Privacy Policy

Bite and Balance ("we", "us") provides the Bite and Balance app (the "App"). The person responsible for your personal data (the "controller" under the EU General Data Protection Regulation, GDPR) is Sulaiman Baruwa, Marientaler Straße 24, 12437 Berlin, Germany.

You can reach us about anything in this policy, including privacy requests, at hello@biteandbalance.app.

• We collect what you enter in the App (like meals, fasting, weight and goals) so the App can work for you.
• Health data is especially sensitive, so we only process it with your explicit consent, which you can withdraw at any time.
• We never sell your data and never use it for advertising.
• We use a small number of service providers (for example hosting and AI features) who may only process your data on our instructions.
• You can delete your account in Settings at any time, and access, correct or export your data by emailing us. We reply within one month.

Data you give us:

• Account data: your name and email address from sign-in, and your password if you sign up with email (stored securely by our app platform; we can't see it). If you use Sign in with Apple, we receive the name and email Apple shares with us, which can be a private relay address if you choose "Hide My Email".
• Profile: nickname, age range, height, weight, goals, fasting protocol and eating window, calorie, water and step targets, macro split, allergies and dietary preferences, and unit preferences.
• Health and wellness logs: meals and their nutrition, meal photos (only if you use the meal scanner), barcodes you scan (including a photo of the barcode if it has to be read by AI), food searches, fasting sessions and journal notes, water, weight and body measurements, sleep, steps, activity and workouts, and mood check-ins.
• Planning data: recipes, favorites, grocery lists, meal plans and challenges you join.
• Messages you send to the AI Coach and to our support email.
• Subscription status: whether you have Pro, your plan and renewal date. Payments are handled by Apple or Google in the mobile app, or by RevenueCat and its payment processor Stripe on the web. We never see your full card details.

Data collected automatically: technical data needed to run the App (such as your IP address, device and browser type, and error logs), and usage events that show which features are used, for example that a fast was started, a paywall was viewed or a purchase was completed. These events are linked to your account.

Apple Health data, only if you connect it. See the Apple Health section below.

Data stored on your device: the App keeps a few things on your phone so it works smoothly, such as your settings, whether you have Pro, and reminders you've set. This is strictly necessary for the App and isn't used to track you. If you allow notifications, fasting and meal reminders are scheduled on your device.

We don't use advertising or tracking tools, and we don't track you across other companies' apps or websites.

Most of what you log in the App, such as weight, meals, fasting, sleep and activity, is health data. The GDPR treats it as a special category of personal data that needs extra protection.

We process health data only on the basis of your explicit consent (Article 9(2)(a) GDPR), which you give by ticking a consent box before you log anything, and only to provide the App's features to you: showing your logs and progress, calculating targets, and generating AI responses when you use AI features.

You can withdraw your consent at any time by deleting your logs or your account in Settings, or by emailing us. Withdrawing consent does not affect processing that happened before. Without health data, most features of the App can't work.

• To provide the App and your account (contract, Art. 6(1)(b) GDPR), plus your explicit consent for health data (Art. 9(2)(a)).
• To run AI features you choose to use, like the AI Coach, meal scanner and weekly letter (your consent, Art. 6(1)(a) and 9(2)(a)).
• To keep the App secure, fix errors and understand which features are used, so we can improve them (our legitimate interest, Art. 6(1)(f)). You can object to this at any time.
• To manage subscriptions (contract, Art. 6(1)(b)).
• To meet legal obligations, such as tax records for purchases or answering lawful requests (Art. 6(1)(c)).

You don't have to give us any data, but we need an email address to create your account, and the App can't track anything you don't log.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. AI suggestions in the App are information only.

The AI Coach, meal scanner, meal recommendations and weekly letter use AI models provided through our app platform, Base44, which relies on third-party AI model providers such as OpenAI and Google. The AI Coach is an AI system, not a person.

When you use these features, we send the AI provider what it needs to answer: for example your question, a meal photo, and relevant profile and log data such as goals, calories, macros, fasting status, weight and activity.

Under the providers' terms for business use, this data is not used to train their AI models. Providers may keep requests for a limited period (typically up to 30 days) for security and abuse monitoring before deleting them.

AI answers and calorie estimates can be wrong. Always check important information, and don't rely on them for medical decisions. You can use the App without AI features.

On iPhone, you can choose to connect Apple Health. Nothing is read or written until you connect and allow access in Apple's permission screen.

If you connect, the App can read your daily steps, active calories, sleep and weight from the last 7 days and add them to your logs. If you turn on "Save my weight", weight you log in the App is saved to Apple Health.

Data from Apple Health is stored in your Bite and Balance account and used only to provide the App's features to you. If you use AI features, it may be part of the information sent to generate your answer. We never use Apple Health data for advertising or marketing, never sell it, and never share it with data brokers.

You can turn this off in the App (Me, then Apple Health) and change access in the Health app: tap your profile picture, then Apps, then Bite and Balance.

We never sell your personal data and don't share it for advertising. We share it only with service providers that help us run the App. They may process it only on our instructions and must protect it at least as well as described in this policy (under data processing agreements, as required by Art. 28 GDPR):

• Base44: app platform, hosting, database and sign-in.
• Base44 and the AI model providers it uses (such as OpenAI and Google): AI features, as described above.
• RevenueCat and Stripe: managing subscriptions, web payments and checking Pro status.
• Apple and Google: sign-in (if you choose Sign in with Apple or Google), app distribution, in-app purchases, and on iPhone Apple Health if you connect it.
• Despia and Natively: the technology that runs the App on phones, including sharing and notifications.
• Google Calendar: only if you choose to sync workouts to your calendar.
• Home Screen widget: if you add it, our server sends your current fasting status to the widget through a private link unique to you. Nothing else is shared.
• Open Food Facts: we look up barcodes and food searches there. Our server sends only the barcode number or search words, never your name, account or IP address.
• Unsplash: some meal-plan images load from Unsplash's servers, which means your IP address is sent to them. Our fonts are hosted by us.

We may also disclose data if the law requires it, or to protect the rights and safety of our users or ourselves.

Some of our providers process data outside the European Economic Area, including in the United States. Where this happens, we rely on safeguards recognized under the GDPR, such as the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses. You can ask us for details.

• Your account and logs: as long as your account exists.
• Data you delete in the App: removed from the App straight away. Copies in our providers' backups are overwritten on their regular backup schedule.
• When you delete your account: your data is deleted straight away, and your login is removed within 30 days at the latest.
• Purchase records: as long as tax law requires (in Germany up to 10 years). These contain no health data.
• Usage events: as long as your account exists, deleted with your account.
• Technical logs (such as IP addresses and error logs): kept by our hosting provider for a short period for security and troubleshooting, then deleted.
• AI requests: see the AI features section above.

Under the GDPR you have the right to:

• access the data we hold about you and get a copy;
• correct inaccurate data;
• have your data deleted;
• receive your data in a machine-readable format (portability);
• restrict how we use your data;
• object to processing based on our legitimate interests;
• withdraw your consent at any time, without affecting earlier processing;
• complain to a data protection authority, for example the one where you live or work, or our lead authority: the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, www.datenschutz-berlin.de).

To use any of these rights, email hello@biteandbalance.app. We reply within one month. We may need to confirm it's really you before acting on a request.

You can delete your account and all your data yourself at any time in Settings, under Delete Account. Settings also lets you delete only your logs. You can withdraw permissions you gave on your phone (Apple Health, camera, notifications) at any time in your phone's settings.

We do not sell personal information and do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information, including health data, for any purpose other than providing the App to you.

Depending on the state you live in (for example California, Washington, Colorado, Connecticut, Virginia or Nevada), you may have rights to know what we collect, to access, correct and delete it, to obtain a copy, and not to be discriminated against for using these rights. The categories of data we collect, their sources and purposes, and the categories of recipients are described above.

Consumer health data: we collect consumer health data only to provide the App's features you ask for, and share it only with the service providers listed above. You can access it, delete it, and withdraw your consent at any time.

To make a request, email hello@biteandbalance.app with the subject "US privacy request". You may use an authorized agent. If we deny a request, you can appeal by replying to our answer with the subject "Appeal".

Data is encrypted in transit and stored with providers that use industry-standard security. Your logs are only visible to your own account, except things you choose to share, such as joining a challenge. No system is completely secure, but if a breach puts your rights at risk, we will tell you and the authorities as the law requires.

The App is for adults aged 18 and over, because it includes fasting and calorie tracking. We don't knowingly collect data from anyone under 18. If you believe a minor is using the App, please contact us and we'll delete their data.

We'll update this policy when our practices change and show the new date at the top. If a change is significant, we'll tell you in the App before it takes effect. If a change needs your consent, we'll ask for it.