Mitso Privacy Policy
Last updated Oct 22, 2026
Summary
Mitso helps you see what food costs your wallet and your body. It is built so that most of your information never leaves your phone. This policy explains what Mitso keeps on your phone, the little it sends to our servers, and why. It applies to the Mitso app for iPhone and Android, run by Chaitanaya Alugolu ("Mitso", "we").
- No account needed. Mitso identifies your phone with a random anonymous ID. An email account is optional and is needed only to link a card.
- Your statements, purchases and receipt photos stay on your phone. The one exception is a meal photo you choose to scan with Plate: it is sent to be read, then discarded.
- We send only what a feature needs, such as a store name or the text of a receipt, and only when you use that feature.
- No ads, no tracking, no selling or sharing your data, and no money from food brands.
- You can delete everything on your phone and on our servers at any time with Delete all my data.
What stays on your phone
The following is stored only in Mitso's private storage on your phone. We never receive it.
- Card statements (PDF or CSV) you add. They are read on your phone and are not uploaded or kept after reading.
- Your food purchases: date, store, amount and category, plus items from scanned receipts.
- Purchases Mitso skipped as not food. These are kept only while the app is open.
- Your choices, such as "this store is groceries", your settings and your recent dish searches.
- Photos of receipts and menus. Text is recognized on your phone (with Google ML Kit, which runs on the device). The photo is never sent anywhere, and a photo taken with the camera is deleted after reading. Your meal log from Plate (the foods, estimates and portions) is also kept only on your phone; the meal photo itself is not kept.
This data is included in your phone's own backups (iCloud or Google) if you have them turned on. That is controlled by your phone settings, not by Mitso.
What we receive and why
Mitso sends information to our servers only when you use a feature that needs it. Each feature sends the least it can.
| Feature | What is sent | Why | What we keep on our servers |
|---|---|---|---|
| Every online feature | A random anonymous ID created by Firebase when you first use an online feature | To apply daily limits and Premium to the right phone | The ID, and daily usage counts tied to it |
| Store lookup (only if you turn it on) | Names of stores Mitso doesn't recognize, such as "Twin Peaks". Never amounts, dates or statements | To tell whether a store sells food | Store names and their category, in a shared directory with no link to you |
| Store corrections (only with Store lookup on) | A store name and the category you chose | So the shared directory learns from users | One vote per store per anonymous ID |
| Linked cards (Plaid) | You sign in to your bank through Plaid, not through Mitso | To bring in your card purchases automatically | A Plaid access token and your bank's name, until you unlink. Your purchases pass through our server to your phone and are not stored there |
| Receipt scanning | The text read from a receipt, with card numbers, phone numbers and emails removed first. Never the photo | To list the items, estimate calories and match the purchase | Nothing beyond a daily usage count |
| Menu scanning | The text read from a menu, with phone numbers and emails removed. Never the photo | To list the dishes and estimate calories | Nothing beyond usage counts |
| Plate (meal photos) | The meal photo you take or choose, shrunk on your phone with location and other hidden photo data removed | To recognize the foods and estimate portions and calories | Nothing beyond a daily usage count. The photo is used for that one request and is not stored or logged |
| Dish search | The dish name you type | To describe the dish and estimate nutrition | Dish names and their descriptions, in a shared list with no link to you, plus a daily usage count |
| Mitso Premium | Purchases go through Apple or Google. RevenueCat receives your anonymous ID and your purchase records (product, dates, renewal status) | To confirm your Premium and handle renewals, cancellations and refunds | Whether your anonymous ID has Premium and until when |
Our servers also keep standard technical logs (such as time of request, errors and network address) to run and secure the service.
Crash reports. If the app crashes, it sends a crash report to Firebase Crashlytics: the error, where in the app it happened, the app version and the phone model and system version. Reports carry a random installation ID, not your name, email or Mitso data, and are deleted automatically after 90 days.
Feedback you send. When you use Send feedback in the Account tab, your message (and, if you leave the box ticked, the app version and phone type) is stored with your anonymous ID so we can read it. Add an email address to the message only if you want a reply. Delete all my data removes your feedback too.
Beta sign-ups on our website. If you join the beta at mitso.app, we store your email address and anything you choose to add (first name, phone type, where you live, how often you eat out) so we can send you a beta invite. We use it only for the beta, never for ads, and never share it. To stop a single sign-up flood, we count sign-ups per network using a one-way code of your network address; the address itself isn't kept. Email team.mitsoapp@gmail.com to have your sign-up deleted.
Optional account. If you create a Mitso account, Firebase Authentication stores your email address and a scrambled (hashed) form of your password; we never see the password itself. Your anonymous ID becomes the account, so linked cards and Premium stay with you when you sign in on another phone. We email you only to confirm your address, reset your password or answer you. Your purchases, receipts and meals still stay on your phone; signing in does not upload them unless you turn on backup.
Optional backup. If you turn on Back up my data (it needs an account), the app sends a compressed copy of your purchases, receipt items, store choices, Plate meals and a few settings to our servers. We encrypt it with a key only our server code can use and keep it in private Google Cloud storage, so a new phone or a reinstall can restore it. It is replaced each time it updates, and turning backup off or using Delete all my data deletes it right away.
Device code for free limits. The app creates a random code for this install and sends it with online requests. We keep only a scrambled (hashed) form of it, to count free daily uses per device so signing out or making new accounts doesn't reset them. It identifies nothing else and isn't used for tracking.
Service providers
We use a few companies to run Mitso. Each receives only what its job needs and processes it for us under its own terms and privacy policy.
| Provider | What it does for Mitso | What it receives |
|---|---|---|
| Google Firebase and Google Cloud (US) | Runs our servers, database and anonymous sign-in, and collects crash reports (Crashlytics) | Everything in the table above that reaches our servers, plus crash reports and feedback |
| Anthropic (Claude AI) | Reads receipt and menu text and meal photos, recognizes store names, describes dishes | That text, those names, or a Plate meal photo, with no ID attached. Under Anthropic's commercial terms it is not used to train their models. Anthropic deletes it automatically within 30 days, unless its safety systems flag it as a usage policy violation (then up to 2 years) or the law requires keeping it longer. |
| Plaid | Connects your card account when you choose to link it | Your bank sign-in and account data, collected by Plaid directly under its own End User Privacy Policy |
| RevenueCat | Confirms Premium purchases and tracks renewals | Your anonymous ID and purchase records |
| Apple and Google | App stores and payment for Premium | Your purchase, under your Apple or Google account |
| Google ML Kit | Recognizes text in photos | Nothing: it runs entirely on your phone |
We don't use advertising, analytics or tracking companies. Crash reports are used only to fix bugs.
What we never do
- We never sell or rent your data, and never share it for advertising.
- We never show ads and never take money from food brands to rank or recommend products.
- We never track you across other apps or websites.
- We never ask for your bank password. Linking a card happens in Plaid's own secure screen.
- We never upload your statements, or your receipt and menu photos. A meal photo you scan with Plate is sent only to be read and is never stored.
- We never use your data to make credit, insurance or hiring decisions about you.
We may disclose information only if the law requires it, and then only the minimum requested. Because we hold so little, that would be at most the server records listed above.
Keeping and deleting your data
You can delete your Mitso data at any time.
- On your phone and our servers: in Mitso, open Privacy & data and choose Delete all my data. This deletes your purchases, receipts, meal log, choices and recent searches on your phone, disconnects linked cards, and deletes the server records described below, in one step. Deleting the app also deletes everything stored on your phone, but not the server records.
- Linked cards: unlinking (or Delete all my data) deletes the Plaid access token and bank name from our servers right away and asks Plaid to end the connection.
- Server records: daily usage counts, store votes and Premium status are tied only to your anonymous ID. Delete all my data removes them right away, along with your anonymous ID or your account and its email address, and Mitso starts fresh with a new ID. If you have deleted the app, email us at team.mitsoapp@gmail.com with your ID and we will delete them within 30 days. Usage counts are only needed for the day they cover.
- Shared lists: store names and dish descriptions in our shared lists carry no link to you, so they stay to help everyone.
- Premium: cancel in your Apple or Google subscription settings. Purchase records are kept by Apple or Google and RevenueCat as required for billing and tax.
- Technical logs are deleted automatically, usually within 30 days.
Your rights
Wherever you live, you can ask us what we hold about you, ask us to correct or delete it, and get a copy of it. Residents of states with privacy laws, such as California and Texas, have these rights by law, and we give them to everyone. If you have an account, write from its email address; if not, tell us your anonymous ID (shown in the app under Privacy & data) so we can find your records. We will answer within 45 days and won't treat you differently for asking.
Health estimates
Calories, nutrition and health labels in Mitso are estimates for typical servings, not medical advice. They are not stored on our servers with your ID.
Children
Mitso is not meant for children under 13, and we don't knowingly collect information from them. If you believe a child has used Mitso's online features, contact us and we will delete the related records.
Security
Data sent between Mitso and our servers is encrypted in transit. Our database cannot be read directly by the app; only our server code can reach it. Keys for our providers are kept in Google Cloud Secret Manager. No system is perfectly secure, so we keep as little as we can.
Changes to this policy
If we change what Mitso collects, we will update this page and its date. For important changes, we will tell you in the app before they take effect.
Contact
Chaitanaya Alugolu, San Antonio, Texas, USA. Email: team.mitsoapp@gmail.com.