Last updated 3 September 2026
What Tare keeps, who else ever sees it, and how to make it stop.
Your email address and password — the password as a bcrypt digest, never as text.
What you tell the goal wizard: sex, date of birth, height, weight, a goal weight and date, and how active you are. All of it optional, and all of it only there because the calorie target is derived from it.
What you log: diary entries, each keeping the nutrition figures as they stood when you logged them, weigh-ins, the names of your meal slots, and any food you create.
Technical records: a hashed session token with the IP address and browser or device that created it, a delivery address for each device you have Tare installed on, so a notification can reach it, counts of AI requests, and purchase events from the store you bought a subscription from.
Photographs. When you photograph a meal or a nutrition label, the image is sent to Anthropic, read, and discarded. It is never written to disk and there is no column in the database that could hold one. What is kept is the result — the foods and the numbers — and a record that a request happened, with its token count and duration.
Your location. Tare asks the device for its country and time zone at signup and stores those two answers; it never asks for or receives a position.
Anything for advertising. There are no ad networks, no analytics SDKs and no third-party trackers in either app. Nothing records which screens you open, what you search for, or how long you stay.
Anthropic — meal and label photographs, for the moment it takes to read them.
RevenueCat — your subscription status, keyed to a random identifier rather than your email address, so they never learn who you are.
SMTP2GO — your email address, only when you ask for a password reset.
Bugsnag — when something in Tare fails: what went wrong, your device model, the version of iOS or Android, the version of Tare, and the number that identifies your account. Not your email address, not anything you have logged, and never a photograph. It is how a bug that happens on your phone becomes something that can be fixed rather than something nobody hears about.
Google — a delivery address for your Android phone, and the text of the notification itself. Firebase Cloud Messaging is the only route onto Android, and messaging is the only part of Firebase in the app: no analytics, no advertising identifier, nothing about how you use Tare.
Apple — the same on an iPhone, through the Apple Push Notification service.
Notifications are off until you allow them, and the weekly one has its own switch in Profile. Turn either off and nothing is sent.
Open Food Facts and FoodData Central are where the catalogue comes from. Nothing about you is sent to either.
Weight, body measurements and what you eat are health data, and Tare treats them as such: they are never sold, never shared for advertising, and never sent to any third party other than those named above.
Tare does not connect to Apple Health or Health Connect. Nothing is read from them and nothing is written to them.
On a server in Singapore, run by Hetzner, with Cloudflare in front of it. Backups stay on the same machine and are not copied elsewhere.
Until you delete it. There is no retention period because nothing is kept on a schedule — your diary is yours until you remove it or remove the account.
Deleting the account is immediate and permanent. How to delete your account covers both the in-app path and how to ask if you no longer have the app installed.
Tare is for people aged 13 and over, which is the floor both app stores set. It is not designed for or directed at children.
If this policy changes in a way that matters, the date at the top changes with it.
Questions, or anything you want removed: tare@charithp.com.