BiteBud Privacy Policy

Effective date: October 3, 2026

This Privacy Policy explains how BiteBud (“we,” “us,” or “our”) collects, uses, discloses, and protects information when you use the BiteBud iOS application, website at bitebud.net, and related services (collectively, the “Service”). BiteBud is the name under which the Service is provided. For privacy questions and requests, contact [email protected].

1. Scope

This Policy applies to information processed through BiteBud. It does not govern third-party services that have their own privacy policies, such as Apple, Google, or websites linked from the Service.

2. Information We Collect

Information you provide

Depending on the features you use, you may provide:

Profile and wellness information: name or nickname, age, gender selection, height, current and goal weight, activity level, workout frequency, sleep, water intake, goals, motivation, food preferences, dietary restrictions, allergies, and preferred units or language;
Food and activity records: meals, ingredients, nutrition estimates, custom foods, favorites, recipes, fasting records, hydration, workouts, calories burned, weight history, achievements, and challenges;
Photos and camera input: meal, label, barcode, or refrigerator images you choose to capture or upload;
Voice and text input: speech used for meal logging, prompts sent to the AI coach, food descriptions, recipe requests, and feedback;
Optional account information: your account identifier, email address, verification status, and sign-in provider;
Purchase information: subscription status, product identifiers, transaction status, entitlement information, a RevenueCat customer identifier, Pebble balances and spending/reward transactions. Full payment-card details are handled by Apple and are not provided to us;
Community food submissions: food names, brands, serving sizes, nutrition values, corrections, and explanatory notes you choose to submit for review; and
Communications: information you include when contacting support or otherwise communicating with us.

Health and fitness data

With your permission, BiteBud may access steps, active energy burned, and workouts from Apple Health. BiteBud may write weight entries to Apple Health when you log weight while Apple Health sync is enabled.

Health permissions are optional and can be managed in your device settings. We do not use health and fitness data for targeted advertising or sell it to data brokers.

We use these specific HealthKit data types to display activity and calorie-burn information and synchronize weight records at your request. We do not request access to your entire Apple Health record. Revoking access stops future authorized reads or writes; it does not automatically erase information previously imported into BiteBud or weight entries already written to Apple Health. You can delete BiteBud records using its data controls and manage Health records separately in the Health app.

Information collected automatically

We and our service providers may automatically receive:

app interactions, onboarding progress and step timing, feature usage, subscription events, and feedback events;
device and app information, such as device type, operating system, app version, language, time zone, and identifiers generated by the app or our service providers;
diagnostics, crash information, performance data, network information, and error logs; and
approximate location inferred from an IP address, where collected by an infrastructure or analytics provider. BiteBud does not request precise GPS location for its core features.

Product analytics helps us understand how features are used. Onboarding analytics records a pseudonymous installation identifier, step views, completion, time spent per step, app version, language, and purchase-flow outcomes. We do not collect onboarding answers through this analytics system. Recipe and coach analytics include recipe identifiers, opens, saves and logs, helpfulness ratings, confirmed meal-log actions, hashed message references, and response error categories. These analytics do not include meal names, chat contents, photos, passwords, or records read directly from Apple Health. Product event records are retained for up to 90 days, subject to operational cleanup and backup retention.

Feedback submitted through the form in app Settings is stored privately for review and product improvement. We may group related submissions, retain their original wording, and track their resolution. Do not submit unnecessary sensitive personal information.

Catalogue search analytics records normalized search terms, language, search filter, date, result counts, and aggregate timing to identify popular foods and catalogue gaps. These totals are not linked to an account or installation identifier and are retained for up to 90 days, subject to operational cleanup and backup retention.

Notifications

If you enable notifications, BiteBud obtains notification permission and may receive a push token from Apple or Expo. Reminders are primarily scheduled on your device and may include your Bud name and progress information. Widgets and Live Activities can show fasting, nutrition, or weight information on your Home Screen or Lock Screen, where other people may see it. You can manage these features and permissions in BiteBud and your device settings.

3. Where Information Is Stored

Core meal logs, goals, weight and fasting history, preferences, and saved meal photos are generally stored locally on your device. They may also be included in device backups according to your operating-system and backup settings.

BiteBud offers optional online account backup. Device backups and copies you export are separate from this feature.

Optional account backup

If you sign in and account backup is set up, we store selected profile information, meal and activity logs, weight and fasting history, saved foods and meals, challenge records, and recipe preferences linked to your account. Your email supports account assistance. Backups may contain health-derived activity totals and workout details already present in your logs.

Changes are backed up automatically after setup while you are signed in; there is no separate Backup now action. You can restore a backup to recover your records. We retain the current backup and limited previous versions for recovery; these are removed when you delete your online account.

Meal photos are not included in account backup and do not transfer to another phone through this feature. Subscription access and currency balances are managed separately by our purchase provider. Data exports may contain sensitive personal records; protect them and share them only with people you trust.

When you use an online feature, relevant information is transmitted to us or a service provider. For example:

meal or refrigerator photos and related notes are sent to our server for AI analysis;
AI coach messages, dietary goals, allergies, meal history, or other context may be sent to generate a response;
barcodes are sent to Open Food Facts to retrieve product information;
onboarding progression, timing, and purchase-flow analytics events are sent to our server; and
purchase and entitlement information is processed by RevenueCat and the applicable app marketplace.

AI features share relevant input with OpenRouter and the AI provider used for the request, currently including Google and Z.ai. This can include submitted images, descriptions or voice-transcribed text, conversation history, and relevant goals, allergies, meal history, or fasting information. These requests can contain sensitive wellness information. Do not submit another person's information without permission. Provider processing, retention, and any training use depend on the applicable provider policies and settings; we do not guarantee zero retention or exclusion from training in every configuration.

Before you first use these AI features, BiteBud asks for permission to share this information. If you decline, the AI request is not sent. You can withdraw permission in Settings; a new AI request will require your agreement again. Withdrawal does not recall information already sent or cancel processing of a request already submitted.

Using an AI feature sends the relevant input and context to BiteBud and its AI providers. You can avoid those transmissions by using manual logging instead. Stopping use does not erase requests already processed; contact us to request deletion of information linked to you.

Speech recognition is provided through your device/platform speech service. Audio may be processed by that service according to its settings and privacy practices; BiteBud sends the resulting text to its AI service when you request analysis.

Food submissions and correction reports are sent to our server for administrator review. Approved food names, brands, serving sizes, and nutrition values can become available to all users in the shared food catalog. Submission photos are not uploaded by this review feature. Avoid including personal or health information in review notes.

4. How We Use Information

We use information to:

provide food logging, nutrition estimates, goals, progress statistics, reminders, widgets, Live Activities, health synchronization, AI coaching, recipes, and other requested features;
personalize calorie and macro targets, recommendations, and app content;
process purchases, verify entitlements, restore purchases, and provide subscription support;
maintain, troubleshoot, secure, and improve the Service;
understand feature usage and measure onboarding and app performance;
communicate with you and respond to support requests;
prevent fraud, abuse, security incidents, and violations of our Terms; and
comply with law and enforce our rights.

We do not use meal photos or health information for targeted advertising. We do not sell personal information for money.

5. How We Disclose Information

We may disclose information in the following circumstances.

Service providers

We use providers that process information for us or help operate the Service, including:

Meta and TikTok for advertising attribution and campaign measurement when enabled, subject to your applicable permissions and consent;
RevenueCat for subscription and entitlement management;
Firebase Authentication (Google) for optional account sign-in and identity verification;
Apple App Store for purchases, distribution, and platform services;
Expo and platform notification providers for app infrastructure and notifications;
OpenRouter and the selected AI model provider to analyze images, process prompts, and generate responses;
Hosting and storage providers for backups, food information, support, purchase-related operations, and security; and
Open Food Facts for barcode-based food information.

Any third party to which BiteBud discloses user data must provide the same or equal protection of that data as described in this Policy and required by Apple's applicable privacy rules. Providers acting on our behalf must process data only for the authorized purposes and subject to appropriate confidentiality, security, and data-protection obligations. Provider terms and privacy policies supplement these protections; they do not remove BiteBud's responsibility for its disclosures. Their locations may differ from yours.

Legal, safety, and business purposes

We may disclose information when reasonably necessary to:

comply with law, regulation, legal process, or a valid government request;
protect the rights, safety, and security of users, the public, BiteBud, or third parties;
investigate fraud, abuse, or security incidents; or
complete a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets. Where required, we will provide notice before personal information becomes subject to a materially different privacy policy.

At your direction

We disclose information when you direct us to do so, such as when you export and share a backup or connect Apple Health.

We do not disclose Apple Health data to advertising platforms or data brokers.

6. Legal Bases for Processing

If laws in the European Economic Area, United Kingdom, or a similar jurisdiction apply, our legal bases depend on the context:

Contract: processing necessary to provide features you request and administer purchases;
Consent: processing health data, accessing your camera, photos, microphone, notifications, or tracking where consent is legally required;
Legitimate interests: securing, maintaining, analyzing, and improving the Service, provided those interests are not overridden by your rights; and
Legal obligation: processing needed to comply with applicable law.

You may withdraw consent at any time through BiteBud or device settings. Withdrawal does not affect processing that occurred before withdrawal.

7. Retention

Your personal meal photos are automatically removed from BiteBud’s managed on-device photo storage after 60 days. Cleanup runs when the app opens or returns to the foreground, so removal may occur later if you do not open the app. Meal names, nutrition records, and other log details remain until you delete them. Food catalogue images use a separate, size-limited cache and may be downloaded again. This cleanup does not delete originals from your iPhone’s Photos library, or copies in device backups or shared exports.

Other locally stored information remains on your device until you delete it, clear BiteBud’s data, or uninstall the app, subject to device backups.

We retain information processed on our systems only as long as reasonably necessary to provide the Service, meet legal and accounting obligations, resolve disputes, prevent abuse, and enforce agreements. Retention periods vary by data type and purpose. Service providers may retain information according to their agreements with us and legal obligations.

Food-analysis results and related request records are temporarily retained to recover interrupted scans. Recovery is available for 24 hours; removal of expired records may take longer. These recovery records do not contain the original image. A pending scan and its image may also remain on your device until cleared.

AI chat requests and responses may be retained briefly to recover an interrupted response. Saved conversations and meal notes remain on your device until deleted. AI providers and infrastructure services may retain information separately under their policies and applicable obligations.

Account backups remain until replaced or deleted with your online account. Food submissions and review records may be retained for catalog maintenance and abuse prevention. Approved food information is not automatically removed when you delete your account. Contact us if a submission contains personal information you want removed.

Analytics and purchase records may be retained for longer periods in aggregated, de-identified, or transaction-record form.

8. Your Choices and Rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or obtain a portable copy of personal information, and to withdraw consent or appeal a denied request.

You can:

edit profile details and preferences in BiteBud;
delete locally stored BiteBud data through the in-app Delete all local data control;
delete your optional online account through the account controls in Settings, after confirming your identity. This removes the Firebase sign-in account, the current server backup and its retained versions, and BiteBud’s local app data and managed meal photos. BiteBud also clears its scheduled notifications, ends its fasting Live Activity, and returns you to onboarding. Sign in with Apple authorization is revoked as part of that account-deletion flow;
manage camera, photo, microphone, notification, tracking, and Apple Health permissions in device settings;
manage or cancel subscriptions through the marketplace where you subscribed; and
contact us at [email protected] to exercise applicable privacy rights concerning information held on our systems.

Deleting local app data does not automatically delete records held by an app marketplace, analytics provider, subscription provider, or information included in device backups. Contact us if you want us to coordinate deletion of information linked to you on our systems. We may need to verify your request and may retain information where law permits or requires it.

Signing out or uninstalling the app does not delete your online account or server backup. Deleting your account also clears BiteBud’s local data on the device where you complete deletion. It does not delete copies in your iPhone Photos library, previous device backups, exports you have shared, or app data on other devices. Account deletion does not cancel an Apple subscription; manage or cancel it separately through Apple subscription management.

You do not need an online account to request privacy assistance. If you use BiteBud as a guest, you can supply the app's customer identifier from Settings so we can locate relevant purchase or provider records. Do not send passwords, payment-card details, or authentication tokens. We will verify requests in a manner appropriate to the data involved and explain any information that must be retained, such as legally required transaction records. Removing an identifier from your device is not a request to erase records held by RevenueCat or another provider.

You may lodge a complaint with your local data-protection authority. We encourage you to contact us first so we can try to resolve your concern.

United States state privacy rights

Residents of certain U.S. states may have rights to know, access, correct, delete, or obtain a copy of personal information, and to opt out of sale, targeted advertising, or certain profiling. We do not sell personal information for money. Whether analytics constitutes “sharing,” “targeted advertising,” or a “sale” under a particular state law depends on how the Service is configured and used.

To submit a request or opt-out inquiry, email [email protected]. We will not discriminate against you for exercising an applicable privacy right.

9. Tracking and Analytics Choices

BiteBud uses first-party analytics to understand onboarding progression, time spent per step, and purchase-flow outcomes. This includes a random installation identifier, step numbers, timestamps, app version, and language, but not the answers you provide during onboarding. Your onboarding answers are still used to set up your profile and personalize the app and may be included in your account backup; disabling their collection for analytics does not remove these app features. Previously collected analytics answers may remain until deleted or removed under the applicable retention policy. Analytics records are retained for up to 90 days, subject to operational cleanup and backup retention. Historical records previously sent to PostHog may remain under that provider's retention arrangements until removed.

Meta and TikTok may be used for advertising attribution and campaign measurement when enabled. Advertising measurement may involve device identifiers and app or purchase events shared with those providers to understand which campaigns lead to installs or subscriptions. Tracking subject to Apple's App Tracking Transparency framework requires your permission; you can allow or deny the request and change your choice in iOS Settings under Privacy & Security > Tracking.

Denying tracking permission does not prevent core BiteBud features from working or remove access to paid content. We do not attempt to bypass a denied tracking permission with fingerprinting or substitute identifiers. Product analytics is separate from advertising tracking and from camera, microphone, notification, and Apple Health permissions. We do not share Apple Health records, meal photos, chat contents, or sensitive wellness measurements for advertising. Contact [email protected] for privacy requests relating to analytics or advertising records.

Website storage

The website uses browser storage to remember preferences and support site functionality. You can clear it in your browser settings. Where website analytics requires consent, use the website's consent controls. Website choices are separate from the iOS tracking permission.

Feature permissions

Camera access is used to capture images you choose to analyze or attach to meals. Photo-library access is used to select or save images at your direction. Microphone and speech-recognition access support voice input. Notifications support reminders you enable. Declining a permission prevents the feature that depends on it, not unrelated features; for example, you can manually enter a food without camera or microphone access. You can manage operating-system permissions in iOS Settings. A camera or microphone permission controls device access and is not itself permission for every downstream use by an AI provider.

10. Security

We use administrative, technical, and organizational measures designed to protect information. However, no storage or transmission system is completely secure, and we cannot guarantee absolute security.

Information stored locally is protected by the security of your device and operating system. Use a device passcode, keep your operating system current, and protect any exported backup because it may contain sensitive wellness information.

11. International Transfers

We and our service providers may process information in countries other than the country where you live, including the United States. Those countries may have different data-protection laws. Where required, we use recognized safeguards for international transfers, such as adequacy decisions or standard contractual clauses.

12. Children’s Privacy

BiteBud is not directed to children under 13, or a higher minimum age where required by local law. We do not knowingly collect personal information from a child who cannot legally consent to the Service. If you believe a child has provided personal information in violation of this section, contact [email protected] so we can investigate and delete it as appropriate.

13. Third-Party Links and Services

The Service may link to or integrate with third-party services. Their privacy practices are governed by their own policies. We encourage you to review them, including:

14. Changes to This Policy

We may update this Privacy Policy as the Service changes. We will post the updated Policy and revise the effective date. If changes are material, we will provide additional notice or request consent where required.

15. Contact Us

For privacy questions or requests, contact:

BiteBud

Privacy and support email: [email protected]

Website: bitebud.net

You can also find help and instructions at bitebud.net/support.