Privacy policy
Your data is yours. We do not sell it, we never will, and there are no adverts in Kriterion. What you log (your food, your weights, your workouts, your cycle if you use it) lives in a private database on your phone, with no account and no copy on any server of ours. The only thing we record about how the app is used is to make the app better, it holds nothing you typed, and it is yours to switch off. A short list of things does leave your phone; all of them are below.
Who we are
Kriterion is a product of Kriterion Ltd, registered in England and Wales, company number 17451764, registered office 167-169 Great Portland Street, London, W1W 5PF. Kriterion Ltd is the data controller for the limited processing described here.
For anything about your data (a question, access, erasure, or a complaint), email [email protected] and we will answer within a month, usually far sooner. For everything else there is [email protected].
This website
Everything above and below describes the app. This marketing site, the one you are reading this on, does one additional and much smaller thing: if you leave an email address in the box asking to be told when Kriterion ships, that address is stored for exactly that purpose and nothing else. It is not linked to any app data, because at the point you sign up there is no app data to link it to. The whole list is deleted once the launch email has gone out.
To stop the signup form being abused, each signup also adds to a short-lived counter keyed to a salted hash of your IP address, never the address itself, and the counter expires on its own within a day.
The site sets no cookie and stores nothing on your device. Visits are counted as totals per page, with no identifier, so nothing here can be tied back to you.
Backup to your own storage
On Android you can turn on a daily backup. It is off unless you switch it on. When it is on:
- The app writes the same password-encrypted export described below to a place you pick with your phone's own file picker, such as Google Drive or a folder on the phone. We do not run a server for it and we do not choose the provider; the file sits in storage you control, under that provider's terms.
- The file is encrypted with a password you set. The password is kept on your phone in encrypted storage so the backup can run by itself; it is never sent anywhere.
- Turning the backup off stops it and makes the app forget the location and the password. Files already saved stay where they are until you delete them.
What stays on your device
Everything you log lives in a private database on your phone. We never receive it, and there is no account to sign into, because there is no server holding your history.
- Food, drink and supplement entries, including anything you scan or search for
- Workouts, sets, reps, weights and personal records
- Body weight, body composition and measurements
- Menstrual cycle dates and symptom check-ins, if you use them
- Progress photos, which are stored in the app's own storage and never uploaded
- Your targets, coaching tone, accent colour and other settings
Deleting the app removes all of it. We hold no copy, which also means we cannot restore it for you. The only copies are the ones you make: the backup to your own storage described above, if you turn it on, or the in-app encrypted export.
Health app data
If you allow it, Kriterion reads from and writes to Apple Health or Android Health Connect. This is entirely optional, the app works without it, and you can revoke it at any time in Apple Health or Health Connect rather than having to ask us.
| Platform | Data types |
|---|---|
| Apple Health | Body mass, active energy burned, step count, resting heart rate, heart rate variability (SDNN), sleep analysis |
| Health Connect | Weight, active and total calories burned, steps, exercise sessions, resting heart rate, heart rate variability (RMSSD), sleep sessions, and menstruation periods (only if you tap Import periods on the Cycle screen, which is the only place it is asked for) |
This data is read on your device to calculate your readiness score, your metabolic rate and your trends. It is never transmitted to us or to anyone else. Health data is never used for advertising, and never shared or sold. That is both our policy and a platform requirement we are bound by.
Cycle data
Menstrual cycle dates and symptom check-ins are health data, and UK GDPR treats them as a special category deserving more protection than ordinary information. The same is true of the phase the app estimates from them. It is derived from special category data and reveals the same thing the dates do, so we treat it identically rather than let the protection stop at the raw input and quietly not cover what the app calculates from it. So the protection here is not a policy promise but an architectural one: none of it, dates or estimate, ever leaves your device, except inside an encrypted backup or export you choose to make yourself. It is stored in the same private database as everything else you log, it is read on your phone to estimate your current phase, and that estimate is used there: shown beside your readiness score as context for training, and allowed for in your calorie target and in how your overnight heart readings are read in the luteal phase. None of it is transmitted to us, and the only copies off your phone are the encrypted ones you make.
Using the feature at all is your choice, and that choice is the explicit consent the law asks for (Article 9(2)(a)). You can stop at any time, delete individual entries, or delete every entry, and the rest of the app carries on without them. Deleting the app removes all of it.
On Android you can also import period dates you already keep in Health Connect, from the Cycle screen. They are read on your phone and stored with the dates you log yourself, under exactly the same rules; nothing about them is sent anywhere.
As set out below, cycle phases are estimates from the dates you type in or import. They are not a contraceptive method and not a fertility test.
What leaves your phone
1. Food searches
When you search for a food or scan a barcode, the search term or barcode is sent to the food databases we use: Open Food Facts, USDA FoodData Central, and our own index built from those plus the UK government's Composition of Foods Integrated Dataset and published restaurant menus.
What is sent is the thing you typed or scanned. What is not sent: your food log, your health data, your weight, your identity, or anything about you.
2. A food correction, if you send one
If a food's numbers are wrong you can tell us, and this is the only part of the app that sends anything because you chose to. Nothing here happens in the background. There are three ways to do it: report the data as wrong and type the correct figures from the packet, report that a barcode resolves to the wrong product, or photograph the nutrition panel as evidence.
What is sent is the food: its name and brand, the figures you entered or that were read from the panel, and which entry you are correcting (its barcode, its database id, or both).
If you photograph the nutrition panel as evidence, that photograph is sent with the correction, so that a person reviewing it can see the packet for themselves rather than taking the numbers on trust. It is stripped of its metadata first, including any location the camera recorded, and it is deleted once the correction has been reviewed. This is the only image the app ever uploads, it happens only on a correction or new product you chose to send, and the app tells you so at the moment it asks for the photo.
Reading the label is a separate thing and stays on your device: when you photograph a panel simply to log a food, the text recognition runs on your phone and nothing about that photo leaves it. Checking a barcoded food against its label is the one exception: the figures it read are shared even when no correction comes of it, never the photo, as section 6 describes.
You can also add a product the databases do not have. If you tick Add to shared database when logging a scanned product that was not found, and photograph its nutrition panel to confirm the figures, the barcode, the name and brand you typed, the figures and that photograph are sent for review, with the installation identifier, in the same way as a correction. The photograph is stripped of its metadata first and deleted once the product has been reviewed.
Alongside it we send a per-installation identifier, which the server stores only as a salted hash. It exists to rate-limit submissions and to let a reviewer spot a contributor who is repeatedly wrong. It is not linked to your name, your email or your health data, and it is never enough to work out who installed the app.
Submissions are quarantined for review rather than published, and never overwrite lab-measured data. Your own food log is not attached to any of this.
3. Exercise demonstration media
Exercise demonstration clips are bundled in the app and are not downloaded.
4. Crash reports
If the app crashes or hangs, a report is sent automatically via Firebase Crashlytics (Google) so we can find and fix the fault. What's in it: which line of code failed, your device model and OS version, and the app's version number.
What is not in it: anything you logged, your food, your weight, your cycle data, or anything else this page describes as staying on your device. A crash report is a fault in our code, never a window into your data.
Crash reporting also sends a short session ping each time the app starts: an installation identifier assigned by Firebase, the app version, and your device model and OS. It carries no events and nothing you logged. Its only purpose is arithmetic: a count of crashes is meaningless without a count of sessions to divide it by. The same switch covers both.
5. How you use the app
So that fixing the app is not guesswork, Kriterion records a small, fixed set of things about how it is used and sends them to Firebase Analytics (Google): which of a handful of screens you opened and roughly how long for, whether you logged food, a workout or a weigh-in, how far onboarding got, what happened at the paywall, and when something failed.
Firebase also records some technical details by itself, as it does for any app that uses it: an installation identifier it assigns, your phone model, system version, language and approximate country (worked out from the IP address, which Google does not give us). We do not add to them and we do not use them for anything else.
What it cannot contain is the part worth understanding. Every one of those events is built from a fixed list written into the app's code. There is no field anywhere in it that accepts free text. Not a note, not a food name, not a weight, not a number you typed. That is a property of how it is built rather than a promise about how we behave: there is no path by which something you logged could reach it, even by mistake. It exists to make the app better and nothing else: it is never sold, never shared, and never used to advertise to you.
6. Label figures, to improve food data
When you check a barcoded food against its label (Check the label, under What's wrong with this food?), the app reads the panel on your phone and then sends the figures it read to our server with the barcode. This happens whether or not a correction follows, because the reads that agree with our figures are as useful as the ones that do not: when many people's reads of one product agree, its numbers can be confirmed, and when they disagree, the entry gets checked.
What is sent: the barcode, the figures read from the label, the figures the app already held for that product, which of them agreed, where the app's figures came from (such as Open Food Facts), how the figures were read, and the installation identifier described in section 2, which the server keeps only as a salted hash.
What is not sent: the photo, your food log, what you ate or how much, your health data, your name, or anything else about you. Reading a label to log a food, or reading one on a product with no barcode, sends nothing.
On our server each read is filed against a tag worked out from the installation identifier and that one barcode, not against the identifier itself. The tag lets us count how many different phones agree about a product, and stops one phone that scans the same packet ten times from counting ten times, while the stored reads do not form a list of what any one phone has scanned. The server also keeps a daily count of reads against the hashed identifier, so the route cannot be flooded.
Why we are allowed to do this
UK GDPR requires a lawful basis for every piece of processing. Most of this page describes data that never reaches us at all, so the list is short.
| What | Why | Lawful basis |
|---|---|---|
| Your waitlist email address | To email you once, when Kriterion ships | Consent. Withdraw it by replying to any email or writing to [email protected], and the address is deleted |
| A food search term or barcode | To return the food you asked for | Performance of our agreement with you. We cannot look a food up without being told which food |
| A correction or new product you send | To review it and fix the database | Legitimate interests in an accurate food database, and you chose to send it |
| A nutrition panel photograph attached to a correction or new product | So a reviewer can see the packet rather than take the figures on trust | Consent, asked for at the moment the photo is attached |
| Label figures from checking a barcoded food against its label | To confirm or check a product's figures by comparing reads from many people, described in section 6 above | Legitimate interests in an accurate food database, with the Help improve food data switch in Settings under Security & Privacy as your right to object |
| The hashed installation identifier | To rate-limit submissions and label reads, and spot a contributor who is repeatedly wrong | Legitimate interests in keeping an open submission route from being abused |
| A daily count of requests held against a salted hash of the IP address they came from, never the address itself | So one address cannot flood submissions, label reads or other requests to our server | Legitimate interests in keeping those routes from being abused |
| Health and cycle data on your device | To calculate readiness, your metabolic rate and your trends | Your explicit consent, given in Apple Health, Health Connect or the app itself. We never receive any of it |
| How you use the app, as a screen or a step rather than as content | To fix what people are actually getting stuck on, described in section 5 above | During the beta, legitimate interests in an app that works, with the switch in Settings as your right to object. At public launch it becomes consent, opt-in and off until you turn it on |
| A crash report, when the app fails | To find and fix the fault, described in section 4 above | During the beta, legitimate interests in an app that does not crash, with the switch in Settings under Security & Privacy as your right to object. At public launch it becomes consent, opt-in and off until you turn it on |
Where we rely on legitimate interests you have the right to object, and you can do that by emailing us, or for crash reports, the usage record and label figures, with their switches in Settings. Where we rely on consent you can withdraw it, and withdrawing it does not affect anything that happened before you did.
How long any of it lasts
| What | How long |
|---|---|
| Everything you log in the app | Until you delete it or delete the app. It is on your phone, so the timing is entirely yours |
| Your waitlist email address | Until the launch email has gone out. Then the whole list is deleted |
| Server access logs, which record the IP address of any request for a food lookup, and for a food search the words you searched for | About two weeks. They are rotated every day and fourteen days of them are kept, after which they are deleted. Nothing copies them anywhere else |
| Crash reports and the usage record, once they reach Google | Held by Google, not on our server, and we keep no separate copy. Google's standard periods are 90 days for crash reports and 2 months for usage events. Turning a switch off stops anything new being sent |
| A nutrition panel photograph sent with a correction | Deleted once the correction has been reviewed |
| The correction itself: the food name, brand and figures | Kept, because once reviewed it becomes part of the food record. It is about a product, not about you |
| Label figures from checking a label | Kept, because they become evidence about that product's figures. They are held against the per-product tag described in section 6, never against the installation identifier itself |
| A contributor's accuracy history | 24 months from the last submission |
| The hashed installation identifier | 12 months from the last submission or label read. A contributor who stops submitting drops out of our records entirely |
| Daily request counts held against a salted hash of an IP address | 12 months, the same as the hashed installation identifier |
Where it goes
Almost nothing that identifies you is sent anywhere. As with any web request, each service below sees your IP address when your phone contacts it. What follows is the list of organisations involved.
- Our own server, which handles food lookups, corrections, new products, label figures, and recipe search. It sits in a data centre in the United Kingdom, rented from a hosting provider who supplies the machine and acts only on our instructions. We do not name them here, for the same reason we do not publish anything else about how the server is built.
- Cloudflare, which serves this website. A US company operating a global network. It is not involved in the app at all.
- Google, which receives crash reports and the usage record described in sections 4 and 5, for as long as you leave those switches on.
- An email delivery service, which sends the launch email to the waitlist. It receives the address and nothing else.
- Open Food Facts (France) and USDA FoodData Central (United States), which your phone contacts directly. They receive a search term or a barcode and your IP address, and nothing else.
- Recipe websites. If you paste a recipe link, your phone fetches that page and its picture directly from the website, which sees your IP address. The ingredient lines are then searched like any other food.
Where a transfer outside the UK happens, it is covered either by the UK's adequacy regulations or by the UK International Data Transfer Addendum. None of these organisations receives your health data, because none of it is ever sent to them.
Keeping it safe
The strongest security measure here is the one that is not a measure at all: there is no account, no password and no server holding your history, so there is no database of Kriterion users to breach. You cannot leak what you never collected.
For the rest:
- What you log sits in the app's own private storage, protected by the operating system's sandbox in the same way as any other app's data on your phone.
- The in-app export is encrypted end to end with a password only you hold. We could not open one if we were sent it.
- Everything that does leave your phone travels over an encrypted connection.
- A nutrition panel photograph is stripped of its metadata, including any location the camera recorded, before it is sent.
- The installation identifier reaches our server as a salted hash rather than as itself.
- Submissions are quarantined for review rather than published, and never overwrite lab-measured data.
What we will not tell you is that this makes anything impossible. No system is perfect, and the ordinary risk applies here as everywhere: if someone has your unlocked phone, they have what is on it. A screen lock is worth more to your privacy than anything we can do at our end.
Decisions the app makes on its own
Kriterion calculates a lot automatically. It works out a calorie target, estimates your metabolic rate, scores your readiness, and can suggest easing a session back. All of that is done on your phone, and all of it is a suggestion you are free to ignore, override or switch off.
None of it is a decision with legal or similarly significant effects, which is what Article 22 of UK GDPR is concerned with. Nothing the app concludes about you is shared with anyone, sold, used to price anything, used to decide what you are offered, or used for advertising. There is no profile of you anywhere but in your own pocket.
What we do not do
- We do not receive your health data. Not your food log, your weights, your workouts, your measurements, your cycle dates or your progress photos. None of it is stored on anything we run, because there is nowhere for it to go: no account, no server copy, no browser dashboard. The only copy off your phone is an encrypted backup or export you choose to make, in storage you pick. If that ever changes, this page will say what is stored and how it is protected before the feature ships, not after.
- No adverts, and no advertising identifiers
- No selling or sharing of your data, now or ever. There is no business model here that depends on knowing what you ate
- No health data in the usage record. What section 5 sends is a screen opened or a step abandoned, never what you ate, weighed or logged, and it stops the moment you turn it off
- No account inside the app, so no in-app email list, no password to leak, and no database of app users to breach. The one email list that exists is the launch waitlist on this website, covered above
Permissions, and why each one exists
| Permission | Why |
|---|---|
| Camera | Scanning barcodes, photographing nutrition labels, and taking progress photos. Barcode and label images are used for that scan only; a label photo travels only if you attach it to a correction you send, and a progress photo never leaves your device. Checking a barcoded food against its label shares the figures read, not the photo, as section 6 describes. |
| Internet | Food lookups, corrections, new products, recipe links and search, the label figures in section 6, crash reports and the usage record. |
| Notifications | Only the reminders you switch on. |
| Foreground service and audio | The HIIT timer keeps counting and speaking intervals with the screen off. |
| Run at startup | Restores your scheduled reminders after the phone restarts. |
| Vibration | Haptic feedback, which you can turn off. |
| Photo library | Saving a workout share card to your gallery, and opening a picture you pick yourself: a nutrition label to read, or a progress photo to keep. Kriterion never browses your library on its own. |
| Health Connect / Apple Health | Reading the signals your tracker already records (steps, sleep, resting heart rate, heart-rate variability, weight, workouts, calories burned and distance, and on Android your period dates if you choose to import them on the Cycle screen), so readiness and your calorie budget reflect what you actually did. Kriterion writes back only two things, a weigh-in you log and a session you finish, so your other apps stay in step. Each one is a separate permission you grant or refuse on its own, and refusing one only switches off what depends on it. |
Your rights
Under UK GDPR you have rights of access, correction, erasure, restriction, portability and objection. In practice most of these are already in your hands rather than ours, because we do not hold your data:
- Access and portability: export your full history from the app at any time
- Erasure: deleting the app erases everything it holds. To have the installation identifier and what is held against it removed from our server, open Settings, then Security & Privacy, tap Copy my install ID and email it to us. We hold it only as a salted hash, so without it we cannot tell which records are yours
- Withdrawing consent: revoke health access in Apple Health or Health Connect, and the app carries on without it
If you think we have handled your information badly, please tell us first, and you also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Children
Kriterion is not designed for or directed at children under 16, and we do not knowingly process their information.
Not a medical service
Kriterion is a wellness and training tracker. It is not a medical device, it does not diagnose, treat, cure or prevent any condition, and nothing in it is medical advice. Cycle phases are estimates from the dates you enter, and are not a contraceptive method and not a fertility test. Speak to a qualified clinician before making significant changes to how you eat or train.
Changes
If this policy changes in a way that affects what leaves your device, we will say so in the app rather than quietly updating this page.