Questions, answered

Yes. Sign in with a code sent to your email, with Google or with Apple: there is no invitation list and no queue. You do not have to bring anything: three recognitions a day — a photo of a meal or of a label, or a description in words — are free on the Snapfork key. Why you might still want your own key is the next answer.

Start for free

You do not have to. Recognition also works on the Snapfork key — free, 3 recognitions a day; a photo or a description in words then passes through our server and onward through OpenRouter to the model provider. Neither is stored here, and we tell OpenRouter not to route through providers that retain what is sent.

Your own API key from an AI provider (Google, OpenAI and others) removes both the limit and the middlemen: the photo or the description goes from your device straight to the provider whose key you entered, bypassing us. Nine providers are supported — from Google Gemini and OpenAI to Mistral and OpenRouter; the full list is in the privacy policy. The app starts on your key and moves to ours only after yours has failed; a checkbox in settings turns even that off.

This is about the Google key: on its free tier Google reserves the right to use what you send to improve its products; on the paid tier it does not. Other providers divide their tiers differently, and that is to be read at the source. The application works on either, and the choice is yours — but it is worth making deliberately, because it is about your photographs and the descriptions of your meals.

In your browser's storage on the device. An encrypted copy travels to our server as well — the key stays with you, so nothing there can open it. The “What happens to your diary” section of the privacy policy goes through this in full, including the uncomfortable half: clear that storage and the diary leaves the device together with its key, and only the diary key code you wrote down opens the encrypted copy again. Without a saved copy and without the code, the diary is gone for good.

Nothing, from the invitation alone: a friend sees your week only level by level, as you allow, and besides the week only what you send yourself — notes and food cards. The first level is whether you logged that day or not, and how many days in a row you have logged. The second, if you share it separately, is one more fact: whether you stayed within your own goal, a plain yes or no. Not what you ate, not how many calories, not your weight, at any level of sharing; and no rankings, leaderboards or comparisons, because other people's goals are not something to measure yourself against.

On your friend’s side our app shows them exactly as much about you as it shows you about them: your device shows a friend’s week only with mutual consent. We cannot read any of it: the contents travel encrypted with a key we do not have. But the server does see the connections and when you open the friends screen — what exactly, and why, is set out in the friends section of the privacy page, together with how to check us: thirty-two digits you and your friend read out to each other.

You can undo it any day, and there are two buttons: “stop sharing” keeps the friendship, “delete friendship” erases both the connection and what each of you saw of the other. “Block” does what “delete friendship” does and also stops the two of you from inviting each other again until you unblock.

With “Save a copy” in the settings, under “Backups and storage” → “Backup”. You get a file with your entries, weigh-ins, profile, goals and diary settings — and, while they still live on the device, the meal photo previews. Your friends’ weeks go in too — exactly what you saw of them. The key for your AI provider does not go into the file. The file is not encrypted: it is the only way to read the diary without the diary key code, so keep it somewhere that will outlive the phone, and remember that you are keeping data about your body and photos of your food there.

A saved copy is the only insurance against losing the database on the device: resetting site data, clearing history in Safari or running out of space wipes entries without warning. The app reminds you to save a copy once a month.

On another device, open the same file with “Restore a copy”: entries from the file are added or overwrite ones with the same id, and everything else stays. An overwrite cannot be undone. Without sync or without the shared friends key, friendships from the file have to be confirmed again. With sync switched on, the diary moves without a file — see the question about several devices.

Your diary travels to the server encrypted, and the key to it exists only on your devices. The diary key code is that key written out in letters and digits: it is how a second device opens the diary. You create it in the settings, under “Sync and devices”, on the “Diary key” card; until a key exists there is no sync, and the diary lives only on the device. The code never contains I, L, O or U, and case and separators do not matter.

The code stays visible on that card for as long as the device remembers the key, and you can copy it. If someone else may have seen the code, tap “Issue a new code”: the diary is re-encrypted and re-sent to the server, the old code stops working, and you enter the new one on your other devices. Sync all of them first — edits that have not left a device yet stay unreadable under the old code.

Lose the code together with the device and nobody can restore the diary — us included. So write the code down, keep it away from the phone, and save a copy to a file anyway. “Download server data” next to it serves another purpose: it gives you a file of what the server holds about you, with the diary encrypted with your key — only “Save a copy” gives you a copy you can read.

Yes. Sign in to the same account and, on the “Diary key” card, enter the code from a device that already has the diary: it is decrypted at the next sync. Settings travel separately and only if you switch on their sync; the theme, language, reminders, Apple Health and your own provider key stay per device.

If the same entry was edited on two devices, the later edit wins. The other one is not lost: it is kept for up to a month, no more than twenty per entry, and on the “Conflicting versions” card you can bring it back — it is then saved as your new edit and travels to your other devices.

The “Devices” card shows when each of them last came for the diary. Nothing but the time is there: a device is known by a random name it gives itself.

Friends come along with the code: every device that has it opens the same friends key and your permissions, and you don’t need to compare the digits again. If you added friends before turning on sync, the friends screen offers the move to the shared key; the friends key then changes, and your friends can compare the digits again. Once you have friends or an open invitation, the move is possible only right after signing in.

Settings → “Delete account”, with two taps: the second one confirms, and it cannot be undone. The server erases the account, every way to sign in and every session, the correspondence with the developer and everything it kept for sync: the encrypted copy of the diary, photo previews, the copy of your settings, conflicting versions and the list of devices, along with the friends key vault. For Sign in with Apple the grant is revoked as well.

One more thing is irreversible: money left on your recognition balance is lost, and we cannot refund it: if the balance matters to you, ask for a refund first and delete afterwards. You can come back with the same address, but the account is created anew — empty.

Deleting the account does not touch the diary on the device: the entries stay, and a separate “Delete all entries” button erases them. In the hourly backups of the server database what was erased stays for up to 14 days, and what was encrypted with your key stays encrypted there — see “Deletion” in the privacy policy.

Reading and editing the diary does. Recognising a new photograph or a description in words does not: that request leaves for the provider whose key you entered, or goes through our server if you entered none. You can always add a meal by hand.

You can, and nothing leaves the phone while you do. The product database is downloaded once and searched on the device, so neither the code nor what you eat is sent anywhere — the same promise the diary gets.

The data comes from Open Food Facts, an open database filled in by its own contributors. Plenty of packages are simply not in it: what you get is what people scan most often, and a shop shelf is wider than that. No match means photographing the label or typing the numbers, as before.

It is a part of the open Open Food Facts database: products by barcode, with calories and protein, fat and carbs, the Nutri-Score letter, the organic label and the list of additives. You download it in the settings, under “Products by barcode”, with “Download” — each country’s base has its own size — and from then on scanning and searching it work offline.

The database on the phone holds one country’s products (yours, if it has a base of its own; the settings say which) plus the world’s most scanned products — not everything on the shelf. The data is filled in by the project’s contributors, so it can be incomplete or wrong; the database is licensed under ODbL. Nothing found — take a photo or fill in the fields yourself; what the “Search Open Food Facts (online)” button sends, and where, is in the privacy policy.

The database does not update by itself: a new one arrives when you tap “Update” in the same section. The app downloads it whole and runs an integrity check; if it fails, the previous database stays in place. “Delete” removes the database from the device, and your diary entries stay.

It is worked out on the device from the same downloaded product database: nothing goes to the network for it. Three parts add up — the ready Nutri-Score letter, the risk level of the additives from our own list, and the organic mark; every risk level on that list names its sources, which is a condition rather than a decoration: we will not speak about risk without one.

It goes wrong wherever the database itself does. Open Food Facts is filled in by its own contributors, and for a share of the products there is no letter or no parsed composition at all — then there is no number, and we say so instead of inventing one. Russian products carry the letter markedly less often than European ones. And above all: the score judges the product on the shelf, not you and not what you ate. It is neither a diagnosis nor a ban, only a reason to turn the pack over.

The profile has a “What you do not eat” list: meat, fish and seafood, dairy, eggs, nuts, gluten. Your diary still takes any food — the list removes these groups from what the app suggests to you.

The day hint about missing protein names protein sources without the groups on your list; if none is left, it only says how much you are short. The recognised meal warns you when the photo or description shows something from the list.

The comparison happens on the device, and the list itself goes nowhere: it is never sent for recognition. Along with the rest of the profile it goes into the backup file, and with settings sync on it is stored encrypted on the server.

The Prevention section is a reference to published recommendations on preventive check-ups for adults without symptoms: a short summary with sources, selected by age, sex, country of care, answers about smoking, pregnancy plans and the organs a check applies to, and the foods you avoid. Not a diagnosis and not a prescription. It summarises recommendations of public health bodies and professional medical societies; each topic names its source, the source's country and its date. The section does not ask for your weight, BMI or diagnoses and does not use them for the list.

Recommendations differ between countries, and that is not an error in the list: organisations weigh the benefit and harm of a check differently and revise their advice in different years. The section counts a date only by the programme of the country where you get care; if that programme differs from another, the item says so and shows both sources, and if your country has no programme on the topic, another one is shown for reference, without a date. The application will not choose between programmes for you — that is a conversation with a doctor.

That is also why the list has no “just in case” tests for everyone — vitamin D, for example: no benefit has been shown from testing it in adults without symptoms. If you have symptoms, do not wait for a scheduled check — see a doctor now. The limits of the section are set out in the terms of use.

On your device. In the iPhone application (it is not in the App Store yet) they are also encrypted with a key that exists only on that phone, so an iCloud backup holds them only encrypted, with nothing there to open them. They go to the server only encrypted, and only if you turn on their sync yourself: it has its own switch and its own consent, it is off by default, and it works only together with settings sync. If you get care in Russia, the answers do not go to the server at all.

They never go to the language model, to friends or into support messages, and they get into a backup file only with a separate checkbox. What “Hide the section”, “Delete answers on this device” and turning sync off each do is explained in the privacy policy section on health answers.

No. The texts of the Prevention section have not been reviewed by a doctor. They are a short summary of published recommendations, written with the help of AI and checked against the sources using a checklist; which edition and when is stated next to each source. They may simplify or contain errors, and a source may have been updated after the check.

Make decisions about check-ups with a doctor. If you find a discrepancy with a source, write to us from the application: if the source confirms it, we correct the section and note it in the check log.

Accurate about what is on the plate, approximate about how much of it there is. The section on portion weight explains why that second part cannot be fixed by a better model, and what you are expected to correct. The daily target and the macros are a separate matter: where every number came from, including the ones with nothing behind them but a decision of ours.

Send the six-digit sign-in code to it, and nothing else: no newsletter, no announcements, nothing to unsubscribe from. The address itself is not kept — the server stores a fingerprint of it, which is enough to recognise you at the next sign-in and useless for writing to you.

To hello@snapfork.app. It is the same person who answers inside the app, where there is a “Support” section in settings. But if signing in fails, that section is out of reach, and the address is the only way left. Describe what exactly happens: without that, a broken sign-in looks the same as an address that is not on the list.

Not yet. The iPhone application is being prepared for the App Store; there is none on Google Play. For now Snapfork is a web application: it opens in the browser and can be added to the home screen like any other app.

• iPhone and iPad (Safari): open snapfork.app, tap “Share” (if you don’t see it, tap “⋯” first), scroll down and choose “Add to Home Screen”, then “Add”.
• Android (Chrome): open snapfork.app, tap the ⋮ menu to the right of the address bar, choose “Install and create shortcut”, then “Install”.

The Snapfork icon appears next to your other apps and opens without the address bar.