Privacy policy

Data controller: ark.swiss Sàrl, Lausanne (Switzerland) — contact: [email protected].

1. Our principle: your data stays with you

ark.fit is built local-first: by default, all your tracking data lives on your device, in an encrypted database. We never sell, rent or share your data. We apply strict data minimisation: we collect and transmit only what is strictly necessary, and only with your explicit consent for each purpose.

2. Data processed on your device (never transmitted by default)

Stored locally, in a database encrypted at rest (iOS file protection + application-level AES-GCM encryption of sensitive fields, key in the iOS Keychain):

Profile: target weight, pace, dietary approach, aversions and restrictions (sensitive data, encrypted);
Food log: foods, portions, nutritional values, timestamps;
Weight and trend: your weigh-ins and the smoothed trend computed by the adaptive engine.

This data does not leave the device unless you deliberately choose so (see §4 and §5).

3. Apple Health (HealthKit)

If you connect Apple Health, ark.fit reads on the device certain metrics (weight, height, age, sex, steps, active and resting energy, heart rate) to calibrate your budget and enrich the display. This raw data stays on the device and is never transmitted as such. The app works entirely without Apple Health. If you allow writing, ark.fit records the energy of your meals in Health; during total erasure (§6), the app attempts to remove samples it wrote, subject to the available permissions.

No account is needed to use the core of the app. You can sign in with Sign in with Apple solely to enable server features, including Describe, AI Insights, AI-enhanced scan, receipts, AI recipe features and household sharing. We ask for the minimum: no name and no e-mail are required; we only receive an opaque session identifier.

After account deletion, the backend retains an opaque security marker made of a hashed internal identifier, a revocation counter and a timestamp. It is used only to durably revoke old JWTs and prevent their recreation. It contains no profile or Apple identifier in clear text.

5. Artificial intelligence — distinct consents and minimisation

General AI features (Describe, scan, receipts and recipes) share one revocable, versioned general AI consent. A previous consent or the previous Boolean does not authorise any transmission under this V2 scope: you must accept the current disclosure. Because AI Insights uses health aggregates, it relies on a separate, versioned consent.

Describe a meal: the app sends the ark.fit backend the entered text, 0–3 minimised images (EXIF/GPS metadata removed), locale, current instant in local time and routing preference. The backend routes the request to the provider for the selected model: Infomaniak in Switzerland or OpenAI / Anthropic, with possible processing outside Switzerland. Your health profile is never sent. The result is an editable range, never a “precise” value.
Enhanced scan: only when AI escalation is needed, the app sends the backend 1–3 minimised images, OCR text, detected barcodes and, when a product is resolved, its Open Food Facts (OFF) data (name, brand, unit, serving and nutrition per 100 g), plus locale and routing preference. According to the selected model, the backend routes this data to Infomaniak in Switzerland or OpenAI / Anthropic, with possible processing outside Switzerland. Without V2 consent, barcode/OFF resolution and heuristic label reading stay on-device.
Receipts: the image stays on-device for local OCR. Only the OCR text, locale and routing preference are sent to the backend; never the photo. The backend routes to Infomaniak in Switzerland or OpenAI / Anthropic according to the selected model, with possible processing outside Switzerland. Without V2 consent, heuristic analysis stays on-device.
AI Insights on Home: a report is generated only after an explicit action and your dedicated consent. The app sends the ark.fit backend your opaque session, locale, routing preference and these aggregates: age, sex and height; smoothed weight and trend; average activity, steps and energy intake; the latest daily resting-heart-rate value; calorie budget. The AI provider receives the aggregates and locale, without the session identifier or routing preference. No food, raw meal detail, meal time or raw Apple Health sample is transmitted. By default, Infomaniak (sovereign) processes these aggregates in Switzerland; if you choose a capable OpenAI or Anthropic model, they may be processed outside Switzerland. The latest report is encrypted on the device and included in the JSON export. Disabling AI Insights immediately revokes authorisation for any new transmission; the app then deletes the local report. If deletion fails, the report remains encrypted, an error state is shown and deletion can be retried.
Recipes: depending on the requested action, the app sends the ark.fit backend the source URL and rendered public page text, 1–3 minimised recipe photos (EXIF/GPS metadata removed), or the title, ingredients and serving count for nutrition estimation. Suggestions and creation send a free-text brief (limited server-side to 500 bytes), the pantry-use setting, names of pantry items and consume-soon indications when enabled, selected criteria, locale and routing preference. The AI provider receives only the content required for the selected flow and locale, without the pantry-use flag or routing preference. The health profile (weight, body metrics, budget and goal) is never sent in these flows. These AI transmissions require V2 general AI consent. By default, Infomaniak (sovereign) processes this data in Switzerland. If you select a capable model, OpenAI or Anthropic may process it outside Switzerland.

The AI providers’ keys are never inside the application (they live server-side) and the usage budget is enforced server-side.

Access / portability: full export of the data stored on this device in JSON format, from Settings. To access any server-account data, contact [email protected];
Local erasure: deletion in one gesture of data on the device and cryptographic destruction of the encryption key (local data becomes unrecoverable). The app also attempts to remove samples it wrote to Apple Health, subject to the available permissions;
Withdrawal of consent: the general AI consent, the versioned AI Insights consent and diagnostics consent are independent.

Uninstalling removes the app’s local container, but iOS may retain Keychain or iCloud-synchronised items, and uninstalling does not delete server-account data. First use “Erase all my data” and, where applicable, “Delete account”.

7. Technical diagnostics (optional)

If you allow it (separate consent, off by default), ark.fit sends technical error reports to our diagnostic tool, self-hosted in Europe. Payloads are filtered (allow-list, no data objects, no personal information). This is the app’s only telemetry — and it is optional.

8. This website

This website sets no cookies and uses no advertising trackers. We measure our audience with Umami, a self-hosted tool in Europe, cookie-free and without personal data (no stored IP addresses, no profiling). The contact form transmits only what you write in it, for the sole purpose of replying to you.

9. Processors and transfers

Our application infrastructure, business continuity and backups are hosted exclusively in Europe. Production is operated in the European Union, with a hot standby site and independent backups in Switzerland.

netcup GmbH (Germany) — primary production, technical diagnostics and Umami in the European Union;
Infomaniak (Switzerland) — hot standby site and default sovereign AI processing in Switzerland;
ark.swiss-owned infrastructure (Switzerland) — independent historical backups;
Apple — Sign in with Apple and HealthKit (on-device processing);
OpenAI and Anthropic — only if you explicitly choose a compatible “capable” model; the relevant data may then be processed outside Switzerland, with the applicable contractual safeguards.

10. Audience and exclusions

ark.fit is a wellness tool, not a medical device, and provides no diagnosis or treatment. It is not intended for minors or people with a history of eating disorders. For pregnancy and breastfeeding, ark.fit offers a dedicated nutrition-tracking mode — a raised maintenance budget, never a deficit during pregnancy, reinforced safeguards while breastfeeding; this mode remains a wellness tool, neither medical advice nor a medical device, and pregnancy care remains the domain of your health professional.

11. Contact

For any question or to exercise your rights: [email protected]. We may update this policy; the date of the last revision appears below. Substantial changes will be announced in the app.

Last updated: 15 July 2026