bitetracking privacy policy

Last updated: 13/10/26

In short

bitetracking shows no ads, has no advertising trackers and never sells or shares your data. An account is optional: without one, everything you log stays on your device only. If you create an account, your data travels encrypted and is stored on our server so it shows up on your other devices, and only you can see it. The app only sends anonymous usage statistics, with nothing that identifies you and no health data, and you can turn them off.

Who is responsible

The controller of your data is the owner of bitetracking.com. For anything about your data, write to [email protected].

What is stored and where

Your entries (fasts, meals, water, weight, measurements, sleep, activity, habits, feelings, vitals and cycle) are stored in the app's local storage on your phone or computer. If Android backs up your apps to your Google account, that backup is managed by Google according to your settings.

Account and sync (optional)

If you sign in with Google or your email, we store your email address to identify the account and a copy of what you log to sync it across your devices. It is stored on Supabase servers (a Postgres database) and always travels encrypted (HTTPS). Every row is protected so only your account can read or change it. We use this data for nothing else: we do not analyse it, sell it or share it with anyone. With Google sign-in we only receive your name, email and account identifier; we access nothing else in your Google account.

You can sign out any time (choosing whether the copy on the device stays or is removed) and you can delete your account under Settings → Account & sync: the account and all data stored on the server are deleted immediately.

Where the servers are and international transfers

The account and sync database is hosted by Supabase in São Paulo, Brazil (Amazon Web Services, region sa-east-1). The website and the packaged-product search go through Cloudflare's global network; AI photos are processed by Anthropic and Plus purchases by RevenueCat, both in the United States. So your data may be transferred outside your country. For those transfers we rely on the data processing agreements of those providers, which include the European Commission's standard contractual clauses, and the data always travels encrypted (HTTPS).

Internet connections

Without an account, the app only goes online when you ask it to, apart from the anonymous usage statistics explained below (which you can turn off):

• Barcodes: the number is looked up in Open Food Facts, an open product database. Only the number is sent.
• Searching packaged products by name: what you typed goes through a bitetracking server (Cloudflare) that queries Open Food Facts and caches the answer for a day. Who searched is not stored.
• Strava (optional): if you link it, our server keeps Strava's authorization and fetches your workouts to show them in the app. You can unlink it anytime, which deletes the authorization.

With an account, it also connects to our server to sync.

Anonymous usage statistics

To know what to improve, the app sends small anonymous notes: the name of the step in the journey (for example "started onboarding", "first fast", "logged water today" or "came back on day 7"), the number of days since installation, the platform (web, Android, iPhone or Windows), the app version and the language. It also sends the app's errors, with the message trimmed, so we can fix them.

No person or device identifier is sent, the IP address is not stored and no health data travels: we know that something was logged, never how long you fasted or how much you weigh.

You can turn them off in Settings, at the bottom, under "Anonymous usage statistics" (it applies to that device). If your browser has "Do Not Track" or Global Privacy Control (GPC) turned on, nothing is sent. The records are deleted automatically after 13 months.

AI meal photos (optional)

If you use AI photos, the photo is downsized on your phone and sent to our server, which passes it to Anthropic (the Claude model) to estimate what food is there and how much. The photo is not kept on our server or Anthropic's beyond what is needed to answer (Anthropic does not use API data to train models). We only store how many photos you analyzed and their cost, to apply usage limits. Requires an account.

Friend groups (optional)

If you join a group, its members see the name you chose for the group, whether you are fasting (since when and with what goal) and your streak. No weight, meals, measurements or health data. Groups are invite-only and you can leave anytime.

Plus payments

Plus is not on sale yet: payments arrive when the app is in the stores. Subscriptions are paid in the store (Google Play or App Store). We never see your card: the store and RevenueCat, the service that unifies purchases, only tell us whether you have Plus and until when, linked to your account identifier.

Permissions

• Microphone: only while you dictate a meal. Speech recognition is done by the phone or browser (Google or Apple, under their policies); the app only receives the text and stores no audio.
• Notifications: to tell you when you reach your goal, when to start, and other reminders you choose.
• Camera and photos: to read barcodes, take progress photos and, if you use AI photos, the meal photo (analyzed and not stored). Progress photos stay on your device; if you turn on their cloud backup, they are encrypted on your phone with a key only you have, and our server keeps files it cannot read. Always when you ask.

Phone health data (Health Connect on Android, Apple Health on iOS)

This only applies to the Android and iPhone apps, which are not in the stores yet; the web version does not connect to Health Connect or Apple Health. If you connect Health Connect or Apple Health, bitetracking reads only the types you choose: workouts (including virtual reality games), sleep, weight, steps, resting heart rate, water and meals, to add them to your history. If you turn it on, it can also write the weight, water, meals (calories and macronutrients) and activity you log in bitetracking, so your other health apps can see them. It never uses this data for advertising and never shares it with third parties. Nothing leaves your phone except the sync with your own account (if you have one), which only serves to show your entries on your other devices. You can choose the types in Settings and revoke access at any time in Health Connect or in Health › Sharing › Apps. Use of this data complies with the Health Connect permissions policy and Apple's HealthKit rules, including the Limited Use requirements.

Legal basis

We process your data on these grounds:

• Providing the service (account, sync, AI photos, groups and Plus): performance of the contract you accept when you use the app (GDPR, art. 6.1.b).
• Health data (fasts, meals, weight, sleep, vital signs, cycle and the like): your explicit consent (GDPR, art. 9.2.a), which you give when you log them and sync them with your account. You can withdraw it at any time by deleting the data or the account; that does not affect what was done before.
• Anonymous usage statistics: our legitimate interest in knowing which parts of the app are used and in fixing errors (GDPR, art. 6.1.f), with the safeguards described above and the option to turn them off.
• Argentina: Personal Data Protection Law 25.326. The Agency for Access to Public Information (AAIP), as the supervisory authority of that law, handles the complaints of anyone whose rights are affected by a breach of the data protection rules.
• Brazil: General Data Protection Law (LGPD, Law 13.709/2018), on equivalent grounds: performance of a contract, specific and prominent consent for health data (sensitive data) and legitimate interest for the anonymous statistics. The authority is the ANPD.

Your rights

You can access, correct, delete and port your data (export it as JSON or CSV), object to its processing and withdraw your consent. Most of this you can do yourself from Settings; for the rest, write to [email protected] and we will answer within the legal deadlines. You can also complain to the data protection authority of your country: the AAIP in Argentina, the ANPD in Brazil or your country's authority in the European Union.

How long we keep data

Account data is kept while the account exists; when you delete it, it is erased from the server immediately and disappears from the provider's automatic backups when they rotate. The AI photo counters are kept with the account. Anonymous statistics and error reports are deleted automatically after 13 months. On your device, the data stays until you delete it or uninstall the app.

Minimum age

bitetracking is for people aged 18 or over. Fasting is not recommended for minors, and the app asks about it when you start. If you are under 18, do not use it; if we learn that a minor created an account, we will delete it.

Export and delete

You can export all your data (JSON or CSV) and delete it from Settings → Your data. Uninstalling the app removes the data from the device. If you have an account, deleting it also removes everything stored on the server.

Health

bitetracking is not a medical device and does not replace advice from a health professional.

Contact

Privacy questions: [email protected]