Privacy policy

Last updated: 2026-11-09

1. Data controller

stebi.me (website and app) is run by Arturas Rynkevič, carrying out individual activity in Lithuania (details). For data protection questions write to [email protected].

2. What data we process, why and on what basis

• Anonymous session (cookie guest_token / device identifier) — to keep your carts, diary and watches. Basis: providing the service, legitimate interest (GDPR Art. 6(1)(b), (f)).
• Account — when you sign in with Google, Apple or Facebook we receive your name, e-mail, profile picture and the provider's identifier. Basis: contract.
• Food diary, carts, watches, meals — what and when you eat, amounts, calories, your goals and settings. This can reveal information about your health or eating habits, so we treat it with extra care: we do not use it for advertising, do not share it with third parties and show it only to you (except what you publish yourself). Basis: contract; your explicit consent (GDPR Art. 9(2)(a)) when you choose to keep a diary — withdraw it by deleting entries or your account.
• Meal photos and text — sent for recognition (see section 4); the reduced photo and result are kept in your account for your history and to improve quality. Basis: contract, legitimate interest.
• Products, prices, photos and public content you add — stored with your account; published content is shown publicly (with your display name if you provide one). Basis: contract, consent to publish.
• Notifications — e-mail, browser (web push) and phone push messages about prices or reminders when you turn them on; we store your e-mail and subscription / device tokens. Basis: consent.
• Subscription data — plan, status, period, Stripe / App Store / Google Play identifiers. We never see or store card details — Stripe, Apple or Google handle them. Basis: contract, legal obligation (accounting).
• Technical data — IP address, browser / device, language, error logs, abuse-prevention flags. Basis: legitimate interest — security and stability.
• Analytics — pages, clicks, errors and, with your consent, session recordings with typed text masked (see the Cookie policy). Basis: consent.
• Correspondence with us by e-mail. Basis: legitimate interest, contract.

We do not sell your data or use it for advertising profiling. We do not make decisions with legal effects on you solely by automated means.

3. Age

The service is for people aged 14 and over. If we learn that a younger person created an account, we will delete it.

4. Recipients (processors)

• Stripe (website payments; independent controller for fraud prevention and legal obligations), Apple and Google (in-app purchases, sign-in), Meta (Facebook sign-in), RevenueCat (in-app purchase validation).
• OpenAI — recognition of meal photos and text. Only the photo and the text you enter are sent, without your name, e-mail or other account data; under OpenAI's terms API data is not used to train its models.
• PostHog (EU data centre) — analytics and error monitoring.
• Google Firebase (FCM) and Apple (APNs) — phone push notifications; Telegram — only if you link the bot yourself.
• Hosting, e-mail delivery and other technical providers acting on our behalf under contract.

Some providers (Stripe, OpenAI, Apple, Google, Meta, RevenueCat) may process data outside the EU / EEA; in that case we rely on the European Commission's adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses. We may also disclose data to authorities where the law requires.

5. Retention

• Anonymous session — while you use the service (cookie up to 5 years from your last visit); unused sessions are cleaned up periodically.
• Account and its content — while the account is active or until you ask for deletion; after deletion data is removed within 30 days (except what we must keep by law).
• Payment and invoice records — as long as accounting and tax law require (up to 10 years).
• Technical logs — a few weeks.

6. Your rights (GDPR)

You have the right to access your data and get a copy, rectify, erase, restrict processing, data portability, object to processing based on legitimate interest, and withdraw consent at any time (this does not affect earlier processing). You can delete your account in the app or by writing to [email protected]; we act on requests within 30 days.

7. Complaints

If you believe your data is processed unlawfully, you may complain to the State Data Protection Inspectorate (Lithuania) or the supervisory authority in your country.

8. Changes

We will update this policy when processing changes; material changes will be announced here and/or by notice.

Related: Cookie policy, Terms of use. The Lithuanian version of this document is the legally binding one. This translation is provided for convenience.