Romby Privacy Policy

Last updated 18 October 2026

Romby Ltd takes your health data seriously. This policy explains what we collect across both of our apps — the Romby eater app at app.romby.co and the Romby Coach coach dashboard at dashboard.romby.co — why we collect it, who we share it with, and the rights you have over it under the UK GDPR and Data Protection Act 2018, the EU GDPR, and equivalent laws.

1. Who we are (the data controller)

Romby is operated by Romby Ltd, a company registered in England and Wales (company number 17445423), registered office Suite RA01, 195-197 Wood Street, London, E17 3NU, United Kingdom. For all data-protection purposes, Romby Ltd is the data controller for the eater app and the base platform. We are registering with the UK Information Commissioner's Office (ICO) as a data controller; the registration number will appear here once issued. You can reach us at hello@romby.co for anything in this policy, including exercising your rights below.

2. What data we collect

Depending on how you use Romby, we collect:

• Account data — name, email address, a securely hashed password, an optional profile photo you upload as your avatar, and (for coaches) professional profile details you add.
• Profile fields used for goal calculation — sex, birth year, height and activity level, which you can add so we can estimate your daily energy needs and suggest calorie and macro goals.
• Apple Health data (iOS app, only if you allow it) — see §2A.
• Device push tokens — if you enable notifications, the device token issued by Apple (APNs) or Google (FCM), used only to deliver your reminders, coach nudges and messages.
• Messages — the chat messages you exchange with your coach (or, if you are a coach, with your clients) inside the apps.
• Health & body data (special category, GDPR Art. 9) — body weight, body-fat %, goal weight, and any notes you log about how you're feeling. This is special category health data and we only process it on the explicit-consent basis described in §3.
• Food data — photos of meals you snap, barcode scans, and the calorie/macro estimates derived from them.
• Activity & usage data — water logging, streaks, app opens, device/browser type, and coarse timestamps needed to run the service and keep it secure; plus in-app usage analytics linked to your account when you're signed in. On the web app (not the iOS/Android app) this includes session replays and heatmaps (see §11).
• Coach-relationship data — if you connect with a coach: the invite link/status, the coach's plan and private notes about you, and any push nudges they send. If you are a coach: your clients' shared health data (above) for as long as they've accepted your link.
• Family-sharing data — if you invite a household member (or accept their invite), the access level you both configure — view-only or edit — lets them see your logged data through the app, and you theirs. Either side can revoke this access at any time from Settings.
• Payment data — Romby never sees or stores your full card number. Romby Plus (the optional eater subscription) is bought through the Apple App Store or Google Play, which handle payment entirely; we receive only a purchase receipt that proves the subscription is active. Coaching subscriptions are a marketplace: a client who subscribes to a coach pays through Romby-hosted Stripe Checkout, Stripe handles the card directly, and we store only the card brand and last 4 digits (shown on the client's membership screen). Romby takes a 15% platform fee from each coaching charge; the rest is paid to the coach via their own Stripe Connect Express account.
• Support communications — anything you send to hello@romby.co.

2A. Apple Health (iOS app)

If you choose to connect Apple Health in the Romby iOS app, iOS asks for your permission for each data type. Romby is read-only: it never writes anything to Apple Health. We read only:

• steps
• active energy (calories burned through activity)
• resting (basal) energy
• walking/running distance
• sleep
• heart rate
• body weight

We sync daily totals of these to Romby's servers (§5) to show your progress, and to personalise your calorie goals and the AI Coach nudges (§4). Your Health data is never used for advertising or marketing, is never sold or shared with data brokers or other third parties (other than the hosting and AI processors in §5 that process it on our behalf), and is never used for analytics — it is not sent to our usage analytics, and no session replay is recorded inside the iOS app (§11). You can turn it off at any time in Romby's Settings, or in the iOS Settings → Health → Data Access & Devices → Romby; synced Health data is deleted when you delete your account (§6).

3. Our legal basis for processing

• Performance of a contract (Art. 6(1)(b)) — account creation, storing your logs, and running the core app.
• Explicit consent (Art. 9(2)(a)) — for the special-category health data in §2 (weight, body-fat %, food photos, macros, goal weight). We ask for this consent when you set up your profile and start logging, and again — separately and specifically — before any AI processing of your data (§4); and every subsequent log is a fresh, voluntary act of providing that data. You can withdraw consent at any time by deleting your account and data (§6); this does not affect the lawfulness of processing before withdrawal.
• Consent (Art. 6(1)(a)) — connecting to a coach and sharing your health data with them (§7) is a separate, specific consent you give when you accept a coach's invite link, on top of the consent in the point above.
• Legitimate interests (Art. 6(1)(f)) — keeping the service secure, preventing abuse, and rate-limiting login attempts; and improving the product through our self-hosted usage analytics, including reviewing session replays and heatmaps (§11).
• Legal obligation (Art. 6(1)(c)) — where we must keep billing records for tax purposes.

4. AI processing — photos, typed meals, and coach nudges

Romby sends certain data to third-party AI providers to power its core features:

• Meal photos — when you snap a meal, the photo is uploaded to our server and forwarded to a third-party AI vision model (routed through OpenRouter — see §5) purely to estimate calories and macros from the image.
• Typed food descriptions — when you type a meal instead of taking a photo ("quick add"), the text you type is sent to the same AI provider's language model to break it into ingredients and estimate quantities; the actual calorie/macro numbers are then looked up in our own nutrition database, not invented by the model.
• AI Coach nudges — to generate your daily in-app coaching message, we send an AI language model a compact data summary: your calorie/ protein goals, a rolling 7-day history of your logged calories and protein, yesterday's logged meals (the food names and their calories/protein), and, if you log your weight, a smoothed weight trend and rate of change. This is a text summary of your data, not photos, used only to generate that one message.

We ask for your explicit consent in-app before any of this AI processing happens; AI features stay off until you accept, and you can withdraw consent by deleting your account (§6). In every case, the estimate or message is returned to Romby and stored on your account so you (and, if you've connected one, your coach) can see it. We do not use this data to train models, and our AI providers are contractually prohibited from training on it under their API terms: requests are routed through OpenRouter to the underlying model providers, processed only to return a response, and our OpenRouter account has prompt and completion logging disabled and excludes providers that would train on inputs.

5. Who we share data with (sub-processors)

We use a small number of vetted service providers to run Romby. We don't sell your data, and we don't share it with advertisers.

Provider	Purpose	Location / processing
Netcup	Application hosting (the server your data lives on)	Germany, EU
Cloudflare, Inc. (R2)	Encrypted, continuous off-site database backups	EU region processing
Resend	Transactional email (invites, password resets, notifications)	EU/US, standard contractual clauses where applicable
Stripe	Payment processing for coach subscriptions (Stripe Connect marketplace — client payments, coach payouts)	EU/US, PCI-DSS compliant
OpenRouter, Inc. (routing to Google and Alibaba Cloud model providers)	AI estimation of calories/macros from meal photos and typed food descriptions (currently Google Gemini models); AI Coach nudges from a summary of your weight and recent nutrition (currently Qwen models). We'll keep this row current if the models change.	United States; UK IDTA / EU SCCs (§9)
Apple Inc. / Google LLC	App Store / Google Play billing for the optional Romby Plus subscription — we receive purchase receipts only, never card details. Also push-notification delivery (Apple Push Notification service and Firebase Cloud Messaging), which carries notification text and your device token	US / global, under their own privacy terms
Telegram Messenger (operational alerts)	Our private error-alert channel: when the server hits an error, a short alert is sent to our team's Telegram bot. It may include technical details such as an error message and user ids; it is not used for analytics	Global, under Telegram's own privacy terms

6. How long we keep your data

We keep your data for as long as your account is active. If you delete your account (from the Data & privacy section of Settings in the eater app, or by emailing hello@romby.co), we delete your personal data from our live database. It is then purged from our continuously-replicated off-site backups (Litestream, streamed to Cloudflare R2) within a further ~30-day retention window, and from our on-box daily snapshot backups within 14 days (we keep the 14 most recent daily snapshots and roll off older ones). Billing records are kept longer where the law requires it. If you were connected to a coach, the coaching content about you (plan, notes, check-ins, messages) is kept for 30 days after the link ends, so an accidental removal can be undone, and is then permanently deleted.

7. The coach-access model

Romby Coach lets a human coach see a client's real logged data — but only after an explicit opt-in:

• A coach sends you an invite link (email or shareable link).
• Nothing is shared until you accept it — a separate, specific consent from the one in §3.
• Once accepted, your coach can see your food logs, weight/body-fat trend, goals, and adherence — computed live from your real data — plus write private coaching notes and a plan for you.
• You can revoke the link at any time from your account. This immediately cuts off the coach's ongoing access to your data going forward. Our Coach Data Processing Agreement separately requires any coach who exported or noted down your data to delete it after a link ends.

8. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data ("right to be forgotten").
• Restrict or object to certain processing.
• Port your data to another service in a machine-readable format.
• Withdraw consent at any time, without affecting past processing.

These rights cover everything we hold about you — including, if you've connected a coach, the plan, notes, and check-ins your coach keeps about you inside Romby.

How to exercise these: the eater app's Settings screen has self-serve export (a machine-readable archive of everything we hold about you) and delete-my-account tools — that's the fastest way. For anything else, including requests from coaches, email hello@romby.co and we'll respond within one month.

9. International data transfers

Our hosting and backups are EU-based (Germany / EU region). Romby Ltd is a UK company; the UK and the EU each recognise the other as providing adequate protection. Where a sub-processor operates outside the UK/EEA — notably our AI providers, Stripe and Resend in the United States — we rely on the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or an adequacy decision (including the UK–US and EU–US Data Privacy Framework where the provider is certified) to ensure your data stays protected to UK/EU GDPR standards.

10. Security

We protect your data with, among other things:

• Encryption in transit (HTTPS/TLS) for every connection to Romby.
• Salted, hashed password storage — we never store plaintext passwords.
• httpOnly, Secure session cookies (see §11).
• Continuous encrypted off-site backups with point-in-time restore.
• Per-handler access controls so a coach can only ever read a client who explicitly accepted their link.

11. Cookies & analytics

Romby uses a single first-party session cookie to keep you logged in. We also run self-hosted, cookieless analytics (Umami, on our own infrastructure at analytics.romby.co) in the web apps (and a reduced set in the native app) and on our marketing sites, to understand product usage — page views, coarse device/browser info, and in-app product events (e.g. which screens get used).

In the iOS and Android apps we record no session replays or heatmaps and we identify your analytics activity by your numeric user id only, never your name; Health data, and the calorie, macro, weight and portion values you log, are never part of analytics — only counts and kinds of actions (e.g. "a meal was logged by photo"). On the web app (app.romby.co in a browser) analytics also includes session replays and heatmaps: recordings of how the app is used — taps, scrolling, navigation, and the screens shown (which can include your logged data as it appears on screen) — that we review to find confusing UI and bugs. When you're signed in, your analytics activity, including replays, is linked to your account name and user id so we can understand it in context. All of this runs entirely on our own EU-hosted servers (§9); nothing is shared with third-party advertisers or ad networks, and we don't use any third-party or cross-site advertising trackers. Replay data is covered by the same rights as everything else we hold about you (§8), including erasure.

12. Children

Romby is not directed at, and may not be used by, anyone under 16 years old.

13. Invite-only accounts

Account creation on the web is currently invite-only. The Romby app for iOS and Android lets you sign up directly. Either way, every account starts from a deliberate signup — this is a product decision, not a data-protection one.

14. Changes to this policy

If we make material changes, we'll update the "last updated" date above and, where the change is significant, notify you in-app or by email.

15. Complaints

If you think we've mishandled your data, please tell us first at hello@romby.co — we'll want to fix it. You also have the right to lodge a complaint with a supervisory authority. If you're in the UK, that's the Information Commissioner's Office (ico.org.uk). If you're in the EU, you can complain to the authority in the member state of your habitual residence, place of work, or where the alleged infringement occurred (for our German hosting, that includes the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)).

16. Governing law

This policy is governed by the laws of England and Wales, alongside the UK GDPR, the EU GDPR where it applies to you, and any mandatory data-protection rights you have under the law of your country of residence.

17. Contact

Questions about this policy or your data: hello@romby.co.