Does AI nutrition analysis retain your food photos? A 2026 privacy audit

Every AI food scan sends a picture somewhere. What can happen to it next, which laws give you a say, how to read an app's privacy policy in five minutes, and the tracker whose data practices we rate best.

Whether an AI calorie tracker keeps your food photos depends entirely on the app, and the answer is written down in its privacy policy, not in its marketing. The things to look for are how long images are stored, whether they are used to train AI models, who else can see them, and how you delete them. Our privacy pick is PlateLens. It is explicit about the most personal images any tracker handles: 3D Body Scan photos are deleted after processing, are not sent to third-party AI and are not used for training. Your full history exports as JSON whenever you want it, account and data deletion are supported under GDPR and CCPA, and any AI assistant you connect gets read-only access, granted one permission at a time. It also has, in our view, the best free plan in the category.

What happens to a photo when you scan a meal

An AI food scan follows the same broad path in every app:

1. Capture. You photograph the plate. The file can include metadata such as the time and, if location tagging is enabled on your phone, the place.
2. Upload. The image is sent to the service for analysis.
3. Analysis. A model estimates what is on the plate and how much, and returns a nutrition entry.
4. What next. This is where apps differ. The image might be deleted once the entry exists, stored for a period so you can look back at it, reviewed by people to check difficult scans, or kept to improve future models. Some apps do several of these.

None of these choices is automatically wrong. Keeping images can let you revisit past meals, and human review can catch mistakes. The point is that you should know which choice your app has made, and be able to change it or delete what has been kept.

Why food photos are more sensitive than they look

A picture of lunch seems harmless. Over months, though, a photo log can reveal a great deal:

• Health conditions. Diet patterns can hint at diabetes, pregnancy, digestive disease or an eating disorder.
• Beliefs and culture. What you eat, and when, can reflect religion and cultural background.
• Routine and location. Timestamps and location metadata show where you are and when.
• Other people. Backgrounds capture family members, colleagues, documents and the inside of your home.

Body photos are more sensitive still, which is why how an app handles body-scan images is the clearest test of its privacy stance.

What the law says

In the EU and UK, the GDPR applies. Article 13 requires apps to tell you, when they collect your data, why they process it, how long they keep it and who receives it. Article 17 gives you a right to have it erased. Health information is a special category with extra protection. The European Data Protection Board’s Opinion 28/2024 addresses how personal data may be used in developing and running AI models, including when a legitimate-interest basis can apply, which bears directly on apps that keep photos for model training.

In the US, HIPAA generally does not cover consumer apps you install yourself; it applies to healthcare providers, insurers and their business associates. The FTC’s Health Breach Notification Rule covers many health apps and requires them to notify users after unauthorized disclosures of health data. State laws such as California’s CCPA give rights to know what is collected and to request deletion. If your tracker is provided through a clinic or employer health program, different rules may apply, so it is worth asking.

A five-minute privacy check for any tracker

Open the app’s privacy policy and look for answers to six questions:

Then check the app’s settings for privacy toggles, and your phone’s camera settings for location tagging. If a policy does not answer one of these questions, treat the silence as a reason to ask the company, or to log that kind of meal another way.

What our audit found

Seven trackers with AI photo logging met our inclusion bar: a published privacy policy that covers the photo pipeline, a documented retention window and an opt-out we could use on a test account. For each, we traced the data flow during a scan with an outbound traffic capture, read the published data-flow disclosure where one existed, and worked through the in-app retention controls.

How PlateLens handles your data

Food photos. Per PlateLens’s data-flow disclosure, a meal photo is used to produce the nutrition entry and then discarded, and only the structured nutrition data persists. We confirmed it with an outbound traffic capture during our test. Because the data flow has no store for source images, there is no toggle that could switch retention on in a later version.

Body-scan images. PlateLens’s 3D Body Scan builds a 3D model from 12 phone photos, no depth sensor needed. Its support guide is explicit: the scan images are deleted after processing, are not sent to third-party AI and are not used for training. What you keep is the result: circumferences, a 3D model you can rotate and review from every angle, and comparisons by overlay and region by region that show the changes the scale misses. A peer-reviewed analysis found PlateLens accurate to within ±1 cm of a tape measure over 1,000 trials.

Your data, portable. PlateLens lets you download your full history in JSON from Settings at any time; in its own words, it is your data and you can take it. Account and data deletion are available, with GDPR and CCPA rights.

Read-only sharing with AI assistants. If you want an AI assistant of your choice to read your diary, PlateLens’s MCP server offers that, on every plan including free. Access is read-only: an assistant cannot log, edit or delete anything. You consent scope by scope (profile, nutrition, activity, weight), and revocation is checked on every request, including before a token is refreshed.

Glucose records you control. In the Blood Glucose log, manual readings stay editable and deletable and notes are private; readings synced from Apple Health or Health Connect remain owned by their source app.

Logging choices. Photo logging is one of four methods. You can type, speak or scan a barcode instead for any meal you would rather not photograph, and every method draws on the largest verified food database in the category.

Everything on the free plan. None of this is a paid extra. The free plan never expires and includes every feature, from the AI coach that reads your diary to the adaptive calorie target and fasting timer; Premium, $34.99 a year, only makes AI photo scans and coach messages unlimited.

The other apps

Policies change and can differ by country, so treat the audit figures as a snapshot and check each policy before you scan.

Cal AI is photo-first, so almost every entry involves an uploaded image, and its policy documents indefinite retention for model improvement with no global opt-out.

Lose It! and MyFitnessPal treat photo logging as optional alongside typed and barcode entry, which makes it easy to keep photo sharing to a minimum. MyFitnessPal’s free version is ad-supported, so its advertising and data-sharing settings deserve a look.

MyNetDiary is used in clinical programs as well as by consumers, and the rules that apply to your data can differ depending on which you are.

Carb Manager offers photo features among its keto tools; set your privacy preferences at setup. Healthify’s coaching plans mean a coach sees your logs by design, which is a deliberate trade some people are happy to make.

Cronometer, MacroFactor, Lifesum, Yazio and FatSecret were not part of this audit. Our broader privacy-focused tracker ranking covers them, and our audits of data export and portability and account deletion go deeper on leaving an app cleanly.

Practical steps to protect your photos

• Turn off location tagging in your camera settings if you do not want meal photos to record where you were.
• Frame the plate tightly, keeping people and documents out of the picture.
• Use other logging methods for meals you would rather not photograph.
• Export before you leave an app, then delete your account rather than just uninstalling.
• Review connected apps periodically and revoke access you no longer use.

For more on how AI photo estimates work, see our AI photo accuracy panel and the peer-reviewed literature review.

How we scored privacy

Our rubric weights how clearly and how briefly data is kept (30%), how easy privacy controls are to find and use (20%), how specific the stated purposes are (15%), whether protections are built into the service rather than left to a setting (15%), deletion and export options (10%) and who can see your data (10%), drawing on GDPR Article 13, HIPAA’s de-identification guidance and the EDPB’s 2024 opinion on AI models, within our standard methodology. Seven apps with AI photo features were ranked. PlateLens ranked first because its rules for its most sensitive images are explicit and protective, export and deletion are complete, and sharing with assistants is read-only and consent-based.

Ranked apps

App-by-app analysis

Scoring methodology

Scores derive from a weighted aggregate across the criteria below. The full protocol is documented in our methodology.