Simor Privacy Policy

Version: 1.2 Last updated: September 7, 2026 Public URL: https://simor.app/privacy-policy

1. Introduction

This Privacy Policy explains how Simor Labs Inc. (“Company,” “we,” “us,” or “our”), doing business as Simor, collects, uses, discloses, and protects personal information when you use the Simor mobile application and related services that link to this Policy (collectively, the “Services” or “App”).

Our Terms of Service are at https://simor.app/terms-and-conditions. If there is a conflict between the Terms and this Policy about personal information practices, this Policy controls for that subject. Health and wellness disclaimers in the Terms (including that Simor is not medical advice) also apply.

Where we collect health-adjacent profile information or meal content, we do so to provide nutrition-tracking features. Providing that information in onboarding or the App, or using meal-logging / AI features, is how you consent to that processing for those purposes. If you do not want to provide it, those features may not work.

2. Who We Are and How to Contact Us

Simor Labs Inc.
Incorporated under the laws of Ontario, Canada (Business Number 779769967)
Doing business as Simor

Address:
350 Bay St, Suite 1300B
Toronto, ON M5H 2S6
Canada

Privacy and data requests: support@simor.app

We are accountable for personal information under our control, including information processed by service providers on our behalf.

3. Scope

This Policy applies to personal information we process in connection with the Simor App and related Services. It does not apply to third-party websites, stores, or services that we do not control (including Apple App Store, Google Play, or linked sites), which have their own privacy practices.

4. Information We Collect

We may collect the following categories of information. Exact fields depend on how you use the App.

4.1 Account and identity

Email address and authentication identifiers (for example Apple, Google, or email sign-in)
Firebase / account user ID
Account security-related signals (for example sign-in events)
Display name or similar identifiers you provide

4.2 Profile and health-adjacent information

To personalize nutrition tracking, we may collect information such as:

Birthdate or age-related inputs
Biological sex
Height, weight, and goal weight
Calorie or nutrition goals and related preferences (for example diet type, activity level, units, meal times)

Some of this information is health-adjacent or may be treated as sensitive under certain laws. We collect it to provide the Services, not to sell it for advertising. See Section 5 for how analytics may also receive related attributes.

4.3 Meal and nutrition content

Meal descriptions and other text you enter (stored in our systems so we can provide history and sync)
Estimated calories, macros, and related nutrition values (including AI outputs we store as part of your logs)
Meal type, timestamps, and history logs
Optional notes or labels you add

4.4 Meal photos

If you use photo logging, meal photos are prepared on your device and transmitted for AI analysis. We design the Services so meal photos are not uploaded to our durable cloud storage as a retained meal-photo library. Meal photos do leave your device when sent to AI providers for analysis. Transient processing needed to complete an analysis may still occur.

4.5 Voice and audio

If you use voice meal logging, microphone audio may be streamed or transmitted in realtime to speech-to-text providers (currently including ElevenLabs) and/or sent to Google Gemini for transcription, then the transcript is analyzed with Google Gemini to estimate foods. We do not operate a retained public voice library of your recordings. Providers may process audio according to their terms; we do not keep a user-facing audio archive after transcription for the core logging feature.

4.6 Profile avatar

If you add a profile avatar, the image is typically stored on your device, and related metadata (for example a local file reference and blurhash) may be saved to your account profile in our database. Unless we later enable cloud avatar hosting, avatars are not uploaded to our durable cloud photo storage as a shared library.

4.7 Device, app, and diagnostics

Device type, operating system, app version, language/locale
Crash logs, performance data, and diagnostic events
Session replay recordings used for debugging and reliability (see Section 5.2)

4.8 Push notification tokens

If you grant notification permission, we may collect push tokens and related delivery metadata.

4.9 Purchases and subscriptions

If you subscribe or make in-app purchases, we receive subscription and entitlement information via Apple, Google, and/or RevenueCat (for example plan status, renewals, cancellations). We do not collect or store your full payment card number for App Store / Google Play purchases. Limited subscriber attributes (for example contact or account identifiers) may be set with RevenueCat to operate subscriptions and support.

4.10 Analytics

We collect product-analytics events through providers such as Mixpanel. Events may include:

Feature usage, funnels, and coarse device/app context; and
Identifiers and profile-related attributes associated with your account when you are signed in (which may include email or phone if present on the account, and profile/nutrition-related attributes such as age, sex, height, weight, goals, diet, or calorie targets).

We use this to understand and improve the product. See Section 5.3 for what we do not do with advertising.

4.11 Support, feedback, and bug reports

If you contact us or submit feedback/bug reports, we collect the content of your message and related contact details. Bug reports you choose to submit may include screenshots, screen recordings, or logs you attach or that the App includes with your submission.

4.12 Agreements and compliance records

We may store records that you accepted the Terms and/or this Privacy Policy (including version and timestamp, and related device or network metadata where collected).

4.13 Information from third parties

We may receive information from:

Sign-in providers (Apple, Google)
App stores and RevenueCat (purchase/entitlement status)
AI and speech providers (model outputs such as estimates or transcriptions)
OS permission systems (notification, camera, microphone, photo library, tracking permission status)
Advertising / attribution platforms used for install acquisition measurement (see Section 7)

5. How We Use Information

We use personal information to:

Provide and operate the Services (accounts, sync, meal history, goals, premium features)
Personalize calorie and nutrition tracking
Run AI and speech features by sending necessary inputs to AI / STT providers
Secure the Services (fraud/abuse prevention, authentication, debugging)
Analyze and improve the Services (product analytics; crash reporting; session replay)
Send push notifications you have permitted (reminders, engagement, or transactional messages)
Send marketing emails only where permitted (see Section 10.1)
Provide customer support and process feedback/bug reports
Measure marketing campaign performance for app installs (attribution), without selling your meal/profile data to ad networks for targeting
Comply with law, enforce our Terms, and protect rights, safety, and property
Maintain encrypted backups for disaster recovery

5.1 AI and speech processing

Depending on the feature, inputs may be transmitted to third-party providers, including:

ElevenLabs — realtime speech-to-text for voice meal logging
Google generative AI services (via Firebase AI Logic / Gemini and the Gemini Developer API) — transcription fallback and food analysis from text, transcripts, or photos

Outputs may be stored as part of your meal logs.

We do not use your identifiable meal photos, meal text, or voice recordings to train our own AI models. We may use de-identified or aggregated information to improve the Services, and we take reasonable steps so such datasets are not reasonably identifiable. Third-party providers process inputs under their terms and our agreements with them; we select configurations and contractual terms intended to prevent use of your content to train their models where those options are available. Confirm provider settings before relying on this commitment in production.

5.2 Session replay

We use Sentry Mobile Replay (or similar) to understand crashes and UX issues. In production configurations for v1, we configure masking of on-screen text, images, and vectors so replays are less likely to expose readable personal content. Replays are used for debugging, reliability, and security—not for advertising.

5.3 What we do not do

We do not sell personal information.
We do not use your Simor meal logs or profile to target third-party ads inside other apps’ ad networks as a data broker.
We do not show third-party in-app ads in v1.
We may run acquisition / marketing ads to encourage new installs. Those campaigns may use privacy-preserving or aggregated attribution (and, where you allow tracking, platform advertising identifiers) for measurement—not your meal diary content.

6. How We Share Information

We share personal information with service providers who help us run the Services, and with others only as described below. We remain responsible for personal information transferred to providers that process it on our behalf, and we use contractual and organizational measures appropriate to the sensitivity of the information.

6.1 Main service providers (list may change)

Provider	Typical role
Google / Firebase	Authentication, database (Firestore), file storage, cloud functions, AI (Gemini / Firebase AI Logic and Gemini Developer API), related infrastructure
ElevenLabs	Realtime voice transcription (speech-to-text)
Apple	Sign-in with Apple, App Store billing, push delivery (APNs), platform services, App Tracking Transparency / attribution frameworks where applicable
Google	Google sign-in, Google Play billing, push delivery (FCM), and advertising/attribution platforms we may use for user acquisition measurement
RevenueCat	Subscription and entitlement management
Mixpanel	Product analytics (including event and profile properties described in Section 4.10)
Sentry	Error monitoring and session replay
Email / messaging infrastructure	Transactional email (for example OTP), support, and consented marketing email as applicable

6.2 Legal, safety, and business transfers

We may disclose information if we believe in good faith that disclosure is required by law, legal process, or government request; to protect the rights, safety, or property of you, us, or others; or in connection with a merger, acquisition, financing, or sale of assets (with notice or consent where required by law).

6.3 With your direction

We may share information when you ask us to or intentionally use a feature that requires sharing.

7. Advertising, Attribution, and “Do Not Sell”

We do not sell personal information.

We do not “share” personal information for cross-context behavioral advertising as those terms are commonly used under California law in the sense of selling your Simor profile or meal data to ad networks for that purpose.

We may promote Simor with acquisition ads. For campaign measurement we may use platform attribution tools (for example Apple’s frameworks / SKAdNetwork-style aggregated attribution, and Google app campaign measurement). On iOS, we may show an App Tracking Transparency prompt; if you authorize tracking, the OS may allow use of the advertising identifier for measurement. You can change this in iOS Settings.

If you have questions, contact support@simor.app. If we ever change sale/share practices, we will update this Policy and provide any required opt-out mechanism.

8. International Transfers

We are based in Canada. Personal information may be processed in Canada, the United States, and other countries where we or our service providers operate. Those countries may have different data-protection laws than your home jurisdiction. Where required, we use appropriate contractual and organizational safeguards. Transferring information to a provider does not end our accountability for that information under applicable Canadian privacy law when they process it on our behalf.

Quebec. If you are in Quebec, mandatory provisions of Quebec privacy law (including Law 25 themes) may apply. A French version of this Policy may be required for certain adhesion scenarios; until a French version is published, Quebec availability may be limited as required by law.

9. Retention

Situation	Retention
Active account	We keep personal information while your account is active and as needed to provide the Services
Account deletion	When you delete your account (in-App or via support), we delete your authentication credentials and take steps to delete or de-identify associated personal information we store in our primary systems (such as profile and meal history). We also request deletion or suppression from key service providers where available (for example analytics). Completing erasure across all systems may take time; we aim to finish primary-system deletion within about 30 days of a verified request, subject to the rows below
Backups	We may retain encrypted backups for up to 365 days. Backups are used only for disaster recovery / data-loss restoration or when we are legally compelled (for example a court order). Backup copies are not used for ordinary product features
Analytics / providers	Provider copies may persist until their deletion processes complete after our requests
De-identified data	We may retain de-identified or aggregated information that can no longer reasonably identify you
Legal holds	We may retain information longer when required by law, dispute, security investigation, or enforcement of our Terms

Deleting the App from your device does not by itself delete your account or cloud data. Use in-app account deletion or email us.

Cancelling a subscription in Apple/Google settings does not by itself delete your Simor account.

10. Your Choices

10.1 Marketing email

For recipients in Canada, we send promotional/marketing commercial electronic messages only with CASL-compliant consent. Elsewhere, we send marketing emails only with your consent or another lawful basis that applies in your location. You can unsubscribe using the link in the email or by contacting support@simor.app. Transactional messages (security, account, legal) may still be sent as needed.

10.2 Push notifications

Push notifications are optional and require OS permission. You can disable them in your device settings. We may still process limited token/status data as needed to honor your preference.

10.3 Device permissions

Camera, microphone, photo library, notifications, and tracking permissions are requested only for features that need them. You can deny or later revoke permissions in system settings; some features will not work without them.

10.4 Analytics / diagnostics / tracking

You can limit some device-level tracking through OS settings (including responding “Ask App Not to Track” / disabling tracking for Simor on iOS). Core crash reporting may still be needed to keep the Services reliable.

10.5 Profile and meal data

You can edit many profile fields in the App. You can delete meal entries where the product allows, or request broader deletion via account deletion / support.

11. Your Rights

Depending on where you live, you may have rights to:

Access the personal information we hold about you
Correct inaccurate information
Delete information (subject to legal exceptions and backup windows)
Withdraw consent where processing is based on consent
Portability or a copy of information in a common format (where required by law)
Object to or restrict certain processing (where required by law)
Challenge our compliance with this Policy

How to exercise: email support@simor.app with your request and enough information for us to verify your account. We aim to respond within a reasonable period (about 30 days), or sooner if required by law.

Canada (PIPEDA): You may request access to and correction of your personal information, subject to limited exceptions. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca/). Provincial privacy commissioners may also have a role depending on your situation.

EEA / UK / similar: If these laws apply to you, you may have additional rights (including complaint to a supervisory authority). Contact us first and we will try to resolve your request.

California and similar U.S. state laws: We do not sell personal information or share it for cross-context behavioral advertising as described in Section 7. You may still request access, deletion, or correction where those laws apply. Some U.S. state laws treat certain health-linked data as sensitive; contact us with questions about those rights.

We will not discriminate against you for exercising privacy rights that apply to you.

12. Children

The Services are not directed to children under 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected such information, we will delete authentication credentials and take steps to delete associated personal information from primary systems as described in Section 9 (including the backup window). Parents or guardians who believe a child under 16 has created an account should contact support@simor.app.

Users who are at least 16 but under 18 should use the Services only with parent/guardian agreement, as described in our Terms.

13. Security

We use reasonable technical and organizational measures designed to protect personal information, including encryption in transit for network communications, access controls, and encrypted backups. No method of transmission or storage is completely secure. If you believe your account has been compromised, contact support@simor.app promptly.

14. Third-Party Stores and Links

Purchases and some account actions are handled by Apple or Google. Their privacy policies apply to their processing. Links to third-party sites are not covered by this Policy.

15. Changes to This Policy

We may update this Policy from time to time. We will change the “Last updated” date and may update a version identifier used in the App. For material changes, we will provide notice as required by law and/or through in-app acceptance (including via a privacy version your account must accept where that flow is enabled).

16. Contact Us

Privacy questions, access/export requests, deletion help, or complaints:

Simor Labs Inc. (Simor)
350 Bay St, Suite 1300B
Toronto, ON M5H 2S6
Canada
Email: support@simor.app

End of Privacy Policy (Version 1.2).