GoGetup
Privacy Policy
GoGetup helps you track meals, water, weight, fasting, and diet plans, and reads lab reports and step data to help you understand your nutrition — using AI to do the heavy lifting. This page explains exactly what we collect, why, who else ever sees it, what rights you have wherever you live, and how to delete it.
GoGetup is managed by Xernext (xernext.com), based in India, which is the controller of your data ("we", "us"). We follow India's Digital Personal Data Protection Act, 2023 (DPDPA) because that is where we operate, and the privacy laws that protect you where you live — including the EU and UK GDPR, California's CCPA/CPRA and the other US state privacy laws, and Canada's PIPEDA.
This app handles sensitive health information — blood markers, medical conditions, meals, and body metrics. The DPDPA and the EU/UK GDPR both single out data like this for extra protection ("special category" data under GDPR), and a growing number of US states regulate consumer health data separately from general privacy law. We treat everything in Section 1 marked health data with that higher standard throughout this policy, not just in name.
01 Information we collect
We only collect what the app needs to do the things you ask it to do.
Your email address, a random account ID, and whether you signed in with Google or with email and password. If you use Google Sign-In, we receive your Google account's name, email, and profile photo — nothing else. We never see your Google password.
Age or date of birth, sex, height, weight, your eating style and food preferences (for example vegetarian, vegan, halal or kosher; we use them only to choose and check the foods in your plan, and never to guess anything about you), allergies and foods you avoid, dislikes, medical conditions you choose to tell us, and lifestyle context (sleep, activity level, cooking time, focus areas) used to personalise targets and diet plans. Your phone's time zone and language are used to pick the right units and regional foods.
Meals you log — including any photo you take of a plate, menu or barcode, and any notes you type with a scan — water intake, weight entries, fasting sessions, and any medications, reminders, or weekly tasks you set up. Questions you ask the in-app nutrition coach and the ingredients you type into "What can I cook?" are processed the same way.
Meal photos are kept for 30 days. A photo you take of a meal is stored so you can look at it again, and our system deletes it automatically 30 days after you took it. The meal itself (what the AI found, with its calories and nutrition numbers) stays in your history until you delete it or your account, so your totals and charts do not change.
Menu scanner and "What can I cook?" photos are not kept. A photo of a menu, a fridge or a pantry shelf is used only to be read: we delete it from our storage as soon as the AI has read it, whether the reading worked or not. We keep only the written result (the dishes or recipe ideas it found for you) and any text you typed, so you can look back at them. While the photo is being read it is sent to our AI providers, as described in Section 3.
Photos or PDFs of lab reports you upload, and the marker values (like blood sugar or haemoglobin) our AI extracts from them.
If you log something by voice, the recording is sent for transcription and is not stored by us afterward — only the resulting text is saved.
Off until you allow it. If you do, your phone works out the name of the place you are in (for example a neighbourhood and city) and we keep only that place name with the meal. Your coordinates are not saved or sent to us. The place name helps the AI name regional dishes and suggest local foods; it is never needed to log a meal, and you can switch it off in Progress → Your data.
If you connect Android Health Connect, we read your step count to estimate calories burned. Nothing is read unless you explicitly grant that permission, and you can take it back in Health Connect at any time. If you are a Circle member and also allow Health Connect's separate background permission (the app asks once, and you can say no or withdraw it at any time), GoGetup reads your step count in the background roughly every 15 minutes or less often (Android decides when) and sends only today's total to our server so your Circle friends see it; it is kept with its date and deleted with your account.
On iPhone, if you allow it, we read your step count from Apple Health to show your daily steps and estimate calories burned. This is read-only: GoGetup never writes anything to Apple Health, and reads nothing other than steps. Apple does not tell us whether you allowed or refused access, and you can change your answer at any time in Settings > Health > Data Access & Devices > GoGetup. If you are a Circle member, GoGetup sends only today's step total to our server while the app is open, so your Circle friends see it; it is kept with its date and deleted with your account. GoGetup does not read Apple Health in the background.
Only if you join Circle and confirm you are 18 or older. Friends you accept can see the progress numbers you share — your logging streak, steps (today's total and a chart of the last 7 days), water, protein, calories on target and weight change — your first name, your Google profile photo (if you signed in with Google), the achievement badges you earn, and a one-tap "encouragement" (no text). Joining shares all of it, including weight change and being findable by email: there are no separate switches, so if you would rather not share, do not join, or leave Circle at any time (that stops all sharing and removes your connections). You can also remove a friend at any time. When someone sends you a friend request we send a notification to your phone with the name they chose (through Google Firebase Cloud Messaging); you can mute it in your phone's notification settings. People can find you by email only while you are a Circle member. Friends never see your meals, photos, blood reports, or exact calories.
When you fix a scanned item (its name, portion, or calories), GoGetup remembers the fix so your next scan of the same food is closer. It stays on your account, is shown to nobody else, and is never used to train an AI model. Switch it off or tap "Forget it" in Progress → Your data.
Anonymous usage events (for example "meal logged" or "screen opened") and crash reports (device model, operating system version, app version, and the error), collected through Google Firebase Analytics and Crashlytics. They are tied only to your random account ID and a Firebase installation ID — never to your name, email, meals, weights, photos or anything you type. Firebase's advertising-ID collection and ad-personalisation signals are switched off. This is on by default; turn it off in Progress → Your data and no events or crash reports are sent.
GoGetup is free and supported by ads from Google AdMob: a full-screen ad some of the time while a meal photo is being read, a clearly labelled "Ad" card at the end of some scan results and in the shopping list, and an optional ad you can watch to unlock one more use of a feature that has a daily free limit. AdMob uses your device's advertising ID and similar device data to choose and measure ads and, if you agree, to personalise them. We do not send AdMob your health, nutrition, meal, or profile data; the only hints we pass are generic words such as "grocery" on the shopping-list screen. There are no ads on blood-report, sign-in, or account-deletion screens.
A push-notification token (through Google Firebase Cloud Messaging) so reminders and notices can reach your device. Reminders you set are scheduled on your phone itself.
What you write in the app's Feedback screen or email to us, with your email address, app version and phone platform, so we can reply and fix problems.
To keep the service fair and secure we keep a record of AI requests per account — what kind, when, whether it worked, and how much capacity it used, not what you logged. We can block an account that abuses the service (Terms, Section 11); a blocked person sees a message to contact support.
02 How we use it
- Identifying food in a meal photo and estimating its nutrition, and making your own repeat scans more accurate
- Generating a personalised 7-day diet plan and shopping list
- Reading lab markers out of an uploaded blood report
- Transcribing voice input into a logged meal, water entry, or profile detail
- Scheduling and delivering the reminders and notices you set or switch on
- Showing your own history, streaks, and progress charts back to you, and sharing what you choose with friends in Circle
- Keeping your account secure, preventing abuse, and answering your support requests
- Understanding which features are used and fixing crashes, without identifying you
- Showing ads that help cover the cost of AI processing
We do not sell your data for money or share it with data brokers, and we never use your health information to train a general-purpose AI model. Showing ads through Google AdMob can count as "sharing" or "targeted advertising" under some US state laws — see Section 6 for how to opt out.
03 AI & third-party processing
Certain features send data to specialised outside services to do their job — for example, a meal photo has to reach a vision model to be identified. Each provider only receives what that specific feature needs, and only to fulfil your request in the moment.
| Provider | What it receives | Why |
|---|---|---|
| Our AI providers | Only what each feature needs: meal and scan photos and the notes you type with a scan; blood-report photos and PDFs; voice recordings and what you say; coach questions together with your eating style and food preferences, allergies, health notes, goals and recent daily totals; menu photos and the ingredients you type into "What can I cook?"; the numbers behind your weekly recap (days logged, average calories, water goals met, weight change, fasts, number of medications taken, badges); the plan's ingredients when your shopping list is rebuilt; for diet plans, your profile (including your eating style, food preferences and any health notes you add), your current weight and how it has changed since you started logging, goals, allergies, time zone and blood-report values; and the place name if you share it. A request can be handled by more than one provider, for example a second one when the first is unavailable. | Reading meal photos and lab reports, speech-to-text, coaching, menu and recipe ideas, weekly summaries, shopping lists, and writing diet plans |
| USDA FoodData Central, Nutritionix, Open Food Facts | Food names or scanned barcode numbers | Looking up nutrition facts |
| Google Sign-In | Your Google account info, if you choose this sign-in method | Authentication |
| Google Firebase | Anonymous usage events, crash reports, push-notification token | Analytics, crash fixing, notifications |
| Google AdMob | Your device's advertising ID and device data; consent choices | Serving and measuring ads |
| Supabase | Everything you store in the app | Our database, file storage, authentication, and backend functions (hosted in Sydney, Australia) |
| Resend, Brevo, Zoho Mail | Your email address and messages: sign-up codes (Brevo), feedback you send in the app (Resend), emails you send to support (Zoho) | Delivering and receiving email |
| Cloudflare | This website's visitors' IP addresses (standard server logs) | Hosting this website; it does not receive app data |
| Cloudflare Turnstile | When you create an account, sign in with a password or ask for a new sign-up code: your device's IP address and the browser signals needed to tell a person from a bot | A bot check that keeps automated sign-ups out; it receives no meals, health data, profile or email address and is not used for advertising |
Each of these providers has its own privacy policy governing how it handles what it receives. We choose providers with clear no-training and limited-retention terms where possible, but we don't control their infrastructure directly.
04 Storage & security
Your data lives in a Supabase-hosted database and file storage in Sydney, Australia, encrypted in transit (HTTPS/TLS) and at rest, with your session credentials encrypted on your device. Every table and every file is access-controlled at the database level so that you can only ever read or write your own data — not another user's, and not us casually browsing it. Meal photos and blood reports sit in private storage buckets that are never publicly accessible. Our admin tools show counts and settings; they do not show your meals, weights, health details, or photos.
If a data breach ever puts your information at risk, we will notify affected users and the relevant regulators without undue delay, as required by applicable law.
05 Legal basis for processing
Under India's DPDPA, 2023, our primary basis for processing is your consent — given as a "Data Principal" when you create an account and actively use each feature (this notice, together with the in-app permission prompts for camera, microphone, location, notifications, and Health Connect, is how we give you notice before collecting anything). Where other privacy law requires a different named basis (for example, the EU/UK GDPR), we rely on:
- Your explicit consent — for sensitive health information specifically (blood reports, medical conditions, meal and nutrition data), for optional features like location, Health Connect and Apple Health steps, and Circle, and, where the law requires it, for personalised ads and analytics (the consent form shown on first use in the EEA, UK, Switzerland and some US states). You give consent by choosing to use that feature, and can withdraw it at any time by not using it, switching it off, deleting the related data, or deleting your account.
- Performance of a contract — for creating your account and providing the core logging, planning, and reminder features you sign up for.
- Legitimate interests — for basic security, fraud and abuse prevention, service-use records, and anonymous crash and usage reports, which we balance against your right to privacy and keep to the minimum needed.
06 Your rights & choices
View or edit almost everything you've entered directly in the app — profile, goals, meals, reminders, and more.
Export a CSV of your full meal, water, and weight history any time, from Progress → Export everything.
Switch things off in Progress → Your data: location, learning from your corrections (and "Forget it"), usage analytics, and ad privacy choices. In Circle you can leave at any time, which stops all sharing.
Delete individual items — any meal, reminder, medication, weekly task, or blood report — with a tap, right where you see it.
Delete your entire account from Progress → Account → Delete account, or by asking us at gogetup.app/delete-account if you can't open the app. In the app it is immediate and permanent and removes every row of your data and your uploaded files — there's no recovery window.
Wherever you live, you can also ask us directly (Section 12) to:
- Confirm what personal data we hold about you and get a copy of it
- Correct inaccurate or incomplete data
- Object to, or ask us to restrict, certain processing
- Receive your data in a portable, machine-readable format
- Withdraw any consent you've given, at any time, without affecting anything already done under it
We aim to answer every request within 30 days. If you're in the EU, UK, or another jurisdiction with its own data-protection authority, you also have the right to lodge a complaint with that authority directly — you don't need to contact us first.
GoGetup is a small team and doesn't currently have a statutorily-required EU/UK representative or Data Protection Officer appointed — our contact email (Section 12) is your point of contact for every privacy matter in the meantime, and we'll appoint one if our EU/UK user base grows to where the law requires it.
California and other US states
We do not sell your personal information for money. Showing personalised ads through Google AdMob can count as "sharing" for cross-context behavioural advertising (California) or "targeted advertising" (other states). Where the law requires it, you see a Google consent form (the User Messaging Platform) before any ad request, and you can reopen it at any time in Progress → Your data → Ad privacy choices; you can also reset or delete your advertising ID in your Android settings. We use sensitive personal information (such as health data) only to provide the features you ask for, not to infer characteristics for advertising.
Residents of California, Colorado, Connecticut, Texas, Virginia, Oregon and other states with comprehensive privacy laws can know what we hold, access, delete, correct and port their data, and opt out of targeted advertising, sale and profiling; we will not discriminate against you, with reduced service or a worse experience, for exercising any of these rights. If we decline a request you may appeal by emailing us (Section 12) with the subject "Appeal", and we will answer within 45 days.
Washington and Nevada (consumer health data)
Washington's My Health My Data Act and Nevada's consumer health data law specifically protect "consumer health data" like the nutrition, weight, and blood-marker information this app collects. In addition to the rights above, residents can withdraw consent to our collection or sharing of consumer health data at any time (Section 12), ask us to delete it, and ask for a list of the third parties it was shared with (Section 3). We do not sell consumer health data, and we do not use geofencing around any healthcare facility for advertising, tracking, or data collection.
India (Digital Personal Data Protection Act, 2023)
As a Data Principal under the DPDPA, you have the right to: obtain a summary of the personal data we hold about you and what we're doing with it; correct, complete, update, or erase your data; withdraw consent as easily as you gave it; nominate another individual to exercise these rights on your behalf if you become incapacitated or die; and file a grievance with us first, and with the Data Protection Board of India if you're not satisfied with our response. For grievances under the DPDPA, write to our Grievance Officer at the email in Section 12 with the subject "Grievance".
Canada (PIPEDA)
For Canadian residents, our legal basis is your meaningful consent — express, given by actively signing up and using each feature. You have the right to access and correct the personal information we hold about you, and to challenge our compliance with Canadian privacy law by contacting us (Section 12) or the Office of the Privacy Commissioner of Canada.
Automated decisions
AI-generated diet plans, nutrition estimates and blood-marker flags are informational suggestions, not automated decisions that produce legal or similarly significant effects on their own — nothing in the app automatically approves, denies, or restricts anything for you without a human (you, or a doctor you consult) making the actual call.
07 International data transfers
GoGetup is developed and operated from India and is available worldwide. Your app data is stored in Australia (Supabase, Sydney), and the AI, analytics, advertising and email providers in Section 3 process data on infrastructure in the United States and other countries. India's DPDPA generally permits transferring personal data outside India, except to a small list of countries the Indian government may specifically restrict from time to time. Where other law requires a specific safeguard instead (for example, transfers of EU/UK personal data outside the EEA/UK), we rely on the mechanism our provider has in place for that transfer, such as Standard Contractual Clauses.
08 Retention & deletion
We keep your data for as long as your account is active, so the app can keep showing you your own history. Deleting a single item (a meal, a report, etc.) removes it immediately. The exceptions are meal photos, which are deleted automatically 30 days after they are taken, and menu scanner and "What can I cook?" photos, which are deleted right after they are read (see Section 1); the written results of those scans stay in your history until you delete your account. Deleting your account removes your profile, logs, reports, friends, saved corrections and all your uploaded photos and files from our systems right away. After that:
- Routine backups at our hosting provider, if any, are overwritten on the provider's normal schedule; we do not keep a separate copy ourselves.
- Anonymous usage and crash data already held by Google Firebase follows Google's own retention periods and is not linked to your name or email.
- Emails you sent to support are kept as long as needed to help you and meet legal duties; ask us (Section 12) to delete them.
- Data held by the providers in Section 3 follows their policies; we send no more than each request needs.
Can't open the app? Request deletion at gogetup.app/delete-account.
09 Not medical advice important
GoGetup is an informational wellness tool, not a medical device or a substitute for professional care. Nutrition numbers read from a photo are estimates. AI-extracted blood markers and AI-generated diet plans can be wrong or incomplete. We refuse to generate a diet plan when a blood report shows critical values and tell you to see a doctor instead — but that safeguard is not a diagnosis, and it doesn't replace one. Always confirm anything health-related with a qualified professional.
10 Children's privacy
GoGetup is not directed at children under 18 — the highest of the age thresholds used by major privacy laws we're subject to, including India's DPDPA (18, with verifiable parental consent required below that age), COPPA (13) in the US, and GDPR (13–16, depending on country) in the EU — and we do not knowingly collect data from anyone under that age. Circle asks you to confirm you are 18 or older. If you believe a child has created an account, contact us (Section 12) and we'll delete it.
11 Changes to this policy
If we materially change how we handle your data, we'll update the effective date above and let you know inside the app before the change takes effect.
12 Contact us
GoGetup is operated by Xernext, India (xernext.com). Questions, requests, or concerns about your data — including any of the rights in Section 6, deletion requests, and DPDPA grievances — reach us at privacy@gogetup.app. For general support, support@gogetup.app. We're a small team, but a real person reads and responds to every message.