Privacy Policy

Mithri (formerly Trigger AI) is made by Abraham Shakir. You can reach us at support@mithri.app or through the Support page. This policy explains what information the Mithri app and this website collect, how it is used, who receives it, and the choices you have.

Mithri is not a healthcare provider and does not provide medical care. We are not a covered entity or business associate under HIPAA, and the information you store in Mithri is not protected health information under HIPAA. It is instead protected by this policy, by the Consumer Health Data Privacy Policy, and by the consumer privacy laws that apply to you.

• Account. Your email address, display name, and the identifiers Apple provides when you sign in with Apple.
• Health and wellness. Meals and ingredients you log; symptoms with severity and timing; the symptom categories you choose during onboarding; allergies and foods of concern; height, weight, age, and sex; activity and dietary goals; calorie targets; heart-profile answers; and the associations the app generates between foods and symptoms.
• Meal photographs. Photographs you take or choose when logging a meal, and the ingredient and portion data derived from them.
• Purchase status. Your subscription entitlement status, provided through RevenueCat. Apple handles payment; we never receive your card details.
• Device and usage data. Basic information about your device and how the app is used, collected without third-party analytics SDKs.
• Location (optional). If you allow location access, the app checks your precise location only while you are scanning a meal, to see whether you are at a supported restaurant so it can match the scan against that restaurant’s menu. To do that, the app sends the location to Apple Maps, which returns the name of the place.

• Account — to sign you in, keep your data synced to your account, and respond when you contact us.
• Health and wellness — to run the core of the app: your log, your history, and the associations the app surfaces between foods and symptoms.
• Meal photographs — to identify the foods in a photograph so you do not have to enter them by hand (see section 6).
• Purchase status — to unlock the features your subscription includes.
• Device and usage data — to operate the app and investigate problems.
• Location — only to check, while you scan a meal, whether you are at a supported restaurant.

These are the companies that process data on our behalf, and what each one does. We do not share your data with anyone not listed here.

When you photograph a meal, the photograph is transmitted to third-party AI providers — Anthropic and MiniMax — to identify the foods in it. Photographs are sent without your name, email address, or account identifier attached. One provider, MiniMax, processes photographs outside the United States.

If you would rather your photographs never be processed this way, log by barcode scan or manual entry instead. Neither sends a photograph to an AI provider.

Photographs are re-encoded before upload. Re-encoding strips the file’s embedded metadata, including GPS location, so it never leaves your device.

We do not use advertising SDKs. This website uses Vercel Analytics, which counts page views without cookies and without identifying you. We do not track you across other companies’ apps or websites. We do not sell personal information.

• Account data — while your account is active, then deleted within 30 days of account deletion.
• Health and wellness data — until you delete the item or your account.
• Meal photographs — until you delete the meal or your account.
• Purchase records — kept for accounting after you delete your account. They contain an app user identifier and the purchase details Apple sends us through RevenueCat.
• Device and usage data — until you delete your account.

Data is encrypted in transit with TLS and encrypted at rest. Database records are isolated per account with row-level security, so one account’s records are not reachable from another’s. Your session token is stored in the device Keychain. If a breach of unsecured health data ever occurs, we will notify affected users and the FTC as the FTC Health Breach Notification Rule requires.

• Export. Ask us by email for a copy of your data.
• Correction. Edit anything you have logged in the app, or write to us to correct account details.
• Deletion, per item. Delete any individual meal, symptom, or photograph in the app.
• Deletion, full account. Delete your whole account in the app or by email — the Delete account page documents both routes.

To exercise a right by email, use the subject line “Privacy Request” (see the Support page). We respond within 45 days. Where reasonably necessary we may take one 45-day extension, and we will tell you before the first window ends. If we decline a request, you may appeal by replying to our decision.

Mithri is for adults 18 and older. It is not directed at minors, and we do not knowingly collect information from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

We operate from the United States and store data there. One AI provider processes meal photographs outside the United States, as described in section 6. If you use the app from outside the United States, your information is transferred to and processed in the United States.

When this policy changes, the updated version is posted on this page with a new last-updated date. For material changes to how health data is handled, we announce the change in the app before it takes effect.

This policy is effective October 26, 2026.

Abraham Shakir
support@mithri.app

• What we collect. Only the email address you enter in the waitlist form on this website.
• How we use it. To send one welcome email when you join and one email when the app launches.
• Who processes it. The address is stored with Supabase, and the emails are sent through Resend.
• Never sold or shared. We never sell the address, and we never share it with anyone for their own marketing.
• Leaving the list. The link at the bottom of any waitlist email takes you off the list at once. To have the address deleted entirely, write to support@mithri.app and we will delete it.
• How long we keep it. Until 12 months after the launch email is sent, or until you ask us to delete it, whichever comes first. An address that has left the list is kept only as a record not to email it again.