Privacy Policy

NutriPath ("we", "our", or "us") is a free nutrition and wellness mobile application for Android (package ID com.nutripath.app). It helps users understand their body with a built-in BMI calculator, track daily physical activity, learn from a library of nutrition articles, tips and videos, ask and answer nutrition questions, and talk directly with a nutrition coach.

The app is available in three languages — English, Amharic and Afaan Oromo — and is completely free. There is no subscription, no premium tier, no in-app purchase, and no advertising in NutriPath. Every feature is available to every user at no cost.

This Privacy Policy describes how we collect, process, store, and protect your information when you use the NutriPath application. By creating an account and using the app, you agree to the practices described in this policy. If you do not agree, please do not use the application.

The following data is stored locally on your device only and is never transmitted to NutriPath servers:

• Step counter data — today's step count, 7-day weekly history, and 10k-step goal count. Stored in Android SharedPreferences and cleared when you uninstall the app.
• Onboarding completion flag — whether you have seen the onboarding screens.
• Language preference cache — a copy of your selected language for instant startup without a network call.
• Authentication tokens — stored in Flutter Secure Storage (Android Keystore) so only the NutriPath app process can read them.
• Cached content images — thumbnails for articles and videos are cached on your device so content loads faster. They are removed when you clear app data or uninstall the app.

Clearing app data from Android Settings will erase all locally stored information listed above.

NutriPath requests the following permissions on Android. Each permission is described with its purpose, whether it is required, and what happens if you deny it.

Core App Functionality

• Authenticate and maintain your account session securely.
• Calculate and display your BMI, health category, and personalised nutrition dashboard on the Home screen.
• Deliver a daily nutrition tip on the Home screen.
• Serve the learning library of articles, tips, and videos in your selected language.
• Display your step count, distance, and estimated calories in the Exercise screen.

Nutrition Coaching & Chat

• You can chat one-on-one with a nutrition coach directly from the app. Messages you send are visible to you and the coach only.
• Chat messages are automatically deleted from our database 48 hours after being sent, regardless of read status.
• A coach may assign specific articles, tips, or videos to your account. These targeted items appear in your Library so you can find them easily.
• Unread chat message and notification counts are calculated to display badges in the app.

Community Q&A

• Questions you submit in the Q&A section are published publicly so the nutrition team and other users can see and answer them. Your account name is not displayed with your question.
• Answers provided by the nutrition team are stored alongside the question.

In-App Notifications

• Notifications are created and stored by NutriPath admins and coaches and delivered to all users, or targeted to your specific account. They may link to articles, tips, or videos within the app.
• You can view, mark as read, or delete any notification from the Notifications screen.

Language & Localisation

• Your preferred language (English, Amharic, or Afaan Oromo) is stored in your user profile so the correct language is applied on every device you use to log in.

Support

• Contact channels (phone/WhatsApp, email, and Telegram) are displayed in the Support screen so you can reach the NutriPath team with questions or feedback.

NutriPath integrates the following third-party services. We share only the minimum data required for each service to function.

We do not integrate Facebook SDK, Google Analytics, Firebase Analytics, Crashlytics, Mixpanel, AppsFlyer, or any advertising network SDK.

• TLS/HTTPS in transit — all communication between the app and Supabase is encrypted using TLS 1.2 or higher. No data is sent over plain HTTP.
• Row-Level Security (RLS) — every table in the Supabase database uses RLS policies. Users can only read or modify their own rows. Admin access is scoped to the admin role only.
• Supabase Auth — passwords are never stored in plaintext. Supabase hashes them with bcrypt and a salt. We never have access to your password.
• Flutter Secure Storage — authentication tokens (JWT) are stored in Android Keystore, which provides hardware-backed secure storage that cannot be accessed by other apps.
• Automatic message expiry — chat messages carry an expires_at timestamp of 48 hours from sending. A server-side cleanup deletes expired rows automatically, limiting sensitive chat exposure.
• R8 code shrinking — the release AAB uses R8 minification and resource shrinking to reduce the app's attack surface.
• No debug builds in production — release builds use a dedicated signing keystore separate from the debug keystore.

You can delete your account and all associated cloud data from within the app under Profile → Delete Account. Device-local data is cleared automatically when you uninstall the app.

Depending on your jurisdiction you may have the following rights regarding your personal data. To exercise any of them, contact us at the address in Section 12.

• Access — Request a copy of the personal data we hold about you. Most of your data (name, email, health profile) is already visible in the app.
• Correction — Update your name, phone number, health profile metrics, and language preference directly in the app at any time.
• Deletion — Delete your account and all associated cloud data via Profile → Delete Account. Device-local data is cleared when you uninstall the app or clear app data.
• Portability — Request your data exported in a readable format by contacting us.
• Restriction — Request that we stop processing your data while a dispute about its accuracy or legal basis is resolved.
• Withdraw consent for Activity Recognition — Revoke the permission at any time via Android Settings. Step tracking will be disabled; all other features remain unaffected.
• Withdraw consent for Health Connect — Revoke step-data access in the Health Connect app. NutriPath will fall back to manual entry.

NutriPath is not directed at children under the age of 13. We do not knowingly collect personal information from anyone under 13. If you are a parent or guardian and believe your child has created an account, please contact us immediately at the address in Section 12. We will delete the account and all associated data promptly.

We may update this Privacy Policy periodically to reflect changes in the app, legal requirements, or our data practices. When we make material changes we will:

• Update the "Last updated" date at the top of this page.
• Display an in-app notification to active users describing the nature of the change.

Continued use of NutriPath after an updated policy is posted constitutes your acceptance of the revised terms.