Privacy policy

Umbral is an app for logging strength training and food. It is built to work on your iPhone: there are no accounts, no sign-up, no ads and no tracking of your activity across apps or websites. This policy explains what data leaves the phone, when, to whom and for how long.

Controller

Beñat Espiña, developer of Umbral (individual, Spain). Contact: hello@useumbral.com.

What stays on your phone

Everything you log is stored only on your iPhone: workouts, sets, meals, foods, goals, weight, measurements, progress photos and settings. Umbral has no server that stores your data and does not sync it through iCloud. If iOS backups are on (to iCloud or to your computer), that data travels inside the backup like any other app’s, encrypted and under your Apple account; Umbral has no access to it.

• Steps (Health and pedometer). With your permission, Umbral reads your steps from the Health app and the pedometer to show them in the app and the widget. It only reads; it does not write to Health and steps never leave the phone.
• Camera and photos. The camera is used to scan barcodes and photograph labels and meals; you can also pick images from your photo library. Photos are processed on the phone except in the cases below.
• Widget. The steps widget and the rest timer Live Activity read data the app keeps on the phone itself; they send nothing.

Deleting the app deletes everything it stores.

What leaves the phone

Only in three situations, always started by you:

1. Reading a label with AI. When you photograph a food label (or pick its photo from your library), Umbral first tries to read it on the phone. If that does not complete the entry, it sends that photo (JPEG, scaled down to at most 2048 px) to Umbral’s server, which forwards it to Google Gemini to extract the name, brand and nutrition values.

Before anything is sent to the AI (cases 1 and 2), Umbral asks for your permission the first time, with a prompt that explains what is sent. If you say no, nothing is sent: the label is completed by hand and “Comer fuera” asks again when you use it. You can change your answer at any time in Settings → Your data.

2. Estimating a meal eaten out. When you use “Comer fuera” (eating out), the description you type and the photos you add (up to 6), with the share of each dish you ate, are sent to Umbral’s server, which forwards them to Google Gemini to estimate calories and macros.

3. Looking up a barcode. When you scan a barcode, the barcode number is looked up directly in Open Food Facts. If it is not found there, it is sent to Umbral’s server, which looks it up in upcitemdb to get at least the product’s name and brand.

Requests to Umbral’s server (cases 1, 2 and the second step of 3) carry an install identifier: the identifier for vendor that iOS assigns to the app (it changes if you delete and reinstall Umbral). It is used only to limit how many requests each install can make per minute and to protect the service from abuse. It is not used to identify you and is not combined with any other data.

Umbral does not send your name, email, location, Health data, weight, workouts or food diary. There is no analytics and no third-party SDK in the app.

Who receives it and how long it is kept

• Umbral’s server (Cloudflare Workers, Cloudflare, Inc.). Receives the request, forwards it to the right provider and returns the answer. It does not store the photos, the text or the barcodes. Like any web server, Cloudflare sees the phone’s IP address, and the service’s technical logs (time, route, response code, request headers such as the install identifier, error messages) are kept for at most 7 days to diagnose failures. The usage limits keep counters tied to the install identifier, holding only the number of requests: the per-minute limit for 60 seconds, the daily limit for 2 days.
• Google (Gemini API). Receives the label photo, or the meal photos and description, without the phone’s IP address or the install identifier: the request comes from Umbral’s server. Pending: Umbral uses the Gemini API free tier today. Under its terms, Google may use the submitted content to improve its products and human reviewers may read it. It will move to the paid tier before launch, which changes this; write this item from Google’s terms in force at that moment (use for training, human review, retention period).
• Open Food Facts (Open Food Facts association, France). Receives the barcode number directly from the phone, and with it the IP address. Its own privacy policy applies.
• upcitemdb (UPCitemdb.com). Receives only the barcode number, from Umbral’s server, without the phone’s IP address or the install identifier. Its own privacy policy applies.

Some of these providers are in the United States, so the data described may be processed outside the European Economic Area, under the safeguards each provider offers for those transfers.

Legal basis

The photos and text that go to the AI (Google Gemini) are sent with your consent, given in the app before the first request and withdrawn at any time in Settings → Your data. The barcode is looked up to provide the feature you ask for (identifying the product). The install identifier is processed on the basis of a legitimate interest in protecting the service from abuse. Pending: legal review of the legal bases.

Your rights

You can request access, rectification, erasure, objection or restriction by writing to the contact address. Since Umbral keeps none of your data on any server (only the technical logs and usage counters described above, which expire on their own within days) and has no way of knowing who you are, in practice there is nothing to hand over or erase outside your phone: you control your data, and deleting the app removes it. You can also lodge a complaint with the Spanish Data Protection Agency (aepd.es) or your local authority.

Children

Umbral is not directed at children under 16.

Changes

If what leaves the phone changes, this policy and its date will be updated before the app version that does it is released.