Provero Privacy Policy

Introduction

This Privacy Policy explains how Provero, a chain restaurant ordering guide developed by Idion, collects, uses, and protects your information. It applies specifically to the Provero app on iOS and Android, not to other Idion products.

By using Provero, you agree to the practices described in this policy.

What we collect

An anonymous session identifier. Provero creates one on first launch, alongside the search field and never in front of it, before anything in the app asks you for anything. It is what your targets and your history belong to while you have no account, and it reaches nothing outside Provero.

The two numbers you give us, and one you keep yourself. Your daily calorie target and your daily protein target are asked once, on three short screens, and the "already gone today" figure is a single number you maintain on the today screen. These are the only figures Provero ever holds about you rather than about a restaurant, and they are health-related, which is why they are named first here rather than further down.

Your eating-out history. Each meal you log holds the chain, the dish named exactly as the chain named it, the chain's own published calories and protein as they were shown at the moment you tapped, the date the chain published that disclosure, the date we last read it, and the date and local time of the tap. There is no note, no portion, no photograph, no rating, no company and no free text field of any kind on a logged meal. It is a pointer at a published figure.

Two things derived from that history and from nothing else: your usual at each chain, which is simply the dish you have logged there most often, and the weekly counts on the strip.

Which chains you have opened. That is what the three free restaurants count, and counting them is the only reason it is held.

Your email address and password, but only if you choose to keep your history across devices. That is offered as one row in Settings, as one dismissible line once you have logged three meals at two or more chains, and once after a purchase. Nothing else in the app ever asks. There is no name field, no username, and no sign-in through Apple, Google or any other provider.

Your subscription status, through our subscription management provider. If you start to cancel a subscription and do not skip the four-option reason survey, we also hold the option you chose.

Usage events in our own database: which screens you reached, whether a chain you searched for was in our table, how often a dish row had to show that a figure was not published, whether the ranked menu arrived, whether you logged a dish, and whether you reached the paywall and what happened there. If you use the control that tells us a chain is missing, the text you typed arrives as one of these events. They carry no identity, and they are not tied to your email address.

Data kept on your own device so that the app works with no connection: your session, your theme choice, the full menus and published figures for chains you have already opened, and today's "already gone" figure.

This is the complete list of what Provero collects today. If that changes as the app grows, this policy will be updated first, and the "last updated" date above will reflect it.

What we do not collect

To be specific rather than leave this to inference:

Your weight, height, age, sex or activity level. Never, for any reason, including working out a target for you. Provero contains no calculator, so none of it is asked for and none of it is held. This is the single largest difference between what Provero holds and what a calorie tracker sitting next to it holds.

Photographs of any kind. Provero requests no camera permission and no photo library permission, in either direction. The share card is handed to your system share sheet, and there is no control anywhere in the app that writes it to your camera roll.

Your location. No permission is requested, nothing in the app is nearby-aware, and there is no way for Provero to know which building you are in. You find a restaurant by typing its name.

Audio. There is no microphone permission.

Notification tokens. Provero sends no notifications, so it never asks for permission to and never holds a token for your device.

Any meal that did not come from a chain in our table. There is no food diary, no barcode scanning, no photo logging and no import from another tracker. The one figure you maintain by hand is a single number about today, not a record of what you ate.

A goal, a diet, a preference or an allergy. None of them changes a figure a chain published, and we do not ask for any of them.

The guess you type before revealing a figure on the share card. It is used to draw that card and it is not kept.

Your government-issued identification, your contacts, or biometric data. We do not collect or store your payment card, bank, or other financial account details.

Anything belonging to another person, and nothing of yours that another person can see. No surface in Provero shows one user anything another user made.

Third-party analytics software and advertising software. None is embedded, at any tier, ever, and Provero holds no advertising identifier. No restaurant pays for a position anywhere in this app at any price.

If any of this changes in a future version of the app, we will update this policy before that change ships, not after.

Accounts and identifiers

Provero can be used without an account, and it is designed to be. When you start without signing in, the only identifier we hold is an anonymous session id, and everything you do belongs to it.

If you later create an account, we collect your email address and a password. There is no sign-in through Apple, Google or any other provider, so there is no private relay address and no third-party identifier. Creating an account upgrades your existing anonymous session rather than replacing it, so your targets, your history and your usual orders are exactly as you left them.

Signing in to an account that already has a history, on a device that has been used anonymously, is the one case where something is lost: the account's history replaces what is on the device. The app names both sides in one sentence and asks you to confirm before anything changes, because two histories cannot be merged without deciding whether the same dish on the same date was one meal or two, and that would be inventing a figure about your day.

Your email address is used to sign you in and to contact you about the service. It is not used for marketing. The only mail Provero sends is a confirmation and a password reset.

How we use your information

We use the information described above to provide Provero's core features and to personalize what you see: ranking a chain's published menu against the numbers you gave us, carrying what you logged forward into what is left today, and deriving your usual at a chain from what you have logged there. We do not use your information for purposes beyond operating and improving Provero, and we do not use it to build advertising profiles.

Usage analytics

We record which screens you reach and which actions you take, so we can see where the app is confusing and fix it. These events are stored in our own database. **We do not use any third-party analytics service and we do not use any advertising service**, so this information is not shared with anyone and is not combined with data from other apps.

Two of the counts exist for the app's own honesty rather than for a funnel: how often a chain someone searched for was not in our table, and how often a dish row had to show that a chain did not publish a figure. Those are the two ways Provero fails at the thing it exists to do, and we would rather count them than not know.

How your information reaches the model

Provero uses Google Gemini for two things. The first, normalising the chains' published disclosures into one consistent shape, runs over the restaurants' own documents and involves nothing of yours at all.

The second happens while you are using the app. To write the one sentence that appears under each of the top three dishes, we send the dish, the chain's published figures for it, and the calorie and protein numbers you have left today, which is what that sentence has to explain. This happens on our servers, not on your device, and our access key is never included in the app.

What is sent is used for the sole purpose of producing that sentence and is not used to train the model provider's systems. We do not send your email address or your account identifier with it. Your logged history, your usual orders and your week are never sent.

What the model writes

The model writes one sentence, on the top three dish rows only, explaining why that dish is near the top. That is the whole of what AI produces inside Provero.

**No figure in this app is generated, adjusted, estimated or filled in by a model.** Every calorie and protein number is the chain's own published figure, carried with a link to the document it came from, and the order of the menu is arithmetic rather than a model's opinion. See our AI Policy for how this works and what its limits are.

Automated decision making

Provero's ranking is arithmetic performed against the two targets you entered yourself, and the one AI-written sentence is there to inform your own decision. Neither makes decisions about you that produce legal effects or similarly significantly affect you, and neither is used for any form of automated profiling beyond producing what this policy describes. Nothing in the app scores you, and the "fits your day" band is a statement about two published numbers and two numbers you typed, not about you.

Subscriptions and payments

If you subscribe, we collect your subscription status through our subscription management provider. Payment itself is handled entirely by the Apple App Store or Google Play. **We never see or store your payment card details.**

Third-party services

We rely on a limited number of infrastructure providers to operate Provero. These process information on our behalf, under confidentiality and data protection commitments, and only to the extent needed to provide their service to us.

We do not sell your information to third parties, and we do not share it with third parties for their own independent marketing purposes. We are not affiliated with, endorsed by or sponsored by any restaurant chain, and no chain receives anything about you from us.

Security

We apply reasonable technical and organizational measures to protect your information from unauthorized access, loss, or misuse, including encrypting data in transit and restricting access so that your records are readable only by your own account. No system is perfectly secure, but security is a priority in how we build Provero, not an afterthought.

If we become aware of a security incident that affects your information, we will notify you and take appropriate action as required by applicable law.

How long we keep it

We retain your information for as long as your account is active and as needed to provide Provero's features. If you delete your account, we delete or anonymize your information as described on our Data Deletion page, except where retention is required by law or for the limited purposes described there.

International transfers

Your information may be processed in countries other than your own. Where this happens, we take steps to ensure it receives an appropriate level of protection, consistent with applicable data protection law.

Your rights

Depending on where you live, you may have rights to access the information we hold about you, correct it, delete it, export it in a portable format, restrict or object to certain processing, or withdraw consent where processing is based on consent.

If you are located in the European Economic Area, the United Kingdom, California, or another jurisdiction with its own data protection law, you may have additional or more specific rights under that law. These are not reduced by anything in this policy.

See our Data Deletion page to request deletion, or contact us using the details on our Contact page for any other request. We will respond within the timeframe required by applicable law, and in any case within a reasonable time.

Children's privacy

Provero is not directed at children, and we do not knowingly collect information from children under the age required by applicable law to consent to data processing on their own behalf. If you believe a child has provided us with information, please contact us so we can remove it.

Changes to this policy

We may update this policy as Provero evolves. We will update the "last updated" date above when we do, and for material changes we will make a reasonable effort to notify you.

Contact us

Questions about this policy can be sent to our privacy team at [email protected]. See our Contact page for details.