Privacy Policy

Shred is built local-first. Nothing you log leaves your phone unless you ask it to, and this page says exactly what happens when you do.

Last updated 8 August 2026

Using Shred without an account

Shred never makes you sign in. Out of the box it is a private notebook: your profile, meals, workouts, weigh-ins, measurements, water, notes and progress photos are written to a database inside the app's own sandbox on this device.

In that state nobody but you can read any of it, because none of it has been anywhere. It is included in your normal iPhone or iCloud device backups, which Apple encrypts and holds under Apple's own privacy policy. Deleting the app removes the database with it.

Apple Health

If you connect Apple Health, Shred reads your weight, steps and workouts to fill in your log, and writes back weigh-ins you record here. Health decides what it shares; Shred only ever asks.

Health data stays on this device and in your own account's sync. It is never used for advertising, never sold, and never shared with anyone for their own purposes. It is never sent to the AI scanner, which sees only the photo you point at it.

You can withdraw access at any time in the iOS Health app, under Sharing then Apps. Anything Shred has written into Health belongs to Health and is removed there.

If you create an account

Signing up turns on cloud sync and the AI scanner, and nothing else. You sign in with Apple or with Google; Shred never sees or handles a password. We receive an account identifier and, when your sign-in provider supplies it, the name and email on that identity. Sign in with Apple can substitute a private relay address, and Shred works perfectly well with one.

Once you are signed in, the written parts of your log are mirrored to our cloud provider under a tree of documents belonging to your account: your profile figures, and one document per day. Security rules restrict those documents to your signed-in account; no other user of the app can reach them.

Progress photos are deliberately left out of that mirror, and so are steps and energy read from Apple Health. Signing out stops the sync and leaves everything on the device untouched.

The AI food scanner

The scanner estimates calories and macros from a photo of a meal, or from a food name you type. Photo scanning requires an account and is off until you turn it on. Nothing is transmitted before you agree.

A food name you type is looked up first in two public nutrition databases, USDA FoodData Central and Open Food Facts, because a published label beats any estimate of what a label might say. Those lookups carry the words you typed and nothing else: no account identifier, no device identifier, and no part of your log. If neither database has the food, your phone estimates it locally where it supports that, and only then does an estimate come from our provider.

What is sent for a photo scan: the photo, resized and compressed. Your name, your email, your log and any health data stay behind. Separately, and with no photo attached, Shred tells its own server that a scan happened so your daily allowance can be counted.

What comes back is a food name and four numbers, often with two or three readings of the same plate and the portion each one assumes, so you choose rather than guess. Nothing is saved until you accept it.

Photos you send to the scanner may be used by the AI provider to improve their models and recommendations, under that provider's own terms. If that is not something you want, leave photo scanning off: barcode scanning, typing meals in by hand and every other part of the app carry on working without it. You can change your answer at any time in Settings under Privacy and Legal.

Shred itself does not keep your photo. It is not saved on a server, not stored in your log, and not written to any file once the meal sheet closes.

Barcode scanning

When the camera recognises a barcode, Shred sends the barcode number, and nothing else, to Open Food Facts, an open food database, and gets the product's nutrition back. No photo, no account identifier and no part of your log is attached.

Progress photos

Progress photos are the most personal thing in the app, so they are the most conservatively handled: they are stored in the on-device database and are never uploaded anywhere. Not to your account, not to the AI scanner, not to us. The sync code skips them by design, even for signed-in users.

They are on this device and in your device backups, and that is all. Deleting a photo in the app, or resetting the challenge, removes it.

App usage data

We may collect anonymous usage data to understand which parts of the app are used and where they are going wrong: which screens are opened, and which features are used.

It is fully anonymised. It is never tied to your account, your name, your email or your device identity, and it never carries anything you have logged: no weights, no meals, no photos, no health data. It cannot be traced back to you, and it is not used for advertising or shared for anyone else's commercial purposes.

What Shred doesn't do

There is no advertising in Shred, no ad network, and no use of the advertising identifier. Nothing you log, least of all anything from Apple Health, is used for advertising or marketing, by us or by anyone else.

Shred does not track you across other apps or websites and does not build a profile of you beyond the log you write yourself. Your data is not sold, rented or shared for anyone else's commercial purposes.

Our providers act for us on the specific jobs described above: hosting your synced log, and estimating nutrition. Handling those requests means they receive the technical details every internet request carries, such as your device's network address.

Shred is not directed at children under 13, and we do not knowingly collect anything from them.

Deleting everything

On this device: Settings, then Reset Challenge. That erases your profile and every day you have logged, including meals, workouts, weigh-ins, measurements and progress photos. It asks twice and cannot be undone.

In the cloud: Settings, then Account, then Delete Account. That deletes your profile, every day held under your account, anything stored for your account on our servers, and the sign-in record itself. It cannot be undone, and it does not touch what is on the device.

Deleting the app removes the on-device database. It does not reach the cloud copy, so if you have an account and want all of it gone, delete the account first. Anything Shred wrote into Apple Health lives in Health, not in Shred, and is deleted there.

Getting in touch

Questions, complaints and deletion requests go to peter.barnett03@gmail.com, or through support.