Almma Health Privacy Policy Version 1.0.0

As of October 4, 2026

US Privacy Policy

Last Updated: October 4, 2026

Welcome to Almma! This Privacy Policy explains what Almma Health Corporation ("Almma," "we," "us," or "our") collects when you use the Almma mobile application, why we collect it, who helps us process it, and what control you have over it.

1. What We Collect

• Your email address, stored by our authentication service for account access and recovery, and so we can reply if you contact us. If you sign in with Apple or Google, we receive your email address from them. We do not keep your name or profile picture.

• Your way of eating and no-go foods. These are preferences you choose. They are stored with your account and used to filter and personalize recommendations.

• Your location, when you allow it. Your phone sends it to Google to find restaurants near you and to suggest places as you type. When you photograph a menu, your phone sends its last known position to our servers, which turn it into a time zone as soon as it arrives, only to work out the local time. We do not store your position anywhere, including our database, technical traces and logs. When you review a dish from a menu you photographed, your phone asks its operating system's location service (Apple's on iPhone, Google's on Android) to turn your position into a city and country. Only the city and country are saved, with the restaurant.

• Photos of menus that you take with the camera. They are sent to our servers and to the AI services that read the menu. We delete the photo from your phone once it has been read, or when you leave the camera. During the beta, copies are kept in our tracing tool for 14 days to understand and improve how well menus are read, and are then deleted automatically. These copies are not tied to your account.

• Restaurant reviews you submit through the app: the restaurant, the dish and size, your star rating, any text you write, the changes you asked for, the dish's carbon rating, and the way of eating and no-go foods you had selected.

• Anything you send through Help and Feedback, including a screenshot if you choose to attach one.

• A count of how many searches your account has made, used to see how much the app is used. It does not record what or where you searched.

• Anonymous usage information, such as which screens are opened, which buttons are tapped, which ways of eating and no-go foods people choose, and which foods people search for that we do not list yet. This is not connected to your account or your name.

• Crash reports, which describe a technical problem on your device, such as the device model and what the app was doing when it stopped.

• The restaurants you look up: the name, address and Google listing ID are sent to our servers, the AI services and a web search service to find and read the menu. They are not tied to your account. 

• A technical record of each recommendation request (the restaurant, your way of eating and no-go foods, any menu photos, and the recommendations), kept for up to 14 days so we can find and fix problems. It is not tied to your account.

• A record of when you accepted our Terms and this Privacy Policy, with basic device and app information.

• Your device's IP address, which every internet connection shares. The services the app connects to receive it, such as Google, our sign-in service and our analytics service. Our sign-in service keeps it with your signed-in session until you sign out or delete your account. Our own servers do not keep it in their logs, and our analytics service does not store it."

2. What We Do Not Collect

• We do not collect or store your real name.

• Your username is stored on your device and is never sent to our servers.

• We do not sell your personal information to third parties.

• We do not share your information with advertisers or track you across other companies' apps and websites.

• We do not store your location: not in our database, our technical traces or our logs.

• We do not store screenshots in our database. They reach us by email and are not kept there.

• We do not ask about, record or infer any health condition, or whether you are pregnant. The way of eating you pick is a preference, including options linked to life stages such as perimenopause, menopause and pregnancy. Choosing one, like choosing dairy-free or gluten-free, does not tell us anything about your health. Almma does not provide medical advice.

3. How We Use Your Information

• Your way of eating and no-go foods filter menus and personalize recommendations.

• Your location is used in real time to find nearby restaurants and, when you photograph a menu, to work out the local time. When you review a dish from a photographed menu, your phone asks its operating system's location service to turn your position into a city and country.

• Menu photos are used to read the menu and, during the beta, to understand and improve how well menus are read.

• Recommendations are made on our servers for each request and are kept on your device afterward. They are not saved to your account unless you choose to submit a review.

• Anonymous usage information helps us see what works and where recommendations fall short for each way of eating.

• Help and feedback messages, including any screenshot, are deleted once your issue is resolved.

4. Who Helps Us Process Your Information

We use these services, which handle information only to provide Almma to you:

• Supabase stores your account, preferences and reviews.

• Google Cloud hosts our servers. Google also provides restaurant search and maps, and sign-in with Google if you choose it.

• Apple provides Sign in with Apple, if you choose it.

• AI model providers, Google (Gemini) and Anthropic (Claude), read menus and prepare recommendations. They receive menu photos, restaurant details, your way of eating and no-go foods. They do not receive your name or email.

• Tavily, a web search service, finds restaurants' menus online. It receives the restaurant's name and location, nothing about you.

• LangSmith records technical traces of how recommendations are produced, so we can find and fix problems. Traces are deleted after 14 days and are not tied to your account.

• RevenueCat, which will manage subscriptions, receives your account's user ID.

• PostHog provides anonymous usage analytics.

• Firebase Crashlytics, from Google, collects crash reports.

• Expo delivers app updates.

• Your phone's operating system (Apple on iPhone, Google on Android) turns your position into a city and country when you review a dish from a menu you photographed.

5. Your Control

• Update your way of eating and no-go foods at any time.

• Edit or delete your reviews at any time in the app.

• Delete your account in the app (Menu > Security), or ask us to. Your account, email, preferences and sign-in information are deleted immediately; backup copies may remain for up to 30 days before being purged. Submitted reviews are kept without any link to you, and still show the dish, rating, text, and the way of eating and no-go foods that were selected.

• Control location sharing through your device settings.

6. State-Specific Privacy Rights

Depending on your state of residence, you may have additional rights under state law, including the right to know what we collect, the right to request deletion, and the right to opt out of the sale of personal information.

To Exercise Your Rights:

• Contact us at privacy@almmahealth.com.