[obvious-autobuild]

What

Privacy and data-flow map for the iOS app and the gemini-agent backend, audited at main @ 1151588d6bc6f5dcc3e848b6115813ff36ffbf0d, plus the still-open backend-default decision (keep cloud on by default / opt-in / remove) with a recommendation and what would reverse it.

Covers

• All six outbound flows (trigger, destination, identifiers sent, payload, local fallback): backend recipe generation, direct Gemini API fallback, reverse-scan cloud re-ranking, the live assistant WebSocket, notification-plan sync (the only flow on without a per-use action), and HealthKit.
• Backend retention and logging: live-session store modes and fields (incl. latestCameraFrame, lastUserMessage, mutation audit), tool-argument tracing, webhook body logging, no auth on /v1 routes.
• Local-only storage: SQLite tables, MealPhotos JPEGs, scan-run diagnostics, on-device Vision inference.
• User controls: what Settings → Data & Privacy reset deletes (5 tables) and what it misses (photo files, scan diagnostics, inventory, the persisted installation UUID, anything server-side).
• Open PR heads: which of the 10 open PRs touch data-flow surfaces (fix(ios): save failed scans and show them in the scan report #13, fix(ios): stop camera labels resolving to unrelated foods and record failed Vision requests #8, feat(ios): let meal-photo confidence set how much the user confirms #5, fix(ios): make the scan-to-meal loop work and log what was confirmed #4) and what changes on each; none alter the default-on posture or add destinations.
• Unknowns separated from findings: deployed sessionStore mode, provider retention, log retention, no account system exists.

Every factual claim carries a file:line ref. docs/check_refs.py re-verifies all 119 refs (113 on the audited main SHA, 6 on PR heads via git show):

python3 docs/check_refs.py
# OK: all 119 refs verified (113 on main@1151588d, 6 on PR heads).

Not included

No behavior changes. The keep/opt-in/remove analysis is documentation only; the recommended follow-ups (redact tool-arg/webhook logs, TTL for the live-session store) are named in the doc and deliberately not implemented here.

Verification

• python3 docs/check_refs.py passes on this branch (working tree at the audited main SHA).
• PR-head refs verified against git show <head-sha>:<path> for fix(ios): save failed scans and show them in the scan report #13 3e6d321f, fix(ios): stop camera labels resolving to unrelated foods and record failed Vision requests #8 a9df6aa3, feat(ios): let meal-photo confidence set how much the user confirms #5 30f34184, fix(ios): make the scan-to-meal loop work and log what was confirmed #4 8c9c88fe.
• Docs-only change: no app/backend code touched, no build impact.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8af95980-ba0a-4624-a56a-b1b7698c3b3d

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}