Privacy Policy

Last updated: October 23, 2026 · Contact: support@bitoo.app

This policy explains what the Bitoo app and the website bitoo.app collect, why, who helps us process it, how long we keep it, and what you can do about it.

Summary

• Your food log, water, weigh-ins and goals are stored on your phone first. The app works without an email or password.
• To back up your log, the app keeps a copy on our server, linked to an anonymous account at first and to your Apple, Google or email sign-in if you add one.
• We do not show ads, do not sell your data and do not track you across other apps or websites.
• Meal photos sent for AI recognition are analysed and then discarded. We never store them.
• The coach sends summaries of your day and week, and (in Premium chat) your messages, to AI providers that keep no data and do not train on it. We do not store your chat; it stays on your phone. The weekly review is available to everyone. Details
• Usage stats and crash reports are off until you allow them, and you can turn them off again anytime.
• Apple Health data is used only to run the features you turn on. It is never used for advertising and never sold.
• You can export your log and delete your account in the app at any time.

Who we are

Bitoo is made by Nikolos Dolidze, an individual developer based in Georgia, who is the controller of your personal data (“we”, “us”). Contact: support@bitoo.app.

What we collect and why

Data you put in the app

• Meals and foods you log: names, portions, grams, calories and nutrients, meal times.
• Foods and recipes you create, and your favourites.
• Water entries and your water goal.
• Weigh-ins and target weight.
• Your plan: goal, birth year, sex, height, activity level, pace, calorie and macro targets, units, language and appearance.
• Habit settings (for example, how many good days make a good week) and reminder settings.
• Premium only, with the new coach (the About me row appears in Profile only then): the optional About me text you write for the coach (for example allergies, tastes, limits). It is saved with your profile, backed up with it, included in your data export and deleted with your account.

We use this to run the diary, calculate your targets and show your progress. Some of it is health information (weight, diet, activity). We process it only to provide the app to you, based on your explicit consent when you enter it or connect Apple Health.

Your account

• When you first open the app, it creates an anonymous account: a random ID with no name or email. It lets the app back up your log and talk to our server.
• If you sign in with Apple or Google, we receive an account identifier and, if the provider shares it, your email address. We never receive your password.
• If you sign in with email, we use your address to send a one-time sign-in code through Amazon SES. The code expires after 10 minutes. We do not send marketing email.
• When you sign in, the data of your anonymous account moves to your signed-in account.
• For each session we store the IP address and device type (user agent) to keep your account secure. Sessions last up to 90 days and are extended while you use the app.

Sync and backup

Your diary data is copied to our server so you can restore it after losing or changing your phone. This happens for anonymous accounts too, although an anonymous backup can only be used from the same phone. The server stores the records described above, with sync timestamps and markers for deleted records.

AI photo, voice and text logging

• When you log a meal by photo, the photo goes from the app to our server and on to an AI model, which names the foods and estimates the grams. Calories are then looked up in our food data.
• When you log by voice, your phone’s built-in speech recognition (from Apple or Google) turns your speech into text. Apple or Google may process the audio under their own privacy terms. Only the resulting text reaches us.
• When you type a description, the text is sent the same way as a photo.
• AI requests go through the Vercel AI Gateway to a model provider, currently Google (Gemini) or OpenAI. We send only what the request needs (the photo or the text), not your name, email or diary.
• We do not store photos, descriptions or transcripts. They are discarded once the model has answered, and we do not write them to logs. The gateway and the model providers process them only to return the answer. Under their API terms they do not use this data to train their models; they may keep it for a short time for abuse and security monitoring.
• We count how many AI scans you use each day to apply the free limit (3 a day, or the number shown in the app).

AI coach

Coach chat is part of Premium. When you send a chat message, the app sends the following to our server, which passes it to an AI model to write the reply:

• the foods you logged today, with amounts;
• your calories and macros left for today, your goal and your pace;
• a summary of your week so far: days logged, good days, average calories and protein against your targets, and your weight trend;
• the time of day, your time zone and the app language;
• the About me text, if you wrote one (our server reads it from your synced profile);
• up to 20 foods you often eat, including foods you created yourself;
• the most recent messages of the current chat, so the coach can follow the conversation.

The weekly review on the Coach tab is available to everyone, not only Premium. It sends only summary numbers for your week, your time zone and the app language, not a chat and not food names.

• No retention, no training. Coach requests go through the Vercel AI Gateway to model providers, currently DeepSeek models (served by providers such as DeepInfra, Fireworks and Together AI) and Anthropic Claude models (served by Anthropic, Amazon Bedrock or Google Vertex AI), and only by providers marked Zero Data Retention and No Training. They do not keep your request or use it to train models.
• We do not store your chat or the request. They are used to produce the reply and then discarded. The chat history you see in the app is kept on your phone only and is cleared when you sign out.
• Weekly reviews (the summary we sent and the review we got back) are stored on our server so you can read them again. They are deleted with your account.
• People under 18 get no calorie figures from the coach. Our server removes calorie figures from the data it sends to the model, and the coach does not give them calorie figures.
• Usage stats about the coach (if you allow them) never include your messages, your About me text or food names.
• Coach replies are general nutrition tips, not medical advice, and can be wrong.

Food search and barcodes

• Search text and scanned barcodes are sent to our server to find foods. When a barcode is not in our database, our server asks Open Food Facts for it, without sending anything about you.
• Nutrition label scanning reads the label on your phone. The image does not leave your phone.

Apple Health

If you connect Apple Health, Bitoo can:

• read your weight, workouts, active energy and steps;
• write the nutrition you log (calories, protein, carbs, fat and food names) and the weigh-ins you enter.

Weigh-ins read from Apple Health are saved in your Bitoo diary and backed up to our server like any other weigh-in. Steps and workouts stay on your phone; we do not send them to our server.

Data from Apple Health is used only to provide Bitoo’s features. It is never used for advertising or marketing, never sold, never used for analytics, and never shared with third parties other than the service providers needed to run the app as described here. You can turn off access anytime in the Health app or in iPhone Settings → Health → Data Access & Devices.

Purchases

Premium is bought through the App Store. Apple handles payment; we never see your card. RevenueCat tells our server whether your subscription is active, the product, whether it is a trial, and when it ends. RevenueCat links this to your Bitoo account ID, not to your name or email.

Usage stats (optional, off by default)

If you allow Anonymous usage stats (on the one-time card on Today or in Profile → Privacy), the app sends a fixed list of events to PostHog, hosted in the EU, such as “meal logged” (with the method and meal slot), “paywall viewed” or “onboarding completed”. Events are linked to your Bitoo account ID. They never include food names, photos, free text, your email or your location. Session recording is off. When you turn it off, no new events are sent.

Crash reports (optional, off by default)

If you allow Crash reports, the app sends error and crash reports to Sentry. We configure Sentry not to collect personal data, screenshots or screen layouts, and we remove search terms and barcodes from reports before they are sent.

Separately, our server reports its own errors to Sentry so we can fix them. These reports contain no request bodies, headers, cookies, email addresses or sign-in codes, and IDs in addresses are replaced with placeholders.

Server logs

Our server logs each request’s method, path, status and duration. It does not log query strings (so search terms are not logged), request bodies or IP addresses. A barcode can appear in the path of a barcode lookup. Logs are rotated automatically by size and kept only for a short time, normally a few weeks.

Notifications and widget

Reminders (meals, weigh-ins, water, weekly review, trial ending, and the coach’s evening reminder, which is off by default and part of Premium) are scheduled on your phone. We do not use push notifications. The home-screen widget reads a snapshot stored on your phone.

Website

bitoo.app is a static site served by Cloudflare. It sets no cookies and has no analytics or trackers. Cloudflare processes your IP address to deliver the pages and protect them from attacks. Fonts load from Google Fonts, which receives your IP address.

Legal bases (EEA, UK and similar laws)

• Contract: to provide the diary, sync, backup, AI features, Premium and the support you ask for.
• Explicit consent: for health data you enter or connect from Apple Health, and for usage stats and crash reports. You can withdraw consent anytime in the app; this does not affect processing that happened before.
• Legitimate interests: to keep the service secure and working (session security, rate limits, server error reports, backups) and to prevent abuse of free limits.
• Legal obligations: where the law requires us to keep or disclose information.

Who processes your data

We use these service providers. They process data only on our instructions.

We may disclose information if the law requires it, or to protect the rights, property or safety of our users, the public or us. If Bitoo is ever transferred to someone else, this policy keeps applying to your data and we will tell you in advance.

International transfers

We are based in Georgia, and some providers are in the United States or elsewhere. When personal data from the EEA, UK or Switzerland goes to a country without an adequacy decision, we rely on the provider’s safeguards, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep data

Your rights and choices

• Use the app without giving your name or email.
• Export your log as a CSV file: Profile → Export my data.
• Correct your data by editing it in the app.
• Delete your account in the app: Profile → Account → Delete account. This immediately deletes your account and everything linked to it from our server and erases this phone. Copies in backups are deleted within 35 days. If you can’t use the app, email support@bitoo.app from the address you signed in with and we will delete a signed-in account within 30 days. Deleting your account does not cancel a subscription; cancel it in your App Store settings.
• Withdraw consent for usage stats and crash reports in Profile → Privacy, and for Apple Health in the Health app.
• Depending on where you live, you may also have the right to access your data, restrict or object to its processing, and receive it in a portable format. Email support@bitoo.app; we answer within 30 days.
• You can complain to the Personal Data Protection Service of Georgia or to the data protection authority where you live.

Children

Bitoo is meant for people 16 and older. It is not directed at children, and we do not knowingly collect personal data from children under 16. People under 18 do not get a calorie target in the app, and the coach gives them no calorie figures. If you believe a child under 16 uses Bitoo, contact us and we will delete the account.

Security

All traffic between the app and our server is encrypted (HTTPS). Our server is reachable only through Cloudflare and has no open ports; admin tools are protected by Cloudflare Access. We never store meal photos. No system is perfectly secure, so please report security issues to support@bitoo.app.

Changes to this policy

We will post any update at bitoo.app/privacy and change the “Last updated” date. If a change is significant, we will also tell you in the app.

Contact

Nikolos Dolidze (Bitoo) · support@bitoo.app