Privacy policy
How Trimm looks after your data
Trimm is a calm iPhone app that takes some of the thinking out of everyday life, for you and the small groups you share it with, such as your family or household: meals, health, groceries and the people close to you. This policy says what Trimm keeps, why, who else handles it, and how to take it back. It describes Trimm as it works today.
Effective 11 October 2026. Trimm (called Keel until 11 October 2026) is run by Tyler Elton, an individual ("we"), who is the controller of your data. Questions: privacy@trimm.uk.
The short version
- Trimm keeps what you tell it so it can count, plan and remind for you. We never sell it and never use it for advertising.
- Trimm's database is in Google Cloud in London. Some fields are encrypted with a key that belongs to you; the rest is protected by Google's standard storage encryption. Trimm is not end-to-end encrypted: our servers read your data to do the sums.
- Trimm has no built-in assistant. On Trimm Plus, a meal photo or label photo you choose to send goes to an AI provider through OpenRouter to be read; otherwise label photos are read on your phone.
- Agents you connect, such as Claude, see what you ask them about. You can disconnect them at any time.
- You can delete your account in the app. That removes everything you have logged.
What Trimm collects
| What | Examples | Why |
|---|---|---|
| Account | The ID your sign-in provider gives Trimm, which providers you use, your name and profile photo from that provider | To know it is you and to show your name to people you connect with |
| What you log | Foods and amounts you log, meals, exercise, weights, water, 5-a-day, alcohol units, day notes | Your day, daily totals and trends |
| Profile | Your target weight, the only number Trimm asks for. Trimm no longer keeps sex, date of birth, height or activity level, and older versions of the app that still send them have them ignored | To know which way your weight should go. Your daily allowance is learned from what you log and your weight trend |
| Food preferences | Diet, allergies, dislikes | To keep meal plans, recipes and shopping safe for you and your household |
| Foods you add | Custom foods, foods read from a label photo, saved meals, recipes | So you can log them again. They stay private to you (or your group) |
| People and groups | Who you are connected with, what each of you shares, reactions, short notes, shared meals, groups (what each covers, what you agreed to share with it and when), meal plans | The family and friends features you choose to use |
| Groceries | Your shops and shopping rules, budget, what is in your cupboards, shopping lists, products and prices your agent found | Shopping lists and baskets |
| Finance (not offered yet; only once it is, and you turn it on) | Your accounts (bank, kind, an optional name and last four digits), the statements you or your agent import (period, balances, each line's date, description and amount), cash spends you add, categories and the rules you set, people you split costs with who are not on Trimm (a name only), splits, and payments you record | To check each statement adds up, show what you spend, and keep track of who owes whom. Trimm never asks for or keeps bank logins and connects to no bank |
| Apple Health | Weight, body fat, steps, workouts and how hard they felt, and daily minutes of activity in four zones worked out on your phone from your heart rate, if you allow it | Your weight trend and activity (see below) |
| Connections | Devices you sign in on (with the device's name), agents you connected and when | So each one works, and so you can sign out or disconnect them |
| Home | What Home last showed you, kept for a couple of minutes | So Home opens quickly |
Trimm does not store your email address; your sign-in provider and Google Identity Platform hold it. Trimm's own logs hold none of what you log and no IP addresses: a request log has only the type of request, whether it worked and how long it took. Food searches travel inside requests, not in web addresses, and Trimm is set up to keep web addresses out of stored logs anyway: Cloudflare keeps no per-request log for Trimm's addresses and removes the part of an address after the "?" from anything else it logs, and Google Cloud's own request log, which would store full addresses, is excluded. To slow down attacks on sign-in, Trimm counts recent sign-in attempts against a keyed hash of your IP address that changes every day; those counts are deleted after a day.
Trimm has no analytics, no advertising and no tracking cookies. The sign-in pages keep what they need for the sign-in itself in your browser's session storage and in short-lived cookies that only work on Trimm's own address.
Your consent to health data
Much of what you tell Trimm is health data, which UK law treats as special category data, so Trimm keeps it only with your explicit consent. Straight after you first sign in, and again whenever its words change, the iPhone app shows the screen below (consent version 3). Until you choose I agree, Trimm saves no health data for you, and Not now signs you out.
Trimm helps you and the people close to you with everyday life, and much of what you tell it, from meals to weight, is health data. Trimm needs your explicit consent before it keeps any.
What Trimm keeps
What you eat and drink, your weight and body fat, exercise, water, 5-a-day, alcohol and day notes, your target weight, your allergies and dislikes, and the Apple Health readings you allow: steps, workouts and how hard they felt, and heart rate, which your iPhone turns into daily minutes of activity in four zones before anything leaves it.
Why
Only to run Trimm for you: what you log, daily targets and trends, and meal plans and shopping that are safe for you. Never for advertising, and never sold.
Who processes it
Google Cloud stores it in London. On Trimm Plus, a meal or label photo you choose to send goes to an AI provider through OpenRouter to be read, which keeps none of it. People and agents you connect see only what you choose to share.
You can withdraw consent at any time in You. Trimm then stops saving health data, and offers to delete what it holds. Not now signs you out.
If the words on that screen change, the version goes up and the app asks you again. Only you can agree, in the Trimm iPhone app: agents you connect, such as Claude, cannot agree for you, and a carer's consent covers only the profiles they manage for a child. To withdraw, open You in the iPhone app and choose Withdraw consent. Trimm stops saving health data and stops sending photos to AI providers straight away, and offers to delete your account and everything it holds. Nothing is deleted unless you choose that.
Signing in
You sign in with Apple, Google or Facebook through Google Cloud Identity Platform. Trimm never sees or stores a password. Identity Platform receives your email address, name and profile photo from the provider you choose, and Trimm receives a signed confirmation of who you are. The Identity Platform user pool Trimm uses is shared with other services run by Tyler Elton, so one email address is one account across them.
AI processing
Trimm uses AI in the places below. Where data leaves your phone, it goes from Trimm's servers to OpenRouter, which passes it to the model provider that runs the model.
- Meal photos (Trimm Plus). You can photograph a meal to get an estimate of what it holds. The photo goes to Google Gemini, which answers with the dish, its main parts and rough calories, protein, carbs and fat. Trimm does not keep the photo or log anything; you check the estimate and log it yourself.
- Label photos. When a barcode is not found, you can photograph the nutrition label. Your phone reads it; the photo does not leave your phone. On Trimm Plus you can choose to have Google Gemini read it instead, and then the photo goes to Gemini. Trimm does not keep the photo; it keeps the values once you confirm them.
These providers process the data only to answer that request. Zero data retention is switched on in Trimm's OpenRouter account settings, so OpenRouter sends Trimm's requests only to model providers that do not keep what is sent, or train on it.
Open Food Facts
To find packaged foods, Trimm's servers send barcodes and food search words to Open Food Facts, a free, open food database. These lookups come from Trimm, not your device, and carry nothing that identifies you. Products found are kept in Trimm's shared food list, which holds no personal data.
Apple Health
Trimm reads from Apple Health only what you allow in the iPhone app: weight, body fat, workouts (their type, time, duration, distance, how hard they felt and the app that recorded them, such as WHOOP or Apple Watch), daily steps, and heart rate. Your heart rate never leaves your phone: the app turns it into how many minutes each day you spent in four activity zones (Light, Moderate, Hard and Peak), and only those minutes reach Trimm. Trimm reads no calorie burn. It writes back the food and water you log, if you allow that too. You can change this at any time in the Health app or in Trimm under You, then Integrations.
- Health data is used only to run Trimm for you: your weight trend, the allowance Trimm learns from it, and showing your activity, workouts and steps.
- It is never used for advertising or marketing, never sold, and never given to data brokers or advertising platforms.
- It is shared only where you choose: with people you connect with, at the sharing level you pick; with agents you connect, when you ask them; and with the AI processors above when you send a photo for them to read.
- Connecting Apple Health happens only in the Trimm iPhone app. Claude and other agents cannot connect it.
Agents you connect, such as Claude
You can connect AI agents to Trimm, for example by adding Trimm as a connector in Claude. You sign in to Trimm and approve the agent first; Trimm shows what it will be able to do. After that it can read and change your Trimm data for you within that access, and Trimm sends it whatever its requests ask for, so what it does with that data is covered by its own provider's policy (for Claude, Anthropic's privacy policy).
To disconnect an agent, remove Trimm from the agent's settings (in Claude: Settings, then Connectors), or choose Disconnect next to it in the Trimm iPhone app under You, then Integrations, Connected agents. There you can also narrow what it may do in each area (diary, meals, groceries, people) to none, see only, or see and change. Finance is not offered yet; once it is, it starts at none for every agent: an agent sees your money only if you choose a level for it. Disconnecting stops it straight away. Deleting your account disconnects every agent.
Who else handles your data
| Provider | What for |
|---|---|
| Google Cloud (London, europe-west2) | Runs Trimm's servers and database, holds the encryption keys and backups |
| Google Cloud Identity Platform | Sign-in with Apple, Google or Facebook |
| Cloudflare | Delivers Trimm's web addresses and passes requests securely to Google Cloud |
| OpenRouter, and the model provider it routes to (Google) | Reading meal photos and label photos on Trimm Plus |
| Open Food Facts | Barcode and food lookups (no personal data) |
| Apple | Apple Health on your iPhone, and Sign in with Apple if you use it |
Data sent outside the UK
Some of these providers handle data outside the UK. Where they do, UK law requires a safeguard, and these are the ones Trimm relies on:
- Google Cloud. Trimm's servers, database, encryption keys and erasure records are in London (europe-west2). Automatic database backups are stored in Google's European Union multi-region, and server logs and sign-in records are held in Google's global locations. The EU is covered by UK adequacy regulations; anywhere else is covered by the UK Addendum to the EU Standard Contractual Clauses in Google Cloud's data processing terms.
- Cloudflare. Requests pass through Cloudflare's data centre nearest to you, which may be outside the UK. Covered by UK adequacy regulations where they apply, otherwise by the UK Addendum to the EU Standard Contractual Clauses in Cloudflare's data processing terms.
- OpenRouter and the model providers it routes to. OpenRouter is in the United States, and model providers may run the request in the United States or elsewhere. Covered by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
- Open Food Facts is in France, which UK adequacy regulations cover. Trimm sends it no personal data.
- Apple. Apple Health data stays on your iPhone and in your Apple account, under Apple's own privacy policy; Trimm does not send your data to Apple. Sign in with Apple is also under Apple's policy.
How it is protected
Everything travels over encrypted connections. In the database, these fields are each encrypted with a key that belongs only to you (or to your group): your name and photo, the descriptions on diary entries and exercise, day notes, notes people send you, shared meal offers, your allergies and dislikes, recipe steps, the assistant's saved suggestions and proposals, and everything Finance keeps about your money: account names and numbers, balances, transaction descriptions, amounts and notes, the names of people you split with, and splits and payments (when you split with someone on Trimm, each of you has your own copy under your own key). Those keys are themselves locked by Google Cloud's key service. Everything else, such as which foods you log, amounts, calories, weights, your profile and dates, is protected by Google Cloud's standard encryption of stored data. Trimm's servers can still read your data while working on a request; that is how they total your day, fit portions and build lists.
How long it is kept
- What you log and everything else above: for as long as you have an account.
- Sign-in codes: about a minute. Sign-in attempt counts: a day.
- Database backups: 7 days. A backup is taken every day and kept for 7 days, and changes are kept for 7 days so the database can be restored to a point in time. When you delete your account, the keys for your encrypted fields are destroyed, so those fields can no longer be read in any backup. Other data in a backup goes when that backup expires.
- Server logs in Google Cloud: 30 days. Google Cloud's audit logs, which record changes to Trimm's infrastructure and hold none of your data, are kept for 400 days.
- Cloudflare: Trimm keeps no per-request logs there. Cloudflare's request logs are switched off for Trimm's addresses, and Trimm writes no log lines of its own.
Deleting your data
In the Trimm iPhone app, go to You, then Delete account. This deletes everything you have logged, your profile, foods, meals, weights, Apple Health readings, preferences, groceries, connections with people, device sign-ins and agent connections at once, and destroys your encryption keys. A group you alone manage passes to its longest-standing member, or is deleted if you are its only member. Foods from Open Food Facts stay in the shared list, as they hold nothing about you.
Deleting your Trimm account does not remove your sign-in record from Google Identity Platform, because that sign-in is shared with other services. Email privacy@trimm.uk and we will remove it. Readings Trimm wrote to Apple Health stay in Apple Health until you delete them there.
Children
Trimm is for people aged 13 and over. It keeps no profiles for children or anyone without their own sign-in.
Your rights
Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or ask for it in a portable format. Where Trimm relies on your consent, you can withdraw it at any time. Email privacy@trimm.uk. You can also complain to the Information Commissioner's Office at ico.org.uk.
Why Trimm is allowed to use your data
| Use | Lawful basis |
|---|---|
| Your account, and the parts of Trimm that hold no health data: foods you add, groceries, people and groups, and Finance once it is offered and you turn it on | Contract: it is the service you asked for |
| Health data: what you log, weight and body measurements, exercise, profile and goals, allergies and dislikes, and Apple Health | Your explicit consent, given on the consent screen above. You can withdraw it in the iPhone app under You, then Withdraw consent |
| Security logs and sign-in attempt counts | Legitimate interests: keeping Trimm and your account secure |
| Sharing with people in your circle and groups | Your consent, given each time you choose to share |
Changes
If this policy changes in a way that matters, we will say so in the app before the change applies. The date at the top shows the current version.
Contact
Tyler Elton
privacy@trimm.uk