NomblinPrivacy policy
Last updated: 15 November 2026
This policy explains what data the Nomblin app collects, why, who we share it with and what rights you have. We write it in plain language. If something is unclear, write to us.
Who is responsible for your data
The data controller is Mihail Nikolov, an individual based in Bulgaria. Contact: hello@nomblin.com. We reply within one month.
What data we collect
- Account: your email address, or your Google or Apple account if you sign in with them.
- Plan details: sex, year of birth, height, weight, goal weight, goal and activity, and the daily plan worked out from them.
- Health data: your food diary, water and weight entries. These are health data under Article 9 GDPR and we process them only with your explicit consent.
- Food photos: when you photograph a meal, the photo is sent to be recognised and is not stored on our servers. We keep only the result (dish, portion, calories) if you add it to your diary.
- Progress photos: weekly body photos stay on your phone only. We never receive them.
- Technical data: how many photos you analyse per day and what they cost, to keep the daily limit and watch costs; short technical error records, without the content of photos.
We don't use ads, we don't sell data, and we don't track you across other apps or websites.
Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Account, sign-in and syncing between phones | Contract (Art. 6(1)(b) GDPR) |
| Diary, water, weight and working out your plan | Explicit consent for health data (Art. 9(2)(a)), given in the app |
| Recognising food from a photo | Explicit consent, asked separately before your first photo |
| Daily photo limit, abuse prevention, security | Legitimate interest (Art. 6(1)(f)) |
| Payments and accounting when you buy Pro | Contract and legal obligation |
You can withdraw your consent at any time by deleting your account. This does not affect processing that happened before.
Who we share data with
We work with providers who process data on our behalf under a data processing agreement:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | Servers in Frankfurt, Germany |
| Anthropic | Recognising food from a photo | USA |
| Resend | Sign-in code emails | USA |
| Google, Apple | Sign in with Google or Apple, if you choose it | EU and USA |
| Google Play, App Store | Paying for Pro (they are separate controllers for the payment) | EU and USA |
| Cloudflare | Hosting this website | Global |
Transfers to the USA rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. Anthropic does not use the photos to train models and deletes them within 30 days. We send only the photo, with no email, name or other identifier.
How long we keep data
- Account, plan, diary, water and weight: as long as you have an account. Deleted immediately when you delete your account.
- Food photos: not kept by us.
- Photo counts and costs: as long as you have an account.
- Database backups: deleted automatically within 30 days.
- Payment records: as long as accounting law requires.
Your rights
You have the right to access your data, correct it, delete it, restrict processing, receive it in a machine-readable format, object to processing based on legitimate interest, and withdraw your consent. Write to hello@nomblin.com from your account's email address. You can also delete your account yourself: here's how.
You have the right to complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, or to the data protection authority where you live.
Age
Nomblin is for people aged 16 and over. A weight-loss plan is only for people aged 18 and over.
Automated calculations
Your daily plan and the calories from a photo are worked out automatically. They are estimates with no legal effect on you, and you can always change them. Nomblin is not a medical device.
Changes
If we change this policy, we'll update the date at the top, and tell you in the app about significant changes.