Bite Built AI is operated by Profenius Development LLC, a North Carolina limited liability company (“we,” “us,” or “our”). We provide a mobile application and website (the “Service”) that help you log meals, track macros, and record workouts. This policy explains what data we collect, why, and the choices you have.
We designed the Service to collect as little as the feature you're using needs. When in doubt, we don't collect it.
1. Data we collect
Account data
When you create an account, we store your email, a hashed password, your display name (if provided), and optional profile details (age, sex, height, weight) used for BMR and macro calculations. If you sign in with Apple or Google, we receive the identifier the provider returns and, where you grant it, your email.
Health and fitness data
The core of the Service is health-related. We collect and store:
- Foods you log (name, portion, macros, meal type, timestamp)
- Workouts (exercise, sets, reps, weight, duration)
- Body-weight entries you add
- Optional activity data when you explicitly grant permission — step count, walking + running distance, and active energy from Apple HealthKit (iOS) or Health Connect (Android), or an estimated step count from your device's motion sensor when neither is available (read-only; we do not read workouts, heart rate, or sleep)
Apple HealthKit, Health Connect, and motion data
When you authorise HealthKit access, Bite Built AI reads only the specific health data types you grant in the iOS permission prompt (steps, walking + running distance, active energy). We never write to HealthKit. We use this data to display your activity inside the app, surface progress charts, and inform macro suggestions. We do not use HealthKit data for advertising, do not transmit raw HealthKit data to advertising networks or data brokers, and do not sell it to anyone. Aggregated copies of selected health metrics are stored on our servers so the data is available across your devices and survives reinstall; you can request deletion at any time via Settings → Privacy & Data or by emailing privacy@bitebuiltai.com. You can revoke HealthKit access at any time from iOS Settings → Privacy & Security → Health → Bite Built AI.
On Android, the same read-only step, distance, and active-energy types come from Health Connect when you grant them in the Health Connect permission prompt; you can revoke access at any time from Health Connect → App permissions → Bite Built AI. If neither HealthKit nor Health Connect is available, the app may ask for motion permission and read your device's motion activity (pedometer) solely to estimate your step count. Health Connect and motion data are handled exactly like HealthKit data: read-only, used only to show your activity and inform your targets, never used for advertising, and never sold.
Health data is never used to train third-party AI models.
Photos you take for meal logging
When you use the in-app camera or attach a photo to a meal, the image is uploaded to our object storage (Cloudflare R2) and sent to OpenAI's vision API to identify the foods on the plate and estimate portions. We do not use your meal photos to train any model, and photos processed by OpenAI are not used to train their models under their API terms (see Section 4).
Photos are retained inside your account so you can review past meals. When you delete your account, we delete every photo associated with it from our object storage as part of the same deletion request.
Device and usage data
When you use the app or site we collect standard technical data: device type, operating system, and app version.
When you sign in, create an account, or your session is refreshed, we also record your IP address, the app or browser user agent, and the device name and operating system you signed in from. We use these only for session security — they let you review and sign out of your active sessions in Settings → Security — and we keep them only while that session is active.
We also keep a security event log (successful sign-ins, failed sign-in attempts, and password changes) that records the IP address and user agent of each event. These entries are retained for 90 days and then deleted.
We collect crash reports and performance diagnostics (Sentry) tagged with your internal account ID, and a minimal record of AI scans (time, tier) to enforce quotas. We do not run advertising or cross-app tracking.
2. How we use your data
- To provide the core tracking, photo-logging, and analytics features
- To personalize macro targets and suggestions
- To authenticate your account and keep it secure
- To process subscription payments through Apple and RevenueCat
- To diagnose crashes and fix bugs
- To enforce plan limits on AI meal scans
- To send transactional email (verification codes, password resets, security alerts)
3. Service providers we use
We rely on a small set of trusted providers to run the Service. Each receives only the data it needs to do its job.
- Neon — managed PostgreSQL database (hosts your account, diary, and workout records; US region).
- Cloudflare — network and DDoS-protection proxy in front of our API (sees request metadata such as your IP address), Turnstile bot-check on this website's contact form, and R2 object storage for meal photos.
- Render — application hosting for our API.
- RevenueCat — subscription and in-app purchase management. Receives your in-app user ID and subscription status; no payment card data.
- Apple App Store — processes all payment transactions under Apple's privacy policy. We never see your card details.
- Sentry — crash and error reporting. Crash reports are tagged with your internal account ID only — not your email, name, or health data.
- Resend — transactional email delivery (verification codes, password resets, new-device notices).
- SendGrid — fallback transactional email delivery used only if Resend is unavailable. Receives the recipient address and message content, nothing else.
- OpenAI — AI provider for meal photo recognition. See Section 4 for what is sent and our retention/training agreement.
- Vercel — hosts this marketing website.
4. Third-party AI processing
Some Service features rely on OpenAI as our third-party AI provider:
- Meal photo recognition. When you take or attach a photo to log a meal, the image is sent to OpenAI to estimate foods and portions. The request contains the image only — no name, email, account ID, or other personal identifiers are attached. Per our agreement with OpenAI under their API terms, submitted content is not used to train their models, and OpenAI retains the request only for the limited window needed to operate the API and detect abuse.
We never send Apple HealthKit data, raw photos other than the meal image you have just taken, or payment data to OpenAI or any other AI provider.
OpenAI's own privacy practices are governed by their privacy policy. If we ever switch or add an AI provider, we will update this policy and notify you in-app or by email before the change takes effect.
5. Data retention
- Account and diary data persist while your account is active. Account deletion (Settings → Privacy & Data → Delete All Data & Account) is immediate and irreversible — we remove your account record, diary, workouts, body metrics, and stored photos in the same request. We retain only the limited records we must for tax or legal compliance.
- Meal photos are stored alongside your meal entries for as long as your account exists, and are removed when you delete your account.
- Sign-in session records (IP address, user agent, device name and OS) are deleted when the session expires or you sign it out.
- Security event log entries and crash reports are retained for 90 days.
6. Your rights
Depending on your jurisdiction, you may have rights to access, export, correct, or delete your personal data, and to object to certain processing. You can exercise most of these directly in-app (Settings → Privacy & Data). For anything you can't do in-app, email support@bitebuiltai.com.
California residents: under the CCPA/CPRA, you have rights to know, delete, correct, and opt out of “sharing” of personal information. We do not sell or share your personal information for cross-context behavioral advertising.
EU/UK residents: under GDPR, our legal bases for processing are contract performance (to deliver the Service), legitimate interests (security, debugging), and consent (for optional Health integrations and marketing email).
7. Children
Bite Built AI is not directed to children under 13. You must be at least 13 years old to create an account, and we do not knowingly collect data from children under 13. If you believe a child has provided data to us, contact support@bitebuiltai.com and we will delete it.
8. Security
We use TLS in transit, encryption at rest on our database and object store, hashed passwords, rotating refresh tokens with theft detection, and account lockout on repeated failed logins. No system is perfect, but we treat your data the way we'd want ours treated.
9. International transfers
Data is processed in the United States. By using the Service you acknowledge your data may be transferred to the US.
10. Changes
If we make material changes to this policy, we'll notify you in-app or by email before they take effect. The “Last updated” date above always reflects the current version.
11. Contact
Questions? Reach us at support@bitebuiltai.com.