Privacy Policy

1. Who we are

UseBite is the data controller for the personal data described in this policy.

Contact for any privacy or data-protection request: support@usebite.app.

2. Lawful basis for processing

Where the UK or EU General Data Protection Regulation (UK GDPR / EU GDPR) applies to your use of UseBite, we rely on the following lawful bases under Article 6:

• Performance of a contract (Art. 6(1)(b)) — for authentication, profile data, tracking data and AI-feature processing. Without this data we cannot provide the service you signed up for.
• Legitimate interests (Art. 6(1)(f)) — for security logging, abuse prevention, service messages, individual personal outreach, and aggregate product improvement, balanced against your right to object (see Section 9).
• Consent (Art. 6(1)(a)) — for personalised advertising via Google AdMob in the EU, UK and Switzerland, captured through Google's User Messaging Platform on first launch of the Android app, and for any optional newsletter you affirmatively opt in to.
• Legal obligation (Art. 6(1)(c)) — for tax and accounting records relating to credit-pack purchases, where applicable.

3. What we collect

We collect only the minimum data required to deliver the service:

• Authentication data: your email address, name, and a URL pointing to your Google-hosted profile picture, obtained through Google sign-in. The picture itself is never copied to our servers; we store only the URL. The app displays your self-chosen nickname, not your Google account name.
• Profile data: birthday, gender, height, location, activity level, and nutritional targets, used exclusively to calculate your basal metabolic rate, total daily energy expenditure, and personalised daily targets.
• Tracking data: meals (descriptions, AI-generated nutritional estimates, optional location tags), physical activities, weight entries, day closings.
• Credit usage: a running count of AI-API requests for billing reconciliation. We log the timestamp and endpoint of each AI call, but never the call's content.
• Feedback: messages you submit through the in-app feedback form. Where you submit feedback while signed in, your sign-in email is automatically attached so we can reply. Each submission also auto-attaches the app version + build number, the Android API level, and the device manufacturer + model — so we can reproduce reported issues without asking you for these details. If you opt in to "Include diagnostics" on the feedback form, a bounded log (≤ 200 events, ≤ 64 KB) of recent app lifecycle events with timestamps is also attached. Diagnostic logs do not include meals, photos, location, profile data, weights, or AI-call content — only the lifecycle of the app itself (process starts, activity create / pause / resume, frame draws, uncaught exceptions). The toggle is off by default; you choose per submission.
• Diagnostic telemetry (v1.5+, signed-in Android users): the same bounded lifecycle log described above is also automatically transmitted to Bite's servers in batches as long as you are signed in. This is the always-on observability channel that lets us notice failures (e.g. an API endpoint returning errors, a screen that crashes on a specific device) within minutes of a deploy instead of waiting for users to file feedback. The data captured is the same as the opt-in feedback toggle — lifecycle event names + timestamps + app version + Android version + device manufacturer + model + a per-process session identifier. It does not capture meals, photos, location, profile data, weights, AI-call content, message text, or any other user-supplied content. Stored in the diagnostic_events table on Neon, retained for as long as needed for product debugging and periodically purged (see Section 13), accessed only by the developer. Web users are not subject to this stream. To opt out: sign out of the Android app, or delete your account (Settings → Account → Delete account), which removes all diagnostic_events rows by foreign-key cascade.

4. Photos: how UseBite handles them

If you attach a photo to a meal, the image is resized client-side (maximum 1024 px, JPEG quality 80) before any transmission, in line with the data-minimisation principle (Art. 5(1)(c)).

UseBite does not store food photos on its own servers. The image is streamed in-flight to one of our AI providers (see Section 5) for analysis, and the in-flight copy is discarded once the analysis is returned. We have no further access to that copy.

Our AI providers may briefly retain transmitted content for abuse-prevention, safety review, or quality-monitoring purposes per their own published terms. UseBite cannot delete content from a third-party provider's logs once transmitted; you can review each provider's retention practice directly:

• xAI — x.ai/legal/privacy-policy
• Google AI / Gemini — policies.google.com/privacy
• Anthropic (used as fallback) — anthropic.com/legal/privacy

5. Third-party processors and international transfers

UseBite relies on a small number of third-party processors. Where these processors are located outside the United Kingdom or European Economic Area, the transfer of personal data is covered by appropriate safeguards under Art. 46 GDPR (Standard Contractual Clauses, or, where applicable, the UK / EU−US Data Privacy Framework). Copies of the safeguards are available on request from support@usebite.app.

Each provider operates under its own privacy policy and data-processing terms. We have data-processing agreements in place with each. We never sell, license, or share your meal, weight, activity or profile data with any third party for advertising or marketing purposes.

6. What we do not do

• We do not sell, license, or share your meal, weight, activity, or profile data with any third party.
• We do not use your tracking data (meals, activities, weight, body stats) to build a marketing profile of you.
• We do not send promotional emails for third-party products, partner offers, or anything unrelated to UseBite.
• We do not store food photos on our servers.
• We do not track your activity across other websites or applications.
• We do not use analytics or tracking cookies on the website.

7. How we contact you

We may use the email address associated with your Google account to contact you about UseBite. Specifically:

• Service messages — account events (e.g. credits granted, security notices), product updates relating directly to UseBite (new features, important changes, downtime notifications), and responses to support requests. Lawful basis: legitimate interests (Art. 6(1)(f)) and, where applicable, performance of contract (Art. 6(1)(b)).
• Personal outreach — particularly while UseBite is small, we may write to you individually to thank you, ask for product feedback, or invite you to share UseBite. These are sent person-to-person, never as bulk campaigns. Lawful basis: legitimate interests (Art. 6(1)(f)).
• Optional product newsletter — when this becomes available, you will be able to opt in via Account → Settings. We will not send any bulk newsletter to your address until you have explicitly opted in. Lawful basis: consent (Art. 6(1)(a)).

All UseBite-related emails identify themselves as such, link back to this policy, and include clear instructions for opting out. To stop receiving any non-essential email (i.e. anything other than security and core-account notices), reply to any email or write to support@usebite.app; we will action your request without undue delay and at the latest within seven days. You may also delete your account at any time via Section 9 below, which removes you from all communications.

8. Cookies

UseBite uses a small set of strictly necessary cookies for authentication and CSRF protection (set by NextAuth.js and, on the sign-in journey, by Google). These keep you signed in and prevent request forgery. Under the GDPR / ePrivacy Directive these are exempt from the consent requirement. We do not use analytics, advertising, or tracking cookies on the website.

9. Your rights

If you are in the UK or EEA, you have the following rights under the UK / EU GDPR:

• Access (Art. 15) — most data is visible directly within the app. For a complete machine-readable export including processing metadata, write to support@usebite.app; we will respond within 30 days.
• Rectification (Art. 16) — most fields are editable directly in the app; for anything else, contact us.
• Erasure (Art. 17) — email support@usebite.app to request complete account and data deletion. Requests are fulfilled within 30 days, save where retention is required by law.
• Restriction of processing (Art. 18).
• Data portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format on request.
• Object (Art. 21) — object to any processing based on legitimate interests (including personal outreach emails).
• Withdraw consent (Art. 7(3)) — where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.
• Lodge a complaint with a supervisory authority (Art. 77) — in the UK, the Information Commissioner's Office; in the EU, the supervisory authority for your country, listed at edpb.europa.eu.

10. Automated calculations and decision-making

UseBite calculates your basal metabolic rate, total daily energy expenditure, daily calorie target, and projected weight change automatically from your profile and weight history. These calculations are suggestions, not decisions: you remain free to ignore, override, or use them alongside professional advice at any time. The optional minimum-calorie floor (default 700 kcal/day) is a configurable safety bound and not a recommendation.

We do not consider these calculations “solely automated decision-making” for the purposes of Art. 22 GDPR, because they produce no legal or similarly significant effect on you. If you disagree with this characterisation in your individual case, contact us and we will review.

11. Advertising (Android only)

The Android app uses Google AdMob to show a single optional rewarded video ad: when your in-app credits run out you can choose to watch an ad in exchange for additional credits. The ad is never auto-played, never appears anywhere else in the app, and watching it is always optional — you can also continue without ads by purchasing a credit pack.

When you choose to watch a rewarded ad, AdMob may collect on Google's side, in accordance with Google's ad-platform privacy policy:

• Advertising identifier (AAID) — a resettable, per-device ID Android assigns for ad measurement. You can reset or limit it at any time in your device's Privacy → Ads settings.
• Coarse location derived from IP address.
• User-agent, device model, OS version for ad-quality scoring and frequency capping.
• Aggregate ad-performance data (was the ad watched to completion, was it clicked, etc.).

In the EU, UK and Switzerland, the Android app shows a Google-provided consent form on first launch (using the User Messaging Platform) so you can choose between personalised and non-personalised ads. You can change this choice at any time by contacting support@usebite.app; an in-app re-prompt is on the planned roadmap. UseBite itself never sees the AAID, IP, or any ad-targeting signals — Google handles all of it. We only receive a confirmation that an ad was watched, which we use to credit your account.

The web version of UseBite (usebite.app) shows no advertising of any kind.

12. Optional GPS / location lookup

When you use the optional “Use GPS” button (in the meal logging flow on Android, or in Account → Settings on web), the device's coordinates (latitude / longitude) are sent server-side to OpenStreetMap Nominatim (about) to resolve them to a city / country name. Coordinates are not persisted by UseBite; only the lookup result (e.g. “Singapore, Singapore”) is stored. Don't want to send your coordinates? Don't press the GPS button — typing a country / city name into the Location field uses the AI-only path with no coordinates leaving the device.

13. Data retention

Retention periods, by category:

• Account & profile data — for the lifetime of your account, plus 30 days after deletion to allow recovery from accidental requests.
• Tracking data (meals, activities, weight, day closings) — for the lifetime of your account; deleted on account deletion.
• AI-call logs (timestamp, endpoint, credits charged; never call content) — 12 months for billing reconciliation.
• Feedback messages — up to 24 months for product-improvement context.
• Credit-purchase records — 5 years (Singapore tax law).
• Aggregate, anonymous usage statistics — may be retained indefinitely.
• Diagnostic telemetry (lifecycle event names, app version, device model, sessionId — see Section 3) — retained for as long as needed for product debugging and periodically purged. Older entries are deleted as a matter of routine maintenance; deleting your account removes all diagnostic_events rows by foreign-key cascade.

14. Data storage and security

Personal data is stored in an encrypted Postgres database hosted by Neon Inc. on dedicated infrastructure. Transport is encrypted via HTTPS. Authentication uses Google Sign-In with short-lived JWTs. We deploy security patches as upstream updates land. We will notify affected users and the relevant supervisory authority of any personal-data breach in accordance with Art. 33 / 34 GDPR.

15. Health and safety considerations

UseBite is a personal nutrition-tracking tool, not a medical device. Calorie estimates, macro breakdowns, and weight projections are AI-generated approximations; they may be materially inaccurate and should not be relied on as a substitute for advice from a qualified medical or dietetic professional. AI cannot reliably detect allergens; never rely on UseBite to identify allergens or assess allergy-related risks.

UseBite is not suitable for, and should not be used by: anyone under the age of 18; anyone with a current or past eating disorder; anyone who is pregnant or breastfeeding; anyone with diabetes or another condition affecting metabolism; or anyone recovering from disordered eating. If any of these apply to you, please use a clinically supervised tool instead.

If you are struggling with food, weight, or body image, please speak to a doctor. Useful contacts: Beat (UK) 0808 801 0677, NEDA (US) text “NEDA” to 741741 (Crisis Text Line), Singapore SAMH 1800-283-7019.

16. Children

UseBite is intended for adults aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has registered an account, please contact support@usebite.app and we will delete the account.

17. Terms of Service

Use of UseBite is also governed by our Terms of Service, which sets out the licence to use the app, acceptable-use rules, AI-output disclaimer, limitation of liability, governing law, and refund policy. By using UseBite you agree to both this Privacy Policy and the Terms of Service.

18. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified through the app or by email; non-material changes will be reflected on this page with an updated date. We maintain an internal version identifier for each iteration of the policy, and each version you accept at onboarding is recorded against your account, so you have an audit trail of what you agreed to and when.

19. Contact

For questions, concerns, or any request relating to your data or privacy, please contact us at support@usebite.app. We aim to respond within 48 hours.