Privacy Policy

Shervy AI — Last updated: 7 July 2026

1. Data Controller

Shervy AI ("Shervy", "we") is the data controller for the personal data described in this Policy.

Privacy & GDPR contact:
Email: shervyai.1@gmail.com
Subject line for privacy requests: "Privacy Request — Shervy AI"
Response time: within 30 days for GDPR requests; within 5 business days for general inquiries

If you are in the European Union or United Kingdom you may contact us at the address above to exercise your rights under GDPR or UK GDPR.

2. Data We Collect

We collect only the data necessary to provide personalised nutrition coaching.

Category	Data Elements	Source
Identity	Name, email address	Apple/Google Sign-In at account creation
Body metrics	Weight, height, biological sex, age, activity level, goal	Provided by you during onboarding
Food logs	Meal names, macro estimates (calories, protein, carbs, fat), timestamps	Entered by you via chat, photo, or voice
Meal photos	Camera frames captured for food recognition	Captured in-app with your permission; immediately discarded after AI processing — not stored
HealthKit data	Read: steps, active energy, sleep duration, workouts, body mass Written back: dietary energy, protein, carbohydrates, fat, water	Apple HealthKit on-device (requires explicit iOS permission)
Coaching memory	Facts the coach remembers about you (food preferences, routines, goals) and summaries of recent conversations	Generated from your chat messages
Purchase history	Subscription status and purchase receipts	Apple App Store

3. How We Share Your Data

We do not sell your personal data and do not share it with advertisers. We share data only with service providers who process it on our behalf to operate Shervy:

Cloud hosting and database providers, which store the app data described in Section 2 (except meal photos, which are never stored).
AI providers, which process meal photos, chat messages, and coaching memory to recognise foods and generate coaching responses. Photos are processed transiently and are not retained.
A subscription management provider, which validates App Store purchases and manages your subscription status.
Crash reporting and analytics providers, which receive technical diagnostics and usage events to keep the app stable and improve it.
Apple and Google, as sign-in providers. Shervy never receives your Apple or Google password.

All service providers are contractually required to protect your data to at least the standard described in this Policy and may only use it to provide their service to us. Your data may be processed on servers located in the United States and other countries.

4. Lawful Basis for Processing (GDPR)

We process your personal data on the following legal grounds:

Contract performance (Art. 6(1)(b)): Processing your food logs, body metrics, and coaching memory is necessary to provide the personalised nutrition coaching service you have subscribed to.
Legitimate interests (Art. 6(1)(f)): We process authentication tokens, session data, and crash/error logs to keep the service secure, stable, and to prevent abuse. Our legitimate interest in maintaining a reliable, safe service is balanced against your rights and freedoms.
Explicit consent (Art. 9(2)(a)): HealthKit data (steps, sleep, workouts, active energy, body mass) is special category health data under GDPR. We only access HealthKit after you grant explicit permission through the iOS system permission dialog, which constitutes your explicit consent. You may withdraw consent at any time by revoking HealthKit access in iOS Settings → Health → Data Access & Devices.

5. Data Retention

Data Category	Retention Period
Account data (profile, food logs, body metrics)	Until account deletion. Deleting your account triggers an immediate cascade deletion of all associated data.
Meal photos	Deleted immediately after AI processing. Photos are never stored persistently on our servers.
Coaching memory	Until account deletion.
Sign-in and security logs	Short rolling window (up to 30 days).
Purchase records	As long as required for subscription management and billing compliance.

6. Your Rights (GDPR Art. 15, 16, 17, 20, 21)

If you are in the EU or UK, you have the right to:

Access and portability — receive a copy of the data we hold about you in a portable (JSON) format.
Rectification — correct inaccurate data, either directly in-app or by contacting us.
Erasure — delete all your data. Use the in-app Profile → Account → Delete Account feature, which immediately and permanently deletes all your data from our systems, or contact us if in-app deletion is unavailable.
Objection — object to processing based on legitimate interests.

To exercise any of these rights, email shervyai.1@gmail.com. We will verify your identity against your registered account before processing any request, and respond within 30 days.

You have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or your national supervisory authority in the EU) if you believe your rights have been infringed.

7. Security and Encryption

All data is encrypted in transit and at rest. Sensitive credentials are additionally encrypted at the application level, and session data on your device is stored in encrypted storage protected by the iOS Keychain. HealthKit data is handled on-device by Apple's HealthKit framework and protected per iOS security standards.

8. Children’s Privacy

Shervy AI is intended for users aged 13 and older. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected data from a child under 13, please contact shervyai.1@gmail.com immediately and we will delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this Policy periodically. Continued use of Shervy after changes are posted constitutes acceptance of the updated Policy.

10. Contact Us

For any privacy questions or requests, use the contact details in Section 1 above.