Privacy Policy
Last updated 22 September 2026
This policy covers the MassDelta app and the websites norply.co and massdelta.app. It is written to be read. The short version is in section 2; the rest is the detail behind it.
1. Who is responsible for your data
Norply Inc., a Delaware C-Corporation registered at 131 Continental Dr, Suite 305, Newark, DE 19713, USA, is the data controller for everything described here. For any question or request, email founders@norply.co.
2. The short version
- There is no account. We do not ask for your name, email, phone number or location. The app knows you as a per-install device id it makes up on first launch.
- Your logs live on your phone. Meals, weigh-ins, your plan and the coach’s transcript are stored on the device. Delete the app and they are gone.
- Some of it visits our server to be read. A meal description or photograph is sent so a model can read the calories off it; a question to the coach is sent with the numbers it needs to answer. What is kept afterwards, and for how long, is in section 6.
- We do not sell it, share it for advertising, or track you. No advertising identifier, no tracking, no third-party analytics SDK in the app, no cookies on the sites.
- Deleting is two steps: delete the app, and email us to remove what the server still holds. Section 11.
3. What the app collects, and why
Everything the app sends to our server is sent to make the app work. Nothing is collected for its own sake.
| What | Why it leaves the phone |
|---|---|
| Meal descriptions, typed or dictated | To read calories and macronutrients off them. If you dictate, your iPhone’s speech recognition may send the audio to Apple to transcribe it; the app receives text. |
| Photographs of meals and nutrition labels | To read what is on the plate or the panel. Taken with the camera or chosen from your library, with your permission. |
| A few settings with each meal | Your unit system, language, local hour, the names of things you logged recently, and any diet or allergy you set — so the reading fits how you eat. |
| What you ask the coach, and the numbers it needs | When you ask Delta a question, the app sends the question and a summary of your recent weigh-ins, targets, logs and patterns, so the answer can be about you. That summary is used for the answer and not stored by our server. |
| A device id, time zone, language and app version | To tell this install apart from others without an account, to roll daily limits at your local midnight, and to know which version to support. |
| Whether the subscription is active | Apple and RevenueCat tell our server. We never see your card, your Apple Account details or your purchase history beyond that. |
| Your email, only if you write to us | To reply. |
Your weight, height, age, sex, activity and goal — what you answered when you set the app up — stay on the phone and are used there to start the estimator. The coach is sent what it needs of them to answer a question, and no more.
The device id is personal data. Nothing here names you, but everything the server holds is tied to that one id, and it lets us tell your device’s records apart from everyone else’s — which is what GDPR means by personal data. That is why the App Store’s privacy label lists what MassDelta collects as linked to you: linked to the device, not to a name.
4. What we do not do
- No advertising identifier, no advertising, no tracking across apps or sites, no fingerprinting.
- No selling or renting of personal information, ever.
- No third-party analytics or crash-reporting SDK inside the app.
- No location. The app asks for your time zone, not where you are.
- No contacts, no health-data integration, no reading of anything on the phone the app did not create.
5. Who touches it
We do not sell your personal information and never have. The only parties that handle it are the providers we need to run, named here rather than described as partners:
- Apple — distribution, billing, and speech-to-text when you dictate a meal.
- OpenAI — reads meals and labels from what you type or photograph, and answers as the coach, including its web search.
- Amazon Web Services — runs our server, in the US (us-east-2).
- Neon — our database and photo storage, in the US (us-east-2).
- RevenueCat — tells our server whether a subscription is active.
- Vercel — hosts our websites and counts page views without cookies.
The model provider reads meals and answers as the coach; our requests to it are made with storage turned off, so it does not retain them to train on. The coach can also search the web when a question calls for it, using a short list of medical and nutrition references rather than the open internet, and it tells you where an answer came from.
We would also disclose information if the law required it, or to protect our rights or someone’s safety. If Norply Inc. is acquired, this data may transfer to the acquirer, who would remain bound by this policy.
6. How long we keep it
These are the clocks our server actually enforces. They are the same figures the app declares to Apple.
| What | Kept for |
|---|---|
| Meal photographs | 24 hours, then deleted — or up to 365 days if you turned on help improve estimates (section 7). |
| Meal descriptions | 90 days. |
| Analysis records — what was read and any correction you made | 24 months, tied to the device id. |
| The summary sent with a coach question | Not stored. |
| Coach conversations on the server | 24 hours. The transcript you see is kept on your phone. |
| Coach evaluation rows — the question, the answer, which tools were used | 90 days, to check the coach is answering well. |
| Device record and subscription status | While the install exists, and until you ask us to delete it. |
| Email you send us | As long as needed to help, then archived under our ordinary business retention. |
7. “Help improve estimates”
Off by default. Turning it on in the app lets us keep your meal photographs for up to 365 days instead of 24 hours, and use them to check and improve how meals are read. Turning it off again deletes the photographs already kept, not just the ones not yet taken. Nothing else changes.
8. Where it is stored
Our server and database run in the United States (AWS and Neon, us-east-2). As a US company we access our own data from the US. Where personal data of EU or UK residents is transferred to the US, we rely on the European Commission’s Standard Contractual Clauses as included in our providers’ data processing agreements.
9. Legal basis (EU and UK)
- Performance of a contract (Article 6(1)(b) GDPR) for everything needed to provide the app you subscribed to: reading meals, answering the coach, checking the subscription.
- Consent (Article 6(1)(a)) for keeping photographs beyond 24 hours, which you give by turning on help improve estimates and withdraw by turning it off.
- Legitimate interests (Article 6(1)(f)) for keeping the service secure and within its limits, and for checking the coach’s answers.
10. Security
Everything travels over HTTPS. The app proves it is the same install with a key it makes on the phone; there is no password to leak. The amount held about any one person is deliberately small, and none of it is joined to a name. No system is perfectly secure, and if we learned of a breach affecting you we would tell you.
11. Your rights, and how to delete
Wherever you live, you can ask us to tell you what we hold about your device, send you a copy, correct it, delete it, or restrict how we use it. We act on every request without charge and without asking why.
To delete:
- Delete the app from your phone. Everything stored locally — logs, weigh-ins, plan, the coach’s transcript — goes with it. There is no cloud copy.
- Email founders@norply.co, ideally from the app (More › Legal & support), so the message carries the device id. We remove the server-side records for that device and confirm. Without the id, tell us roughly when you used the app and we will find it.
Cancelling the subscription is separate and is done with Apple: iOS Settings → Apple Account → Subscriptions. Deleting the app does not cancel it.
EU and UK: you also have the right to data portability and to complain to your supervisory authority; we would rather you gave us the chance to fix it first. California: the CCPA and CPRA give you the right to know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information as those laws define it, so there is nothing to opt out of, and we will never treat you differently for exercising a right.
12. Children
The app and the sites are not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has used the app, write to founders@norply.co and we will delete what we hold.
13. The websites
norply.co and massdelta.app set no cookies. There is no cookie banner because there is nothing to consent to. Both sites use Vercel Analytics, which counts page views without cookies and without a profile of you across sites, recording the page, the referrer, the country and the browser type. There are no forms, no advertising pixels, no session recording.
14. Changes to this policy
If we change this policy we update the “Last updated” date at the top. If a change materially affects how we use data we already hold, we say so in the app before it takes effect.
15. Contact
founders@norply.co, or Norply Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA. See also the Terms of Service.