KODA is operated by TRYKODA LTD, a company registered in England and Wales (Company No. 17265721). Our registered address is available at Companies House. You can contact us at support@trykoda.co.uk.

We collect the following personal data when you use KODA:

• Account data — your email address and password (stored securely via Supabase Auth)
• Profile data — your nutrition goals, dietary preferences, allergies, health conditions, age, weight, height, and activity level. This is health data under UK GDPR and we treat it with the highest level of protection.
• Usage data — meal plans you generate, meals you mark as eaten, pantry items you add, shopping lists, macro tracking logs, water intake logs, and fasting records
• Receipt and scan data — photos of receipts and food labels you scan. Images are processed by Google Cloud Vision and are not stored permanently after processing.
• Payment data — we use Stripe to process payments. We do not store your card details. Stripe retains payment records as required by financial regulations.
• Waitlist data — if you joined our pre-launch waitlist, we store your email address and the source of your signup.
• Communications — if you contact us by email, we store that correspondence.

We collect your data to:

• Provide the KODA service — generate your meal plan, track your macros, and power the AI coach
• Process your subscription payment via Stripe
• Send you transactional emails — account verification, password reset, and launch notifications if you joined the waitlist
• Improve the app — aggregate, anonymised usage patterns help us understand how KODA is used

We process your personal data on the following legal bases under UK GDPR:

• Contract — processing your account data and usage data is necessary to provide the KODA service you have subscribed to
• Legitimate interests — we have a legitimate interest in understanding how the app is used to improve it. We always balance this against your rights.
• Consent — where we ask for your explicit consent, such as optional push notifications, you can withdraw this at any time in the app settings
• Legal obligation — we retain Stripe payment records for 7 years as required by UK financial law

Your nutrition goals, dietary information, and health conditions are special category data under UK GDPR. We process this data only to provide you with the KODA service. We do not sell, share, or use your health data for advertising purposes. Your health data is never used to train AI models.

We share your data with the following third-party services only as necessary to provide KODA:

• Supabase — database and authentication provider. Data stored in the EU (Ireland). supabase.com/privacy
• Anthropic — AI provider powering meal plan generation and the coach. Your profile and meal data is sent to Anthropic to generate your plan. anthropic.com/privacy
• Google Cloud Vision — processes receipt and label photos for OCR. Images are not retained after processing. cloud.google.com/terms/data-processing-addendum
• Stripe — payment processing. Stripe is PCI-DSS compliant. stripe.com/gb/privacy
• Resend — transactional email delivery. resend.com/privacy
• Open Food Facts — open database used for barcode lookups. No personal data is shared. openfoodfacts.org

We do not sell your personal data to any third party. We do not share your data with advertisers.

We retain your personal data for as long as your account is active. When you delete your account:

• All your personal data is permanently deleted from our systems within 30 days
• This includes your profile, meal plans, pantry, macro logs, coach conversations, and receipt history
• Stripe payment records are retained for 7 years as required by UK financial law — this is a legal obligation we cannot override
• Anonymised, aggregated data that cannot identify you may be retained

Under UK GDPR you have the following rights:

• Right of access — you can request a copy of all personal data we hold about you
• Right to rectification — you can correct inaccurate data via the Profile tab in the app
• Right to erasure — you can delete your account and all associated data from Profile → Settings → Delete Account
• Right to data portability — you can request your data in a portable format by emailing support@trykoda.co.uk
• Right to object — you can object to processing based on legitimate interests by contacting us
• Right to restrict processing — you can request we restrict processing of your data in certain circumstances

To exercise any of these rights, contact us at support@trykoda.co.uk. We will respond within 30 days.

We send push notifications only if you enable them in the app settings. You can disable all notifications at any time from Profile → Settings → Notifications or from your device settings. We do not send marketing push notifications.

The KODA mobile app does not use cookies. The trykoda.co.uk website uses essential cookies only for functionality. We do not use advertising cookies or tracking pixels.

KODA is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us at support@trykoda.co.uk and we will delete it.

We may update this privacy policy from time to time. We will notify you of significant changes by email or via an in-app notification. The date at the top of this page shows when it was last updated. Continued use of KODA after changes constitutes acceptance of the updated policy.

If you are unhappy with how we handle your personal data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.