Privacy Policy — What to Eat?
Effective date: October 15, 2026
Last updated: October 15, 2026
This Privacy Policy explains how the What to Eat? iOS app ("the app") handles your personal data. It is written to meet Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA").
The short version:
- Your profile, food log, favorites and settings stay on your iPhone. There are no user accounts, and we have no copy of this data.
- The AI assistant is optional. If you agree to use it, your recent chat messages go through our server to an AI provider outside Thailand. Your age, weight and other profile details are not sent.
- "Restaurants near me" opens Google Maps with the dish name. The app does not send your location.
- Location is used only if you tap Auto-detect on the Me tab, and only on your device.
- There are no ads, no analytics and no trackers. Purchases are handled by Apple.
- You can delete your app data at any time from the Me tab.
1. Who is responsible for your data (data controller)
- Name: Anuwat Mongkolwongsakul
- Email: notthedream@mail.grokbot.com
For any privacy question or request, including questions for our data protection contact, please email notthedream@mail.grokbot.com.
2. Data that stays on your device
The app stores the following data only in the app's storage on your iPhone. It is not sent to us or to anyone else, except as described in section 3 (AI assistant).
| Data | Why the app uses it |
|---|---|
| Age, sex, height, weight, activity level and goal (lose / maintain / gain) | To estimate your daily energy needs (TDEE) and suggest a calorie budget |
| Daily calorie budget and number of meals | To build your meal plan |
| Food log ("Ate it" entries) | To show your daily, weekly, monthly and yearly totals |
| Favorite dishes, pinned dish, drink choices and recent plans | To personalize suggestions and avoid repeats |
| Language, country menu and theme | To show the app the way you set it |
| Earned credits, logging streak, purchased credits and Pro status | To run the free allowance, credits and Pro features |
| AI message counters (messages used today and this month) | To apply the free and Pro AI message allowances |
| A random device code (a short string of random letters and numbers) | Created by the app; sent to our server only with AI messages, to apply the daily limit (section 3) |
| Your AI consent choice | To remember whether you agreed to use the AI assistant |
We cannot see, access or recover this data. Your age, sex, height and weight can be health-related information. Because this data never leaves your device, we do not collect it.
3. AI assistant (optional, only with your consent)
The AI assistant answers questions about food, calories and nutrition. It stays off until you tap Agree on the AI consent screen.
What is sent when you send a message:
- the message you just typed and up to 6 of the most recent messages in the current chat (yours and the assistant's), each cut to at most 600 characters;
- the app language you are using;
- the app's own menu data (dish names, calories, protein and portion size), which is the same for every user and is not about you;
- the random device code (to our server only, not to the AI provider).
What is not sent: your age, sex, height, weight, activity level, goal, calorie budget, food log, favorites, location, purchase status or contact details. The app does not add any of these to AI messages.
What you type is sent as you typed it. Please do not type your name, contact details, health conditions or other personal information into the chat. Questions about illness, medication, pregnancy or very low calorie intake get a standard "please consult a doctor" reply from our server and are not forwarded to the AI provider.
Who receives it:
1. Our AI server, which runs on a cloud hosting service and may be located outside Thailand. It checks the message, adds the menu data and forwards the request. It does not store the content of your messages. To apply the daily limit, it keeps a counter made of the date, the random device code and your IP address. This counter is deleted automatically within 48 hours.
2. OpenRouter, Inc. (United States), an AI routing service, which passes the request to an AI model provider. We currently use a model from the Qwen family.
3. The AI model provider that OpenRouter uses to run that model, which may be located outside Thailand.
OpenRouter and the model provider handle the data under their own policies (OpenRouter: https://openrouter.ai/privacy). OpenRouter states that it does not use requests to train models, but model providers' practices differ. We may change the AI provider or model in the future. If the change is material, we will update this policy and ask for your consent again.
Message allowances: free users can send 3 AI messages a day. Pro includes about 300 AI messages a month. Credit packs add more messages (see the Terms of Use).
Legal basis: your explicit consent (PDPA sections 19 and 26, because chat text may include health-related information, and section 28 for the transfer abroad). Rate-limiting by device code and IP address is based on our legitimate interest in keeping the service available and preventing abuse (section 24(5)).
Withdrawing consent: you can turn the AI assistant off at any time in Me › AI assistant. After that, the app sends nothing to our server or the AI provider. Withdrawing consent does not affect messages already sent.
4. Restaurants near me and location
- Restaurants near me: tapping this button opens Google Maps with a search for the dish name (such as "ข้าวมันไก่ ใกล้ฉัน"). The app does not ask for your location and does not send your coordinates. Google Maps may use your location under its own settings and Google's Privacy Policy (https://policies.google.com/privacy).
- Auto-detect (Me tab): if you tap this button, the app asks for location permission ("While Using the App"). Your coordinates are used on your device only to choose which country's menu to show (Thailand, Japan, China or international). They are not saved and not sent anywhere. You can choose your country by hand instead.
Legal basis: your consent, given through the iOS permission prompt. You can change it any time in iPhone Settings › What to Eat? › Location.
5. Purchases
Pro subscriptions and credit packs are sold through Apple In-App Purchase. Apple processes the payment under its own terms and privacy policy. We never receive your payment card details or your Apple ID. The app receives from Apple only the information needed to confirm what you bought, and stores your Pro status and purchased credits on your device. Apple gives us sales reports for accounting. Legal basis: performance of a contract (section 24(3)) and our legal obligations, such as tax and accounting (section 24(6)).
6. No ads, no analytics, no tracking
The app contains no advertising, no analytics or crash-reporting tools, and no third-party tracking code. We do not track you across other apps or websites, and we do not sell or share your personal data for advertising.
7. When you contact us or report an AI answer
If you email us, we receive your email address and whatever you write. If you tap Report this answer under an AI reply, the app opens your own email app with a draft that contains the question, the AI answer, the app version, the language and the time. Nothing is sent unless you send that email yourself, and it contains no profile data. We use these emails only to reply to you, handle your request and improve the AI answers. Legal basis: legitimate interest and, where relevant, our legal obligations. We keep this correspondence for as long as needed to handle your request, and no longer than 1 year.
8. How long data is kept
| Data | Kept for |
|---|---|
| Data on your device (section 2) | Until you delete it in the app, or delete the app |
| AI message content on our server | Not stored; processed only to forward the request |
| AI rate-limit counter (date, device code, IP address) | No more than 48 hours |
| Data held by OpenRouter and the model provider | According to their policies |
| Location | Not stored by the app |
| Emails to us | As long as needed for your request, no longer than 1 year |
9. Transfers outside Thailand
AI requests may pass through our cloud server outside Thailand, are sent to OpenRouter in the United States, and may be processed by AI model providers in other countries. These countries may not have data protection standards equal to Thailand's. We transfer this data only with your explicit consent on the AI consent screen, after telling you about this (PDPA section 28). We keep the data sent to a minimum, as described in section 3.
10. Your rights under the PDPA
You have the right to:
- be informed about how your data is used (this policy);
- access your data and get a copy of it;
- data portability, where applicable;
- correct inaccurate data;
- delete your data, or have it made anonymous;
- restrict (suspend) the use of your data;
- object to processing based on legitimate interest;
- withdraw consent at any time (AI: Me › AI assistant; location: iPhone Settings);
- complain to the Office of the Personal Data Protection Committee (PDPC), Thailand: https://www.pdpc.or.th
Most of your data is only on your device, so you can view and correct it in the app.
Deleting your data: Me › Delete all my data deletes your profile, food log, favorites, settings, earned credits, device code and AI consent choice from the device. Your purchase data stays: purchased credits and Pro status are kept on the device. You can also tap Restore Purchases to restore your Pro subscription through Apple with the same Apple ID. Purchased credits cannot be restored: they are lost if you delete the app or change devices. The AI message counters are also kept, so deleting data does not reset your message allowance. Deleting data does not cancel a subscription; manage it in your Apple ID settings.
For data on our server (the short-lived rate-limit counter), or any other request, email notthedream@mail.grokbot.com. We will reply within 30 days. We may ask for details to confirm the request is yours. Because there are no user accounts, we may not be able to link server data to you; it is deleted automatically within 48 hours anyway.
11. Security
All connections between the app, our server and the AI provider use encrypted HTTPS. Our AI provider key is kept on the server and is never included in the app. We limit what is sent and what is kept, as described above. No method is completely secure, but we take reasonable measures to protect your data.
12. Children
The app is meant for adults and teenagers who plan their meals. It is not directed to children under 13. Calorie planning is not suitable for children without adult guidance. Users under 20 should get permission from a parent or guardian before turning on the AI assistant, as required by PDPA section 20. If you believe a child has sent us personal data, contact notthedream@mail.grokbot.com and we will delete it.
13. Changes to this policy
If we change this policy, we will update the date at the top and show a notice in the app. If a change affects what is sent to the AI provider, we will ask for your consent again.
14. Contact
Anuwat Mongkolwongsakul
Email: notthedream@mail.grokbot.com
All contact is by email; we reply within 30 days.