'%3e%3crect%20width='512'%20height='512'%20fill='url(%23bg)'/%3e%3cg%20fill='%23ffffff'%3e%3cg%20transform='rotate(-45%20256%20256)%20translate(256%20256)%20scale(1.08)%20translate(-256%20-256)'%3e%3crect%20x='206'%20y='76'%20width='24'%20height='92'%20rx='12'/%3e%3crect%20x='244'%20y='76'%20width='24'%20height='92'%20rx='12'/%3e%3crect%20x='282'%20y='76'%20width='24'%20height='92'%20rx='12'/%3e%3cpath%20d='M206%20148%20L306%20148%20L306%20168%20C306%20192%20290%20202%20276%20206%20L276%20410%20C276%20425%20268%20436%20256%20436%20C244%20436%20236%20425%20236%20410%20L236%20206%20C222%20202%20206%20192%20206%20168%20Z'/%3e%3c/g%3e%3cg%20transform='rotate(45%20256%20256)%20translate(256%20256)%20scale(1.08)%20translate(-256%20-256)'%3e%3crect%20x='238'%20y='76'%20width='36'%20height='26'%20rx='8'/%3e%3crect%20x='238'%20y='108'%20width='36'%20height='256'/%3e%3cpath%20d='M238%20364%20L274%20364%20L261%20416%20C258%20426%20254%20426%20251%20416%20Z'/%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/svg%3e)
Privacy Policy
Last updated: July 30, 2026
Who is responsible
PKU Tools is an independent project run by André Reus, who is the controller under the GDPR. This policy covers the website and the app, which work the same way and store your data in the same place.
The operator can be reached by email at mail@nullpkutools.com.
What is stored, and why
| Data | Why | Legal basis |
|---|---|---|
| Account data: your email address, sign-in details and internal user ID, plus your name and profile picture if you sign in with Google | To create your account and let you sign back in | Performance of a contract (Art. 6(1)(b)) |
| Nutrition diary, blood values, custom foods and targets entered for you or a child | To provide the health features you choose to use | Consent (Art. 6(1)(a)), and explicit consent for health data (Art. 9(2)(a)), given by the person the data is about or someone legally allowed to act for them |
| App preferences, plan status and how much of your AI allowance you have used | To remember your choices and apply the limits of your plan | Performance of a contract (Art. 6(1)(b)) |
| Whether you consented, and when | To respect your choices and show that consent was given | Legal obligation (Art. 6(1)(c)) |
| Request data such as your IP address, pages opened and technical errors | To keep the service working and secure, and to understand how it is used | Legitimate interests (Art. 6(1)(f)) — you can object to this |
Your diary, blood values and targets say something about your health, so the GDPR treats them as a special category of data. That is why the app asks for explicit consent before storing any of it, and why the health features stay switched off until you give it.
You can withdraw that consent at any time in Settings. Withdrawing stops new health data being saved and makes those features unavailable. It does not delete what is already stored — you can do that separately in Settings. Withdrawing also does not undo processing that was lawful before.
Services used
| Service | What it receives | When |
|---|---|---|
| Firebase (Google) Privacy policy | Your account details and everything you save. It provides sign-in, account emails and the database. | Whenever you are signed in |
| Google Gemini API terms | What you submit to the AI Calculator, including any photo, and the food name when the app generates an icon for it. Google does not use it to train or improve its models. | Only when you use the AI Calculator or save a food |
| Open Food Facts Privacy policy | The barcode you scanned, and your IP address. | Only when you scan a barcode |
| PostHog (EU servers) Privacy policy | Which pages you open, your IP address, and session replays, which can include content shown on the page. | Every visit |
| Umami Privacy policy | Page views, without cookies. | Every visit |
| Headway Privacy policy | Your IP address, to show the changelog widget. | Every visit |
| Google Play Privacy policy | Whatever Google collects when you install or update the app. | Only if you install from Google Play |
Your data is not sold, and not shared for advertising.
Where your data is stored
The database holding your diary, blood values and custom foods runs in the United States. AI requests are processed by Google outside the European Union too. Both are covered by the European Commission's standard contractual clauses and by Google's certification under the EU-US Data Privacy Framework. PostHog is the exception and runs on European servers.
Cookies and local storage
PKU Tools stores a few things in your browser to keep you signed in and to remember choices such as appearance, camera and your analytics decision. None of those are used to track you.
Analytics run without a lasting identifier unless you accept analytics storage. If you accept, PostHog also stores an identifier in your browser, on the basis of your consent. Declining changes nothing about how the app works for you, and you can change your mind later by clearing this site's data in your browser.
Sharing a food with the community
Custom foods are private. You can share one with the community by ticking the sharing option on that food. Only that food is shared: what you entered about it, and the language you shared it in. Your name and email are never part of it, and nothing identifying you is shown in the app.
A shared food carries your internal user ID. That is what links it to your own copy, so you can keep editing it. Ratings you give carry it too.
The ID is not shown in the app, and other signed-in users have no way to connect it to your name or email. After you delete your account it no longer points to a live account, though temporary copies can remain in backups or provider logs for the periods described below.
If you would rather not leave a shared food behind, delete it from Own Food before deleting your account: that removes the community entry as well. Ratings you gave on other people's foods stay where they are.
Emails
Emails about app updates are optional and separate from your health data consent. You can turn them on or off in Settings. Emails needed to run your account, such as a password reset, are sent regardless.
How long data is kept
Your data is kept for as long as your account exists. When you delete your account, your data and your sign-in record are removed from the live database straight away.
The database is backed up automatically and those backups are kept for 30 days, so a copy can still exist during that period. Providers may hold their own residual copies in logs or deletion queues for the periods set out in their privacy policies.
Shared foods and ratings stay, because other people may be using them.
Your rights
Under the GDPR you can:
- ask what data is stored about you, and get a copy of it
- have inaccurate data corrected
- have your data deleted
- ask for the use of your data to be restricted
- receive your data in a portable, machine-readable format
- object to processing based on legitimate interests
- withdraw your consent at any time, without giving a reason
Account deletion and health data consent withdrawal are built into Settings, so you do not have to ask. For anything else, contact the operator by email.
You also have the right to lodge a complaint with a data protection authority. The competent authority for PKU Tools is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, and you can equally go to the authority where you live.
Automated decisions
AI results are estimates for you to check. Nothing in the app makes an automated decision with legal or similarly significant effects for you.
Children
Account holders need to be at least 18. A parent or legal guardian can use their own account to manage a child's PKU diet if they are legally allowed to provide the child's health information. The health information in that account may therefore be about the child.
Security
Data is transmitted over encrypted connections, and each account can only reach its own data and what has been shared with the community. No online service can promise absolute security.
Changes to this policy
The date at the top changes when this policy changes. If a new use of your data needs your consent, the app will ask before that use starts.
Questions
Questions can be sent by email to mail@nullpkutools.com.