Think about what’s actually in a food log. Carb counts that track a diabetes diagnosis. A sudden shift to prenatal vitamins. An eating pattern that looks disordered if anyone bothered to look. Alcohol intake you’d rather your insurance company not see. A religious or cultural diet that identifies things about you that have nothing to do with nutrition at all.
A food log is a health record. Arguably a more revealing one than most, because you generate it voluntarily, in detail, every single day. And most nutrition apps treat that record with roughly the same care as a to-do list.
What “syncs to the cloud” actually means
Most tracking apps require an account and sync your log to a server the company controls. That’s the default architecture in this category, and it’s rarely questioned, but it’s worth being specific about what it means: your food log lives on infrastructure you don’t control, governed by a privacy policy that can change, held by a company that could get acquired, shut down, or breached.
Take Cronometer, the category leader. Its privacy policy states plainly that it uses personal information to “develop and display content and advertising tailored to interests,” and that it shares personal information “with service providers, advertisers, and other third parties, including sharing limited information for targeted advertisements.” It also pledges never to sell your data outright, and I believe that pledge is sincere. But “we don’t sell it, we just monetize it through advertising partners” is a distinction that matters less than it sounds like it should. Your eating patterns are still feeding an ad-targeting pipeline somewhere.
I’m not picking on Cronometer specifically here - this is the standard model for the category, and Cronometer is more transparent about it than most. That’s exactly the problem. This is normal. Nobody blinks at it.
The scenario nobody plans for
Here’s the failure mode that doesn’t get discussed enough: what happens to your data when the company behind the app doesn’t survive? Health and fitness apps shut down, get acquired, or quietly pivot business models constantly - and user databases are frequently the most valuable asset left when that happens. A food-and-health dataset tied to millions of real people is worth something to somebody, even if the app that collected it never intended to sell it when you signed up.
If your data lives on someone else’s server, that risk exists no matter how well-intentioned the current privacy policy is. Policies change. Companies change hands. The only architecture that’s immune to this particular failure mode is one where there’s no server holding your data in the first place.
Why offline is a structural difference, not a slogan
This is the actual argument for building Nutrient Logger without an account or a backend: it’s not a privacy feature bolted onto a cloud product, it’s the absence of the thing that creates the risk. There’s no server for your food log to live on, so there’s nothing to breach, nothing to sell if the business changes hands, and no privacy policy update that could someday redefine what “sharing with partners” means for data that’s already been collected.
I want to be precise about this rather than making a blanket claim, because vague privacy marketing is part of what got this category into its current state. Here’s exactly what does and doesn’t leave your device:
Stays on your device, always: everything you log - every food, every meal, every weight entry, every goal. There’s no account, and there’s no server of ours that any of it gets sent to.
Leaves the device, and here’s why: anonymous product analytics (which screens and features get used, so I know what to fix or improve) - these events don’t include what food you ate or any personal details, and aren’t tied to your identity. Barcode scans send the scanned barcode number to the Open Food Facts public database to look up the product - nothing else about you goes with that request.
That’s the honest list. It’s not “zero data, ever” - that claim doesn’t survive contact with how any modern app actually gets built and improved. It’s “no account, no cloud copy of your food log, and nothing that reveals what you actually eat leaving the device.”
The bottom line
You don’t have to assume bad intent from any nutrition app to think the current default - account required, log synced to the cloud, monetized through advertising partnerships - is a bad default for a category that’s collecting this much personal health detail. Most people tracking their nutrition have never read the privacy policy of the app doing it, and if they did, “shares limited information with advertisers” would probably surprise them.
The alternative isn’t complicated. It’s just less common: keep the data on the device that generated it, and don’t build a server to be tempted by, breached, or sold later.
Nutrient Logger tracks 80+ nutrients completely offline - no account, no cloud sync of your food log, ever.