Orwee · Legal

Privacy policy

Explains which data Orwee processes where, why and for how long, and what your rights are.

Effective: 10 November 2026 · Version 2.0

1. Data controller

Data that stays on your phone never reaches us; you have full control over it.

Data controller
The person or company that publishes Orwee in the app store (the name is shown on the store page)

2. Data that stays on your phone

None of this is sent to a server. It is deleted with the app or with Settings > Delete all data. A transfer file is encrypted with a password only you know, and you move it yourself.

  • Log: meals, times, nutrition values and, if you keep them, small photos of analysed meals.
  • Recipes and your products (names, ingredients, label values, barcodes).
  • Goals and profile: sex, age, height, weight, activity and the answer to the optional health question.
  • Weight entries, water entries, settings and your permission records.
  • Business workspaces: allergen marks and e-approval records (name, title, date).

3. Photo analysis

Data
The food, menu or label photo you take or pick, the analysis type and your note, if you wrote one. In bulk entry, the PDF or the photo of a recipe page you pick.
Purpose
To recognise the food, estimate grams, and read menu and recipe text. Nutrition values are calculated on your phone.
Legal basis
Your explicit consent to photo analysis (KVKK art. 5(1); art. 6(2) if the photo reveals information about your health; GDPR art. 6(1)(a) and 9(2)(a)).
Retention
Our server does not write the photo or the document to disk and clears it from memory when the analysis ends. The photo does not go to another provider.

4. Helping improve the app (two separate permissions)

Data
My corrections: the model’s proposal and your final version, unmatched ingredient names, units. My photos: the analysed image and the result you confirmed.
Purpose
To improve recognition, matching and gram estimates with automated jobs, and to measure new model versions before release.
Legal basis
Separate explicit consent for each permission (KVKK art. 5(1), art. 6(2) where needed; GDPR art. 6(1)(a), 9(2)(a) where needed).
Retention
At most 12 months; when you turn a permission off, submissions not yet processed are deleted at once. Aggregated results (synonyms, average grams) cannot be linked to a person and are kept.

5. Barcodes and data packs

Data
The barcode number you scan; the version and region code of the data pack requested.
Purpose
To find the product in the Open Food Facts database; to download current, signed food data.
Legal basis
Providing the service you ask for (KVKK art. 5(2)(c); GDPR art. 6(1)(b)).
Retention
The barcode number is not written to the logs. A pack request contains no personal data.

6. Security and rate limits

Data
The IP address of your internet connection and the app key; in technical logs the request type, duration and error code.
Purpose
To prevent abuse and overload and to find errors.
Legal basis
Legitimate interest in the security of the service (KVKK art. 5(2)(f); GDPR art. 6(1)(f)).
Retention
The IP address is held in memory briefly, only for the rate limit, and is not written to the logs. Logs contain no images, notes, recipe text or barcodes.

7. Photo analysis in detail

  • The photo is re-encoded on the phone: location and camera data are removed, and the long edge is at most 1568 pixels.
  • Where: the photo is sent to our server; recognition is done by an open-source vision model running on our own server, and the photo is not sent to another AI company.
  • Our server reads the text of a PDF itself; a scan or photo is read by the vision model. Word, Excel, CSV and TXT files are read on your phone and not sent.
  • If you choose “Analyse later” while offline, the photo is kept only in the app’s private storage on your phone until it is analysed, at most 48 hours.
  • You can withdraw your consent at any time in Settings > Photo analysis. Barcode and recipe entry keep working.
  • The app shows results to you only as suggestions; no automated decision with legal or similarly significant effects is made about you.

8. How contributions are protected

  • Both permissions are off by default; you turn each one on or off separately at first launch and in Settings > Privacy. Without them every feature works.
  • Your notes, product and brand names are not sent; a product name a business typed is kept only if it is a generic dish name.
  • There is no account or device ID. Submissions carry only a random key for the current permission period; it is used to delete your submissions when you turn the permission off, and the server keeps only its hash.
  • Nobody browses entries: data is processed only by automated jobs in aggregate, and a synonym is used only when at least 5 different submissions agree. The team sees only counts and metrics.

9. Recipients and transfers abroad

Your photos and contribution data are not given to another company.

To find a product, the barcode number is looked up in Open Food Facts through our server; the request contains no other information about you.

The hosting provider of our server, only as a data processor and on our instructions.

Competent public authorities may receive information only where the law requires it, and only data we hold. We do not hold the data on your phone.

Photo analysis runs on our own server; the photo is not transferred to another AI company. If our server is outside Türkiye, sending to it is a cross-border transfer (KVKK art. 9) and relies on the safeguards that article requires.

10. What we do not do

  • No account, no advertising ID, no location, no access to contacts.
  • No third-party analytics, advertising or tracking tools; we do not track you across apps and websites.
  • We do not sell or rent your data or share it for targeted advertising.
  • Notifications are only the meal and water reminders you set up, scheduled on your phone; no notification server and no device token are used.

11. Your rights

Under KVKK art. 11 and GDPR art. 15-22 you have the following rights:

  • To learn whether your data is processed and, if so, to request information about it
  • To learn the purpose of processing and whether the data is used for that purpose
  • To know the recipients in Türkiye and abroad to whom the data is transferred
  • To have incomplete or incorrect data corrected, to have data deleted or destroyed, and to have this notified to the recipients
  • To object to a result against you that arises only from analysis by automated systems
  • To claim compensation for damage caused by unlawful processing
  • To withdraw your consent at any time; withdrawal does not affect the lawfulness of earlier processing
  • If the GDPR applies to you, also: the rights to restriction of processing, to object and to data portability
  • Directly in the app: Settings > Export my data, Settings > Delete all data, Settings > Privacy (contribution permissions) and Settings > Photo analysis.
  • How and where to apply is set out in the “KVKK information notice”; your request is answered free of charge within 30 days at the latest.
  • Complaints: in Türkiye to the Personal Data Protection Board (after applying to us first); in the EU to the data protection authority of the country where you live or work.

12. If you live in the USA

  • We do not sell your personal information or share it for targeted advertising (as defined by the California CCPA/CPRA and similar state laws).
  • Photos and contribution data may count as “consumer health data” under some state laws (e.g. the Washington My Health My Data Act). We process this data only for the purposes above and with your consent; you can withdraw consent and request access and deletion.
  • You will not be treated differently for using these rights.

13. Children

The app is not directed at children and must not be used by anyone under 16. Calorie suggestions are calculated only for people aged 18 and over. Data that reaches us is not linked to anyone, so it cannot be told apart by age; people under 16 must not turn on photo analysis or the contribution permissions.

14. Security

Our server accepts only requests that carry the app key, applies rate limits and re-encodes incoming photos to remove embedded data. Data packs are signed; the phone does not use a pack whose signature does not match.

15. Changes

When this policy changes, the date and version above change. If the text of a permission or the provider that analyses photos changes, the app asks for that permission again.

16. Language of this text

This text was written in Turkish and is published in the app’s 21 languages. The translations contain the same terms.

If the translations differ in meaning, the Turkish text is the reference. If the difference is to your disadvantage, the meaning more favourable to you applies.

This clause does not limit the consumer rights and personal data rights that the law of your country of residence gives you and that cannot be waived by contract.