Privacy Policy, Qoot

Last updated: October 7, 2026

Consent version: 2026-06-22 (health and religious practices).

AI permission version: 2026-09-11. This permission to send information to our artificial intelligence provider is separate, optional and off until you accept it.

1. Who we are and scope

This privacy policy explains how Serenity Media collects, uses and protects your personal data in connection with:

• the getqoot.com website (including the waitlist sign-up); and
• the Qoot mobile application (halal nutrition tracking).

Serenity Media is a French simplified joint-stock company (SASU) registered under SIREN number 999 352 842, with its registered office at 8 bis Hameau de Girou, 09300 Villeneuve-d'Olmes, Ariège, France. It acts as the data controller within the meaning of the General Data Protection Regulation (GDPR).

For any question about your data, or to exercise your rights, you may contact our data protection point of contact at hello@getqoot.com.

2. The data we collect

2.1 On the getqoot.com website (waitlist)

2.2 In the Qoot app

Account and identification. Your email address and login credentials. If you sign in via Apple or Google, we receive the corresponding account identifier.

Profile and health data. First name, gender, age, height, weight and target weight, activity level, calorie and nutritional goals, units (metric/imperial). Your logged meals, daily journals, hydration, weight history, as well as your streaks and achievements.

This information constitutes health-related data, considered sensitive within the meaning of Article 9 of the GDPR. We process it on the basis of your explicit consent, given when you create your profile, and solely to provide you with nutrition tracking.

Optional Apple Health and Health Connect connection. This connection is off by default. The “Connect Health” button in settings requests a separate device authorization. Qoot only reads today’s steps and the latest weight recorded within the past 30 days. Steps are displayed locally: they are not sent to our server, the Coach or an AI provider. A read weight only pre-fills an editable input and is saved to your Qoot account when you confirm it. Once confirmed, this weight is treated like your other weigh-ins and can be included in your weekly reviews and the Coach’s nutritional context described below.

If you permit writing, Qoot copies the weight and water you log in Qoot to Apple Health or Health Connect. No heart rate, sleep, route or workout data is requested. This data is not used for advertising, data sales or commercial profiling. You can stop the connection in Qoot settings and revoke permissions in Apple Health or Health Connect. Disconnecting stops future access; it does not delete records you have already confirmed, which you can manage separately in Qoot and the Health app.

Data relating to your religious practices. Your halal strictness level and, if you choose to provide them, your answers regarding Ramadan and prayer, along with your fasting dates, times and meal choices before and after fasting.

This information reveals religious beliefs, also sensitive within the meaning of Article 9 of the GDPR. It is optional, processed on the basis of your explicit consent, and used exclusively to personalise the app (prayer reminders, Ramadan mode, halal settings). You may decline to provide it without losing access to Qoot's core features.

Meal photos. The images you capture or upload for nutritional analysis. See section 5.

Product scans. The history of the barcodes you scan and the associated halal verdicts. To look up a product, our server sends its barcode to Open Food Facts, without your profile or account identifier.

Google ML Kit native scanner. On iOS, the scanner uses Google ML Kit; on Android, it uses Google Code Scanner, which is based on ML Kit. Images and barcodes are decoded on your device: the scanner does not send those images or decoded results to Google. The SDK does send technical information to Google: device model and system version, application identifier and version, technical installation or device identifiers depending on the platform, processing times, image configuration, operational events and error codes. Google uses these metrics to diagnose, maintain and improve its APIs and prevent abuse. Qoot does not add your account identifier or health profile to this data. Qoot's Privacy Mode does not disable this SDK telemetry; you can enter a barcode manually without starting the scanner's camera. The provider describes its practices in the ML Kit privacy terms and its iOS and Android disclosures.

Weekly reviews. If you are a subscriber and have accepted AI permission, we produce a review of each week that has just ended. To do so, we bring together what you recorded yourself over those seven days: the name and calories of each meal, your calorie and macronutrient totals and averages, your hydration, your weigh-ins, the halal statuses of your dishes and of the products you scanned, along with your nutrition targets and preferences (halal strictness, Ramadan). No new information is collected: everything is derived from the data described above, and your meal photos are not part of it.

This set of figures is kept alongside the text of the review, for two reasons: to show you the corresponding numbers without recomputing them, and to let you understand afterwards what the review was based on. When a week holds too few entries for a review to mean anything, we keep the figures and the fact that no text was written, so as not to leave an unexplained gap in your history.

Coach assistant. When you write to the Coach assistant, we bring together a set of figures covering your last twelve completed weeks: for each one, the number of days on which you recorded meals, the number of meals, your calorie and macronutrient averages across those days, your weigh-ins, how many dishes were flagged as doubtful or not halal, how many dishes were never given a halal status at all, and your Ramadan days. If you are a subscriber, we add the two recommendations from your most recent weekly review, together with its age in weeks, so that the assistant does not advise you the opposite of what the review told you, and does not present it as recent when it no longer is. When that review covers a week older than the twelve summarised here, it is not included at all: it no longer describes any of the weeks the assistant can see. As with the review, no new information is collected: everything is derived from the data described above, and your meal photos are not part of it.

This set of figures is not saved separately in Qoot. It is recomputed from your entries when you send a message. Corrections and deletions are reflected in the next calculation. Conversations are kept to display your history. The AI provider's retention rules for information already sent are explained in section 5.

My kitchen, planning and personal follow-up. We keep the private recipes you enter or import, their ingredients, quantities and portions, dinner plans, allergies and food preferences, shopping lists, pantry items, Coach follow-up actions and your feedback. Your halal library contains saved products, the sources you associate with them and your notes. This information stays linked to your account; it is neither a medical diagnosis nor halal certification.

Recipe sharing. A sharing link gives anyone who has it access to a copy of the recipe's culinary information for up to seven days, or until you revoke it. It does not share your profile, health goals, private notes or other recipes. Someone who imports the recipe keeps their own copy: revoking the link or deleting the original does not delete that copy. Publishing a recipe to the community is a separate process subject to the moderation described in section 4.

Notifications. If you enable them, local reminders are scheduled on your device. Remote notifications use a device token associated with your account, Apple Push Notification service on iOS and Firebase Cloud Messaging on Android. Qoot's remote messages announce that content is available without including your meals, weigh-ins or other health measurements. You can disable them in settings.

Technical incidents. We receive error counts with a predefined code, the general app section, app version and platform. These counts contain no error text, conversations, health information or account identifier. A separate, temporary quota counter linked to the account prevents abuse. This essential diagnostic stays within our infrastructure, separate from optional usage analytics.

Location. Prayer times are calculated on your device using the Adhan library. Your GPS location and selected city are stored locally for future calculations and removed when you sign out or delete your account; they are not saved in your Qoot profile. No requests are made to Aladhan. A city search is sent only when you press Search or submit the input. The Qoot server receives this authenticated request and your chosen language; if the answer is not cached, it sends the city name and language to OpenStreetMap (Nominatim) to obtain coordinates. Your GPS location, account identifier and IP address are not forwarded to this provider, which receives the Qoot server's IP address. Responses can be reused from a shared cache for 7 days without linking accounts to cities; an account-level usage counter over 24 hours protects the service against abuse. Expired entries in both mechanisms are removed by an hourly purge, at most one hour after expiry. OpenStreetMap states that it retains request logs to operate, secure and improve its services. See the OpenStreetMap privacy policy.

Subscription. Your subscription status and transaction identifiers, managed by our provider RevenueCat and by the app stores (Apple, Google). We neither receive nor store your payment data (card number, etc.).

Usage data. We record Qoot usage events in Supabase (for example: a scan performed, an analysis launched) to understand usage and improve the app. You can disable these optional internal statistics through Privacy Mode. Minimal operational records remain necessary to enforce quotas and prevent abuse. This setting does not disable the essential diagnostics described above, ML Kit's own technical metrics, or RevenueCat's subscription processing and purchase analytics.

3. Why we process your data (purposes and legal bases)

For sensitive data (health, religious beliefs), we rely both on a legal basis under Article 6 and on your explicit consent under Article 9(2)(a), which you may withdraw at any time.

Features that send your personal information to Anthropic require additional explicit AI permission, separate from health and religious-practice consent. This permission covers only the features explained in section 4. Without it, you can use manual logging, your private recipes, the catalogue and planning. Automatic reviews are not generated and your information is not sent to the Coach.

Where we rely on legitimate interest, it consists in ensuring the proper functioning, security and continuous improvement of the app. We have balanced this interest against your rights and freedoms. You may object to this processing (see section 10).

4. AI-powered analysis and absence of automated decision-making

Several Qoot features rely on artificial intelligence: meal photo analysis, halal status estimation, the "Qoot Coach" assistant, and the writing of weekly reviews. These processes produce estimates for indicative purposes only and give rise to no automated decision producing legal effects concerning you or significantly affecting you within the meaning of Article 22 of the GDPR.

Before any personal information is sent, a dialog identifies Anthropic, explains the information involved and offers a choice to accept or continue without AI. A subscription does not count as permission. You can withdraw permission in settings: future personal-data transfers and automatic reviews stop, without deleting your account or saved content. A request already sent cannot be recalled. A weight imported from Health and then confirmed in Qoot is included in transmitted context only if you have also given this AI permission.

To write a weekly review, the set of figures described in section 2.2 is sent to our artificial intelligence provider (Anthropic), which writes the text. Neither your photos, nor your email address, nor your location is sent on that occasion.

To answer a message addressed to the Coach assistant, the same provider receives your message, earlier messages in the current conversation, relevant profile information (goal, nutrition targets, preferred cuisines, allergies, halal strictness and Ramadan) and the figures covering your last twelve weeks. Your first name, account identifier, photos, email address and location are not added to this context. Avoid including personal information that is unnecessary for your request in your messages.

To generate a recipe, Anthropic receives the culinary criteria, ingredients, allergies and preferences needed for your request. When you submit a recipe to the community, its content is sent to Anthropic to assist moderation. The product library and barcode scanner do not send your health profile to Anthropic.

Nutritional values, food identification and the displayed halal status (for example "likely halal") are estimates that may contain errors. They constitute neither medical advice, nor professional dietary advice, nor an official halal certification. You remain solely responsible for verifying what you consume. These limitations are detailed in our Terms of Service.

5. Meal photos

After you give AI permission, the image you choose to analyse is sent to Anthropic, the provider of Claude, to estimate nutritional values and halal status. Qoot does not durably retain the image from that analysis; results you save remain in your journal. A photo you separately choose to publish with a recipe is stored with that recipe.

Qoot not retaining the analysis photo does not mean the provider never retains it. Anthropic states that API inputs and outputs are normally deleted within 30 days, with exceptions including safety and legal obligations. Qoot does not offer a zero-retention guarantee. Current rules are available in the Anthropic API retention policy.

6. Cookies and trackers

On the getqoot.com website, we use:

• strictly necessary cookies for the site to function (for example, managing your session), which do not require your consent;
• internal (first-party) audience measurement intended to produce aggregate statistics on site traffic, with no advertising tracking, no cross-site correlation and no sharing with third parties. The site uses no third-party advertising trackers.

In the app, we do not use advertising trackers. Optional internal statistics can be disabled through Privacy Mode. The Google ML Kit scanner sends its own technical metrics to Google; RevenueCat processes purchase history to manage and analyse subscriptions. Firebase Cloud Messaging delivers the Android notifications you enable; Firebase Analytics collection is disabled. These processes are separate from internal statistics and are explained in sections 2.2 and 7.

7. Recipients of your data

We never sell your data.

Processors (they process data on our behalf and under our instructions):

• Supabase: database hosting and authentication (European Union, Ireland).
• Anthropic (United States): meal photo analysis, Coach, recipe generation, weekly reviews and moderation assistance, subject to your AI permission.
• Apple Push Notification service and Google Firebase Cloud Messaging: delivery of the remote notifications you enable.
• RevenueCat (United States): subscription management, purchase validation and purchase analytics.
• Open Food Facts: product database (barcode only).
• Netlify: hosting of the getqoot.com website.

Independent data controllers (they determine their own purposes, notably tax and fraud-prevention):

• Apple (App Store) and Google (Google Play): payment processing and app distribution. The processing of your data by these platforms is governed by their own privacy policies.
• Google: technical telemetry from the ML Kit scanner, for the operation, security and improvement of its APIs, under the provider policies linked in section 2.2.
• OpenStreetMap Foundation: city searches forwarded by the Qoot server and related technical request logs under its own privacy policy. Qoot does not send it your GPS location, IP address or account identifier.

We may also disclose your data where the law requires us to, for example at the request of a competent judicial or administrative authority.

8. Transfers outside the European Union

Your data is hosted in the European Union (Supabase, Ireland). However, some of our providers (notably Anthropic, RevenueCat, Apple and Google) may process data outside the European Union, including in the United States.

These transfers are governed by appropriate safeguards: adherence to the EU–U.S. Data Privacy Framework where the provider is certified, or, failing that, the European Commission's Standard Contractual Clauses together with a transfer impact assessment. You may obtain a copy of these safeguards by writing to hello@getqoot.com.

9. How long we keep your data

• Waitlist email: until the app launches and you sign up, and at most 24 months after sign-up, or until you unsubscribe.
• Account and profile data: for as long as your account is active. After you delete your account, your personal data is erased within 30 days, unless a legal retention obligation applies.
• Analysis photos: no lasting retention by Qoot; provider retention is explained in section 5.
• Private recipes, plans, shopping lists, pantry, Coach follow-up, conversations, library and fasting entries: until they or your account are deleted. Copies imported by recipients are independent of your account.
• Sharing links: access lasts up to seven days and can be revoked earlier.
• Aggregated technical incidents: 30 days; account-linked quota counters: 24 hours, then hourly cleanup.
• Billing data: retained for the period required by our accounting and tax obligations (generally 10 years).
• Weekly reviews (text and figures): 400 days, roughly 13 months, counted from the week covered. That period is what allows a comparison with the same period a year earlier, including from one Ramadan to the next (the Hijri calendar moves back by about eleven days a year, so twelve months would not suffice). After that, they are deleted automatically. You can keep a copy yourself by exporting your data (section 10).
• Usage data: retained on a limited basis (at most 25 months), then aggregated or anonymised for statistical purposes.
• Proof of consent: 5 years. The GDPR requires us to be able to demonstrate that you consented (Article 7(1)), including after a withdrawal, since that is what establishes that the earlier processing was lawful. We therefore keep, separately from your account and for that sole purpose, a record of the consents given and withdrawn: the date, the category concerned, the version of the text accepted, and the path through which the consent was collected. That record contains neither your email address, nor your IP address, nor any information about your device, and it survives the deletion of your account. After 5 years it is deleted automatically.

10. Your rights

Under the GDPR, you have the following rights: access, rectification, erasure, restriction, objection, portability of your data, and the right to withdraw your consent at any time.

Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal.

AI permission. You can decline or withdraw it separately in settings without deleting your account. Manual logging, private recipes and planning remain available. Withdrawal stops future personal-data transfers to Anthropic; it does not automatically delete conversations, recipes or reviews already saved.

What you can do yourself, from the app's settings: export your data, withdraw your consent to the processing of your religious practices, and withdraw your consent to the processing of your health data (that last withdrawal being the deletion of your account, for the reason explained below). The religious withdrawal turns off halal, Ramadan and prayer personalisation, and erases the corresponding information: your halal strictness level, your answers about Ramadan and prayer, and the prayer times and city stored on your device. The rest of the app keeps working: nutrition tracking, product scanning and halal verdicts are unchanged, a verdict being about the product and not about you.

Withdrawing your consent to the processing of your health data is also done from the settings, and it ends your account. Those data are what the nutrition tracking is made of: processing them cannot stop while the service continues. Withdrawal and account deletion are therefore one and the same thing, reachable under both names ("Withdraw my consent" in the Data section, "Delete account" in the Account section), and both lead to the same flow. That flow explains what stops and what is erased, offers to export your data first (this is the last opportunity: after erasure there is nothing left to export), and reminds you, if you are a subscriber, that your subscription is billed by Apple or Google and continues until you cancel it with them. Erasure is immediate.

Withdrawing religious-practice consent also deletes saved fasting dates and settings and cancels the corresponding reminders.

Deleting your account also erases the recipes you published in the community and your photos stored by Qoot. Recipe copies already imported by recipients remain in their accounts. Billing data and consent evidence are retained as described in section 9.

For any other request, write to us at hello@getqoot.com; we respond within one month, which may be extended by two months for complex requests.

You have the right to lodge a complaint with the CNIL (the French data protection authority, www.cnil.fr) or with the supervisory authority of your country of residence.

11. United States residents

If you reside in the United States, you have, depending on your state (California and other states with an applicable privacy law), the rights to know what personal data is collected, to access it, to correct it, to delete it, and not to have your data sold or "shared" for targeted advertising. We do neither. As your health and religious-belief data constitute "sensitive personal information" under California law (CPRA), you may further request that we limit its use. To exercise these rights, write to hello@getqoot.com. We do not discriminate against you for exercising your rights.

12. Minimum age

Qoot is intended for people aged 16 or over. We do not knowingly collect data from people under 16. If you believe a minor under 16 has provided us with data, please contact us so we can delete it.

13. Security

We implement appropriate technical and organisational measures to protect your data: encryption of communications (HTTPS/TLS), encryption of data at rest, database access control (row-level security policies / RLS), and limiting access to authorised persons only. In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify the CNIL and, where necessary, the affected individuals, in accordance with Articles 33 and 34 of the GDPR. As no method of transmission is entirely secure, we cannot guarantee absolute security.

14. Changes to this policy

We may update this policy. In the event of a material change, we will notify you by email or within the app. If the change introduces a new purpose based on your consent, we will obtain your consent again. The date of the last update appears at the top of this document.

15. Contact

Serenity Media: SIREN 999 352 842 8 bis Hameau de Girou, 09300 Villeneuve-d'Olmes, Ariège, France Email: hello@getqoot.com