Milos Privacy Policy

Last updated: 12 October 2026

Milos is an app for logging what you eat, your weight and your training, with an AI coach called Milo. It is provided by ACORNAWARE PTE. LTD., Singapore (“we”, “us”), which is the data controller for your data. This policy explains what we collect, why, where it is kept, who helps us process it, and the choices you have. We have kept it short on purpose; if anything is unclear, write to us.

1. What we collect

• Account: your email address, or the identifier Apple or Google gives us when you sign in with them (Apple may give us a private relay address instead of your real email).
• What you log: meals and their nutrition estimates, meal photos, weight and body measurements, workouts, notes, and what you say or type to Milo (voice is turned into text; we keep the text, not the audio).
• Your starting answers: goal, sex, age, height, weight, activity level, and any target you set.
• Apple Health (only if you connect it): weight, height, age and sex, workouts and active/resting energy, steps, sleep, resting heart rate and heart-rate variability. We write back one thing: the weight you log in Milos. We never read medications, cycle tracking, clinical records or any other Health category. Before anything is read, a dedicated screen explains each item and asks for your explicit consent; you can withdraw it at any time in iPhone Settings.
• Things you share into Milos: photos, links or text you send from other apps with the share sheet.
• Technical data: a push-notification token and your time zone (to send reminders at the right local time), the language you use, and usage counts of our AI features (for example how many requests were made and how large they were), used to run, secure and budget the service. If you have chosen in iOS to share diagnostics with developers, Apple may give us anonymous crash reports.

We do not use advertising identifiers, third-party analytics or tracking SDKs, and we do not track you across other apps or websites.

2. Why we use it, and on what basis

• To provide the app (performance of our contract with you): store your records, recognize food in photos and text, estimate nutrition, show your trends, let Milo answer you, write a short nightly note and a weekly review, and remind you at mealtimes if you ask us to.
• Health data (your explicit consent): data from Apple Health, and the weight and body measurements you log, are health data. We process them only with your consent, only for the features above, and you can withdraw consent at any time by disconnecting Apple Health or deleting the data.
• Reminders (your consent): push notifications are sent only if you turn them on, and you can turn them off any time.
• To keep the service working and safe (our legitimate interest): rate limits, abuse prevention, debugging and backups.

We do not sell your data. We do not use it, or share it, for advertising or marketing. Health data is used only to provide the features described here, never for advertising or for any purpose other than your own use of the app. We may compile anonymous, aggregated statistics (for example how many meals are logged per day across all users) to run the service; these cannot identify you.

3. The AI coach (Milo)

Milo runs on Google’s Gemini models through the paid Gemini API. For each request, the parts of your records needed to answer are sent to Google (for example a meal photo, what you said, your recent days and targets, and Health data you connected). Under the paid-tier terms, Google does not use this data to train or improve its models. When Milo needs to look something up, the model may run a web search with that query. Milo’s answers are suggestions: targets and plans only change when you accept them, and nothing in the app makes decisions with legal or similarly significant effects on you automatically.

4. Where it is stored, and how it is protected

Your account and records are stored with our hosting provider Supabase, in its data centre in Frankfurt, Germany (EU). Data is encrypted in transit and at rest. Your records are kept in your own account space, protected by access rules so that only your signed-in app can read them. A copy of your records is also kept on your iPhone so the app works offline; it is removed when you sign out or delete your account. We keep daily backups for seven days to recover from failures.

5. Who helps us (service providers)

• Supabase — hosting, database, file storage (photos), sign-in and backups (EU).
• Google (Gemini API, paid tier) — the AI model, as described in section 3. Google may process requests outside the EU (for example in the United States) under Google’s data processing terms and the EU standard contractual clauses.
• Google — also delivers our sign-in code emails, and handles “Continue with Google” if you choose it.
• Apple — “Sign in with Apple”, push notifications, Apple Health (read on your iPhone), and speech recognition for voice input (audio may be processed by Apple to produce the text).

These providers process data only on our behalf and under contract, to deliver the service. Our team is based in Singapore and may access your data only to provide support you have asked for or to fix a problem; such access is limited and logged. We do not give your data to anyone else unless the law requires it, or to protect our users or the service from abuse.

6. How long we keep it, and deleting it

We keep your records for as long as you have an account, so you can see your history. You can delete individual entries in the app. In Settings › Account & data you can erase all records (your account stays and you start fresh) or delete your account (the account and all its data, including photos, are deleted right away; if you signed in with Apple, we also revoke Milos’s access with Apple). Deleted data may remain in backups for up to seven days and is then gone. You can also email us from your account email and we will do it within 30 days. Disconnecting Apple Health (iPhone Settings › Health › Data Access & Devices › Milos) stops new reads; data already recorded stays in your account until you delete it. Usage counts and logs without your content are kept for up to 12 months.

7. Your rights

Wherever you live, you can ask us to: give you a copy of your data (your records are stored as plain text, so we can give you a complete, readable export); correct it; delete it; restrict or object to how we use it; and withdraw any consent you gave, without affecting what was done before. We answer within 30 days and may ask you to confirm it is your account. If you are in the EU/EEA or the UK you also have the right to complain to your data protection authority; in Singapore, to the Personal Data Protection Commission. We would appreciate the chance to help first.

8. Children

Milos is not meant for anyone under 16, and we do not knowingly collect data from them. If you believe a child has given us data, contact us and we will delete it.

9. Changes

If we change this policy in a meaningful way, we will tell you in the app before the change takes effect. The date at the top shows the current version.

10. Contact

ACORNAWARE PTE. LTD., Singapore — milos@acornaware.com