Download on the App Store
Get the app

Legal

Privacy policy

Also in DeutschEspañolFrançaisItaliano日本語

Effective October 10, 2026 · Last updated October 10, 2026

Onederland is a GLP-1 medication and weight tracker for iPhone and iPad. Onederland is operated by Steven Giles (“we”, “our” or “us”), who is responsible for the personal data this policy describes. This policy explains what stays on your iPhone, what leaves it, who receives it, why, and for how long, and the choices you have.

1. Data stored on your iPhone

The app keeps a database on your iPhone with what you log and what it reads from Apple Health with your permission:

  • doses and their notes;
  • weights and body measurements, blood pressure, blood glucose;
  • food, water and nutrition;
  • sleep, steps and other activity;
  • notes, check-ins and side effects;
  • goals, reminders and settings;
  • daily insights;
  • 3D comparisons.

It's protected by your iPhone's data protection. Reports (PDF, CSV) and share images are made on the iPhone and leave it only when you share them.

Backups. When you tap Back up now, the app writes a backup file of everything you've logged, including the 3D photos and models kept on your iPhone, to the app's folder in your own iCloud Drive. You can also export one to Files. These files are in your iCloud account, under your control; we don't have access to them.

3D photos and models. 3D body compare saves its photos and models on your iPhone. If you turn on Save in iCloud Drive on the 3D body compare screen, it saves new ones in your iCloud Drive instead. The switch is off unless your iCloud Drive already held 3D comparisons from an earlier version of the app; then it stays on, and the screen tells you so.

Apple Health. The app reads only the types you allow:

  • weight, height and body composition;
  • blood pressure and blood glucose;
  • steps, distance, active energy and exercise minutes;
  • sleep;
  • nutrition and water;
  • sex and date of birth.

It writes back the weights, blood pressure, food and water you log, unless you turn that off in Settings. On iOS and iPadOS 26.5, it neither reads nor writes blood pressure. On its own, the app sends data from Apple Health off your iPhone only in the daily insight's summary, after you allow the insight (section 2); otherwise it leaves only in reports, share images and backups you choose to make or share. It's never used for advertising or marketing and never sold.

2. Data that leaves your iPhone, by feature

FeatureWhat is sentWho receives itWhyHow long it's kept
Daily insight (Onederland tab), only after you allow it Up to 7 days of daily totals (calories, protein, carbs, fat, fiber, water, steps, active energy, exercise minutes, sleep minutes and stages); your weight unit, height, latest, starting and goal weight, sex, age in years, medicine, dose and dosing interval, and goal settings; your last, today's and next dose; side effects you logged (with any words you typed for “Other”); check-in mood and energy; your language; and the text of up to 14 recent notes (up to 280 characters each, with emails, links and phone numbers removed) Our server (hosted on Cloudflare), which passes it through Cloudflare AI Gateway and OpenRouter to the AI model's provider, currently OpenAI. Neither your account ID nor a device ID goes with it To write your daily insight and today's focus Our server doesn't store it; it keeps only a count of requests per account or device for daily limits. Deleting your account deletes the counts tied to it. A cleanup that runs whenever a request is counted deletes counts more than 8 days old, so a count can stay longer when no request comes. Cloudflare AI Gateway is told not to log it. OpenRouter and OpenAI keep it under their own policies and our account settings with them, for example to monitor abuse; we haven't arranged zero retention with them
AI food logging (Onederland Plus), only after you allow it The meal you describe (up to 2,000 characters) or the photo you take, re-encoded without location or other metadata, any note you add, and your language As the daily insight To estimate calories and nutrients As the daily insight
Label check, under the same permission The nutrition label image and product name from Open Food Facts (not your photo) As the daily insight To check a scanned product's numbers As the daily insight
Barcode scan The barcode number Open Food Facts, a public food database, directly from the app; no account or device ID is sent To look up the product Open Food Facts' own policy
3D body compare (Onederland Plus, signed in), only after you allow it Your two photos, re-encoded without metadata Our server, then fal.ai, a 3D-model service. Only if you made a comparison in the Detailed or Textured quality before, and so can still choose those qualities, fal.ai also sends the photos to its partner Tripo, which builds those models under its own terms. For everyone else the photos go to fal.ai alone To build your 3D models fal.ai is told to keep no copy of the requests and results, and to delete the photos it stores and the models it makes an hour after they're created. Photos and models made before this policy took effect weren't set to expire at fal.ai; we have deleted them. If your photos go to Tripo, it keeps what it receives under its own terms, which we don't control. Our server keeps each comparison's result with your account until you delete the account: links to the files, which stop working once fal.ai deletes them, and, for the Quick quality, the body keypoints and shape parameters the model reports. It also reads that record to see whether you have made a comparison in the Detailed or Textured quality before
Sign in with Apple Your Apple account ID, and on first sign-in the name and email Apple shares (often a private relay address you can turn off in Apple settings) Our server Your account, keeping Onederland Plus on your devices, referrals, and deleting your account Until you delete your account
Subscriptions Your purchases and receipts, an app user ID (your Apple account ID when signed in, otherwise a random ID), and facts such as first purchase date, total paid and referral codes; with each request, device details (model, OS version, app version, language and App Store country), the identifier for vendor, which Apple gives this developer's apps on your iPhone, and whether tracking is allowed RevenueCat, our subscription service, and our server, which keeps a copy of the subscription status RevenueCat reports for your app user ID (the plan, trial or paid period, end date and App Store transaction IDs); Apple processes the payment itself and we never see payment details To give you Onederland Plus, restore purchases and grant referral rewards RevenueCat keeps them so purchases can be restored, also after you delete your account, unless you ask us to delete them (section 4). Our server keeps its copy while the subscription is active and for 30 days after it ends, whether or not you signed in; deleting your account deletes it, leaving only a keyed hash of your app user ID so that later renewals store nothing
Referrals Your referral code and the code you used; the payment status of the subscriptions involved (whether the person you invited, or you, started paying, with the plan and renewal date); and the reward records (which free month was earned, for whom, and when it was applied) Our server Referral rewards Until you delete your account; records shared with another person are anonymized. After you delete your account we keep only a keyed hash of the store subscription that received or earned a referral reward, with no account ID or purchase ID, so the same subscription can't earn a reward again.
Device session A random ID for this installation, the platform and app version Our server Secure connections, limits and fraud prevention 1 hour (the session); 10 minutes (rate limits)
Analytics, unless you turn them off Which features you use (for example that a meal was estimated, the weekly score was viewed or the paywall opened), with details such as a meal's type, servings and the AI's confidence, or a referral code; purchase events with product, price and currency; and, with every event, device details (model, OS version, screen size, app version, carrier, mobile network type and whether Wi-Fi is on), tied to a random ID for this installation. No location, weights, doses, food names, note text, scores or email Mixpanel To understand how the app is used and improve it Under Mixpanel's retention for our project, until we delete it on your request
Crash reports Crash logs, performance traces and technical details (device, OS, app version, the screen and request addresses involved); no account ID Sentry To find and fix crashes Under Sentry's retention for our plan
Invite links, install check and ad measurement When you open a friend's invite link, before the app is installed: your browser's request to Linkrunner (app.onederland.fit), which includes your IP address and your browser's user agent, and the friend's referral code from the link. Only if you allow tracking (and then every time the app starts): device details (model, OS version, language and region, time zone, screen size, app version, connection type, your iPhone's web browser user agent and when you first opened the app); the identifier for vendor, which Apple gives this developer's apps on your iPhone; a random ID for this installation; a token from Apple that lets Linkrunner ask Apple whether an Apple Search Ads campaign led to the install; your tracking permission status; your advertising identifier; your account ID once you sign in; the web addresses of the links you open from the Onederland Plus screens (the terms, the privacy policy and Manage subscription); and your IP address, from which Linkrunner works out your approximate location (country, state and city). Without your permission, the app sends Linkrunner nothing, and an invite link can't be matched to your install. Linkrunner, a link and attribution service To find out whether an invite or ad link brought you, so a friend's referral code can reach the app, and to learn which ad campaigns and invite links bring people to the app Under Linkrunner's retention policy

Server logs. Our server's logs (Cloudflare) record technical events, such as which part of our server the app called and any error codes. They don't record your IP address, your location, your device's details or the content of your requests; a few events include a random ID for an installation or an account. They're kept for 7 days.

Our website. onederland.fit is hosted on Amazon Web Services. Its servers record standard access logs, including IP addresses, which are kept in our Amazon Web Services account under its log retention settings and used only to run and secure the site. The site uses no cookies, analytics or advertising. It saves only your answer to its language suggestion, in your own browser.

3. Why we use your data (legal bases)

  • To provide the app and the features you ask for: the daily insight, AI food logging, 3D body compare, your account, subscriptions and referrals. This is necessary to perform our contract with you.
  • With your consent: Apple Health access, through Apple's permission sheet; what the daily insight, AI food logging and 3D body compare send, through the app's permission sheet, which asks before anything is sent (you can turn each off in Settings › AI and analytics); the install check and ad measurement, which send Linkrunner your device details, the vendor and install IDs, an attribution token from Apple, your IP address, your advertising identifier, your account ID and the links you open, through Apple's tracking permission, and nothing without it.
  • Our legitimate interests: analytics and crash reports, to keep the app working and improve it; the invite-link request, which sends Linkrunner, without asking, your IP address, your browser's user agent and the friend's referral code when you open a friend's invite link, so that, if you later allow tracking in the app, a friend's invite can be applied and we can tell which invite links bring people to the app; security and fraud prevention.
  • Legal obligations: keeping records the law requires.

We don't use your data to make decisions that have legal or similar effects on you. The daily insight is written by AI from your logs. It isn't medical advice.

4. Your choices and rights

  • Apple Health: change what the app reads or writes in the Health app (Sharing › Apps › Onederland) or iOS Settings, and stop writing to Apple Health in Onederland's Settings.
  • AI features: the daily insight, AI food logging and 3D body compare each ask before they first send anything, and send nothing if you choose Not now. Turn any of them on or off anytime in Settings › AI and analytics. If what a feature sends changes, it asks again. A label check is part of AI food logging: it sends a scanned product's label image from Open Food Facts (never your own photo), and only once you've allowed AI food estimates. 3D body compare sends your photos only when you start a comparison, and only once you've allowed it.
  • Tracking: allow or deny in the prompt, and change it anytime in Settings › Privacy & Security › Tracking. Without your permission, the app sends Linkrunner nothing, and an invite link can't be matched to your install. With your permission, Linkrunner receives your device details, the vendor and install IDs, an attribution token from Apple, your IP address, your advertising identifier, your account ID and the links you open, which it uses to match your install to the invite or ad link that brought you and for ad measurement. The request your browser makes when you open a friend's invite link happens before the app is installed, so this choice doesn't cover it; to object to it, or to have Linkrunner delete what it holds, use Ask us below.
  • Analytics: turn off Share usage analytics in Settings › AI and analytics; the app then stops sending analytics events.
  • iCloud Drive: turn Save in iCloud Drive on or off on the 3D body compare screen. Back up now only runs when you tap it.
  • Delete your account: in the app, Settings › Account › Delete account. This deletes, on our server, your account and profile; your sign-in tokens, and revokes Sign in with Apple; and your links to purchases, the copy of your subscription status, your 3D comparison records and the usage counters tied to your account. Referral records shared with another person are anonymized. Your subscription continues until you cancel it in your Apple Account settings, and its later renewals store nothing on our server.
  • Delete everything you've logged on your iPhone: Settings › Reset app. Delete backups in iCloud Drive or Files.
  • Ask us: to access, correct, export or delete what we and our processors hold about you, including at RevenueCat, Mixpanel, Sentry, fal.ai and Linkrunner. Email support@fandaria.com. We answer within 30 days, or as the law of your region requires.

Europe, the UK and Switzerland. You have the rights of access, rectification, erasure, restriction, portability and objection, and to withdraw consent at any time. You can complain to your data protection authority.

California. You have the rights to know, delete, correct and limit the use of sensitive personal information. We don't sell personal information. We do disclose some to Linkrunner, our link and attribution service. When you open a friend's invite link, before the app is installed, your browser's request to Linkrunner includes your IP address and your browser's user agent, and the friend's referral code from the link. Only if you allow tracking does the app send Linkrunner anything. Then it sends your device details, the vendor and install IDs, an attribution token from Apple and your IP address, so Linkrunner can tell whether an invite or ad link brought you, and also your account ID, the links you open and your advertising identifier, for ad measurement; California law may treat that as sharing for cross-context behavioral advertising. You can withdraw your tracking permission anytime in Settings › Privacy & Security › Tracking.

5. Consumer health data (Washington, Nevada and similar laws)

  • Categories collected: medicines and doses, weights and body measurements, blood pressure and glucose, food and nutrition, activity and sleep, side effects and notes, and body photos for 3D models.
  • Purposes: the features in section 2.
  • Sources: you, and Apple Health with your permission.
  • Shared with: Cloudflare, OpenRouter and OpenAI, for the daily insight and AI food logging, only after you allow each feature; fal.ai, for 3D models, and, only if you made a comparison in the Detailed or Textured quality before, its partner Tripo, only after you allow 3D body compare.
  • Never sold. Rights: as in section 4, and to withdraw consent.

6. Where data is processed

Our server runs on Cloudflare. Our processors are based in, or process data in, the United States and other countries: Cloudflare, OpenRouter, OpenAI, fal.ai, RevenueCat, Mixpanel, Sentry and Linkrunner. Linkrunner processes data in India (its main location), the United States and the European Union. Tripo receives photos from fal.ai only for people who made a Detailed or Textured 3D comparison before. When personal data from the EEA, the UK or Switzerland goes to a country without an adequacy decision, the transfer relies on appropriate safeguards in the processor's data processing terms, such as the European Commission's Standard Contractual Clauses, with the UK Addendum and the Swiss amendments, or the EU–US Data Privacy Framework and its UK and Swiss extensions where the processor is certified.

Each processor uses your data only to provide its service to us and protects it as this policy describes. Where Tripo builds 3D models, it does so under its own terms.

7. Security

Data in transit is encrypted (HTTPS). Sign-in tokens are kept in the iPhone's Keychain, and the database uses iOS data protection. On our server, the refresh tokens we issue for your sign-in are stored only as hashes. Two kinds of token are not hashed: the short-lived session and access tokens (valid for an hour and a day), which expire on their own, and the refresh token Apple gives us when you sign in, which we keep only so we can revoke it when you delete your account. Our server's database and key-value storage are on Cloudflare, which encrypts them at rest (AES-256, with keys Cloudflare manages). No system is perfectly secure, so we can't guarantee absolute security.

8. Children

Onederland is for adults. You must be 18 or older to use it, and we don't knowingly collect data from anyone younger. If we learn that we have, we delete it.

9. Changes

We'll update this policy when the app changes how it handles data, change the date above, and post a material change on this page before it applies. If what the daily insight, AI food logging or 3D body compare sends changes, the app asks your permission again before sending it.

10. Contact

Onederland is provided by Steven Giles. Contact: support@fandaria.com