Soba
English
Last updated: 2026-09-29
The short version
Your saved meal history and glucose readings stay on your iPhone. Photos and descriptions you submit for recognition go to our server and AI providers with your permission. Our server also processes a device identifier, usage events, subscription transactions and Apple Ads attribution to measure how people discover and use Soba. There are no user accounts or third-party analytics SDKs.
What we process
- Food photos and text descriptions you submit are sent to our server and forwarded to an AI model provider — currently Google Gemini, routed through OpenRouter — solely to recognize the food. They are processed in memory and are never stored on our servers. We enable OpenRouter's setting that routes requests only to providers which do not train on submitted data; OpenRouter may still log requests under its own policy, which we do not control. The app asks for your explicit permission before the first photo is ever sent.
- Device identifier: a random UUID generated on your device and kept in the Keychain. It links your subscription entitlement, scan allowance, usage events and advertising attribution. We do not ask for your name or email to use the app.
- Usage records — timestamps, token counts, processing cost, success or failure. They keep the service economics honest and contain no photo content and no food data.
- First-run steps — the names of the setup screens your device reached (for example «opened onboarding», «saw the subscription screen»), stored once each. They show us where people get stuck. No properties, no timestamps beyond the first occurrence, no food data, and nothing from any third-party analytics service.
- Apple Ads attribution: the app sends a short-lived Apple token to our server, which exchanges it with Apple for available campaign, ad group, keyword, country and conversion-type information. We retain the result and a token hash, linked to your existing device identifier. We use it to count successful scans, trials and verified paid subscription transactions by advertising source. The raw token is not stored. Meal contents, nutritional values, glucose readings and subscription events are not sent to Apple through this attribution request. An unavailable result remains unknown.
- Subscription receipts — Apple-signed transaction data, verified and stored to unlock recognition. Apple is the seller; we never see your payment details.
What stays on your device
Your meal history, including photos and nutritional values, is stored only on your device. Glucose readings are read from Apple Health for display next to a meal and are never transmitted to us. Deleting the app deletes all of it.
How long we keep things
- Photos and descriptions: not retained at all, only held in memory for the duration of the request.
- Retry cache (so a repeated request never charges you twice): 24 hours.
- Barcode product data from Open Food Facts: 7 days.
- Attribution and first conversion records: until you request deletion or we discontinue the service.
- Usage records and subscription receipts: for as long as the service operates, or until you ask us to delete them.
Legal basis and transfers (GDPR)
Because Soba is built for people with diabetes, a food photo you send can imply information about your health. We therefore process it on the basis of your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), which the app requests before the first recognition and which you can withdraw at any time in Settings — the free features (barcodes, manual entry, history, statistics, Health sync) keep working without it. Subscription data is processed to perform the contract (Art. 6(1)(b)).
Our server and the AI providers are located in the United States (Render, OpenRouter, Google). Sending a photo for recognition therefore involves an international transfer of that data.
Your rights
You can request access to, correction of, or deletion of the data tied to your device identifier, and you can object to processing or ask for it to be restricted. Write to the address below and include your device identifier — the app shows it in Settings → Data, where a tap copies it. Deleting the app also removes everything stored on the device.
What we don't do
Soba does not display ads or use IDFA. We use Apple AdServices to measure ads for Soba on the App Store. First-run steps and conversion counts stay on our server. We do not sell these records or send meal or Health data for advertising.
Medical disclaimer
Soba is not a medical device. It does not diagnose, treat, cure or prevent any condition, and it does not calculate or suggest insulin doses. Carbohydrate, bread unit, glycemic index and other values are estimates produced by an AI model. Always verify against product labels and follow your diabetes care plan.