Nutri-E Privacy Policy
Last Updated: September 2026
Nutri-E ("the App") is developed and published by Invotek AS ("we", "us", "our"), org.nr. 931 930 354, Postboks 1 Bjørndal, 1214 Oslo, Norway. Invotek AS is the data controller. This policy explains what the App keeps on your device, what it sends off your device, who receives it, and what you can do about it.
How to read the version notes. Some parts of the App were added after the release that is currently on the App Store. Where that matters, the entry below says whether it applies to the current release or to a future release. Nothing marked "future release" is running on your phone today.
1. Information We Collect
Stored on your device
The App keeps the following in a local database on your iPhone, using Apple's Core Data framework. There is no iCloud sync and no account, so we never receive a copy of it. If you have iCloud Backup switched on, iOS includes this database in your device backup, the same as it does for any other app. That copy is held by Apple under your Apple ID, not by us.
- Supplement information: names, brands, dosages, and nutrient content of the products you track
- Dose history: records of when you took each supplement
- Health details you enter: age, gender, and pregnancy or lactation status, used to calculate your reference daily values
- Schedules: reminder times and frequency settings
- Photos you scan: images of food and supplement labels
- Symptom notes and Apple Health readings (future release), which are read and written on the device only
A device identifier
The App creates a pseudonymous device identifier from Apple's identifier for vendor and stores it in the iOS Keychain. It is not your name, your email, or your Apple ID, and we cannot use it on its own to identify you. It is attached to every request the App makes to our servers, and it is the key our subscription records and usage counters are stored under. Because it lives in the Keychain, it can survive deleting and reinstalling the App.
2. What Leaves Your Device
The App is not fully offline. The things listed below send data off your phone. Some of them happen only when you ask for them. Others happen on their own, and each entry says which it is.
Your AI allowance, checked automatically
Happens automatically. Every time you open the App it asks a Cloudflare Worker that we operate how many AI requests you have left, so that the App can show you the right number. That request carries your device identifier and reaches our server from your IP address. It happens on every launch whether or not you go on to scan anything, and our server records that your device was active.
AI scanning of labels and meals
Happens only when you ask. The two kinds of scan behave differently, and the difference matters:
- Supplement labels. The photo is read on your iPhone, by Apple's on-device text recognition. Only the text it recognises is sent to a Cloudflare Worker that we operate, which forwards it to OpenAI. The photo of the label itself never leaves your phone.
- Meals. The photo itself is sent to our Cloudflare Worker and forwarded to OpenAI's vision model, because it is the picture that has to be recognised. A food description you type instead of taking a photo is sent as text.
The result comes back to your phone. Your age, gender, pregnancy status, health goals, and dose history are not included in what we send to OpenAI. Only the label text, meal photo, or food description you are asking about is sent.
Supplement lookups
Happens only when you ask. When you search for a product or scan a barcode, the search term or barcode is sent to a Cloudflare Worker that we operate, which queries the National Institutes of Health Dietary Supplement Label Database. The query itself does not contain your personal information, but it does carry your device identifier and reaches our server from your IP address.
Feedback and in-app messages
Partly automatic. The App includes the Cuti-E feedback component. When you send feedback, your message and a pseudonymous device identifier are sent to the Cuti-E service. Separately, and whether or not you ever use feedback, that component contacts the Cuti-E service when the App starts and periodically while the App is open, to check whether there is a reply waiting for you. If you allow notifications, a push token for your device is also registered with that service.
3. Data Storage
On your device
Your supplement records, dose history, health details, schedules, and scanned photos are stored in the local Core Data database described above. Deleting the App removes that database from your device. The App does not back this database up to our servers or to iCloud.
On our servers
Our Cloudflare Workers do not store your supplement diary, but they are not stateless either. Against your device identifier or your IP address they hold:
- A record that your device was active, used to count how many devices use the App
- Counters for how many AI requests your device has made, used to enforce the daily limits of your plan
- Counters for how many product lookups your device has made, used to enforce a separate daily lookup allowance
- Rate limit counters keyed on the IP address the request arrived from
- A cache of the label text you submitted and the AI result for it, kept for seven days and shared across users, so that a label already analysed does not need to be analysed again. Meal photos are never cached. Food text you type when logging a meal is not cached either, but if you edit a food name and ask for it to be analysed again, that name and its result are held in this same seven day shared cache.
- A short lived cache of results returned by the NIH product database
- Your subscription plan and its expiry date, updated by Apple's App Store server notifications. If you cancel or your subscription is removed, a record of that is kept for support and billing history.
Cloudflare processes this traffic for us and keeps request logs, which include the IP address a request came from.
We do not publish retention periods for these records yet. If you want to know how long a specific record about your device is kept, contact us using the details in section 10.
4. Data Sharing and Third Party Services
We do not sell your personal information, share it with advertisers, or use it for marketing. We do pass data to the following services in order to run the App.
| Our Cloudflare Workers (operated by Invotek AS) |
Every allowance check, every AI scan, and every product lookup, together with your device identifier and the IP address the request came from. Current and future releases. |
|---|---|
| OpenAI (GPT-4 models) |
The text recognised from supplement labels on your device, the photos of meals you scan, and food descriptions you type for analysis, forwarded by our Worker. Photos of supplement labels are not sent. Current and future releases. |
| NIH Dietary Supplement Label Database | Your product search terms and scanned barcodes, forwarded by our Worker. Current and future releases. |
| Apple | Purchase and subscription handling through the App Store. We never see your payment details. Current and future releases. |
| Cuti-E (feedback) |
Your feedback messages, a pseudonymous device identifier, a check for unread replies when the App launches and while it is open, and a push token if you allow notifications. Current and future releases. |
| RevenueCat (subscription management, United States) |
Your device identifier as the customer id, plus purchase, entitlement, and receipt data. Current and future releases. |
| Google Firebase Crashlytics (crash reporting) |
Crash reports and diagnostic data, tagged with your device identifier and your subscription tier. Current and future releases. |
Consent, plainly. AI scanning, product lookups, and sending feedback happen only when you ask for them. The allowance check described in section 2 happens automatically each time you open the App. Optional usage analytics in the Cuti-E component are off unless you turn them on, and you can change that at any time under App Settings, then Privacy. Crash reporting is switched on by default in released builds and is not behind a separate prompt.
5. Your Rights and Control in the App
- Access: everything the App holds about you is visible in the App itself
- Export: you can export your supplements, nutrients, dose history, schedules, and profile as a JSON file, on every plan including the free one. Meals logged in food tracking are not part of the export file. The export runs on your device and is handed to the iOS share sheet. We do not receive a copy.
- Delete: delete individual entries in the App, or delete the App to remove the local database entirely
- Control: turn optional analytics on or off under App Settings, then Privacy, and manage notifications in App Settings or iOS Settings
Deleting the App does not by itself remove the records held on our servers against your device identifier. To ask about those, contact us using the details in section 10.
6. California Residents (CCPA)
If you live in California you have the right to know what personal information is collected, the right to have it deleted, the right to opt out of the sale of personal information, and the right not to be discriminated against for exercising those rights. We do not sell personal information.
7. Children's Privacy
Nutri-E is intended for people aged 18 and over. Supplements can have serious health effects, and the App is built for adult use. We do not knowingly collect data from anyone under 18. If you are under 18, please do not use the App.
8. Website Analytics and Cookies
This website (dashecorp.com) uses Cloudflare Web Analytics, a privacy-first analytics service. It does not use cookies, does not collect personal data, and does not track individual visitors across sites. Only aggregate metrics (page views, referrers, browser type) are collected. This applies only to the website, not the App itself.
This website also loads the Inter typeface from Google Fonts, so your IP address is visible to Google when your browser requests the font files. No other third party analytics or advertising service runs on these pages.
9. Changes to This Policy
We may update this policy from time to time. We will notify you of significant changes through the App or on this page. The date at the top shows when it last changed.
10. Contact Us
If you have questions about this privacy policy, or wish to exercise your rights over your data:
Invotek AS
Oslo, Norway
Email: privacy@dashecorp.com
Website: www.dashecorp.com
GDPR Compliance (EU Users)
Under the General Data Protection Regulation you have the following rights over personal data we process about you:
- Right of access (Art. 15): you may request a copy of the personal data we hold about you
- Right to rectification (Art. 16): you may request correction of inaccurate or incomplete data
- Right to erasure (Art. 17): you may request deletion of your personal data where there is no compelling reason for continued processing
- Right to restriction (Art. 18): you may request that we limit how we process your data
- Right to data portability (Art. 20): you may request your data in a structured, commonly used, machine readable format
- Right to object (Art. 21): you may object to processing of your personal data
- Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand
To exercise any of these rights, contact us at privacy@dashecorp.com. Tell us that your request concerns Nutri-E so we can look up the records held against your device.
Data Controller: Invotek AS, org.nr. 931 930 354, Postboks 1 Bjørndal, 1214 Oslo, Norway
You have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) if you believe your personal data is being processed unlawfully.
Website: www.datatilsynet.no
Medical Disclaimer
Nutri-E is not a medical device and does not provide medical advice, diagnosis, or treatment. It is for information and tracking only. Nutrient values extracted by AI can be wrong. Consult a qualified healthcare professional before starting, stopping, or changing any supplement regimen.