Privacy policy
This policy explains how the Cornerstone mobile app, cloud-sync service, and companion API handle information. Levelmark Studios LLC is the operator and data controller for Cornerstone. Cornerstone has no advertising network, paid data broker, or third-party behavioral analytics SDK.
Subscriptions and first-party promotions
Apple processes iOS subscription payments. RevenueCat verifies purchase and subscription status using your Cornerstone account UUID, product and transaction identifiers, purchase dates, renewal status, and sandbox status. Cornerstone does not receive your payment-card details and does not send diary content, health records, photos, or your email to RevenueCat as subscriber attributes. RevenueCat's native SDK also processes technical app/device information needed to operate purchases. See RevenueCat's privacy policy.
Our service stores your current verified entitlement while your account exists. Completed webhook identifiers are retained for 30 days for deduplication; raw payment receipts and webhook bodies are not stored in our database. Pending processing and deletion jobs remain until completed. Account deletion removes the entitlement and queues deletion of the RevenueCat customer record; Apple may retain transaction records under its own policies. Deleting your account does not cancel an Apple subscription.
Cornerstone displays its own optional Premium suggestions. A device-local account-specific timestamp limits their frequency; dismissing a suggestion hides it for seven days. These suggestions do not use health data for targeting and do not involve an advertising network.
Your account and local-first data
Cornerstone requires an account created with Sign in with Apple or Google. The sign-in provider gives Cornerstone a stable account identifier and, depending on your provider choices, an email address and display name. Cornerstone does not receive your Apple or Google password. After your first successful sign-in, Cornerstone remains usable offline with a cached session.
The following information is stored in the app's private storage:
- your display name, preferences, equipment, goals, and app settings;
- nutrition logs, foods, recipes, meal plans, grocery lists, and household display names;
- dietary patterns, allergies, avoided foods, dislikes, calorie and macro targets;
- workout plans, exercise history, notes, timers, and training progress; and
- timestamped body weight and measurements, their source or device label, progress notes, and progress or recipe photos you choose; and
- Apple Health connection settings, sync cursors, Cornerstone write receipts, and the limited Health summaries you choose to read.
Native structured data is stored in SQLite or compatible local storage. Photos are copied into the app's private document directory. Account credentials are stored using the operating system's secure credential storage. After account setup, approved profile, nutrition, recipe, planning, training, body, and preference records are queued and synchronized on launch, foregrounding, network recovery, and manual retry. Progress and recipe photos are stored in a private cloud bucket; temporary AI meal photos and scale-import source files are not added to that library. Apple Health connection settings, permission choices, sync cursors, and write receipts stay device-local. Health-derived Cornerstone body records join the cloud library only after the separate opt-in described below.
Cloud sync and security model
Cornerstone syncs versioned collection records, device-generated mutation identifiers, synchronization status, and the progress or recipe media you save. If both a device and cloud library for the same account already contain data during initial setup or a signed-in user restores a complete library, Cornerstone requires an explicit whole-library replacement. Before every replacement it makes a new owner-bound, media-complete local safety backup of the library being displaced; it does not silently merge the libraries. After the revision-checked cloud replacement begins, media from the superseded cloud library can be reclaimed immediately to make room for the complete replacement upload. The safety backup is the recovery point and remains only on that device. All restore points stay on that device until you use Remove Cornerstone data from this device. Records and restore points already owned by another account stay hidden until you sign back into that account or erase them from the device. Per-record prior versions can be retained for up to 30 days to recover from synchronization conflicts.
Cornerstone uses HTTPS in transit, provider-managed encryption at rest, private storage buckets, database row-level security, and least-privilege service credentials. This is managed encryption, not end-to-end encryption: the operator and contracted infrastructure providers can technically access cloud content when necessary to operate, secure, support, or comply with law. Administrative access is restricted and should be audited.
When information leaves your device
Information leaves your device for account authentication and cloud sync, and when you deliberately use food search or barcode lookup, an AI meal-photo estimate, online recipe import or revision, AI meal planning, AI training-plan drafting, or screenshot/PDF scale import. An authenticated client can also request deterministic phase planning or weekly review from the companion service. The services receive an account credential, app version and platform, and standard network data such as IP address and request headers. CSV scale exports are parsed on your device and are not uploaded by that import feature.
- Authentication and sync: Supabase processes your Apple or Google account identifier, session, synchronized Cornerstone collection records, conflict history, and saved progress or recipe media. Apple or Google processes the sign-in request under the choices and policies of that provider.
- Food lookup: a food-search phrase is sent to USDA FoodData Central when configured, or to Open Food Facts as a fallback. A scanned barcode is checked with USDA when configured and can also be sent to Open Food Facts. These providers receive the query, product identifier, or barcode from Cornerstone's server, not your Cornerstone account ID.
- Smart food photo analysis: only after your versioned opt-in, up to two selected photos and optional context can be sent through the companion service to OpenAI to read a package or Nutrition Facts label or estimate one meal. A second photo can show another angle, a receipt, or ingredients. Crop out names, payment details, and unrelated receipt items before uploading. The approval is saved with your synchronized preferences; you can withdraw it at any time in Preferences. Cornerstone disables provider response storage, does not intentionally retain uploaded photos or receipt contents, and requires review before saving nutrition. The diary keeps reviewed nutrition and estimate metadata, not the photos. OpenAI processing retention is described below.
- Recipe tools: the service can process a public recipe URL and page text, a description, an existing recipe plus your correction, or a recipe/dish image and notes you choose to upload. When an entitled user explicitly chooses Estimate with AI, the recipe title, saved yield, ingredient names and amounts, and directions are sent to OpenAI for one structured whole-recipe nutrition estimate and a suggested serving count when needed. Cornerstone checks that every included ingredient received a plausible result, shows the estimate for review, and does not save an incomplete estimate.
- Meal planning: the service can process anonymous household role IDs, nutrition targets, dietary pattern, allergies, avoids, dislikes, meal attendance, schedule exceptions, cuisine preferences, and the relevant parts of your saved recipe library. Household and profile display names are not included.
- Training-plan drafting: the service can process your selected phase type and name, training goal and experience, plan length, training days and session length, available equipment, focus areas, limitations and comments, and the IDs of favorite or avoided exercises. It also receives the names, muscles, equipment, movement categories, and tracking modes for the candidate exercise catalog. When you request a revision, the current draft and your revision instruction are included. You review the draft before it replaces your training plan.
- Phase planning and weekly review: Cornerstone calculates calorie and macro targets with a fixed, versioned rules engine on your device. Authenticated companion endpoints can perform the same deterministic calculation using the profile, goal, completed food-log summaries, training aggregates, check-ins, and body trends supplied in a request. They do not request an OpenAI explanation. Apple Health-derived summaries are included only when you separately opt in.
- Scale screenshot and PDF import: only after you consent, the service can process the scale screenshots, display photos, PDF report, and optional context you select. Cornerstone requests structured measurements, disables provider response storage, does not intentionally retain the uploaded file, and requires you to review selected values before saving them locally.
- Direct sharing: exports use your device's share sheet, and Cornerstone does not receive the destination. A hosted recipe or grocery link creates a separate, minimized public snapshot only after you choose to share it. Anyone who has the long, unlisted link can read that snapshot without signing in. Shared recipes exclude private notes, collections, planning metadata, internal identifiers, and private media paths. Shared grocery recipients can check or uncheck the listed items; those item-state changes are returned to your signed-in app through a constrained event channel and can then join your normal private sync. Recipients cannot add, rename, reorder, or delete your items. You can review and revoke active links in Cornerstone. Exports remain readable JSON, not encrypted archives, so protect them after sharing.
Apple Health
On a compatible iPhone development or store build, Cornerstone can access Apple Health only after you choose to connect and respond to Apple's permission sheet. Read and write categories are separately controlled in Cornerstone. Cornerstone uses selected Health data to show and import body measurements, workout summaries, and nutrition summaries, and can add selected Cornerstone records that are missing from Apple Health.
Apple Health-derived records stay on the device by default. A separate Sync imported Health records control explains the selected data categories before any Health-derived Cornerstone records are uploaded. Separate consent is required before Health summaries contribute to phase planning or weekly review. Cornerstone does not upload raw HealthKit samples, use Health data for advertising or data mining, or use it for eligibility decisions. Turning off Health cloud sync atomically removes Health-derived fields from the active cloud library and stops future uploads while retaining the local copy you control. Prior conflict-recovery versions that already contained those fields can remain until they expire under the bounded history policy.
Apple controls the authoritative Health record, permission status, device sync, and any iCloud Health copy. Disconnecting Health in Cornerstone stops future imports and removes Cornerstone's locally cached Health summaries and cursors; it does not delete records already stored by Apple Health. Deleting a Health-sourced record inside Cornerstone removes Cornerstone's copy. Cornerstone only attempts to delete Apple Health samples that Cornerstone itself wrote.
Service providers
- Supabase provides account authentication, Postgres cloud storage, and private media storage. Database row-level security and private-bucket policies limit each signed-in user to that user's records. See Supabase's privacy policy.
- Apple and Google provide account sign-in and recovery. Cornerstone receives the account information each provider releases according to your provider settings. See Apple's privacy policy and Google's privacy policy.
- Render hosts Cornerstone's companion API and its private, short-lived security-counter and public food-response cache stores. Uploaded request bodies, images, and PDFs are processed in memory and are not intentionally persisted by the companion API. See Render's privacy policy.
- Cloudflare provides Cornerstone's DNS and edge network. It also hosts Cornerstone's lightweight public sharing pages and the optimized public copies of recipe photos you explicitly share. Cloudflare necessarily processes public-share content, checkbox requests, and standard network metadata. See Cloudflare's privacy policy.
- OpenAI processes recipe, meal-planning, training-plan, user-authorized meal-photo, and scale screenshot/PDF inputs to return structured suggestions, nutrition estimates, or extracted measurements. Cornerstone sends a one-way pseudonymous safety identifier rather than your Supabase account ID and sets
store: false, so responses are not saved as retrievable application state. OpenAI does not use API content to train its models by default, but its standard abuse-monitoring logs may contain request content and are generally retained for up to 30 days unless a different approved retention control applies. See OpenAI API data controls. - Sentry may receive production error and release-health diagnostics only when a release has Sentry configured. Events can include an exception and stack trace, app version, operating-system/device context, and a generated request ID. Cornerstone disables tracing and replay and removes user identity, request data, extra context, and content-bearing breadcrumbs before sending. See Sentry's privacy policy.
- USDA FoodData Central returns public food and nutrient records. Cornerstone identifies USDA as the data source and does not send USDA your local diary or profile.
- Open Food Facts returns community-maintained product and nutrient records for food search and barcode lookup. Cornerstone identifies Open Food Facts as the data source and does not send it your diary, profile, or Cornerstone account ID.
Cornerstone does not sell personal information, share it for cross-context behavioral advertising, use it to determine eligibility for employment, credit, insurance, or housing, or send advertising identifiers to these providers.
Purpose and legal basis
Cornerstone uses account, local, and synchronized data to provide cross-device logging, planning, training, body-data, and media features. Online request data is processed to authenticate you, synchronize your library, perform the feature you initiate, secure the services, prevent abuse, and diagnose failures. Depending on applicable law, these activities rely on providing the requested service, Cornerstone's legitimate interest in operating it safely, or your consent. Saving or importing a recipe without nutrition does not start an estimate. An entitled user can explicitly request one OpenAI estimate for a recipe and must review it before saving. You control other optional AI and import features and whether to grant camera, photo-library, sharing, notification, and Apple Health permissions. Health cloud sync requires a separate opt-in.
Diet, allergy, body measurement, and exercise information may be considered sensitive or health-related information. Cornerstone uses it only for the user-facing features described here. An adult entering information about another household member must have permission to do so.
Retention and deletion
| Record | Cornerstone retention |
|---|---|
| Local app records, photos, and safety backups | Deleting an entry removes it from the active library. An unreferenced photo directly inside Cornerstone's app-owned media folders becomes eligible for reference-checked cleanup after at least 24 hours on a later successful sync; until that runs, it can remain until local-data removal. Every owner-bound whole-library safety backup, including its copied media, remains outside that cleanup and can persist until you use Remove Cornerstone data from this device, uninstall the app, or the operating system removes app storage. Device or cloud backups controlled by Apple, Google, or you can retain a separate copy under their settings. |
| Account and synchronized records or media | Deleting an item removes its active collection reference. Conflict-recovery versions can be retained for up to 30 days. Ordinarily, an unreferenced private media object receives a 24-hour race-safety grace, is rechecked and claimed against the canonical library, and is deleted on a later successful foreground or manual sync; until cleanup runs, it can remain until account deletion. A failed upload that was never referenced by the canonical library can be reclaimed sooner by a locked capacity reservation, but only when it is neither canonical nor part of the device's pending target set. During an explicit whole-library replacement, superseded cloud media can instead be claimed immediately after the photo-complete local safety backup and revision-checked epoch change, so the replacement can upload within the account limit. Provider backups can retain encrypted residual copies for a limited disaster-recovery period before routine overwrite. |
| Hosted recipe and grocery shares | Recipe snapshots remain available until you revoke the link, delete your account, or Cornerstone retires the sharing service. Live grocery links expire after 30 days without owner or recipient activity. Revocation or expiry blocks the public link immediately; after a seven-day recovery window, the hosted snapshot record and any optimized public recipe-photo copy are deleted during the next scheduled cleanup. Grocery checkbox events remain only as long as needed to reconcile the shared list and diagnose bounded synchronization failures. |
| Apple Health-derived Cornerstone records | Local by default. When Health cloud sync is enabled, synchronized copies follow the cloud retention above. Turning the control off immediately scrubs Health-derived fields from the active cloud library while leaving your local Cornerstone and Apple Health records under your control; prior conflict-recovery versions can remain until their bounded expiry. |
| Account session | Refreshed while the account remains signed in. Signing out removes the device session; deleting the account removes the Cornerstone authentication identity. Apple or Google can retain their own sign-in records under their policies. |
| Companion request bodies and uploaded images/PDFs | Used in memory to complete the request and not intentionally persisted in Cornerstone's database or application logs. OpenAI's separate processing retention is described below. |
| Food lookup cache | Public food-provider search and detail responses are cached for 6 hours by default. A successful barcode result can be cached for up to 7 days, while a missing barcode result is cached for 30 minutes. Cache keys use a one-way hash rather than the raw search phrase, provider identifier, or barcode. |
| Security and abuse-prevention counters | AI burst counters expire after one minute and concurrent-request leases within five minutes. Food lookup and upload protections generally expire within one hour; legacy installation-registration counters expire within 24 hours. These are short-term safeguards, not monthly AI credits. Account IDs are one-way hashed before use as quota keys. |
| Operational logs | Cornerstone application logs contain request ID, route path without query string, method, status, and duration, but no request body. Hosting infrastructure can also process standard network metadata. Operational logs are retained no longer than 30 days. |
| Sentry diagnostics, if enabled | No longer than 30 days under Cornerstone's release policy, unless a shorter project setting applies. |
| OpenAI processing | Cornerstone does not create retrievable response state. OpenAI's default API abuse-monitoring retention can be up to 30 days and can be longer when legally required, as described in its API data-controls documentation. |
| Support reports | GitHub issues are public and remain until edited or deleted under GitHub's controls. Do not put health data, private images, credentials, or other sensitive information in an issue. |
Account deletion removes active synchronized database records, private Cornerstone media, and the Cornerstone authentication identity. A verified privacy or support request will be addressed within 30 days unless law requires a different period. Data already sent to a processor may remain until that processor's stated retention period expires. Cornerstone cannot delete copies you exported, shared, stored in a device backup, or separately added to Apple Health.
Your controls and rights
- View, correct, or delete individual entries inside Cornerstone.
- Export a structured copy from Preferences → Export or restore Cornerstone data.
- Delete your account and its synchronized records and media from Preferences → Account and cloud sync → Delete account and cloud data. If you cannot use the app, begin a verified request at the account-deletion page.
- Use Remove Cornerstone data from this device to sign out and erase the local library, copied media, safety backups, sync state, and credentials together. Erasing one device does not delete the cloud account.
- Revoke camera, photo-library, or notification permissions in operating-system settings.
- Change Apple Health read/write choices, disable Health cloud sync, disconnect inside Cornerstone, or revoke Cornerstone's Health access in iOS Settings or the Health app. These controls do not erase records already stored by Apple.
- Turn off Smart food photo analysis in Preferences to withdraw that approval immediately. Barcode lookup, food search, and manual food entry remain available. Recipe nutrition is gathered only when you press the recipe's explicit action; deleting that recipe also deletes its saved estimate. You can stop other optional AI processing by not invoking recipe nutrition, planning, recipe-generation/revision, or screenshot/PDF scale-import features. CSV body-data import remains local.
Applicable law may also provide rights to access, correct, delete, restrict, object, or obtain a portable copy of personal information. Contact [email protected] from the email associated with your Apple or Google sign-in. Do not send health records, photos, exports, credentials, or passwords by email.
Security
Cornerstone uses operating-system private storage, secure credential storage, HTTPS, short-lived account credentials verified against Supabase signing keys, private storage, row-level security, request-size limits, restricted public-URL fetching, rate limits, and server-side provider keys. Request bodies are excluded from application logs. Managed encryption does not prevent authorized operational access, and no security measure is perfect. An exported JSON file is only as secure as the location you choose for it.
Adults, household information, and health safety
Cornerstone is intended for adults and is not directed to children. Do not let a child operate the app or submit a child's information directly. An adult can plan household meals only when authorized to enter the other person's dietary needs. Cornerstone is an organizational tool, not a medical device, clinician, or emergency service. Nutrition, calorie, exercise, AI, scale-import, body-composition, and allergen outputs can be incomplete or wrong. Bio-impedance scale estimates vary with hydration and other conditions; use trends cautiously, verify imported values, and consult a qualified professional.
International processing and changes
The included companion-service configuration uses infrastructure in the United States. Providers can process information in the United States and other locations described in their policies. Local law may provide safeguards for international transfers.
Material changes will be reflected by updating the effective date and the policy served with the companion service. Continued use after a change is subject to the revised policy where permitted by law.
Contact
Email [email protected] for support or [email protected] for privacy and deletion requests. The public issue tracker is available for non-sensitive bug reports only.