Privacy Policy

This Privacy Policy explains how Waxwing: Food Log collects, uses, shares, and protects personal data when you use our websites, applications, messaging features, and related services (the "Service").

1. Controller and scope

The controller of your personal data is Igor Morozov PR Računarsko programiranje Beograd, Đure Jakšića 1, 2nd floor, Belgrade (Stari Grad), Serbia, registration number 67248732, tax identification number (PIB) 114000236 ("Waxwing: Food Log," "we," "our," or "us"). You can contact us at [email protected].

2. Data we process

2.1 Account and authentication data

We may process your name, email address, password hash, profile image URL, authentication-provider identifiers, security settings, and other information needed to create and secure your account. If you sign in through a third party, such as Apple or Google, we receive the account information that provider makes available according to your settings.

2.2 Food logs and content

We process the content you choose to add to the Service, including meal descriptions, dates and times, daily context, photos and files, and information you choose to share or export. Depending on what you enter, this content may reveal information about your health, beliefs, or lifestyle. We do not use food-log content for advertising, sell it, or use it to diagnose you.

2.3 Integrations and subscription data

• Messaging integrations: When you connect Telegram or another supported messaging service, we may receive your platform identifier, username, profile details, messages, and attachments needed to carry out your requests. If you send your location to set your time zone, we use it for that purpose and do not intentionally retain the raw location after the time zone is determined.
• Authorized applications: When you authorize an external application, automation, AI tool, or MCP client, we process the authorization details and requests needed to let it access or change your data within the permissions you approve.
• Payments and subscriptions: The payment provider identified at checkout processes payment credentials. We receive information such as your plan, subscription or entitlement status, transaction references, renewal dates, and limited billing details. We do not receive or store full payment-card numbers.

2.4 Technical, usage, and communications data

We may process IP address, device and browser information, app version, access times, interactions with the Service, cookie or local-storage identifiers, diagnostic and error information, and messages you send to support. We may also record your communication preferences and whether Service emails were delivered or opened.

2.5 Sources and required data

We obtain personal data from you, your device and use of the Service, and the sign-in, messaging, payment, app-store, or other services you choose to connect. Account, authentication, contact, and subscription information is required when needed to create or secure an account, enter into a contract, or provide paid features. If you do not provide it, we may be unable to create your account or provide the relevant Service. Food logs, photos, daily context, and optional integrations are voluntary, but a feature cannot work without the content or permission it requires.

3. Why we process data

We process personal data for the following purposes and legal bases, as applicable:

• To perform our contract with you: creating and securing your account, storing and displaying your logs, operating requested integrations, managing subscriptions, providing sharing and export features, and responding to support requests.
• For our legitimate interests: protecting the Service, preventing fraud and abuse, diagnosing errors, understanding aggregate product usage, improving features, communicating important Service information, and establishing or defending legal claims, where those interests are not overridden by your rights.
• With your consent: using optional analytics or similar technologies, sending product news, tips, and offers by email, and enabling optional integrations where consent is required. You may withdraw consent at any time without affecting earlier processing.
• To comply with law: meeting accounting, tax, consumer-protection, security, and other legal obligations.

Where content you provide is treated as sensitive or special-category data under applicable law, we process it only to provide the features you request and rely on your explicit consent or another lawful condition where required.

We do not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects. If that changes, we will provide the information and safeguards required by applicable law before carrying out that processing.

4. How we share data

We may disclose personal data in the following circumstances:

• Service providers: Providers that support hosting and storage, authentication, payment and subscription administration, email and communications, product analytics, error monitoring, customer support, and security. They may process data only for the services they provide to us and subject to appropriate contractual restrictions. We require them to provide protection consistent with this Policy and applicable law.
• At your direction: People with whom you share a log and messaging, AI, automation, or other services that you choose to connect. Those third parties process data under their own terms and privacy policies once they receive it.
• Legal and safety reasons: Authorities, advisers, or other parties when reasonably necessary to comply with law, protect rights or safety, investigate misuse, or establish or defend legal claims.
• Business transactions: A prospective or actual buyer, successor, investor, or adviser in connection with a financing, reorganization, sale, or transfer of all or part of the business, subject to appropriate confidentiality protections.

We do not sell personal data or share it for cross-context behavioral advertising. We may change individual service providers without revising this Policy when the provider remains within a category described above and the purposes, types of data, and protections do not materially change.

5. Optional integrations

5.1 Telegram and other messaging services

Messaging features work only when you choose to connect and use them. Messages and attachments sent to our account on that platform are transferred to the Service so we can carry out your request. Disconnecting an integration prevents future access through it, but content already added to your account remains until you delete it or your account, subject to the retention rules below.

5.2 External applications, AI tools, automations, and MCP clients

An application you authorize may be able to read, create, update, or delete food logs and related context, depending on its approved permissions. Review an application's identity and privacy practices before authorizing it. You can revoke its authorization, but revocation does not remove data the application previously received. Actions taken by an authorized application are treated as actions made at your direction.

5.3 Sign-in and app-store services

If you use Apple, Google, or another supported provider to sign in or purchase a subscription, that provider processes data under its own terms and privacy policy. Your device or provider settings may let you limit the data it shares with us or manage your subscription.

6. International transfers

We and the providers described above may process personal data in Serbia, the European Economic Area, the United States, and other countries that may have different data-protection laws. Where applicable law requires it, we rely on an adequacy decision, contractual safeguards, consent, or another lawful transfer mechanism and take appropriate steps to protect transferred data.

Contact [email protected] for information about applicable transfer safeguards and, where available, a copy.

7. Retention

We keep personal data only as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining security, complying with legal and accounting duties, resolving disputes, and enforcing agreements. Retention depends on the type of data and why we hold it:

• Account information and food-log content are generally kept while your account is active and then deleted or de-identified according to our deletion process, subject to backup cycles and legal exceptions.
• Payment, transaction, and business records may be kept for the periods required by tax, accounting, consumer-protection, and other laws.
• Security, analytics, and diagnostic data are kept only as long as needed for the relevant operational purpose and may be aggregated or de-identified.
• Authorization records are kept while an integration is connected and as reasonably necessary afterward for security, audit, or legal purposes.

8. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal data; restrict or object to certain processing; withdraw consent; and complain to a data-protection authority. Applicable law may permit us to limit a request, for example where retaining data is legally required or needed to protect another person's rights.

• You may update available account details and disconnect integrations where the Service provides a control. To revoke another connected application, use that application's controls or contact us.
• Where a consent control is available, you may use it to reject optional analytics technologies. You may also clear site data, adjust browser or device settings, or contact us for help withdrawing consent.
• You may unsubscribe from non-essential emails using the link in the message. We may still send transactional, security, or legal notices.
• To exercise a privacy right or request account deletion, email [email protected]. We may need to verify your identity before completing the request.

9. Cookies, analytics, and diagnostics

We use cookies and similar technologies that are necessary to operate the Service, such as maintaining sessions and remembering security or consent choices. With your consent where required, we may also use optional product-analytics technologies to understand how the Service is used. Diagnostic and error-monitoring tools may collect error events, performance traces, navigation and interaction metadata, and sampled session replays used to reproduce failures. Replay tools are configured to mask text and media where supported, but may record page structure and interactions. We do not use advertising cookies or use food-log content for advertising profiles. Where a consent control is available, you can use it to manage optional analytics technologies and may also clear site data or adjust your browser or device settings.

Change your analytics choice

10. Security

We use technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or loss. No online service can guarantee absolute security, so you should use a strong, unique password and protect access to your email, device, and connected accounts.

11. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided personal data without the authorization required by applicable law, contact us so we can investigate and take appropriate action.

12. Changes to this Policy

We may update this Policy as the Service and applicable law evolve. Replacing a provider within an already described functional category is not by itself a material change. If we materially change the types of data we collect, why we use it, how we share it, applicable safeguards, or your rights, we will update the date above and provide additional notice where appropriate or required by law.

13. Contact and complaints

Questions, requests, or complaints may be sent to [email protected] or to Igor Morozov PR Računarsko programiranje Beograd, Đure Jakšića 1, 2nd floor, Belgrade (Stari Grad), Serbia.

You may also lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection at poverenik.rs, or with the data-protection authority in your country where applicable.