Yours to run.
Yours to change.
Yours to keep.

NutriCore runs on hardware you own, against a PostgreSQL you own. There is no account with anyone, no telemetry, no analytics, and in the default configuration not one request leaves the container — the food databases it searches are already inside it.

The security work is the ordinary, boring kind: passwords hashed with Argon2id at OWASP parameters, session tokens random 256-bit values of which only a SHA-256 hash is stored, and registration by invitation after the first account. Scan images are discarded once the estimate exists. And the door out is a route, not a support request: the whole diary as JSON, or day and weight histories as CSV, whenever you want them.

57 documented settings in one .env. Every food source can be switched off independently, the AI and the web research are off until you fill in an address, and the interface language, the upload ceiling and the invitation lifetime are all yours to set.

The personalisation goes further than a preferences screen usually does. The calculated energy target can be overridden outright, and any nutrient in the catalogue can carry a goal you set yourself — not just protein, carbohydrate and fat, but fibre, iron, iodine, whatever you are actually watching. Targets are versioned rather than replaced, so changing one keeps the history of what it used to be.

Sources are consulted in tier order — what you already have, then the bundled reference databases, then the network ones. The traversal stops on the first candidate that is both an identity match and complete enough to log.

Similarity is not enough, and it is the reason the rule is written down in one testable place: Nutella is 0.8 similar to a dozen BLS entries for nut spreads, so a similarity threshold would mean no German search ever reaches a branded product. Tier order decides who is asked; ranking decides how answers are ordered. The two are kept apart on purpose.

Mifflin–St Jeor for basal rate, the standard activity multipliers, a conservative goal adjustment. Every intermediate value is kept, so the day's number can be traced back through the multiplier and the adjustment that produced it — or replaced outright with your own.

The guardrails are part of the calculation rather than a warning printed next to it: an automatic adjustment is capped at 500 kcal, an automatic target never falls below 1.200 kcal, and pregnancy, breastfeeding or an age outside the formula's population return medical-guidance-required instead of a target. An override you set yourself is still honoured, so the diary stays usable.

Two silhouettes give a breadth and a depth at the same height. The circumference of that cross-section is the perimeter of an ellipse. There are no learned weights anywhere in it, so there is no training population to fall outside of — and the photographs never leave your instance.

Heights are the same BODY_LANDMARKS the drawn figure is built from, so a scan and the figure it feeds answer to one model of where a waist is. Nothing here has been validated against a tape measure — which is exactly why every result carries an interval and the interface never presents one as a measurement.