Last updated 12 October 2026
Pinch is a medication and body-metric tracker. Everything you log stays on your phone. There is no account to create, no server of ours holding your health data, and nothing for us to read — by design, not by promise. The one exception is a meal photo you choose to have analysed, described below: it is processed and discarded, never kept.
All of your entries — medications, doses, injection sites, weights, symptoms, supplements, water, and food logs — are written to a database inside the app's own storage on your device. They are not uploaded anywhere.
Your weight and height are additionally encrypted on the device with AES-256-GCM before being written to that database. The encryption key is generated on your phone, stored in the iOS Keychain, and never leaves it. It is marked as device-only, so it is deliberately not carried to a new phone by an iCloud backup. That means a restored backup can show you the rest of your history but cannot open weights and heights recorded on the old device; the app tells you when this has happened instead of silently showing blanks.
| When | What is sent | To whom |
|---|---|---|
| You search for a food | The search text or barcode you typed. No identifier, no account, nothing about your health history. | Open Food Facts, an open food database |
| You choose to log a meal from a photo | That one photo, reduced in size, together with the anonymous app-install identifier (used only to count how many free analyses you have left) and your app language. Our server passes the photo to Anthropic to estimate its calories and returns the estimate. Neither we nor our server store the photo, and it is not linked to your name or any account. The photo screen says so before you take or pick a photo, and only photos you choose are sent. | Our server on Cloudflare, and Anthropic, whose Claude model does the analysis. Anthropic does not use API inputs to train its models. |
| You open the subscription screen, subscribe, or restore a purchase | An anonymous app-install identifier and your subscription status. Apple, not us, processes the payment; we never see card details. | RevenueCat, our subscription infrastructure provider, and Apple |
That is the complete list. Pinch contains no analytics SDK, no advertising SDK, no crash reporter, and no social login. We do not build a profile of you, and we have nothing to sell to anyone.
Dose and supplement reminders are scheduled locally by iOS. They are not push notifications and do not involve a server. If you deny notification permission the rest of the app still works.
Discreet Mode can hide your numbers behind Face ID or Touch ID. iOS performs the check and tells the app only whether it succeeded; Pinch never receives your biometric data.
Settings → Your data → Delete everything erases every entry on the device and cancels scheduled reminders. Deleting the app removes its storage as well. Because we hold no copy, there is nothing left for us to delete on your behalf.
Pinch is not directed at children and is not intended for anyone under 18. We do not knowingly collect data from children.
Rights of access, correction, portability, and erasure under the GDPR, UK GDPR, and CCPA apply to data a company holds about you. We hold none: your records live on your own device, under your control, and we sell no personal information. If you subscribe, the purchase record held by Apple and RevenueCat is governed by their policies, linked above. Write to us at any time if you want help exercising a right.
If this policy changes materially, the updated version will be posted here with a new date before the change takes effect in the app.
Questions about privacy: support@opsenter.com.
Pinch is not a medical device. It records what you tell it and does not diagnose, treat, or recommend a dose. Always follow your prescriber's instructions.