turn it on.
3. How we use it
- To run the app: log meals, show your day, set targets, build plans and lists.
- To estimate foods and nutrients from your photos and words, and to suggest plans and recipes (see section 4).
- To adjust targets and plans to your day. Every change comes with a short reason you can tap, “Why we changed today”.
- To send the reminders you set. Reminders are scheduled on your phone.
- To sign you in and keep your account secure.
- To improve estimates. Your corrections help us see where estimates go wrong. We use them to improve PlateWay, and they are deleted with your account.
- To fix bugs and understand which features get used (see section 6).
- To answer you when you contact us, and to meet legal duties.
We don’t use your data for advertising, we don’t build ad profiles, and we don’t sell or rent it to anyone, including data brokers. PlateWay does not track you across other companies’ apps or websites, so it never asks for Apple’s tracking permission.
We only send email to sign you in and to reply to you. We don’t send marketing email from the app.
4. How AI is used
PlateWay uses Anthropic’s Claude API to estimate the foods and nutrients in your photos and descriptions, to read menus and fridge photos, and to write meal plans, recipes and weekly pattern notes. Calls go from our servers to Anthropic, never straight from your phone.
- What Anthropic receives: the photo or text for that task. For plans: your targets, pathway, food preferences and allergens, pantry items, and household members as anonymous references (no names). For weekly notes: summary numbers only.
- What it never receives: your name, email, user id, medication names or doses, or your sleep or weight logs.
- Training: Anthropic does not use your data to train its models.
- Retention: Anthropic deletes these inputs and outputs within 30 days. If a request is flagged for a possible breach of Anthropic’s usage policy, it may be kept for up to 2 years.
AI estimates can be wrong. The app shows how confident each estimate is, asks when it isn’t sure, and lets you fix anything. Nutrition values are grounded in USDA FoodData Central, a public U.S. government database.
5. Who we share it with
We share data only with the service providers below, only for the reasons listed, and only under agreements that limit how they use it. We don’t share it with anyone else unless the law requires it (see below).
| Provider | What they do | What they receive | What they don’t receive |
|---|---|---|---|
| Supabase | Hosts our database, sign-in, photo storage and server code | Everything your account stores | Nothing is held back, so it’s all deleted with your account |
| Anthropic (Claude API) | AI estimates, menu and fridge reading, plans | Photos and text for the task; plan context (see section 4) | Names, email, user ids, medication names or doses, sleep or weight logs |
| Resend | Sends sign-in emails | Your email address and the sign-in link | Anything you log |
| PostHog | Usage analytics | Which screens and features are used, with a random account id | What you eat, nutrients, weight, medications, household details, or any health value |
| Sentry | Crash and error reports | Error details, app version and device type, with a random account id | Your email, what you log, or health values (we mask them before sending) |
| Apple and Google | Sign in with Apple or Google, if you choose it | The standard sign-in exchange | Anything you log |
| Apple | App Store purchases and subscriptions | Your purchase, handled under Apple’s terms | Anything you log |
Some lookups use public databases and send no personal data at all:
- USDA FoodData Central for nutrition values. Our server sends only food names.
- Open Food Facts for barcode lookups, where the feature is available. Our server sends only the barcode number.
Grocery lists: when you share a grocery list, your phone’s share sheet sends it where you choose (Messages, Notes, a grocery app). PlateWay leaves out items that may contain an allergen in your household. Anything you buy happens with that grocer, under their terms and privacy policy.
Other cases: we may disclose data if the law requires it, to protect someone’s safety, or to protect our rights. If Harding Ventures or PlateWay is ever sold or merged, your data would move to the new owner under this policy, and we’d tell you first.
6. Usage analytics and crash reports
To see what works and fix what doesn’t, PlateWay sends two kinds of technical data:
- Usage analytics (PostHog): events like “a meal was logged” or “a plan was built”, with a random account id. These events never include what you ate, nutrient amounts, weight, medications, household details or any other health value.
- Crash reports (Sentry): what went wrong, the app version and the device type. Before a report leaves your phone, we strip emails and mask numbers such as calories, water, sleep, doses and weight. No screenshots are sent.
Turning analytics off
Go to Settings › Your data and turn off Share usage data. That stops usage analytics from that phone. Crash reports still send, so we can fix problems that stop the app from working. They never include what you log.
7. How long we keep data, and deleting it
- Your account and what you log: kept while you have an account. When you delete your account, we delete it and its data, including photos, logs, plans, grocery lists, household details and your corrections.
- Guest accounts: a guest account (one not saved to an email, Apple or Google sign-in) that hasn’t signed in for 365 days is deleted automatically, the same way as Delete account. To keep your data, save your plan to an email, Apple or Google account.
- Photos: kept until you delete the photo, the meal or your account.
- AI requests: deleted by Anthropic within 30 days (up to 2 years if flagged for a usage-policy review).
- Analytics and crash reports: kept by PostHog and Sentry for a limited time under their retention settings, then deleted.
- Support emails: kept as long as we need them to help you, then deleted.
- Backups: our hosting provider keeps short-term backups for recovery. Deleted data drops out of them as they are replaced on a rolling schedule.
How to delete
- Everything: Settings › Your data › Delete account. This can’t be undone, so the app offers an export first.
- One photo: open the meal and tap Remove photo. The meal’s numbers stay.
- One meal or entry: open it and delete it.
- Deleting the app from your phone does not delete your account. Deleting your account does not cancel an App Store subscription; cancel that in your iPhone settings (see our Support page).
Can’t get into the app? Email support@hardingventuresllc.com from the address on your account and we’ll delete it for you.
8. Your choices and rights
Wherever you live, you can:
- See and take a copy of your data: Settings › Your data › Export my data gives you one JSON file. Photos come as links that work for 24 hours.
- Correct it: edit any meal, entry, setting or body basic in the app.
- Delete it: see section 7.
- Turn off analytics: see section 6.
- Choose what to share: body basics, medications, household members and most tracking are optional. You can turn off what you track in Settings.
- Ask us anything else: email support@hardingventuresllc.com.
To protect your account, we may ask you to confirm a request from the email address on the account, or from inside the app. We answer within 45 days, or sooner where the law requires. If we can’t do something you asked, we’ll tell you why.
Appeals: if we turn down a request, you can appeal by replying to our answer with “Appeal” in the subject line. We’ll review it and reply within 60 days. If you still disagree, you can contact your state attorney general or your local data protection authority.
9. Consumer health data
This section is our consumer health data privacy policy. It applies to residents of Washington (My Health My Data Act), Nevada (SB 370), Connecticut, and anywhere else with similar laws. We treat it as our standard for everyone.
What counts as health data in PlateWay
Meals and nutrients, meal photos, water, sleep, caffeine and alcohol counts, energy check-ins, medications and supplements and their reminder times, body basics (age, sex, height, weight, activity), targets, your pathway, allergens and food restrictions (yours and your household’s), and anything about your health you write in your own words.
Where it comes from
From you, when you enter it in the app, and from AI estimates of what you photograph or describe.
Why we collect it
Only to provide the features you use: logging, targets, reminders, plans, recipes and grocery lists, and to improve estimates. We don’t use it for advertising, and we never sell it.
Who we share it with
Only the service providers in section 5, for the purposes listed there: Supabase (hosting), Anthropic (AI processing, with the limits in section 4), and Sentry (crash reports, with health values masked). We have no affiliates that receive it. PostHog and Resend receive no health data.
Your consent
You consent to us collecting a piece of health data when you choose to enter it. Each item is your choice. You can withdraw consent at any time by deleting the entry, turning off that kind of tracking in Settings, or deleting your account. We stop collecting it and delete what we hold.
Your rights
You can confirm whether we hold your health data, get a copy, see the list of providers we share it with (section 5), withdraw consent, and have it deleted. Use the in-app tools in section 8, or email us. You can appeal a decision as described in section 8.
10. California privacy rights
If you live in California, the CCPA, as amended by the CPRA, gives you these rights:
- To know what personal information we collect, use and disclose, and to get a copy.
- To correct it, and to delete it.
- To opt out of “sale” or “sharing” for cross-context advertising. We do neither, so there is nothing to opt out of.
- To limit the use of sensitive personal information. We use it only to provide the service you asked for, as the law allows.
- Not to be treated differently for using these rights.
In the last 12 months we collected these categories: identifiers (email, account id); sensitive personal information (health data, as described in section 9; account sign-in); personal characteristics (age and sex, if you add them); photos; internet or device activity (usage analytics and crash reports); and inferences (such as estimated energy needs). They come from you and your phone. We use and disclose them only as described in sections 3 to 5, and keep them as described in section 7.
You or an authorized agent can make a request by emailing support@hardingventuresllc.com. We’ll confirm the request with you before acting on it.
11. EEA and UK privacy rights
If you’re in the European Economic Area or the United Kingdom, Harding Ventures, LLC is the controller of your personal data. Our legal bases are:
- Contract: to provide the app you signed up for.
- Explicit consent: for health data, which you give when you choose to enter it. You can withdraw it at any time, as described in section 9.
- Legitimate interests: for usage analytics (which you can turn off) and crash reports, to keep the app working and improve it.
- Legal obligation: where the law requires us to keep or disclose data.
You have the right to access, correct, delete, restrict or object to the processing of your data, and to take it with you (Export my data). You can also complain to your local data protection authority, or in the UK to the Information Commissioner’s Office.
We and our providers are based in the United States, so your data is processed there. Where required, transfers rely on the European Commission’s Standard Contractual Clauses (and the UK addendum) in our providers’ data processing terms.
12. How we protect your data
- Data is encrypted in transit and at rest with our hosting provider.
- Every table is locked so each account can only reach its own rows.
- Photos sit in private storage, with hidden photo details removed.
- API keys for AI and other services stay on our servers, never in the app on your phone.
- AI requests carry only the minimum context the task needs.
No system is perfectly secure. If a breach affects your data, we’ll tell you and the authorities as the law requires.
13. Children and households
PlateWay is not directed at children under 13, or under 16 in the EEA and UK, and they shouldn’t create accounts. If you think a child has given us personal data, email us and we’ll delete it.
An adult account holder can add household members, including children, to plan family meals. For each member, the account holder enters only a first name, an age band, and any food restrictions, allergens or meal feedback. We never ask for a child’s birth date and never set a calorie target for a child. Household details aren’t sent to analytics, and AI sees members only as anonymous references. The account holder can edit or remove a member at any time, and members are deleted with the account.
14. This website
plateway.io has no forms, no cookies, no analytics and no trackers. Its fonts are hosted here, not loaded from a third party. Our web host, Vercel, keeps standard server logs (such as IP address and browser type) for a short time to deliver and protect the site.
15. Changes to this policy
If we change this policy, we’ll update the date at the top. If a change is significant, for example a new kind of data or a new provider that receives health data, we’ll tell you in the app before it takes effect and ask for consent where the law requires it.
16. Contact us
Harding Ventures, LLC · Arlington, Virginia, USA
support@hardingventuresllc.com
Please don’t include health details in your email unless they’re needed for your request.