What is collected, and by whom.

Short version: this website collects nothing, because there is nothing on it to fill in. The app keeps your data on your phone, and three of the things you can ask it to do send something out. What each of them sends is written out below.

Last updated 3 September 2026.

This website

There is no analytics script, no tag manager, no cookie banner, and no cookie to put behind one. There is no form either — no address to leave, no list to join, nothing that asks you for anything. The page sets nothing in your browser and does not attempt to identify you.

Every asset — the typefaces, the images, the stylesheet — is served from this domain. There is no font CDN and no embedded media, so loading a page here does not tell any third party that you did. That is a deliberate position rather than an accident of simplicity: a site whose argument is that figures should say where they came from should not be quietly reporting its readers to somebody else.

The host serving these files keeps ordinary web server logs, which include IP addresses, for a short period and for the purpose of running the server. That is standard for any website and is not used to build a profile of you.

The app

Where your data lives

On your phone, in the app’s own container, as plain JSON files: your profile, your saved entries, and one file per day. There is no account to create, no server holding a copy, and no sync to anything by default. If your data is on a second machine, it is because your own device backup put it there.

This is the reason there are no accounts, and it is a decision rather than a gap. An account’s real product would be a server holding other people’s food diaries — data adjacent to health, and a standing liability for an app whose entire argument is traceability.

Health data

If you connect Health, the app reads steps, active energy and workouts. It reads them and never writes: nothing Burnline calculates is put back into your Health record. Permission is asked for by iOS, is optional, and can be withdrawn in Settings at any time. The app works without it.

What leaves the device

Three things do, each only when you ask for it, and they are nothing like the same size. The difference between them is the part worth reading, so they are set out one at a time rather than averaged into a sentence that would be true of none of them.

An estimate. Photograph a plate, or type something the food list has never heard of, and the photograph or the line of text is sent to be estimated. What goes with it is the standing instruction that asks for a figure in a fixed shape, and nothing else: not your profile, not your weight, not the rest of the day, not anything else you have ever logged. The figure comes back, you see it and the assumption it rests on before it is saved, and the photograph is not kept — not in the app afterwards, and not by us.

A question for the companion — the sheet behind Ask Lorie, and the sentence that sometimes appears under About today, which is written the same way. This one is different in kind, and saying otherwise would be the dishonest thing on this page: it sends the day. Every entry in it, food and exercise, with the name, the time, the portion, the calories and macros, how confident the figure was and what it assumed, where the figure came from, and the words you typed when you logged it. With them go the day’s figures — burned so far, the burn expected by midnight, eaten, your step count, protein against its target, your goal and the target range it sets, the intake that plan allows and how much of it is left — and a short summary of the days behind it: your averages over the last seven and thirty days, and the foods that turn up most often. Then whatever you type into the conversation.

It is sent because there is no other way to answer the questions the thing exists for: is protein short today? cannot be answered without today, and one given the totals alone could only talk about your lunch in the abstract. What does not go with it: your name, your weight, your height, your date of birth, and the days themselves — history is sent as averages, and an individual past meal is looked up only if you ask about one. The note under About today is written only when the day has actually moved, never because the app was opened.

A barcode. Scanning one sends the digits under it to Open Food Facts, a public database, and the manufacturer’s declared figures come back. Nothing about you goes with the number, there is no key and no account, and this is the one free feature that needs a network. The rest of the free app — the food list, the by-hand form, repeating something you have logged before, the widgets, the statistics, the export — makes no network request whatsoever, which is why it is fully usable in airplane mode.

Who handles it

An estimate and a companion turn take the same road. It has two stops, and only the first of them is ours.

That first stop is a small server we run: the proxy. It exists so that nobody has to go and find an API key of their own. It holds ours, checks that the request came from a genuine copy of this app on a real device, and checks whether it is inside the fifty free estimates or covered by a subscription — then forwards the request as it stands and hands back the answer. The proof of the device is a signature made by the phone’s own security hardware, and the proof of a subscription is a receipt from Apple. Neither is a name, an email address or an account.

From there it goes to OpenRouter, which routes it to the model that answers — today Google’s Gemini 2.5 Flash. That is the hop furthest from us and the one we can say least about: OpenRouter states that it does not keep the prompts and completions it routes beyond what routing, billing and abuse detection require, and the provider that actually answers has a policy of its own. Worth knowing before a photograph of your kitchen goes down it, which is why it is written here rather than left to be assumed.

What is kept, and what is not

The proxy keeps two rows per device, and neither is a diary: the public key your phone proved itself with, and a count of how many of the free estimates it has spent. Both are filed under an identifier for that key, which identifies a device and nothing about a person. There is no name, no address, and no way back from a row to you.

No request or response body is written down. Not at any level, and there is no debug switch that turns it on, because a switch that can be turned on is a diary that can be kept. The request is forwarded and dropped. What is left is counts — how many calls, how long they took, how many tokens they cost — and the ordinary server logs any host keeps.

Getting your data out, and deleting it

Profile → Your data → Export as a spreadsheet writes every entry you have ever logged as a CSV and hands it to the share sheet. The origin of each figure is a column like any other, so the record of what was measured and what was guessed survives leaving the app.

Deleting the app deletes your data, because your data is on your phone. There is no copy of it to ask us for and none to ask us to delete, which is the plain consequence of there being no accounts. The two rows above outlive the app, because they belong to the device rather than to the install — that is exactly what stops a reinstall handing out fifty more free estimates — and neither holds anything you logged or anything that says who you are. The same count is mirrored in the phone’s Keychain so the app can show it to you, and that copy outlives the app for the same reason. Nothing to log in to, and nothing to look you up by: it is the same trade in both directions.

Children

Burnline is not designed for or directed at children, and calorie tracking is not something to hand to one.

Questions

See support for how to reach a person. If something here is unclear or looks wrong, that is worth reporting — a privacy page nobody can follow is not doing its job.