Privacy Policy

The short answer

Food Replay is run by parents, for children. A parent creates the family account, confirms consent, and only then sets up each child; children can't sign up on their own. Here is what that means in practice:

• No ads, no tracking. There is no advertising, no third-party analytics and no tracking code in the app.
• Nothing for sale to kids. Children earn stars and gear by playing; none of it can be bought with money.
• Strangers can't reach your child. Leaderboards, challenges and cheers stay inside your family.
• Voice stays on the phone. When a child says what they ate, the phone turns speech into text; no recording is sent to us.
• Photos of faces stay on the phone. A meal photo showing a face is refused before upload. Food photos are deleted from our servers within an hour of being read.
• Names stay out of the AI. Your child's name is never sent to the AI service that writes stories.
• A grown-up approves every story before your child sees it.
• Your data is yours. You can download all of it, or delete the account, from the app.
• No selling, ever. We never sell personal data.

The full policy follows.

1. Who we are

Food Replay is operated by Tiso Studio Private Limited, a company registered in India and based in Hyderabad, Telangana ("Food Replay", "we", "us"). We decide how and why your family's personal data is used. That makes us the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the controller under the EU and UK GDPR.

• Privacy questions and requests: [email protected]. Everything else: [email protected]
• EU / UK representative: [name and address, or "not appointed" until launch there]

This policy covers the Food Replay app, our servers, and foodreplay.com. Please read it with our Terms and Conditions. "Parent" means the parent or legal guardian who manages the family account; "child" means a child using the app through that account.

2. Children and parental consent

Food Replay is made for children aged 4 to 13. The app does not accept a date of birth outside that range. Children cannot create an account or sign in on their own; they use the app on a device a parent has set up.

How a family account works

• The parent signs in with Sign in with Apple, Google Sign-In, or a one-time code sent to their email.
• The parent adds each child and answers a short set of questions about them (Section 3).
• Consent. Before the first child is added, the parent reads what we collect and confirms consent. We email a one-time code (valid for 24 hours), and the parent enters it in the app together with their own parent PIN. Until a parent in the family has confirmed, the app cannot save any child's details, meals, activity or other child data. One confirmed consent covers the whole family.
• The parent gate. Settings, privacy controls, data download and deletion, and any purchase sit behind a 4-digit parent PIN or Face ID. Face ID is handled by the device; we never receive face data. A parent can also give each child a 4-digit kid code to keep siblings out of each other's profile.

Other adults in the family. The account owner can invite other adults:

• Owner: everything, including privacy settings and deletion.
• Parent: sees and manages the children's activity.
• Cheerleader (for example a grandparent): can cheer the child on, but cannot see what the child eats.

Only the owner can change privacy settings or delete the account.

In India, a "child" is anyone under 18. Every child profile is managed by a parent whatever the child's age. We do not track children across other apps or websites or show them targeted advertising. We process a child's food and activity entries only to run the features the parent uses.

If we learn that a child's data was collected without a parent's agreement, we will stop using it and delete it.

3. What we collect and why

Items marked ◆ are also encrypted field by field on our servers.

We never collect location, contacts, photos of people, voice recordings or advertising IDs. The app has no ads, analytics, tracking code or cookies.

4. How we use data

We use the data in Section 3 only to:

• run the features the family uses: the food log, hero powers, Move, streaks, family challenges and stories;
• personalise daily nutrition targets, portion guidance and stories to the child's age and preferences;
• give parents reports, insights and suggestions;
• send parents service emails (sign-in codes, consent) and notifications (for example a story waiting for approval or a safety alert);
• send the child's device reminders (morning and dinner nudges, "your story is ready", level-ups, "a grown-up logged a meal for you");
• keep the service secure, prevent misuse and fix faults;
• meet our legal obligations.

We count three kinds of anonymous product events: a meal was logged (meal slot, method, number of items), a food was analysed (input type, outcome), and a story was finished (status, variant). These counts hold no names, IDs, text or photos.

"Help improve Food Replay" is off by default. If the owner switches it on, the family's confirmed food recognitions (text, never photos) help confirm recognitions for other families. No personal details are included.

5. Automated and AI features

Some features use generative AI provided by Google (the Gemini service; see Section 7). Here is exactly what each feature sends.

Meal photos

1. The phone checks every photo first. A photo showing a face is refused and never leaves the phone. If the phone cannot run the check, the photo is refused too. Hands or arms without a face are painted over before upload.
2. The cleaned photo is sent to our server and on to Google for food recognition. If Google's check finds a person, the photo is discarded.
3. The photo is deleted from our server as soon as recognition finishes, and in any case within 1 hour. The recognition record is deleted within 24 hours. Photos are never stored with the meal log.
4. The child confirms the suggested foods before anything is logged.

Typed or spoken food words. These are first checked on our server (Section 6). Swear words, contact details and names are removed. The text is then sent to Google to recognise the foods. Only the child's allergy list goes with it, never their name, age or profile. To save repeat work, recognised foods may be reused; results from photos are reused only within the same family, for 24 hours.

Stories and pictures. These use the child's age band (not exact age), interests and favourites (screened first), hero and avatar look, buddy, pet kind and colour, and the focus areas the parent picked. The child's name and the pet's name are never sent to Google. They are added on the phone when the story is shown. A grown-up approves every chapter before the child sees it.

Daily nutrition targets. Targets are calculated from the child's age band and the details in Section 3. For families in India, how much a child of each age needs is based on the Recommended Dietary Allowances (RDA) 2024 from ICMR-NIN; elsewhere we use the US Dietary Reference Intakes. Parents can adjust each target by up to 20%.

Parent suggestions ("Ask Romy"). These are for parents only and answer three fixed kinds of question. They use recent food names, weekday eating patterns, liked and disliked foods, allergies, condition types and diet type, with no name or date of birth. Answers are kept for 12 hours.

AI output can be wrong. Nothing in Food Replay is medical advice, and no automated decision has a legal or similarly significant effect on you or your child. We use Google's paid service. Under its terms, Google does not use our prompts or its responses to improve its products. It keeps them for a limited period, only to detect abuse, and processes them under its data-processing terms.

6. Keeping children safe

When a child types or says something while logging food, our server first checks the words against a fixed list of worry words. The list covers, for example, self-harm, being hurt by someone, not having enough to eat, very restrictive eating, distress, and unkindness. This check is a simple word match, not AI.

If a worry word appears:

• the entry is not sent to any AI service and is not logged;
• the family's parents get a private alert;
• the child's words are stored encrypted, visible only to the family's parents, and deleted after 30 days.

Separately, entries that may need a grown-up are held for a parent to check before they count, for example alcohol, energy drinks or medicine. Parents choose in Settings whether to review only unusual entries, all entries, or none. For younger children, a parent verifies entries.

We do not otherwise read children's entries. Food Replay is not an emergency or monitoring service. If you are worried about your child's safety, contact a doctor or your local emergency services.

7. Who receives data

We never sell personal data or share it for advertising. We share it only with service providers that act on our instructions under contract:

• Google Cloud: hosting, database and backups, in India (Mumbai).
• Google Gemini: food recognition, stories and parent suggestions. It receives only what Section 5 lists, never names.
• Cloudflare for network security, Resend for sign-in emails, and Apple and Google for sign-in, notifications and app-store purchases.
• On our website: our host, FormSubmit for waitlist emails, and YouTube, which loads our video only when you press play.

We also disclose data where the law requires it. If we sell or merge the business, the buyer must honour this policy, and we will tell parents first.

8. How long we keep data

We keep account data while the account is open. Some data is kept for much less: meal photos for at most 1 hour, recognition records for 24 hours, and safety flags for 30 days. Purchase records are kept as long as tax law requires. Backups expire within 35 days.

Deleting data. In Settings, the account owner can:

• delete one child's data: immediate and permanent;
• delete the whole family account: locked at once and permanently erased after 30 days. The owner can cancel during those 30 days.

Backup copies expire within a further 35 days. Anonymous product counts identify no one and are not deleted.

9. Where data is stored and how we protect it

Storage and transfers. Our servers, database and backups are in India, in Google Cloud's Mumbai region. Some providers in Section 7 handle data in other countries, including the United States. For EU and UK families, we rely on the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum, or on an adequacy decision. We will not transfer data to any country the Government of India restricts under the DPDP Act.

Security. Our protections include:

• Encryption in transit (HTTPS/TLS) between the app, our network edge and our servers.
• Encryption at rest for the database and backups.
• Field-level encryption (AES-256-GCM) for the most sensitive items (◆ in Section 3): health details, allergies and diet type, growth check-ins, parents' notes and safety flags. The keys are held separately from the database.
• One-way hashing of parent PINs and kid codes.
• Restricted access. Separate, restricted database accounts for live and test systems. Backups go to a private storage bucket. Only staff who need production data can reach it.
• On-device checks that keep faces and voice recordings off our servers.

No system is perfectly secure. If a breach affects your data, we will tell you and the Data Protection Board of India, and other regulators where the law requires, without undue delay and within the legal time limits.

10. What we never do

• Sell or rent personal data, or trade it for advertising.
• Show advertising anywhere in the app, or include third-party advertising, analytics or tracking code.
• Sell anything to a child. Stars and gear are earned by playing and cannot be bought with money. Any paid plan for parents sits behind the parent gate.
• Let anyone outside the family reach a child. Leaderboards, challenges, duels and cheers are family-only. Cheers are fixed messages, not free text. The occasional community goal shows only a combined total, never a child or family.
• Upload a photo showing a face, or record a child's voice.
• Send a child's or pet's name to an AI service.
• Make automated decisions with legal or similarly significant effect on a child.

11. Parent controls

Behind the parent gate, the account owner and parents can:

• view and edit each child's profile, food preferences and optional health details;
• switch off growth check-ins (height and weight are then neither stored nor used);
• choose which of a child's entries wait for a grown-up's check;
• approve or decline every story chapter;
• switch "Help improve Food Replay" on or off (off by default);
• set or remove a child's kid code;
• invite or remove other adults;
• turn notifications off for any device in the device's settings;
• download all family data, including profiles, meal and activity logs, growth records, stories, progress and safety flags;
• delete one child's data, or the whole family account (Section 8).

12. Your rights

Depending on where you live, you have rights over your own data and, as parent, over your child's. These include the right to:

• know what we hold and get a copy, in a portable format;
• correct it or update it;
• delete it;
• withdraw consent at any time. This does not affect processing before you withdraw, but the features that rely on it will stop;
• object to or restrict some processing;
• complain to a regulator.

Country-specific rights:

• India (DPDP Act): you may also nominate someone to exercise your rights if you die or become unable to act. Please contact us first at [email protected]. We will respond within 7 days and resolve your complaint within 90 days at most. If you are not satisfied, you may complain to the Data Protection Board of India.
• EU and UK: you may complain to your local data protection authority, or to the Information Commissioner's Office in the UK.
• United States: under COPPA, a parent may review the child's information, refuse further collection and have it deleted. Residents of California and other states have the rights their state law grants. We do not sell or share personal information, so there is nothing to opt out of.

Use the controls in the app or write to [email protected]. We may need to confirm that you are the account holder. We reply within 30 days, or sooner where the law requires, and we do not charge for requests.

13. Changes and contact

We will post any change here with a new effective date. If a change affects how we use children's data, we will tell parents in the app or by email first. Where the law requires, we will ask for fresh consent before the change applies.

Effective date: 4 November 2026. Last updated: 9 November 2026.

Questions? Write to [email protected]. Our postal address is Tiso Studio Private Limited, Hyderabad, Telangana, India. A person reads and answers every message.