Privacy Policy
Last updated: 14 September 2026
1. Who we are
Avo is made by Firo Factory LLC, a Wyoming limited liability company. We are the data controller for everything described here. “We”, “us” and “our” mean that company; “you” means the person using the app.
Questions, requests and complaints: legal@avoapp.food.
This policy covers the Avo app and the account behind it. Our Terms and Conditions cover the rest of the relationship.
2. The short version
- You photograph a meal. That photo is sent out to an AI service to be read. It is the only way the app can tell you what you ate.
- We store your meals, your photos and a short health profile so the app can show them back to you and work out your targets.
- We do not sell your data. We do not advertise to you. There is nobody paying us for access to it.
- You can ask us for a copy of everything we hold, or ask us to delete it.
- You have to be 16 or older.
The rest of this document is the same thing with the detail attached.
3. What we collect, and why
Things you give us
| What | Why we need it | Where it is kept |
|---|---|---|
| Your name and email, from Google or Apple sign-in | To make an account and know it is you next time. We never see or store a password. | Our hosting provider |
| Photos of your meals | To produce the estimate. See §5. | Our private storage, and sent to our AI provider |
| What you type about a meal | Same — it is part of the description the model reads. | Sent to our AI provider; kept with the meal |
| Your meals: foods, amounts, nutrients, scores, times | So your history, your daily totals and your progress exist at all. | Our hosting provider |
| Meals you save | So you can log a repeat meal without photographing it again. | Our hosting provider |
| Your profile: health goal, exercise frequency, sex, birth year, height, body weight | To work out your daily calorie and macro targets. Without them the app cannot personalise anything. | Our hosting provider, and a copy on your phone |
| The targets we compute from it | So every screen agrees on the same numbers. | Our hosting provider, and a copy on your phone |
Things the app produces by itself
| What | Why | Where |
|---|---|---|
| Technical records of each estimate, tied to your account | So we can tell whether estimates are working and diagnose the ones that are not. | Our hosting provider |
| Which onboarding screens you reached, and when | To see where people get stuck setting the app up, so we can fix the screens that lose them. It stays with us — no other company is sent it. | Our hosting provider |
| Crash and error reports, with a stack trace and the state around the error | To find and fix crashes. | Our crash-reporting provider |
| Which parts of the app get used, and how often | To decide what to build and what to remove. Only if you agree — see §10. | Our analytics provider |
Things that stay on your phone
Your language, your units, your reminder times, your timezone, unfinished meal drafts, and a copy of your profile all live in local storage on the device. They do not leave it, we cannot read them, and deleting the app deletes them.
Meals logged before the app moved to accounts also sit on the phone until the one-off migration moves them up.
4. What we do not collect
We do not ask for and do not want: your address, your phone number, your payment details, your precise location, your contacts, or anything from any other app.
We never see your card. Subscriptions are bought through Apple or Google, who take the payment and keep the details. All we are told is whether your subscription is active.
5. How your photo becomes an estimate
Avo cannot tell what is on a plate by itself. When you photograph a meal, the app makes the picture smaller and sends it out to an external artificial-intelligence service, together with anything you typed about it. That service reads the picture and returns the foods it can see and their nutrition. That is the whole product, and it happens on every estimate.
Under the terms we are on, the provider does not train on your photos and its reviewers do not read them. The call goes through our own server, on a paid commercial tier, and never through any account of yours with that provider — your photo is not attached to one. That tier’s terms say the provider does not use what we send, or what it returns, to improve its own products, and its human reviewers do not see it. Those terms apply to paid use; we do not use the free tier, where they would not.
It keeps what we send for a limited period only, to detect abuse of its own service and to make any disclosure the law requires of it. Throughout, it acts as our data processor under a data processing agreement.
We will tell you which company this is if you ask — write to legal@avoapp.food. We describe it by role here rather than by name so that the policy stays accurate if we change provider, not to keep it from you.
Your photos are also stored in our own private storage, so your history has pictures in it. Nobody but you can read them: the bucket is private and every object sits under your user id.
6. Who else handles your data
Avo does not run on its own. These are the kinds of company that process data on our behalf, under contract. None of them is allowed to use it for their own purposes.
| What they do | What they get | Where they are |
|---|---|---|
| Hosting, database, photo storage and sign-in | Everything in the first table of §3 | European Union (Paris) |
| Artificial-intelligence processing | Your meal photos and descriptions, as §5 describes | United States |
| Sign-in providers (Apple, Google) | That you signed in, and the name and email you let them share | United States |
| Subscription management | That your subscription is active, and an identifier for your account | United States |
| Crash reporting | Stack traces and the state around an error | European Union (Germany) |
| Analytics, only if you agree | Which parts of the app you use | United States |
| The app stores (Apple, Google) | The purchase. They are their own controllers, not our processors | United States |
We will tell you exactly which companies these are if you ask. Write to legal@avoapp.food and we will name them. We describe them by what they do rather than by name so that this policy does not go out of date the moment we change one — see §13.
Beyond these, we share data only when the law requires it, or to protect someone from harm. We do not sell your data and we never have.
If the business is ever sold or reorganised, your data may transfer with it, under this policy.
7. How long we keep things
| What | How long |
|---|---|
| Meals and their photos | Until you delete them, or close your account. Deleting a meal deletes its picture too. |
| A meal you shared as a picture | 14 days, then the shared copy and its photo are deleted automatically. Your own meal is untouched. |
| Your profile and targets | Until you change them, or close your account. |
| Estimate records (model, tokens, cost, the returned meal) | Until you close your account. |
| Which onboarding screens you reached | Until you close your account. |
| Crash reports | Under our crash-reporting provider's retention, which is shorter than the life of your account. |
| Everything, once you close your account | Deleted from our live systems. Backups are overwritten on their own cycle. |
8. Deleting your account
You can close your account from inside the app, or by writing to legal@avoapp.food. When you do, your profile, your meals, your saved meals, your photos and your estimate records are deleted — they are tied to your account and go with it.
Cancelling your subscription is a separate thing and has to be done in the App Store or Google Play. Closing your Avo account does not cancel it.
9. Your rights
Wherever you live, you can ask us to:
- send you a copy of what we hold about you;
- correct anything that is wrong;
- delete it;
- stop using it in a particular way, or object to a use;
- be told which companies have received it — §6 describes them by role, and we will give you their names on request;
- withdraw consent you gave, including for analytics, without it affecting anything done before you withdrew it.
Write to legal@avoapp.food. We answer within one month. We will not charge you, and we will not treat you differently for asking.
If you think we have handled your data badly, please tell us first — most of it is fixable. You can also complain to your national data protection authority.
10. If you are in Europe or the UK
We are a US company and you are protected by GDPR anyway, because we offer this app to people in the EU.
Why we are allowed to use each thing
| What | Legal basis |
|---|---|
| Your account, meals, photos, estimates and targets | Contract — Article 6(1)(b). Without them there is no app to provide. |
| Your health profile: goal, sex, birth year, height, body weight | Your explicit consent — Article 9(2)(a). Treated as special-category health data. You can withdraw it, and the app then stops personalising your targets. |
| Subscription status | Contract — Article 6(1)(b). |
| Crash reports, onboarding progress, and keeping the service secure | Legitimate interests — Article 6(1)(f). Our interest is a working, un-abused app that people can get set up; we ask for no more than that needs. |
| Usage analytics | Consent — Article 6(1)(a). We ask before the analytics tool starts, and nothing is collected if you say no. |
Your data leaves Europe
Your meals, photos and profile are stored inside the European Union — our database and photo storage are in Paris (eu-west-3), and crash reports are processed in Germany.
Some of it still leaves. We are a United States company, and the AI, subscription and analytics providers in §6 are US companies, so data reaching them — including the photos in §5 — goes to the United States.
For those transfers we rely on the European Commission’s Standard Contractual Clauses, and on the EU-US Data Privacy Framework where the company is certified under it. Ask us at legal@avoapp.food for the details of any particular one.
Your rights, in full
Access, rectification, erasure, restriction, portability, objection, and the right not to be subject to a decision based solely on automated processing that significantly affects you. Avo makes no such decision about you — it estimates what is on a plate, and every choice that follows is yours.
You may complain to the supervisory authority where you live. In Spain that is the Agencia Española de Protección de Datos, www.aepd.es.
11. If you are in California
We collect the categories described in §3: identifiers, health-related information you give us, photographs, and usage and diagnostic data. Why we collect each one is in the same section, and who receives it is in §6.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We never have.
You can ask us to tell you what we hold, to delete it, or to correct it, using the same address as everyone else: legal@avoapp.food. We will not deny you service, charge you a different price, or give you a worse version of the app for asking.
12. Children
Avo is for people aged 16 and over. It is not designed for children, we do not knowingly collect anything from them, and if we discover that we have, we delete it. If you are a parent or guardian and believe your child has an account, write to us and we will remove it.
13. Changes to this policy
We update this policy when what we do changes. The date at the top always says when it last changed.
If a change matters — a new company handling your data, a new purpose, anything that widens what we collect — we will tell you in the app or by email before it takes effect, and ask again for consent where consent is what allows it.
14. Contact us
Firo Factory LLC
legal@avoapp.food
Write to us about anything in this document, including a request to see, correct or delete your data.