LeanPick ("LeanPick," "we," "us") is a mobile app published by KellyBot LLC, a Utah limited liability company doing business as Kelly Claude AI, that helps you tell, in plain language, which dishes on a menu fit how you eat. This policy describes, plainly and completely, what data LeanPick collects, why, and how it is handled. It describes only the actual behavior of the shipped app; it is not a generic template.
LeanPick has no account, no sign-in, and no user profile stored on a server tied to your identity. The only data the app collects is the following:
| What | What it is | Why we collect it |
|---|---|---|
| Menu text | When you scan a menu (photo, multiple photos, a delivery-app link, or typed text), the app extracts the menu's text on your device and sends that extracted text (never the photo itself) to our server so it can generate your picks and reasons. | App functionality: this text is the input our inference service needs to tell you which dishes fit your preferences. The same request carries the install and anonymous subscriber identifiers described below, so Apple treats the menu text as linked data even though LeanPick has no named account. |
| Allergies and eating preferences | The allergies, foods to skip, goals, strictness, and dining context you enter are sent with the extracted menu text. Allergy information is Health data under Apple's App Privacy categories. The request also carries the install and anonymous subscriber identifiers described below. | App functionality: applying your stated preferences and producing allergy-specific warnings and questions. LeanPick does not use this information for advertising or tracking. |
Install identifier (install_id) |
An identifier generated by the app, seeded from your device's per-vendor identifier
(identifierForVendor, "IDFV," supplied by iOS) when available, or a random identifier
generated by the app when IDFV is unavailable. It is stored in the device Keychain so it survives a
reinstall (this persistence is intentional, so fair-use limits cannot be reset by reinstalling). |
App functionality: it lets our server meter how many free scans a given install has used and enforce fair-use limits on paid usage. LeanPick's server does not use it for advertising. When the identifier is seeded from IDFV, the TikTok SDK can independently read that same Apple-provided IDFV after you allow tracking, as described below. |
| App usage events | Standard product-analytics events (such as app open, onboarding step completed, paywall shown, subscription started) from a fixed, published list. Each event carries only simple values such as a screen name, a count, a duration, or a true/false flag, and an app-generated random installation ID. It never carries your name, your email, your location, your menu photos, or your menu text. These events are recorded to a log on your device and sent to Google Firebase Analytics, which processes them on our behalf. Firebase also generates and sends its own app-instance identifier (a "Firebase installation ID") and standard device and app context, such as device model, operating-system version, app version, language and coarse country, to attribute those events. That identifier is generated by the SDK, is specific to this installation of LeanPick, and is not the Advertising Identifier (IDFA). | Analytics and app functionality: understanding which parts of LeanPick people actually use, so we can improve them. |
| Crash and performance diagnostics | If LeanPick crashes, a crash report is sent to Google Firebase Crashlytics. That report contains the app's stack trace at the moment it failed, the device model, the operating-system version, the app version, whether the device was jailbroken, and a Crashlytics-generated installation UUID. It also contains a short breadcrumb trail carrying only the NAMES of the analytics events listed above, never their values. Basic timing information, such as how long a scan took, rides on the analytics events above. | App functionality: finding and fixing crashes and slow paths. |
| Advertising measurement data (TikTok Events SDK) | Standard app-event signals (such as app install, session start, tutorial completion, content view, and subscribe) and basic device signals. If you allow tracking through Apple's prompt, these include Apple's per-vendor device identifier (IDFV) and may include your device's Advertising Identifier (IDFA). These are sent to TikTok's Events SDK, which we use to measure how our TikTok advertising performs. | Advertising measurement: understanding whether a TikTok ad campaign led to an install and a later meaningful action, so we can measure and improve our ad spend. LeanPick explains this choice immediately before Apple's App Tracking Transparency (ATT) prompt. The TikTok SDK is not started and no event is sent to TikTok unless you allow tracking. You can change that choice later in iOS Settings under Privacy & Security, then Tracking. |
| Subscription and purchase records | When you subscribe, renew, cancel, or receive a refund, a record of that transaction is processed by RevenueCat, which we use to manage subscriptions. RevenueCat receives the StoreKit transaction identifiers and product identifiers Apple issues, the resulting entitlement status and its dates, and basic device and app context (device model, operating-system version, app version, country). It identifies you by its own anonymous app user ID, which it generates itself; we never give it your name, your email, or the analytics installation ID above. It never receives your menu text or your payment credentials. LeanPick also asks Apple's AdServices framework for an Apple Ads attribution token and sends that token to RevenueCat under the same anonymous app user ID, so RevenueCat can associate an Apple Ads campaign with installation and subscription outcomes. | App functionality and our advertising measurement: managing your subscription, keeping your access accurate, and measuring Apple Ads campaigns. This Apple-provided attribution path does not use IDFA or require ATT and is not used to track you across other companies' apps or websites. |
| Subscription / entitlement status | Whether your Apple Account currently holds an active LeanPick Plus subscription, as reported by StoreKit. | App functionality: unlocking the features your subscription pays for. |
Apple's App Privacy label treats data as linked when it is associated with a device or other persistent identifier, even when LeanPick does not know the person's name or email. LeanPick therefore declares menu and preference content, allergy information, device identifiers, product interactions, Apple Ads attribution, and purchase history as linked data.
We do not collect: your name, email address, phone number, physical address, clinical records or HealthKit data, location, contacts, browsing history, or photos themselves. We do collect the allergy information you choose to enter, as described above. Only extracted menu text, not the photo you take or select, leaves your device.
If you use the camera-scan feature, LeanPick asks for camera access to photograph a menu. The photo is processed on your device to extract the menu's text; the photo itself never leaves your device. If you use the multi-image or "add from library" road, the system's standard photo picker is used, which does not require LeanPick to request photo-library permission and does not let the app see or enumerate your photo library. If you save a "My Pick" share card, it is written to LeanPick's own storage area on your device (visible in the Files app), not to your system Photos library, so no photo-library-write permission is used or requested.
To turn a menu into plain-language picks, the extracted menu text and your stated eating preferences, including any allergies you enter, are sent over an encrypted connection to a server-side function we operate on Supabase (our backend and database provider). The same request carries LeanPick's persistent install identifier and RevenueCat's anonymous app user ID, plus a signed Apple transaction when one is available. Supabase routes the menu and preference text through OpenRouter to an allowed third-party AI model to generate the assessment. The menu text and health information you submit are not used to build an advertising profile, sold, or shared with data brokers.
Our application database does not store the raw request body as a menu record. It does store the generated assessment in a content-addressed response cache. The cache key is derived from the menu and preference inputs rather than the install or subscriber identifier, but the generated assessment can repeat or summarize menu and allergy terms. The inspected cache has no automatic expiration time.
LeanPick offers an optional auto-renewing subscription, "LeanPick Plus," billed by Apple through your Apple Account. Apple processes all payment details; LeanPick and its developer never see your card number, billing address, or other payment credentials. We only receive confirmation of your subscription's entitlement status (active/inactive) from Apple's StoreKit framework. See our Terms of Use for full subscription terms.
We do not sell your data, and we do not share it with data brokers. We share data only with the service providers that operate LeanPick on our behalf, including the advertising-measurement processor listed below, each acting as a processor for the purpose described:
LeanPick uses Apple's own on-device SKAdNetwork and AdAttributionKit frameworks so that, if you installed LeanPick from a paid advertising campaign, the ad network that ran it can learn, in aggregate, that its campaign led to installs and coarse, delayed conversion milestones (such as reaching your first result or starting a subscription). This runs entirely on your device under Apple's design: it reports only a coarse, delayed, install-level signal, never anything tied to you as an individual. This native aggregate path operates whether or not you allow tracking.
LeanPick also uses the TikTok Events SDK described above to measure TikTok advertising performance. This path is different from native SKAdNetwork: LeanPick first shows a plain-language explanation, then asks through Apple's ATT framework. The TikTok SDK is constructed and may receive the limited events described above only if you allow tracking. If you decline or tracking is restricted, pre-decision TikTok events are deleted from the device and never sent. LeanPick does not sell your data.
LeanPick has no user account, so there is no account to delete. Our application database does not store the raw menu, preference, or allergy request body as a menu record. It does retain generated assessments in a content-addressed Supabase response cache, and an assessment can repeat or summarize menu and allergy terms. The inspected cache has no automatic expiration time. Supabase may also retain operational request metadata under its service settings. Your install identifier is stored in your device's Keychain and, by design, persists even if you delete and reinstall the app: this is intentional, so that fair-use limits on paid usage cannot be reset simply by reinstalling. It is not tied to your name or any account and is used only for metering. It is a device-local anonymous identifier, stored only in this device's Keychain and never synced to iCloud or shared across your devices. Because it is anonymous and used only for fair-use metering, it persists on this device and is cleared when you erase the device. Your saved preferences and results, and the local copy of your analytics events, are held only on your device and are removed when you delete the app.
Data held by our processors is retained as follows. None of it is tied to your name or to any account, because LeanPick has no accounts:
| Processor | What it holds | How long |
|---|---|---|
| Google Firebase Analytics | Product-analytics events and the SDK's installation identifier | Event-level records expire on Google's shortest available user-data retention setting, 2 months; aggregate, non-identifying reporting totals may persist longer |
| Google Firebase Crashlytics | Crash reports and their breadcrumb trails | Google deletes crash reports 90 days after they are received |
| RevenueCat | Subscription transaction and entitlement records, its anonymous app user ID, and Apple Ads attribution derived from the AdServices token | Kept under RevenueCat's processor terms to maintain entitlements, refunds, and attribution, and deleted on our request |
| Supabase (our edge function and database) | Menu, preference, and allergy text during request processing; generated assessments in the response cache; fair-use metering counts keyed to the install identifier; and operational request metadata | The application cache has no automatic expiration time in the current implementation. Metering records and Supabase operational metadata are retained under our service configuration and Supabase's applicable terms. |
| OpenRouter and the AI model provider | The menu text and stated preferences and allergies sent for assessment | Under the retention terms of the route and underlying provider used for the request. We request that providers not use the content for data collection or training, but the underlying provider's retention policy still applies. We do not include the install identifier, RevenueCat app user ID, or Apple transaction in the model prompt. |
| Apple | Payment and subscription records | Under Apple's own policy; we never receive or store payment details |
| TikTok (Events SDK) | After ATT authorization only: the limited attribution events, subscribe value and currency, device signals, and advertising identifiers used to measure ad performance | Under TikTok's own retention terms for advertising measurement data |
If you want records associated with your installation deleted, email support@kellyclaudeai.com. We will explain what installation information is needed to locate the applicable anonymous records and request deletion from the processors above where available. Deleting and reinstalling LeanPick does not reset the metering identifier because it intentionally persists in this device's Keychain.
LeanPick is rated 4+ and is not directed at children. We do not knowingly collect data from children in a manner different from any other user, and the app collects no information that identifies any user, child or adult, by name.
LeanPick is offered in the United States storefront only in this version, and this policy is written for that scope. If LeanPick expands to additional regions, this policy will be updated before that expansion ships.
If LeanPick's data practices change, for example, adding a user account or a new data-processing partner, we will update this policy before that change ships in the app.
LeanPick is published by KellyBot LLC, a limited liability company organized in the State of Utah, United States, doing business as Kelly Claude AI. KellyBot LLC is the party responsible for the data described here. LeanPick is offered on the United States App Store storefront only, and this policy is written under, and governed by, the laws of the State of Utah and the United States, without regard to conflict-of-laws rules. Questions, requests, and deletion requests can be sent to support@kellyclaudeai.com, and we answer them ourselves; there is no third-party support desk that receives your message.