Privacy policy

Last changed: October 22, 2026

What we keep about you, why, who else sees it, and how you take it with you or delete it. Ommzy keeps only what it needs to work out your household’s food.

Who is responsible

The controller of your personal data is Nimblesoft (company ID 206342094), Bulgaria. For anything about your data, write to [email protected].

What we keep and why

Account: name, username, password (only as a one-way hash), household and your role in it
What for
to give you an account and a household
Legal basis
contract (GDPR Art. 6(1)(b))
Sign-in: a session cookie, the IP address and browser of each sign-in
What for
to keep the account safe and show you your devices
Legal basis
legitimate interest: security (Art. 6(1)(f))
Profile and health: sex, date of birth, height, weight and measurements, goal, daily life, workouts, water, what you avoid
What for
to work out calories, macros and portions
Legal basis
explicit consent (Art. 9(2)(a))
Plans and recipes: the menu, what you ate, recipes, reviews, lists, what you have at home
What for
the service itself
Legal basis
contract
Settings: language, theme, layouts, reminders
What for
to keep the app as you like it
Legal basis
contract
Email, once we add it for invites and password resets
What for
to send your invite or a reset link
Legal basis
contract
Messages to us: name, email, text
What for
to answer you
Legal basis
legitimate interest

Data	What for	Legal basis
Account: name, username, password (only as a one-way hash), household and your role in it	to give you an account and a household	contract (GDPR Art. 6(1)(b))
Sign-in: a session cookie, the IP address and browser of each sign-in	to keep the account safe and show you your devices	legitimate interest: security (Art. 6(1)(f))
Profile and health: sex, date of birth, height, weight and measurements, goal, daily life, workouts, water, what you avoid	to work out calories, macros and portions	explicit consent (Art. 9(2)(a))
Plans and recipes: the menu, what you ate, recipes, reviews, lists, what you have at home	the service itself	contract
Settings: language, theme, layouts, reminders	to keep the app as you like it	contract
Email, once we add it for invites and password resets	to send your invite or a reset link	contract
Messages to us: name, email, text	to answer you	legitimate interest

We do not sell data. The app has no ads and no tracking scripts.

Health data

Weight, measurements, goal and workouts are health data, which the law protects specially. So:

we keep them only if you enter them and give explicit consent at the “Body and goal” step; you can skip it;
you can withdraw consent at any time by deleting the data from your profile or writing to us;
the people in your household see the profiles and portions, because you cook together; only you see your workouts and water;
the admin console shows counts only, never weight or goals; only the administrator can reach the database, and only for maintenance and backups.

Artificial intelligence

Your data is not sent to AI services. Only the administrator uses AI, to translate and prepare the recipes of the shared library.

Who else sees the data

We use a few providers who process data only on our instructions, under a data processing agreement:

Cloudflare: the network in front of the site and the app, protection from attacks and the encrypted connection. It is a US company in the EU–US Data Privacy Framework.
Hetzner (Germany): the server the app runs on, in Germany.
Cloudflare R2: encrypted backups, in the European Union.
Brevo (France): the app’s emails: confirming the address, a new password, welcome and account deletion.

We give data to no one else unless the law requires it.

Analytics and advertising on the public site

Only on the public site and only if you agree, we use Google Analytics (Google Ireland Ltd) and Meta Pixel (Meta Platforms Ireland Ltd), through Cloudflare Zaraz. They receive which pages you open, where you come from, your device and browser, but not your IP address to Google. We use them to know where people come from and how well our ads work, and to show ads to people who visited the site.

The legal basis is your consent. You can withdraw it at any time from “Cookie settings” at the bottom of every page. Google and Meta may transfer data to the US, under the EU–US Data Privacy Framework. The cookies are listed in Cookies.

The app has no such tools: your body, goals and eating data never reach Google or Meta.

How long we keep it

As long as you have an account.
A sign-in session ends after 30 days without use.
When you delete your account, your data leaves the database within 30 days and the backups within about 2 months (we keep 14 nightly copies and one a week for 8 weeks).
We delete an account with no sign-in for 12 months, after a warning.
Approved public recipes stay in the library without your name.
We keep messages to us and invite requests for up to 12 months.

Your rights

You can ask:

for access to your data and a copy of it, in a machine-readable form;
to correct data that is wrong;
to delete it;
to restrict its processing;
to object to processing based on legitimate interest;
to withdraw your consent, without affecting what was done before.

Write to us at [email protected]. We answer within one month. A copy and deletion will soon be in the settings too.

You may complain to the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg.

How we protect it

The connection is always encrypted (HTTPS).
We keep passwords only as a one-way hash.
The server has no ports open to the internet, and admin access is only through a private network.
Backups are encrypted.
If a leak puts your rights at risk, we tell the Commission within 72 hours and you without delay.

Children

Only adults have accounts. A parent may add a child’s profile to their household to work out the child’s portion. The child’s data is kept the same way and deleted when you remove it.

Changes

If we change this policy in substance, we will tell you in the app at least 14 days ahead.