Privacy Policy

This policy covers the YolkHatch app for iPhone and Android and the nutrition professional portal at yolkhatch.com, operated by Summitview Land Holdings, LLC.

The honest summary, before the long version: YolkHatch handles sensitive health data — what you eat, your weight, your medication, your surgery. We do not sell it, rent it, or share it with advertisers, insurers, employers, or data brokers. There is no advertising SDK and no analytics SDK in the app.

1. What we collect

Account data

In the app, you sign in with Sign in with Apple. We receive a user identifier and an email address — which may be Apple's private relay address if you choose that option, in which case we never see your real email. In the Android app, you sign in with your Google account: we receive a user identifier and the account email. In the professional portal, practitioners create an account with their name, email, password, and self-reported professional registration number.

You can use the app without an account. Without signing in, everything stays on your phone and nothing is sent to us. The account exists to sync across devices and to link with a nutrition professional.

Health data you provide

Purchases

Subscriptions and coins are processed by Apple (iPhone) or by Google Play (Android). We never receive, see, or store card numbers or payment details — only whether a subscription is active.

2. What we do NOT collect

• On iPhone, your meal photos never leave your device.Recognition runs locally using Vision and Apple's on-device models. Android has no such on-device AI: the plate photo and the meal plan PDF/photo (YolkHatch Plus features) are sent to the YolkHatch server for analysis — see section 4. In neither case is the file stored.
• Your location. The app never requests or uses it.
• Advertising and tracking. No ad SDK, no analytics SDK, no advertising identifier (IDFA on iPhone, advertising ID on Android). The app does not show the iOS tracking prompt because there is nothing to track.
• Apple Health data. Only if you turn it on in Settings › Apple Health, the app reads your workouts (type, time and duration) so your pet can show the days you trained. This happens on your iPhone and, by default, the result stays there. Only if you turn onSettings › Nutritionist › "Share my workouts with my nutritionist", your daily log on our server gets the minutes and number of workouts for each day — no heart rate, calories, or workout details — and only the nutritionist you linked can see it. Turning it off or unlinking deletes those numbers. This data is never used for advertising. We never write anything to Apple Health.
• Health Connect data (Android). Only if you allow it, the app reads steps, exercise sessions, active calories, and food and water logged by other appsto fill your daily rings and show the days you trained. Reading happens on your phone and the result stays there; the only exception is the same as on iPhone: with "Share my workouts with my nutritionist" on, the minutes and number of workouts for each day are synced. We never write anything to Health Connect and this data is never used for advertising.

3. Where data is stored

On your phone, always. If you sign in, a copy is synced to Summitview's own server, hosted by Contabo in a data center in Lauterbourg, France (European Union). Traffic is encrypted in transit (HTTPS) and your profile, daily logs and meal plan are stored encrypted in the database (AES-256), with the key kept outside it. The app tells you the server is outside your country on the sign-in screen, before you sign in. Without signing in, nothing leaves your phone.

Database security rules are configured so that each person can only reach their own data — and, for practitioners, only the data of patients who linked themselves to them.

4. Who we share with

The professional you link to

If you enter a practitioner's code in the app, they can see your daily log (meals, protein, calories, water) and set your goals. You start that link — nobody can reach your data unless you enter their code.

To end the link today, email [email protected]. We remove the access and confirm by email.

Service providers

• Contabo GmbH — server hosting (data center in France). It keeps the machine; it does not run the app or read the data, which is stored encrypted.
• Apple— sign-in, purchase processing, and iOS speech recognition when you log water by voice. In that specific case the audio snippet may be processed on Apple's servers under Apple's policy. You can always type instead of speaking.
• Google (Android app) — sign-in with your Google account, purchase processing through Google Play, and Android speech recognition when you log water by voice. Also the Gemini API, which analyzes your plate photo and reads your meal plan PDF/photo when you use these YolkHatch Plus features on Android: the file is sent encrypted (HTTPS) to our server, which forwards it to Google only for the analysis and returns the result to the app. YolkHatch does not store the file, and no account, profile or history data is sent with it. Google's processing follows the Gemini API terms.
• Open Food Facts — a public, open food database. When you search for a food by name, the search text is sent to their service. No account, health, or identifying data is sent with it.

Never

We do not sell, rent, or trade your data. We do not hand it to advertisers, insurers, health plans, employers, or data brokers. If the company is ever sold or merged, we will notify you before any transfer.

5. How long we keep it

As long as your account exists and you want us to. There is no minimum retention period: the moment you ask for deletion, we delete. If you uninstall the app without asking for deletion, the synced copy stays so you do not lose your history when you change devices.

6. Your rights

You may request access, correction, a copy (portability), or deletion of your data, and withdraw consent. These rights are guaranteed by Brazil's LGPD(Law 13.709/2018) and equivalent laws elsewhere, including California's.

Email [email protected]. We respond within 15 days. To erase everything, just ask — we delete the account and the synced data, free of charge and without trying to talk you out of it. Uninstalling the app removes the local copy from your device.

7. Children

YolkHatch is not directed to anyone under 18 and we do not knowingly collect children's data. If you know of such an account, tell us at the address above and we will remove it.

8. This is not medical advice

YolkHatch is a tracking and engagement tool. It is not a medical device, it does not diagnose, and it does not prescribe. Default goals are a generic starting point — decisions about your diet, medication, or post-operative care belong with the healthcare professional who treats you.

9. Changes to this policy

If anything material changes, we will tell you inside the app before it takes effect. The date at the top of this page reflects the last revision.

10. Contact

Summitview Land Holdings, LLC — [email protected]