Overview
Personal Assistant is a native iOS app, developed and operated by Derive LLC ("we," "us," "the developer"), that helps with calendar, reminders, shopping, food inventory, fitness, nutrition, budgeting and journaling in one place. Most of what you enter — shopping lists, food inventory, saved recipes and workouts, budget entries, your journal — stays on your own iPhone.
Four things can send data off your phone, and each is described below:
- AI features you use. The app uses Google's Gemini AI with a key you set up yourself. Each AI request goes straight from your phone to Google, with no server of ours in between. Some AI features have an on-device alternative, and you choose each time.
- Your account. Signing in and managing your plan uses a small backend we run (Firebase). It holds your account record, not your food, budget, health or journal content.
- Sharing. If you share a budget, food inventory or bill split with other people, what you share is stored on that backend so they can see it.
- iCloud sync. If you turn it on, your data is kept in your own private iCloud.
The table below lists every feature and exactly where its data goes. There is no advertising or analytics SDK in the app, and we never sell your data.
What's accessed, and why
On device never leaves your phone. Developer backend is our own Firebase project. Everything else goes straight to the outside service named.
| Feature | Data involved | Purpose | Leaves the device? |
|---|---|---|---|
| Account & sign-in | Email address, password (never stored in plain text) | Create and sign in to your account | Developer backend · Firebase Authentication (Google) |
| Subscription & billing | Payment details | Process a subscription payment | Stripe or Apple — the developer never receives or stores your card number |
| Plan & status | Which plan you're on, active/inactive, a billing-provider reference ID | Confirm your plan is active so its features unlock | Developer backend |
| Signed-in devices | Each device's name, model, app version and notification token | Keep a list of the devices on your account (a second device needs iCloud sync) and send notifications such as a bill-split payment claim | Developer backend |
| Google Calendar | Google Calendar events | Show your Google events alongside your device calendar; create, edit, or delete one only when you choose to | Google (Calendar API) |
| Calendar & Reminders | Device calendar & reminders | Create, view, and edit events and reminders in Apple's Calendar and Reminders apps | On device |
| Leave-by advisory | Current location, event address | Estimate travel time so the app can suggest when to leave | Apple (Maps/MapKit) |
| Scanning receipts, labels and expiry dates | Camera / photo library images | Text is first read on your phone with Apple's text recognition. A photo only goes to AI if you choose an AI option below | On device |
| AI: recipes, meal plans, workouts | Ingredients on hand, dietary restrictions, preferences and anything you type into those screens | Generate recipes, meal plans and workout plans | Google (Gemini API), straight from your phone with your own key |
| AI: workout muscle tags, exercise explanations and exercise swaps | Exercise names only — nothing about you. For a swap, also the workout's other exercises and the equipment you've chosen | Work out which muscle groups each exercise trains, for the Fitness Coach (done when you open the coach; you can turn it off in Fitness settings), write a short written explanation of each exercise: how to set up, the steps, breathing, common mistakes and an easier version (done when you open a workout; you can turn it off in Fitness settings), and replace an exercise with a similar one when you tap Swap | Google (Gemini API), straight from your phone with your own key |
| AI: meal photos, descriptions and ingredient breakdowns | A photo or typed description of a meal, plus any weights or barcode details you add | Estimate calories and nutrition, and break a meal down by ingredient | Google (Gemini API), straight from your phone with your own key |
| AI: product labels | A photo of a nutrition label and ingredient list | Score a product the barcode database doesn't know | Google (Gemini API), straight from your phone with your own key |
| AI: receipts | When you choose an AI option: the receipt photo and its text. You can instead choose to read it on your phone with no AI | Pull out the total, or the items, from a receipt | Google (Gemini API), straight from your phone with your own key |
| AI: bank statements | When you choose Gemini for a CSV/PDF, or for any screenshot or photo: the statement text or images. Account, card and routing numbers, emails, phone numbers, street addresses and ZIP codes are blanked out on your phone first, but a printed name may not be. For a CSV or PDF you can instead choose to keep it on your phone, and nothing is sent | Pull transactions out of a statement, and suggest names and categories | Google (Gemini API), straight from your phone with your own key |
| AI: Nutrition Coach | What you've eaten today, your nutrition targets, and food on hand | Suggest foods to fill gaps or review your day | Google (Gemini API), straight from your phone with your own key |
| AI: importing recipes and workouts | Text from the link or from your photo (read on your phone first) | Reformat a recipe or workout into the app's layout | Google (Gemini API), straight from your phone with your own key. A link's web page is fetched directly from that website |
| AI: ingredient price estimates | Ingredient names and your selected city | Estimate a price when an ingredient isn't in the app's price list (this runs automatically when a key is saved) | Google (Gemini API), straight from your phone with your own key |
| Voice assistant | Your spoken request. Apple turns speech into text. The text, not the audio, is sent to Gemini only when the app can't work out the request itself | Run voice commands, including from Apple Watch and Cook Mode | Apple (Speech) · Google (Gemini API) only for requests the app doesn't recognize |
| Product health scores | The barcode you scan (and a product name, for finding alternatives) | Look up the product's nutrition, additives and processing level; suggest better options | Open Food Facts (public database) |
| Contributing a missing product | Nutrition facts, ingredients, product name/size and the label or package photo you took, only if you tap "Add It" | Add a product the database doesn't have. Posted under the app's own account; nothing about you is included | Open Food Facts (public database), via Developer backend |
| Food nutrition lookups | Food and ingredient names | Look up real nutrient values | USDA FoodData Central, forwarded through Developer backend (which does not keep a record of what was searched) |
| Journal | Your entries and photos; an optional 4-digit PIN | Keep a daily journal. The PIN is stored in your device's keychain | On device |
| Journal PIN reset | Your account email address; a one-time 6-digit code | Email you a code to reset a forgotten PIN, only when you ask for one | Developer backend → your email |
| Crash reports | Technical details of a crash or freeze (call stack, app and iOS version, device model) and your account ID | Find and fix bugs. No journal, food, budget, or other personal content is included | Developer backend |
| Apple Health | Heart rate (during workouts, and, only if you turn on Daily Energy, while you are resting), active energy, steps and workouts, sleep, heart rate variability and resting heart rate (only if you turn on Daily Energy), and cycle data (period days, basal body temperature) if you allow them | Show them in the app. If you allow it, the app also saves your logged meals' nutrition, logged period days and the workouts you complete or log in the app to Health, and, if you turn on Record on Apple Watch, your Apple Watch records the workout (with its heart rate and active calories) and saves it to Health. None of this is sent to AI or to the developer | On device · Apple Health |
| Sharing with other people (optional) | What you choose to share: budget categories and their expenses (last 60 days), a food inventory, a bill-split event or group (people, expenses and receipt photos), and a code or link for each | Let other people see and, if you allow, edit it. The live link for a bill split is viewable by anyone who has the link | Developer backend. Stops when you turn sharing off; expired or idle shared items are also removed automatically |
| iCloud sync (optional, off by default) | Everything the app stores: lists, inventory, recipes, budget, journal, logs and photos | Keep your data in step across your own devices | Your private iCloud (Apple CloudKit). The developer cannot see it |
| Everything else | Shopping, food, budget, saved recipes/workouts/plans, weight and nutrition logs, product scans | Stored so the app is useful across sessions | On device |
Account & subscription
You sign in with an email and password (handled by Firebase Authentication, never stored in plain text or seen by us), or with Google. Plans can be bought through Stripe on our website or through Apple In-App Purchase, and some people are given access directly by us.
Our server stores only: your account record, whether your plan is active, which plan you're on, a reference ID from Stripe or Apple used to look up your subscription with them, and the list of devices on your account. It never stores your card number; Stripe and Apple collect and keep that directly.
Paid plans unlock features such as Shared Budget and the Weekly Meal Plan. AI features are not part of any plan: they run on your own Gemini key, and we don't route, count or store your AI requests.
Cancelling and deleting
Cancel from Settings in the app. A website (Stripe) subscription can also be managed from the account you signed up with; an Apple subscription is managed under Settings → Subscriptions on your iPhone, because Apple doesn't allow us to cancel it for you. Delete Account in Settings removes your sign-in, your account record and your device list from our backend right away; data on your phone stays until you delete the app.
Your Google Account
Connecting Google Calendar uses Google's own Sign-In flow — the app never sees or stores your Google password. The app asks for exactly one permission:
- Read and manage events on your Google Calendar — to show your events, and to create, edit, or delete a Google Calendar event when you explicitly choose to (for example, turning on "Also add to Google Calendar" when creating an event, or tapping Edit or Delete on an event that came from Google Calendar). The app never edits or deletes anything on Google Calendar on its own — only in response to an action you take in the app. This scope only covers events; it does not grant access to your Calendar's settings or let the app create or delete entire calendars.
Google API Services User Data Policy. Personal Assistant's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from your Google Account is used only to power the features described on this page, is never sold, and is never used for advertising.
You can revoke access at any time — either from Settings inside the app (Sign Out) or from your Google Account's third-party access page.
On-device permissions
These are standard iOS permissions the app asks for the first time each feature is used. You can review or revoke any of them in iPhone Settings → Personal Assistant.
- Calendar & Reminders — read and create events and reminders in Apple's own apps through EventKit. The app doesn't copy them anywhere else.
- Camera & Photo Library — to photograph food labels, meals, receipts and statements. Text is read on your phone with Apple's Vision framework. A photo is sent to Google only if you use an AI feature that needs the picture (meal photos, nutrition labels, receipts or statements you choose to read with AI).
- Microphone & Speech Recognition — for voice commands and hands-free Cook Mode ("next", "back"). Apple's Speech framework turns speech into text. There is no always-on listening for a wake word. Cook Mode listens only while it's open.
- Location — only for the Calendar's "leave by" advisory, which compares your location to an event's address through Apple Maps. Not logged or used anywhere else.
- Apple Health — heart rate, active energy, steps and workouts, sleep, heart rate variability and resting heart rate (the last two, and heart rate while you are resting, used only for the optional Daily Energy and stress score, worked out on your phone), and cycle data, only the types you allow. It stays on your device (and in your own iCloud if you turn sync on). It is never included in an AI request or sent to us. If you allow it, the app can also write your logged meals, period days and the workouts you complete or log in the app to Health (and, if you turn on Record on Apple Watch, your watch records and saves the workout, with its heart rate and calories); saving workouts can be turned off in Fitness settings.
- Notifications — to alert you before food expires, for reminders, and for things like a bill-split payment claim.
Other services this app talks to
A few features send a specific piece of information to a third-party service to do their job. None of them receive your Google Account data or anything beyond what's listed in the table above:
- Google Gemini (AI Studio) — receives what you send through the AI features listed above. Requests go straight from your phone, using your own key, to Google. Google's own terms and privacy notice govern what Google does with it, and those terms can differ between free and paid keys — including whether content may be used to improve Google's products or reviewed by people. Please read the terms for the key you use: Google's Gemini API terms. We don't control or see these requests.
- Firebase (Google) — our backend for accounts, plan status, device list, crash reports, sharing and a few small server functions (sign-in, subscription checks, journal PIN reset email, food lookups, adding a missing product to Open Food Facts).
- USDA FoodData Central — public nutrient database. Food names are forwarded to it through our server.
- Open Food Facts — a scanned barcode is looked up in this free, public database. If a product is missing and you choose "Add It", the label facts and photo you provide are contributed to it under the app's own account.
- Stripe and Apple (In-App Purchase) — payment processing, under their own privacy terms.
- Apple — Maps/MapKit (leave-by advisory), Speech (voice), CloudKit/iCloud (sync, if you turn it on) and Health.
- Websites you import from — when you import a recipe or workout from a link, your phone loads that page directly from the site.
There is no analytics or advertising SDK in this app, and no data broker relationship of any kind. Crash diagnostics come from Apple's MetricKit and are sent only to our own backend.
Where your data actually lives
Shopping lists, food inventory, saved recipes and workouts, budget entries and receipts, meal plans, your journal and its photos, weight and nutrition logs, product scans and the weekly fitness and nutrition reports the app makes for you are stored on your device using Apple's SwiftData framework. If you turn on iCloud sync (Settings → iCloud Sync, off by default), the same data is also kept in your private iCloud so your devices stay in step. We cannot see or access it. Device backups may include it too, under Apple's terms.
Our own Firebase project holds: your account and plan record, your device list, crash reports, a short-lived journal-PIN reset code, and anything you choose to share with other people (shared budgets, food inventories and bill splits). It exists to run the app, is never sold, and is never used for advertising.
Your Google Account access token is managed entirely by Google's Sign-In SDK on your device. We never receive your Google password or a copy of your token.
Your controls
- Choose AI or not. Receipts: each scan asks whether to read the total, read the items, or read it on your phone with no AI. Bank statements: each CSV or PDF import asks whether to use Gemini or keep it on your phone. Everything with an AI option also has a manual way to do the same job.
- Your own Gemini key. Settings → Gemini API Key. AI features work only with it, and its usage is tied to your own Google account. Remove it any time to turn all AI off.
- iCloud sync — Settings → iCloud Sync, off by default.
- Sharing — turn off a shared budget, inventory or bill-split link at any time; for a live link, that deletes the published data immediately.
- Disconnect Google Calendar — Settings → Sign Out, or revoke access from your Google Account settings.
- Back up or move your data — Settings → Backup & Restore writes everything the app stores to a single file you keep, and can restore from one.
- Delete your data — delete items in the app, or delete the app to remove what's stored on the phone. Delete Account in Settings removes your account record from our backend immediately, or email Caitlin@derivellc.com.
- Revoke device permissions — iPhone Settings → Personal Assistant → Camera, Microphone, Speech Recognition, Location, Calendars, Reminders, Health or Notifications.
Children's privacy
Personal Assistant is not directed at, marketed to, or knowingly used by children under 13. It's a personal productivity tool designed for a general adult audience.
Changes to this policy
If what the app accesses or how it's used changes meaningfully, this page will be updated and the "Last updated" date above will reflect it. September 30, 2026: rewrote this policy to cover the AI features added since September 22 (photos and text sent to Google, voice requests, Nutrition Coach, imports, bank statements), the on-device choices for receipts and statements, optional iCloud sync, sharing, device and account records, USDA lookups, and Apple Health; removed the Managed AI add-on, which no longer exists. October 1, 2026: added that workouts you complete or log in the app can be saved to Apple Health, and, if you turn on Record on Apple Watch, that your Apple Watch records the workout (heart rate and active calories) and saves it to Health, and that if you turn on Daily Energy the app reads your heart rate variability, resting heart rate and heart rate while resting from Health to estimate energy and stress on your phone. October 2, 2026: added that the Fitness Coach asks AI which muscles an exercise works (exercise names only) and that you can swap an exercise for a similar one with AI, that Look Up a Restaurant Item searches a menu database built into the app (public-domain MenuStat data from 2018) on your phone, with nothing sent anywhere (an AI estimate for an item that isn't in it sends only the name you type to Google, like any other estimate), and that when you open a workout the app asks AI for a written explanation of its exercises (exercise names only), and that the app makes weekly fitness and nutrition reports from your own logs, on your phone, with no AI and nothing sent anywhere. Continuing to use the app after a change means you accept the updated policy.
Contact
Questions about this policy or your data — Caitlin@derivellc.com.