HASTE PRIVACY POLICY Kokonut • Version 1.2 • Updated 3 October 2026 Contact: admin@kokonut.cc Haste helps adults record food and estimate nutrition. Estimates can be wrong. Haste is not a medical device and does not diagnose, treat, cure or prevent medical conditions. Consult a qualified professional for medical or dietary treatment advice. ACCOUNT SYNC AND LOCAL STORAGE Signed-in profiles, saved meal journal entries (descriptions, dates, nutrition estimates, corrections and sources), weight/maintenance check-ins and calorie goals (including their measurement inputs) are saved locally and synced to private Google Firebase Firestore records when connected and account sync is available. Offline changes wait on this device and are sent when a connection is restored. Each account has separate local records and owner-only cloud records. Earlier account records are merged with cloud copies; earlier guest journals and temporary Explore entries are not moved into an account or uploaded. Photos and saved capture drafts stay on their original device and are not included in account sync. Earlier local copies that lose a sync conflict are kept on this device and can be reviewed in Settings. A deleted cloud meal is replaced by a small deletion marker with its identifier, affected dates and version, without its description, estimate or photo. This prevents an older device restoring it. Account deletion removes private synced records and local conflict copies on the current device. Minimal account identifier/deletion-time guards are retained in Firebase and Supabase to block stale tokens from recreating erased records. Android backup is disabled. Haste does not separately encrypt local records; your device's protections apply. Uninstalling or clearing app storage erases local records, photos, drafts and pending offline changes. Synced account records can be restored by signing in while the account still exists. Temporary Explore entries are not retained after a restart. ACCOUNTS AND FRIENDS Google Firebase Authentication processes your email, account identifier and sign-in credentials; Google sign-in also supplies your basic profile. Firestore stores your private sync records separately from your display name, friend requests, accepted friendships, per-friend privacy preferences and a rolling 30-day consistency summary (logged days, streak, number of meals and last logged day). Accepted friends can see your name and summary unless you hide your progress from that friend. They cannot read your private meal entries, goals, photos or weight through this feature. Your account remains until you delete it. AI CAPTURE IS OPTIONAL When you choose AI, the selected photo, food description, context, known nutrition and corrections travel over HTTPS through our Supabase API to Google's Gemini API. Corrections include the estimate being corrected. The AI API does not save these request photos or full estimates in its operational database. An estimate you accept into your Journal is saved locally and included in your private account sync; the photo is not included in sync. Google processes them under its Gemini API terms. When an unpaid Gemini service is used, Google may use inputs and outputs to improve its products and human reviewers may review them. Do not submit people, identifying details, medical information or other sensitive or confidential information. Paid Gemini services have different data-use terms. Read the current terms at https://ai.google.dev/gemini-api/terms. The AI consent screen is required before the first request on this account and device. You must be 18 or older to use AI. You can withdraw consent in Settings and continue using manual or database logging. SEARCH, USAGE AND REPORTS Food search terms and scanned product barcodes are sent through our API to USDA FoodData Central and/or Open Food Facts. They do not receive your Firebase account identifier from us. Open Food Facts records are community maintained; official menu records link to their restaurant source. Cached public product records are kept separately from account records. For abuse prevention, Supabase stores daily AI and report counts under day- and purpose-specific keyed hashes, without a plain account identifier, photo or report content. These counters remain after account deletion so erasure cannot reset allowances; they become eligible for removal after 30 days during routine quota checks. Connection diagnostics and Google Play verification use separate short-lived keyed-hash counters, eligible for removal after two minutes during subsequent admission checks. Cleanup can be delayed while the service is inactive. When you accept a food, we count the selection to order 'Most selected'. We deduplicate the same food once per account per UTC day using a daily keyed hash, rather than saving an email or raw account ID in the selection table. These temporary records contain the food identifier but no portion, weight or photo. Older daily records are removed during subsequent selection or deletion requests. Aggregate selection totals contain no account identifier and are retained. Counts represent use in Haste, not usage of another app or the entire food provider's database. If you send an in-app report, we store your account identifier, category, message, time and only the estimate text you explicitly choose to include. Photos and the rest of your journal are not attached. Reports help us investigate inaccurate, unsafe or inappropriate output. Reports older than 90 days are removed when a subsequent report is submitted, or when you delete your account. Support emails remain in the support mailbox for handling your request; ask us to remove them when no longer needed. SUBSCRIPTIONS If you buy Plus or Pro, Google Play handles the payment. Haste sends the Google Play purchase token through our Supabase API to Google Play to verify access. Supabase stores that token with your Firebase account identifier, plan, subscription status, expiry, last verification time and a retry time after an unsuccessful check. We do not receive or store your card details. These records are deleted when you delete your Haste account. Deleting the account or app does not cancel a Google Play subscription; manage or cancel it in Google Play first. Google Play handles charges and refunds under its terms. SERVICE PROVIDERS AND SECURITY Google Play processes subscription purchases and related payment information under its own terms. Our server checks the purchase state through the Google Play Developer API. We use Google Firebase for accounts, private account sync and friend data, Supabase for the API and operational database, Google Gemini for requested AI estimates, and USDA/Open Food Facts for food lookup. The Supabase project is hosted in Sydney; other providers may process information in other countries under their terms. HTTPS protects network transfers. API credentials stay on the server. Hosting, authentication and food providers may retain technical access/security logs, such as IP addresses and request times, according to their own policies. We do not intentionally put meal photos, descriptions, tokens or API keys into application logs. This release includes no advertising or analytics SDK, and Kokonut does not sell your personal data. DEVICE PERMISSIONS Camera access is used when you take a food photo or scan a barcode. The system photo picker lets you choose a photo without granting access to your whole library. Microphone access is optional for dictation; your device speech-recognition provider may process audio under its own settings and policy. Bluetooth permissions support audio devices for dictation. You can revoke permissions in Android Settings. Manual logging remains available. YOUR CHOICES AND DELETION Edit or remove journal entries in the app. Use Friends & privacy to hide progress from individual friends. Use Settings > Profile & account > Delete account to erase your Firebase account, profile, friend records, shared summary, operational records, synced journal/check-ins/goals and this account's local journal, drafts, weight, goal, conflict copies and saved photos on the current device. The minimal deletion guard described above is retained. Day-scoped pseudonymous abuse counters contain no plain account identifier, meal content or report details; they remain for abuse prevention and become eligible for removal after 30 days during routine quota checks. Cleanup can be delayed while the service is inactive. Erasure cannot reset service limits. Reauthentication and an internet connection are required. If deletion fails, retry; partial steps are safe to repeat. Copies on another offline device must be removed there by clearing Haste's app storage or uninstalling. Provider security logs and information already processed by Google may be subject to the provider's separate retention obligations. Anonymous aggregate selection totals remain. You can also request account deletion without the app: email admin@kokonut.cc with subject 'Haste account deletion' from your account email address. Include your Haste account email if different. Do not send a password. We verify account ownership before deleting cloud data and reply when completed. Contact the same address to request access, correction or deletion of personal information, or to raise a privacy concern. CHANGES We update the date and this policy when practices change. Material changes to AI transmission require renewed consent in the app. FOOD DATA ATTRIBUTION Open Food Facts: https://world.openfoodfacts.org • Database licensed under ODbL: https://opendatacommons.org/licenses/odbl/1-0/ USDA FoodData Central: https://fdc.nal.usda.gov Restaurant nutrition belongs to its identified source; availability, country, recipe and serving sizes differ. Check the label or current official menu.