Effective: 7 October 2026. This policy covers the Pea iOS app and getpea.app. Questions: [email protected].
Everything you log in Pea stays on your device: meals, cycle data, symptom check-ins, supplements, lab values, calorie tracker entries (including any weight or goals you enter), and any doctor visit summary you create. None of it is uploaded to a database of ours or anyone else's. The only time any of it travels is when you choose to send it: a meal you scan, or a conversation you have with Pod (both described below). There is no account and no cloud sync of this data. Like any app's local data, it is included in your own device backup (encrypted by Apple, controlled by you) if you use iCloud Backup.
When you scan a meal, the photo (or the text you type) is sent over an encrypted connection to our server, which forwards it to Anthropic's Claude AI to produce the verdict. The request contains only the photo or your food text (plus, when you refine a result, the previously identified food name), and a random install identifier for rate limiting. It never includes your profile, goals, cycle, symptoms, age, or anything else. We store nothing: our server keeps only an anonymous daily counter to enforce rate limits (deleted within 48 hours) and never saves your photos or text. Anthropic generally deletes API inputs and outputs within 30 days. Inputs flagged by its safety systems for policy review can be kept longer (Anthropic states up to 2 years for flagged material). Under its commercial terms, Anthropic may not train models on this content.
If you scan a barcode or search a packaged food, the barcode number or your search words are sent to Open Food Facts, a public food database, to find the product. We keep no search history.
Pod is Pea's companion. When you text Pod, your messages go over an encrypted connection to our server, which forwards them to Anthropic's Claude AI to write Pod's reply. When you call Pod, your voice is streamed securely to OpenAI's realtime voice service, which listens and speaks back; during a call Pod can also ask Claude to research a question. So Pod has context, each conversation includes a short summary of your recent activity in Pea, such as check-ins, symptoms you logged, and streaks. If Pod logs something for you during a conversation, that entry is saved on your phone exactly like one you typed yourself.
We store none of it: conversations are not saved on our server, and the summary exists only for that conversation. OpenAI and Anthropic generally delete API inputs and outputs within 30 days (longer only for material flagged by their safety systems), and under their commercial terms may not train models on this content. Conversations are never an analytics input. The microphone is used only during a call you start and stops when the call ends.
If you connect Apple Health, Pea reads sleep and menstrual flow, and writes mindful minutes from completed moments. Steps, workouts and active energy are read only if you turn on activity import in calorie settings. Health data powers features on your device, is never used for advertising or analytics, and is never stored on any server. If you talk to Pod, your recent check-ins (which can include sleep or flow you imported) can be part of the conversation summary described above. You can disconnect any time in the iOS Health app or Settings.
We use PostHog to understand which features are used, events like "recipe opened" or "check-in completed", tied to a random anonymous ID. The app is built so these events can never contain what you ate, your results, or anything from your health data. Subscription lifecycle events (a trial starting, a renewal, a cancellation) also reach PostHog via RevenueCat, tied to the same anonymous ID. No session recording, ever. Versions of Pea before 1.2.2 also sent anonymous usage analytics to TelemetryDeck. This was removed in version 1.2.2.
Subscriptions are processed by Apple and managed through RevenueCat using the same random anonymous ID. We never see your payment details.
To know whether our ads work, we use AppsFlyer and the Meta SDK. The first time you finish setting up, iOS shows the standard "Allow tracking?" prompt. If you allow, your device's advertising identifier (IDFA) is shared with these services to attribute installs to ads. If you decline, the IDFA is not shared, and the app works identically. Declining does not stop everything: AppsFlyer and Meta still receive a per-app Apple identifier (IDFV), your IP address, device model, and basic app events (such as installs and sessions) for aggregate measurement. Purchase events, meaning that a trial or subscription happened, never what you ate, are also reported for measurement.
Like any internet service, the providers that power Pea (PostHog, AppsFlyer, RevenueCat, Cloudflare, which runs our servers, OpenAI, Anthropic, and Open Food Facts) see your IP address when the app talks to them. We have configured our analytics to discard client IP addresses rather than store them. IPs are otherwise used by these providers for delivery and security under their own policies.
Deleting the app deletes your on-device data (and you can clear Health permissions in the Health app). Anonymous analytics and attribution records are kept by the services above under their own retention rules; because they are tied only to a random ID, they are not linked to you. To ask us to delete anything or for any privacy question, email [email protected].
If you are in the EU/UK, you have the right to access, correct, delete, and port personal data, and to object to processing. Because Pea keeps your personal health data only on your device, most of these rights you exercise directly by using or deleting the app; for anything else, email us and we will respond within 30 days. Our legal bases are: performing our contract with you (app features), and legitimate interest / consent for analytics and ad measurement (the iOS tracking prompt is your consent control).
For residents of Washington (My Health My Data Act), Nevada, and similar states: Pea does not sell health data, does not share consumer health data with third parties, and does not process health data off your device at all, except the meal photos/text you choose to scan and the conversations you choose to have with Pod, both processed transiently to deliver the result you requested and not retained by us. We do not use health data for advertising.
Pea is not directed at children under 13 and we do not knowingly collect their data.
If this policy changes materially, we will update this page and the effective date above.
Pea is operated by Egg Commerce Ltd, the data controller for this policy. Registered in Scotland, company no. SC725343, registered office By Muthill, PH5 2BD. Contact: [email protected].