Half a Berry — Privacy Policy

Effective date: November 12, 2026

us on earth Inc., South Korea, operates Half a Berry. This policy covers our app, halfaberry.com, waitlist, and related account and support services.

Contact: hello@halfaberry.com · +1 (332) 239-4312 Mailing address: 131 Continental Dr, Suite 305, Newark, DE 19713, US Privacy contact: Brian Shin, CEO

The Consumer Health Data Privacy Policy provides additional information about applicable US health-data rights. Our Terms of Service govern use of the Service. Accepting the Terms or reading this policy does not replace consent required for particular processing.

1. Information we collect and why

We receive information you provide, information from your chosen sign-in provider, technical records generated by the Service, and results of AI tasks you request.

A nickname does not need to be a legal name. Please avoid sending unnecessary child or health details in support messages or waitlist feedback.

Apple and Google sign-in. If you sign in with Google, we request only Google's basic sign-in permissions (openid, email and profile). Google then provides your Google account identifier, email address, name and profile photo link. We use the identifier and email address to create your account, sign you in and contact you about your account. Our authentication provider stores the name and profile photo link with your sign-in record; the app does not display them or use them for your child's profile. We do not request access to Gmail, Calendar, Drive, contacts or other Google data, and we do not sell Google sign-in information or use it for advertising. If you sign in with Apple, we request only your email address, which can be an Apple private relay address.

We do not currently analyze saved setup answers for product-needs research. We do not reuse identifiable or linkable family records for routine AI-quality evaluation or model improvement. Processing necessary to deliver a requested feature, investigate a specific support request or protect the Service is limited to those purposes.

Subscriptions. Half a Berry Plus is sold through Apple's App Store, and we use RevenueCat to manage subscriptions. Apple handles payment; we do not receive your card or payment details. To link a purchase to your account, the app gives RevenueCat a random account identifier (not your name or email address). RevenueCat receives the purchase and subscription records for that identifier from the app and from Apple, including Apple transaction identifiers, the plan, purchase, renewal and expiry dates, the price, and your App Store country. Our servers then ask RevenueCat whether your account has an active subscription and keep only that answer and its expiry date. We do not send RevenueCat your child's information, journal, photos or setup answers.

2. Providers and disclosures

We use the following providers for the purposes described below. They receive the information needed for their role. A provider may also process limited information for its own legal, security or account-management obligations under applicable terms.

Access is limited to authorized personnel who need information to operate, secure or support the Service. We currently have no affiliate recipients. We may disclose information when required by law or under a specific lawful exception. A business transfer remains subject to applicable privacy law and does not itself authorize new uses of personal information.

We do not sell app personal information or use child health or feeding information for advertising or audience targeting. Website advertising measurement may constitute sharing or a sale under some US laws; applicable choices are described below.

3. Optional AI features

Food suggestions. We send the selected meal photo through OpenRouter to Google Vertex AI. We resize it and remove embedded metadata before transfer. We do not add your child's name, birth date, age, setup answers, reactions or journal history as prompt context. The visible photo may still contain faces or other personal information. Failed or slow requests may be retried.

Meals and suggestions may be saved as Needs review before you confirm foods and intake. If you never save a photo meal, we delete it and its photo from our servers after 7 days. AI output can be wrong; review it before confirming. You can enter meals manually without AI suggestions. Turning off Settings → AI food suggestions stops future transfers for that purpose once the change is recorded; it does not delete the journal or photos you keep.

Profile illustrations. We send your selected cropped photo through OpenRouter to Google to generate an illustration. We then send the generated illustration for an automated output check. We do not add child profile or journal history as prompt context. The source photo may identify your child. Illustrations are synthetic images, not photographs of your child.

Food suggestions and profile illustrations have separate permission settings. You can withdraw illustration permission and remove the illustration in the app. Withdrawal initiates removal of our stored source photo and illustration. A request already sent may finish, and an illustration already being generated may still go through its automated check before it is discarded; withdrawing permission cannot recall information already received by a provider.

Training and retention. We do not use your photos, notes, child profile, setup answers or other family records to train our own AI models. Our requests are configured to reject provider routes that permit training on request data. This does not prevent permitted safety retention, caching or operational metadata processing.

AI processing is not guaranteed to involve zero retention. OpenRouter's Safety Retention category permits abuse-prevention retention of flagged or unflagged requests. Its published Google Vertex policy describes retention of safety-flagged prompts for up to 90 days without training. That is not a maximum for every image, output, cache or metadata record. Security investigations, suspected child sexual abuse material and legal preservation may involve additional retention. See OpenRouter's data-retention information and privacy policy. Contact us about applicable access or deletion rights, including provider-held information.

4. App analytics, website tracking and device storage

App analytics. The app uses PostHog to understand how its features are used, for example where setup is hard to finish and whether food suggestions, search and meal saving work well. The app sends a small, fixed set of events to PostHog's US cloud: setup steps viewed and setup completed; a food-suggestion scan finished, with the number of foods detected and how long it took; a meal saved, with the number of items and whether they came from a scan, search or manual entry; a food search, with the number of results but not the search words; and a custom food added. Each event also carries the time, app version, operating system, an analytics identifier and a two-letter country code taken from your phone's language and region settings. We do not use your IP address, GPS or any location service to work out where you are. Events do not contain names, email addresses, photos, notes, food names, reactions, allergen information or other health answers. Session replay, surveys, feature flags, crash or error capture and location lookup from your IP address are turned off, and the app removes other automatically collected device and session details before sending. PostHog receives the IP address of each request as part of the network connection; our app project is set to discard it rather than store it with events.

Before you sign in, events use a random identifier that is new each time the app opens. After you sign in, the app links events to an analytics identifier our server issues for your account. It is not your account ID or email address, and only authorized personnel can match it to an account. Setup events from the same app session join that identifier, so they can be deleted with the account. App analytics events are kept for up to 24 months, the retention period of our PostHog plan. When you delete your account, we ask PostHog to delete the analytics identifier linked to it and its events; PostHog removes the events in batches, usually within two weeks. Events from app sessions never linked to an account cannot be connected to you and are removed at the end of their retention period.

You can turn app analytics off in Settings → Share usage stats. The setting applies to everyone using the app on that phone. While it is off, the app sends no analytics events and discards any not yet sent. Turning it off does not delete events already sent; email us or delete your account to remove them.

Website tracking. We use PostHog and Google Analytics to understand website use and Meta Pixel for campaign measurement. These services can receive identifiers, IP addresses, page/referrer information and interactions. Tally receives form answers directly and syncs them to Google Sheets; our website's signup event handler does not forward those answers to Meta.

Optional website analytics, recording and advertising technologies stay off until you accept them in Privacy choices at the bottom of the website. You can reject them or change your choice there at any time. Rejecting them does not prevent access to the legal pages or basic website content.

Website session replay, when enabled, reconstructs page interactions to help us understand usability. Private information is masked and sensitive forms and pages are excluded. We do not send child profiles, photos, journal notes, food/allergen identities, reactions or health answers to general analytics. Apart from the app analytics described above, the app does not include a replay or crash-reporting SDK; hosting and authentication systems still produce technical logs.

Setup answers stay on your phone until account hand-over. Drafts, queued files and caches support interrupted work. Unlinked setup checkpoints and queued illustration jobs have a 30-day expiry checked during cleanup; an unopened installation can retain them longer. Recent-photo caches are cleared when you sign out.

Device backups can retain separate copies. In the currently reviewed app, iPhone meal and reaction photos may be included in iCloud or device backups; the local database and queued profile photos are excluded. Android automatic app-data backup is disabled. Account deletion does not remotely erase all offline devices or device backups.

5. Retention and deletion

We consider the purpose, whether an account or request remains active, security needs, applicable law and necessary legal preservation when determining retention. Provider-managed copies and recovery systems may have separate lifecycles.

Hosting, authentication, email delivery and analytics providers retain operational records under their applicable schedules. These records can contain IP addresses, sign-in email addresses, identifiers and request information. PostHog keeps website analytics events for up to 7 years under our current plan; this is separate from replay retention. Resend publishes 30-day email/log retention for Free, Pro and Scale plans and seven-day backups. Legal or security preservation can extend routine periods. We do not promise that all provider records expire within 30 or 90 days.

Support mailbox cleanup is manual. Google's Workspace terms allow up to 180 days to complete an irreversible deletion instruction, subject to the terms and legal retention. Tally states deleted form data is permanently removed within 90 days, with earlier removal available through its Trash controls. Deleting a Tally response does not establish deletion of its Google Sheets copy. AI retention is described in section 3.

Deleting a meal also deletes any reaction recorded with it. This includes the reaction's symptoms, timing, notes, suspected foods and photos. Deleting only a reaction keeps its meal. Photo files are queued for removal from storage, as with other deleted photos.

You can start account deletion in Settings → Delete account or email us. It removes active account and household records, queues stored files for removal, deletes your subscription records at RevenueCat and asks PostHog to delete app analytics linked to the account. It does not automatically submit deletion requests to every other provider; we handle applicable provider requests separately. Our operational target is removal from active systems and relevant processors within 30 days of a valid request. Applicable legal deadlines and exceptions take priority. We explain any lawful extension or retained information.

Copies on closed or offline devices, in separate device account storage, or in backups may remain until their cleanup or recovery lifecycle completes. Uninstalling the app does not delete server records. Account deletion does not cancel a Half a Berry Plus subscription, and Apple keeps billing until you cancel it in Settings › Apple Account › Subscriptions. Apple keeps its own purchase records under its terms.

6. International processing

Our company operates from South Korea. The primary app database and the app and website PostHog projects are in the United States. Tally stores form data in Europe, and Resend stores email data in the United States. Food suggestions use Google's global Vertex AI route, which does not restrict processing to a single country. Illustration generation and output checking request its US route; that does not guarantee that all related metadata or support processing stays there.

Our providers and authorized personnel may process or access information outside your country, where protections can differ. Transfers must have an applicable legal basis and safeguards, such as an adequacy decision or appropriate contractual protections where required. Contact hello@halfaberry.com for information about recipients, destinations, safeguards and how to obtain a copy of applicable safeguards.

You can decline optional AI transfers and use manual journal entry. Saved account services require the hosting and authentication processing described above. Withdrawing a required consent may mean we cannot continue the processing that depends on it; we explain the effect and handle applicable deletion rights.

7. Your rights and regional information

Email hello@halfaberry.com to request access, correction, export or deletion, withdraw consent, object to processing or make a complaint. No new account or special subject line is required. We may request reasonable evidence of identity and authority to act for a child. Export is handled through email rather than an in-app export feature. We respond within applicable deadlines, explain lawful extensions or refusals, and provide available appeal routes. We do not unlawfully discriminate against rights requests.

South Korea. Where PIPA applies, you or an authorized legal representative may request access, correction, deletion or suspension and withdraw consent, subject to lawful limitations. Health information requires separate consent or another applicable statutory authorization. Where consent is required for a child under 14, the legal representative's consent and confirmation are required. Brian Shin is our privacy officer. You may seek help from the Personal Information Protection Commission and applicable privacy-dispute channels.

United States. Depending on applicable law, rights include access, correction, deletion, portability, withdrawal, appeal, and opting out of sale, targeted-advertising sharing or certain profiling. An authorized agent may submit requests subject to appropriate verification. Applicable website opt-outs are described in section 4. We do not use AI suggestions to make decisions with legal or similarly significant effects about you or your child. See our separate Consumer Health Data Privacy Policy.

EEA and United Kingdom. We act as controller where GDPR or UK GDPR applies. We rely on our contract with the adult for account administration, subscriptions and account-related support. For the child's profile, setup answers and journal, including any health information a parent or guardian chooses to record, we process the information because it is needed to provide the journal the parent or guardian asks us to keep. Optional AI features rely on the separate permission you give in the app; special-category processing also needs an applicable Article 9 condition. Optional website analytics, replay and advertising measurement rely on your consent in the website's Privacy choices. Essential website delivery and necessary security records rely on our legitimate interests in operating and protecting the Service, balanced against individual rights. App analytics rely on our legitimate interest in understanding and improving the app; you can object at any time with the Settings switch described in section 4. Duties imposed by applicable EU, member-state or UK law rely on legal obligation.

You may withdraw consent without affecting earlier lawful processing, object to legitimate-interest processing, and request applicable access, correction, erasure, restriction or portability. Withdrawing an optional choice does not remove unrelated features. You can delete records or your account at any time. You may complain directly to your competent data protection authority or the UK ICO. For complaints covered by UK law, we acknowledge receipt within 30 days, investigate, keep you informed and communicate the outcome without undue delay.

Switzerland. You may exercise applicable access, correction, objection and deletion rights and contact the Federal Data Protection and Information Commissioner.

Canada. You may request access or correction, complain and withdraw consent subject to lawful limits. An authorized parent or guardian acts for a child who cannot meaningfully consent. Brian Shin is our privacy contact, including for Quebec requests. You may contact the Office of the Privacy Commissioner of Canada or the relevant provincial regulator.

Australia. Where Australian privacy law applies, you may request access or correction and complain to us. We investigate and explain the outcome. If we have not responded within 30 days or you are dissatisfied, you may complain to the OAIC, subject to its requirements, or another competent regulator.

Mandatory local rights remain available wherever you use the Service.

8. Children, security and changes

Half a Berry is for adult parents and legal guardians. We receive child information from those adults. Contact us if you believe a child directly provided information without proper authorization.

Access controls and protected connections help protect information. No system is completely secure.

We update the effective date and give appropriate notice of material changes. A policy update or continued use does not replace new consent where required.