Pit Stop privacy policy

Pit Stop is published by Appalachian Integrity LLC. Last updated November 3, 2026.

The short version. Your saved diary and goals stay on your device (and in your phone's own backup, if you use one). Find food sends the nutrition requirements you enter, any filter you agree to send, the country you picked and, if you allow it, your phone's position to our server to find options, and Pit Stop does not store them. We keep account, subscription and service-use records. AI lookups and menu and label pictures go through our server to Anthropic; its separate retention terms apply. Our server and Anthropic process your data in the United States. There are no ads or advertising tracking, and we do not sell your data. If you live in the EU, EEA or Switzerland, see "Where your data is processed" and "Your rights" below.

Who is responsible

Appalachian Integrity LLC, a Virginia (USA) limited liability company, decides how and why Pit Stop uses your data. In EU and Swiss law that makes us the "controller." You can reach us at john@appalachianintegrity.com.

Most of what we hold comes from the app. Some comes from Apple or Google: your account identifier when you sign in, and your subscription's status, renewal and expiry.

What we store about you

Your Apple or Google account ID: The identifier supplied by the sign-in provider you choose, plus our account and session records. Our account database does not store your provider profile name, email address or profile photo. On iPhone, Sign in with Apple requests no name or email scope. If Apple's authorization-code exchange succeeds, we keep a refresh token so we can request revocation when you delete the account.Used to recognize your account and manage sign-in.
Your ZIP code, if you add one, and your free chains: A ZIP code is optional. If you add one under Account, we keep it and the date you set it. We also keep the chains your free account has unlocked in the United States: a random pick across the country, plus chains near your ZIP if you have added one. In Germany, Switzerland, Italy and Portugal, your free chains are worked out from your account each time, always the same ones, and nothing extra is stored.In the United States, the ZIP is used to find chains near you and as the starting point for distances, unless you choose to measure from your phone's location. You can change it once every 30 days.
Your subscription: The store purchase reference, a hash to prevent one purchase unlocking several accounts, subscription state and expiry, renewal information and reward days. For Apple, this includes the original transaction reference and purchase environment; for Google Play, the purchase token needed for validation.Used to check the subscription with Apple or Google. The store handles payment; we do not receive your payment-card number.
Sign-in sessions: Random tokens, stored only as one-way hashes, that keep you signed in on your phone for up to 180 days.
Menu and label uploads: An account-associated record of each upload: place or barcode, time, page count, result, items kept or rejected, rewards and processing cost. Image processing is described below.Used for upload limits, rewards, abuse prevention and review of incorrect foods.
Menu items you add: Foods read from a successful scan join the shared food database. Internally, they can be connected to the account-associated upload record. Account deletion removes the account link from that upload; shared foods and the upload record remain.
AI lookups: Search text, the app's random device ID, a salted hash of the IP address, time, result and processing information. Signed-in usage can be associated with the account. Do not put health or other personal information into a lookup.Used for monthly limits, abuse prevention and cost control. Database and log retention are described below.
Reports of wrong nutrition: Your reason text, food reference, device ID and hashed IP address. Database reports are configured for removal after 365 days when the purge runs.
A shared lookup cache: Lookup text and its result, including when nothing was found. The cache has no account or device field and is kept for reuse. Do not put personal information into a food lookup or nutrition report.
Operational records: Lookup and upload events, timestamps, results, quota and reward information, processing metrics and technical errors. Operational logs can include AI search text and generated search queries. Our host also keeps access logs with IP address, time and requested address; an ordinary search address can contain search words, the country you picked and the app's random device ID.Used to operate the service, enforce limits and investigate technical problems. Logs are separate from database retention and account deletion.

Why we use it (EU, EEA and Switzerland)

EU and EEA law requires a legal basis for each use of personal data. Swiss law does not ask for one use by use, but we apply the same list to Swiss users.

To provide the app you asked for (contract, GDPR Art. 6(1)(b)): Your Apple or Google account ID, sign-in sessions and stored Apple sign-in token; your ZIP code if you add one, and your free chains; subscription records; answering an AI lookup; reading a menu or label you upload; the nutrition numbers, the country you pick and, if you allow it, the phone's position, for a Find food search; the country you pick, for a food search; barcode lookups.
Our legitimate interests (GDPR Art. 6(1)(f)): Keeping free use and AI costs within limits and preventing abuse (device ID, hashed IP address, AI lookup and upload records); stopping one store purchase from unlocking several accounts (the purchase hash); keeping the food database accurate for everyone (nutrition reports, review of uploads, the shared food database and lookup cache); running the service securely and fixing faults (operational and host logs); a reliable scanner on Android (Google's ML Kit, described below); complying with US legal requirements, such as tax records and valid legal process. You can object to any use based on legitimate interests. See "Your rights."
Find food filters, such as an allergy or a diet (consent, GDPR Art. 9(2)(a)): Filters like these can say something about your health or beliefs. The app asks for your explicit consent the first time a filter would leave your phone, and sends filters only if you agree. You must be 16 or older to agree. You can withdraw your consent at any time with the "Send Find food filters" switch in Account; searches then go without the filter. Withdrawal does not affect searches already made.
Legal obligations under EU or member-state law (GDPR Art. 6(1)(c)): Including answering your rights requests.

What you have to give us. You need an Apple or Google sign-in to have a Pit Stop account; without it we cannot provide the account, Find food or a subscription. Find food also needs your phone's location; in the United States, a US ZIP code can stand in for it. Everything else (location, filters, uploads, AI lookups, reports) is optional, and the diary works without any of it.

Local data and optional location

Your saved diary, goals and custom foods, the filter buttons you make, and your choice about sending filters are stored on your device (and in your phone's own backup, if you use one; we never receive a copy). The editable nutrition requirements used for a Find food search are sent to our server for that search, together with the country you picked and a filter line you add (for example "no burgers" or "peanut allergy") if you have agreed to send filters. Our server reads them for that search and Pit Stop does not store them.
The country you pick in Today's top bar is stored on your device. Until you pick one, the app starts from your phone's language and region setting. When it is not the United States, food searches tell our server the country so they show that country's restaurant menus, and Find food sends it so it searches that country's restaurants. Pit Stop does not store the country with your account. A food search puts it in the search address, so it can appear in our host's access logs; Find food sends it inside the request, which those logs do not record. You can change the country at any time, for example when you travel.
If you enable location, the phone's position is used for a Find food request and is not kept by Pit Stop. Its accuracy depends on device settings. In Germany, Switzerland, Italy and Portugal, Find food needs the position: our server measures from it to each chain's nearest store in that country, in kilometers, for that search only. In the United States without a ZIP code, Find food measures from that position: our server finds the nearest US ZIP area for that search and keeps neither. With the United States picked and no US ZIP code added, Find food shows no options when your phone is more than about 60 miles from the United States. If you add a ZIP code, it is stored with your account and used to select chains and locate options in the United States.
We do not collect your contacts or advertising ID. Pit Stop's account database does not store your provider profile name, email address or profile photo.

Who the data goes to

Apple: On iPhone, Apple supplies sign-in credentials and handles App Store purchases. We validate sign-in and purchase information, can ask Apple's services about subscription state, and request revocation of a stored Apple sign-in token during account deletion. Apple decides how it handles its own services (it is a separate controller), and Apple's own privacy terms apply.
Google: Sign-in: we validate Google's sign-in token. Google's iOS sign-in SDK can collect a user identifier and IP-derived general location for authentication and fraud prevention. Google Play: Google handles Android purchases, and we send the purchase token to its API for validation. Scanner (Android): the barcode and document scanners on Android are Google's ML Kit, run by Google Play services. The camera picture is read on the phone and is not sent to Google for that step. ML Kit sends Google device information (such as model and Android version), scanner settings, performance metrics and error codes, which Google uses to maintain and improve the scanner. The iPhone app does not include ML Kit. Maps: the app does not show a Google map today. If we add one, we will update this policy before it appears. Google decides how it handles its own services (it is a separate controller). Google's privacy policy applies.
Anthropic: AI search text, source material needed for a lookup, and menu or label images selected for reading go to Anthropic's API, which processes them in the United States. Anthropic handles them for us under its commercial terms and data processing addendum (it is our processor) and may not train its models on them. We remove temporary image files from our server during processing. This does not delete Anthropic's copy. Its commercial API policy ordinarily deletes inputs and outputs within 30 days, with exceptions for agreed arrangements, certain services, policy enforcement and legal requirements. We do not claim zero data retention. Our API call does not include your Pit Stop account or device ID as a separate field.
Open Food Facts and USDA FoodData Central: The barcode numbers you scan are looked up there. They receive no account information.
Our web host: Bluehost hosts our server and account database in the United States. Bluehost is run by Newfold Digital and processes this data on our behalf under its hosting terms. Host access logs and our separate operational logs are described above.

We do not sell your data and we do not share it with advertisers. The app has no advertising code, and we run no analytics service. On Android, Google's ML Kit scanner sends Google its own usage metrics, described above.

Where your data is processed

Appalachian Integrity LLC is in Virginia, USA. Our server, account database and logs are hosted in the United States. Anthropic processes AI lookups and images in the United States. Apple and Google run their own services in the United States and elsewhere.

If you use Pit Stop from the EU, EEA or Switzerland, what the app sends goes directly to us in the United States. Anthropic processes personal data for us under its data processing addendum, which includes the European Commission's standard contractual clauses. Bluehost does so under its hosting terms. The EU and Switzerland recognize the United States as giving adequate protection only for companies certified under the EU-U.S. Data Privacy Framework and its Swiss counterpart. You can ask us for a copy of the safeguards; commercial details may be removed.

How long we keep it

Account identity, stored Apple sign-in token, ZIP (if added), free chains, subscription and reward records: until account deletion.
Sign-in sessions: up to 180 days.
Database AI lookup/use records: configured for removal after 90 days; database reports after 365 days. Purging runs at most daily on sign-in and can also be run administratively.
Upload records and shared foods: kept for review and reuse. Account deletion removes the account link from upload records.
Shared lookup cache: kept for reuse without an automatic maximum retention period. It holds no account or device field.
Operational logs: separate from the database purge; no automatic maximum retention period is set by the app. Host access logs and the host's backups follow Bluehost's retention arrangements. A database copy we make before an update is kept only until the update has been checked.
Images on our server: temporary upload files are removed during processing. Anthropic's separate retention is described above.

Deleting your account

In the app, open Account, then choose Delete account.

Deleted: your account, subscription references, stored Apple sign-in token, rewards and sign-in sessions.
Unlinked: upload records lose their account link. Shared foods and unlinked upload records remain.
Associated usage records: the account link, device ID, IP hash and query text are removed from account-associated AI usage records. Date and processing-cost information remain. Reports are unlinked when their device ID can be matched through those usage records.
Exceptions: reports without that usage linkage, shared lookup-cache text and separate operational logs are not automatically erased by account deletion. Contact us for a request concerning those records. Copies held by Apple, Google or Anthropic remain subject to their terms.

For an account with a stored Apple sign-in token, the server requests its revocation after deleting the account record. Account deletion proceeds if that request cannot be completed; revocation is not guaranteed to succeed or be retried.

Deleting your account does not cancel a store subscription. Cancel in Apple Account subscription settings on iPhone, or Google Play subscription settings on Android.

No longer have the app? See how to delete your account without it. To ask us to delete the records that account deletion does not reach, see "Your rights."

Your rights

Wherever you live, you can ask us to:

tell you what we hold about you and give you a copy (access);
correct it (rectification);
delete it (erasure). Delete account in the app does most of this at once; we handle what it does not reach on request;
send you the data you gave us in a common machine-readable format (portability). Your diary is on your phone, and you can already export it from the app;
limit how we use it while a question is sorted out (restriction);
stop using it for a purpose based on our legitimate interests (objection);
withdraw a consent you gave, at any time. This does not affect what was done before.

How to ask. Write to john@appalachianintegrity.com with the subject "Privacy request." Our database does not hold your email address, so tell us whether you used Apple or Google sign-in. We may need to verify that you control the account before we act on a request; if we cannot verify it, we will tell you what we could and could not do. Never send an Apple or Google password. Requests are free. We answer without undue delay, and within one month (for requests under Swiss law, normally within 30 days). If a request is complex, EU law lets us take up to two further months; we will tell you why within the first month.

Records we cannot link to you. Some records hold no account or device field, such as the lookup cache. We do not have to collect extra information only to find you in them. If you ask, we will search for them and, where we can reasonably confirm a record is about you, delete it or give you a copy. We cannot edit our host's own access logs or backups; they expire on the host's schedule.

If you live in the EU or EEA, these rights come from the General Data Protection Regulation (Articles 15 to 22). You can also complain to a data protection authority, in particular where you live or work: in Germany, the authority for your federal state (list of state authorities); in Italy, the Garante per la protezione dei dati personali; in Portugal, the Comissão Nacional de Proteção de Dados; elsewhere, see the EDPB list of authorities.

If you live in Switzerland, the Federal Act on Data Protection gives you the rights of access, data portability, correction and deletion, and the right to object. You can contact the Federal Data Protection and Information Commissioner (FDPIC).

Automated decisions

Pit Stop makes no decision about you based solely on automated processing that has legal or similarly significant effects. The free chains an account unlocks are drawn at random, and Find food lists options by distance and by how closely they fit the numbers you enter; you can change the order.

Children

Pit Stop is meant for adults. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you think a child has an account, the quickest way to remove it is Account > Delete account on their phone. You can also write to us, and we will delete any account we can identify from the details you give.

Security

App requests travel over HTTPS. The database and our credentials are kept outside the website's public files. Apple and Google handle normal sign-in; we do not receive their account passwords.

Changes

If we change how we handle data, we will update this page and its date. For a material change, we will also tell you in the app or in the app's store release notes. Earlier versions are available on request.

Contact

Appalachian Integrity LLC, Virginia, USA
john@appalachianintegrity.com