Privacy policy

Tembilo · Effective: 17 October 2026

The app's Policies and licences page provides offline documents. The website links below require internet access.

Provider and scope

Tembilo is provided by the individual developer Yu Lu. It is a food diary with daily limits you set yourself. The initial release is free, for users aged 16 and over in Australia on iPhone and iPad, in English and Simplified Chinese. Support and privacy contact: [email protected]; website: https://tembilo.fogtide.games. This policy covers the app, that website and support correspondence.

The app has no account, developer-operated app server, large language model, advertising, tracking or analytics SDK. Ordinary logging, built-in food search and history viewing run on your device; the developer cannot remotely read or change its database. We do not sell personal information or use it for targeted advertising. Support email, optional online lookup and external sharing are described separately below. Local storage, individual status and free access do not limit rights under applicable privacy law.

Local records and permissions

The app stores on your device food names, portions, energy, protein, carbohydrate and fat values, other nutrient values you record, water and coffee amounts (mL or cups), meal categories, entry dates, times and time zones, lower and upper limits you enter with their effective dates and days of use, My foods, recent items, favourites, source snapshots, and settings such as language and units. You can log before setting any limits. The app does not request or collect personal physiological information, calculate limits from it, or read or write Apple Health/HealthKit data. Records and settings remain in the local database and are not sent to the developer. An identifiable food diary may still be information protected by applicable law.

The device also stores food booklet identifiers, titles, cover designs and ordered references to favourites, without separately copying nutrient values; this statement does not apply to unparsed import text. Today's summary is generated locally from existing records for that day. It does not retain skip, completion or streak states, and is not sent to the developer or third parties.

To avoid data loss, unrecognised or damaged food booklet imports are retained as original text, which may include additional fields. This text stays only on your device, is not uploaded, and is included in JSON exports. It can be repaired through a valid overwrite import or cleared with “Delete all data”.

Manual logging and the built-in AFCD/USDA library work offline. Camera permission is optional and only recognises barcodes locally; frames and photographs are not uploaded. Declining it leaves manual entry and local search available. These functions do not request contacts, microphone, advertising identifiers or device location.

Optional Open Food Facts lookup

Only after you choose and agree to online lookup does the app send a barcode and necessary HTTP parameters to Open Food Facts (OFF) over HTTPS. The User-Agent contains the app name, version and our support email, identical for all users; your device may also add standard headers such as your language preference. OFF is an independent organisation based in France. Requests do not include your diary, portion, meal category, photographs, account or unique installation ID. The recipient also receives your IP address and ordinary connection information. A barcode lookup does not establish that you ate or bought the product.

OFF independently handles its data and connection information under its privacy policy. That policy states that visit logs including IP addresses are kept for 3 years for security, technical analysis and popularity measurement; it does not say whether anonymous API requests are covered, so we treat your lookups as possibly retained by OFF on that basis. OFF lists French hosting providers; we cannot guarantee every processing location and do not promise immediate deletion. Requests about information held by OFF may be sent to [email protected] under its policy. Agreeing to lookup does not waive applicable cross-border disclosure or other privacy protections. Because OFF may associate lookups with your IP address, our App Store privacy label declares Search History as linked to you.

New queries require internet access. The app does not bundle an OFF product database or maintain a separate offline product cache. Saved records, recent items and favourites retain selected product fields, barcodes and source snapshots locally for offline reuse, without automatic online refresh. Reuse and exports must retain contributor attribution, product links and licence notices. The app does not automatically publish or upload your private diary to meet open-data licensing requirements. Protect private content and consider third-party data licences when sharing files yourself.

You can decline lookup and continue local logging, or withdraw online permission in Settings. Withdrawal stops future queries without deleting saved records, favourites or information already received by OFF. If saving the choice fails, retry as prompted by the app.

Export, deletion and backups

In Settings you can export CSV/JSON or delete the current device's app records, self-set quotas and limits, My foods, favourites, source snapshots and preferences.

Booklets and their member relationships are included in JSON/CSV exports and deletion of all local app data. JSON supports backup import; CSV is for export. If you choose to save or share these files, booklet information is also passed to the selected destination. Local deletion does not recall external copies.

The app cleans up temporary exports it manages; retry if cleanup is reported incomplete. Deletion cannot recall separately saved or shared files or delete existing backups or OFF server records, and does not guarantee forensic irrecoverability.

The app provides no cloud sync or developer cloud recovery. The local database uses iOS backup exclusion and temporary exports are placed in the app cache; those settings cannot guarantee that existing backups or system migration contain no copies. Files you choose to save or share are handled by the selected destination and need separate protection or deletion. Do not rely on system backups to restore app records.

Local security

A device passcode and operating-system app isolation help protect local data. Using a database does not imply additional app-level encryption, and we cannot promise absolute device security. Keep the system updated and take care with shared or compromised devices. We use reasonable safeguards for support information we hold and restrict access to people who need it to handle the issue.

Support email and website

A support email link opens your own mail app without automatically sending records. The developer and mail providers receive the address, message and attachments you choose to send; local storage does not apply to those emails. Messages to [email protected] are forwarded through Cloudflare Email Routing, with routing, authentication and delivery-log processing. Cloudflare (United States) routes messages to the developer's Gmail (Google) mailbox, which may store them in the United States and other countries. Correspondence is used only to respond, investigate, handle privacy requests and meet legal obligations, not for marketing. Messages may contain health information, which is sensitive information; provide only what is needed to resolve the issue and avoid full diaries, sensitive attachments or identity documents.

Support information is retained only for the issue, necessary follow-up or applicable legal requirements, and deleted or de-identified when no longer needed and legally permitted. Unsolicited sensitive information is assessed for lawful retention; information that cannot be retained is deleted or de-identified as soon as practicable where lawful and reasonable. You may request earlier deletion. Where particular information must be retained by law, we explain the basis, period and access/correction options where permitted. We do not treat every support email as a medical record requiring long-term retention.

This site has no tracking scripts, analytics tags, external fonts, embedded advertising or application cookies. The site is hosted on Cloudflare Pages; the host receives IP addresses and request metadata to deliver and protect the site and may process them in the United States and other operating locations; see Cloudflare's privacy policy. Visiting the site cannot retrieve the app diary. External links load their destinations only when followed.

Age and alcohol entries

The app is for users aged 16 and over. Food data may display alcoholic product names and composition; the app does not sell alcohol or encourage drinking. The product age limit does not establish the legal age to buy or consume alcohol locally. Age confirmation is an immediate self-declaration, without collecting exact age, date of birth or identity documents; it is not independent identity verification. Users aged 16–17 have the same self-set limits and logging flow.

Users under 16 should stop using the app and delete local records. An assisting adult needs appropriate authority; this policy does not automatically authorise a parent to access, share or delete another person's records. Contact [email protected] about a minor's information received through support. Where consent is required, understanding and appropriate representative authority must be considered.

Access, correction and complaints

You can review, correct, export and delete local records and settings in the app. The developer cannot operate your database remotely. For information held through support, request access, correction or deletion at [email protected]. We request only reasonable, necessary verification and explain any lawful refusal.

Send privacy complaints to that address. We aim to respond within 30 days, with applicable statutory deadlines taking priority. Within their respective jurisdictions, you may seek help from the OAIC, Victoria's Health Complaints Commissioner, the NSW Information and Privacy Commission or the ACT Human Rights Commission. Contacting support is not a prerequisite to other remedies; requests about information held independently by OFF use its channels.

Policy changes

Website revisions show the actual update date, and the app includes offline text for its version. Material changes introducing new data handling must be explained in the app beforehand, and processing requiring consent must not start before it is obtained. A website revision or app update does not itself authorise new processing or remove accrued rights.