Nudish Privacy Policy

• You don't need an account. The app signs you in with an anonymous ID. We never ask for your email, phone number or a password. • Your profile (your name, height, weight, goal and the other setup answers) stays on your phone. • The meals you log, photos and text, go to our servers so AI can estimate what's in them. We store them so your diary works. • We don't sell your data, we don't send marketing emails, and Nudish has no ads. • You can ask to see or erase your data at any time: garage.app.co@gmail.com.

Nudish is made by Barboza e Barboza Tecnologia da Informação Ltda. (CNPJ 43.945.405/0001-05, Rio de Janeiro, RJ, Brazil), which publishes apps as Garage App. The company is the controller of your personal data. Privacy contact, including our data protection contact under Brazil's LGPD (encarregado): garage.app.co@gmail.com.

Your setup answers stay on your device and we don't receive them: • the name you'd like us to use • birth year • the formula answer (female, male or rather not say) • height, weight, activity level • goal, target weight and pace • your daily calorie and macro targets The app uses them on your phone to work out your daily targets. The formula answer only picks which calorie formula to use, and nothing else. If Android backup is on, Android may include them in your own Google backup, which we can't read.

Anonymous ID: the first time you open Nudish, Firebase Authentication creates a random ID for you. It keeps your meals yours. It's also attached to crash reports, analytics and feedback, so we can connect them. Meals you log: • Photos you take with the camera or pick with the system photo picker. The app only sees the photo you pick, never your library. • Descriptions you type. • Changes you ask for in the meal chat. • The results: foods, portions, calories, macros, the meal's name and time. A food log can say something about your health, so we treat it as sensitive data. Feedback and surveys: our forms run on Tally inside the app. We get your answers and an email address if you choose to give one. The app adds details that help us help you: your anonymous ID, app version, phone model, Android or iOS version, the screen you were on, and the meal's ID if you came from a meal. Usage analytics: Google Analytics for Firebase records events such as a meal being saved or a survey being shown. It also collects an app instance ID, your device's advertising ID, phone model, system version, language, and an approximate location (country or city) worked out from your IP address. We never collect your precise location. Crash and performance data: Firebase Crashlytics (in the app) and Sentry (on our servers) collect error details, the app's state when it happened, and your anonymous ID. Subscriptions, once they're available: Google Play or the App Store handle payment. We never see your card details. RevenueCat receives your purchase history and anonymous ID so the app knows what to unlock. Technical data: our hosting provider logs IP addresses and request times, which we use for security and to keep the service running. Firebase Remote Config uses your country, language and system version to choose which settings to send. Permissions: the camera is used only when you take a meal photo. We don't ask for access to your photos: the system picker hands us only the photo you choose.

• To estimate the foods and nutrition in your meals, using AI. The AI looks at the photo or text you send and suggests foods, portions and nutrition. These are estimates, and you can edit any of them. We don't use AI to profile you or decide anything else about you. • To show your diary and history. • To fix bugs and keep the app stable. • To understand, in aggregate, which features help. • To check and improve the quality of estimates. We may look at individual analyses that went wrong. • To prevent abuse, for example by limiting how many requests one ID can send. • To reply when you write to us. • To measure the ad campaigns that bring people to Nudish, using the advertising ID. Nudish itself shows no ads. You can reset or delete your advertising ID in your phone's settings. We don't sell your data and don't build advertising profiles from it.

• To provide the service you asked for: your anonymous ID, meals, AI analysis and subscriptions (LGPD art. 7, V; GDPR art. 6(1)(b)). • Your consent: for meal data that may reveal health information (LGPD art. 11, I; GDPR art. 9(2)(a)). You can withdraw consent at any time. Withdrawing doesn't affect what we did before. • Legitimate interests: analytics, crash reports, security, abuse prevention and quality checks (LGPD art. 7, IX; GDPR art. 6(1)(f)). You can object to these. • Legal obligations, when the law requires us to keep or disclose data.

• Google Firebase (Google): anonymous sign-in, analytics, crash reports, remote settings, photo storage, and live status updates while a meal is analysed • Railway: hosts our servers and database • Google Gemini, OpenAI, Anthropic: AI models that analyse meal photos and text and match foods • OpenRouter: routes some AI requests to the model provider • Braintrust: records AI requests and results so we can check quality • Sentry: server error and performance monitoring • RevenueCat: subscriptions • Tally: feedback and survey forms • Google Play, Apple App Store: app distribution and payments These providers act on our instructions, under data processing terms, and may use your data only to provide their service to us. None of them may use your photos or text to train their AI models. Each has its own privacy policy. We may also disclose data: • when the law requires it, such as a court order • when we believe in good faith it's needed to protect your safety or someone else's, investigate fraud, or protect our rights • to a buyer if Garage App is sold or merged, in which case this policy keeps applying

These providers process data outside Brazil and the EU, mainly in the United States. We rely on the safeguards the law allows, such as standard contractual clauses (LGPD art. 33; GDPR chapter V).

• Meals: as long as you use Nudish. Deleting a meal removes it from your diary right away. To erase it from our servers too, ask us. • Feedback: up to 24 months. • Analytics: up to 14 months. • Crash and performance data: up to 90 days. • Server logs: up to 30 days. • Purchase records: as long as the subscription and tax rules require. • Aggregated statistics, which no longer identify you, may be kept indefinitely. Uninstalling Nudish stops all collection from your phone. It doesn't erase what we already have. To erase that, ask us.

Brazil (LGPD, art. 18). You can ask us to: • confirm whether we process your data, and give you access to it • correct it • anonymise, block or erase data that's unnecessary or processed unlawfully • move it to another provider • erase data processed with your consent • tell you who we share it with, and what happens if you don't consent • withdraw your consent • review a decision made only by automated processing (art. 20) You can also complain to the ANPD: https://www.gov.br/anpd EU and UK (GDPR): access, correction, erasure, restriction, portability, objection, and withdrawing consent. You can complain to your data protection authority (listed at https://edpb.europa.eu/about-edpb/members_en) or, in the UK, to the ICO (https://ico.org.uk). California (CCPA/CPRA): to know, delete and correct, to limit the use of sensitive information (we only use it to run the app), and non-discrimination. We don't sell or share personal information for cross-context behavioural advertising. You can use an authorised agent to ask for you. How to ask: write to garage.app.co@gmail.com or use the feedback form in the app. Because there's no login, we find and verify your data by its anonymous ID, and the in-app form adds it for you. If you've already uninstalled Nudish, we may not be able to tell which data is yours. We answer within 15 days.

Data is encrypted in transit (TLS) and at rest by our cloud providers. Access is limited to the people who need it, and photo links expire after an hour. No system is perfectly secure. If a security incident could put you at risk, we'll tell you and the authorities the law requires, including the ANPD, within the legal deadlines.

Nudish is for adults, 18 and over. It isn't directed at children or teenagers. If you think someone under 18 has given us data, write to us and we'll erase it.

The app doesn't use cookies. It does use the identifiers described above: the anonymous ID, the app instance ID and the advertising ID. Feedback forms load from Tally inside the app and may use cookies the form needs to work.

When we change this policy, we'll update the date above. If a change is significant, we'll tell you in the app before it applies. Earlier versions are available on request.

Garage App (Barboza e Barboza Tecnologia da Informação Ltda., CNPJ 43.945.405/0001-05) Email: garage.app.co@gmail.com