Legal
BiteSense privacy policy
This is a draft awaiting review. It was written from the app’s real data flows, but it has not been checked by a lawyer and several decisions are still open — they are highlighted below. Do not publish or submit it to Google Play until each one is resolved.
In short
- Your meal diary is stored on your phone, not on our servers.
- Meal photographs are sent to be analysed and are not kept. What the analysis returned is kept.
- We do not sell your data, and we do not use it for advertising.
- There are no third-party trackers or advertising identifiers.
- You can delete your account and everything attached to it — see Delete your account.
Who we are
BiteSense is made by Konbran, Needs your decision a studio whose legal entity and registered address are not yet settled (registered entity name, address and country) . For anything in this policy, write to privacy@konbran.com.
What we collect, and why
Your account
An email address and a password, so that you can sign in. The password is stored only as a hash by our authentication provider; we never see it. Your email address is used to confirm your address, to let you reset your password, and to reach you about the service. It is not used for marketing.
Your nutrition profile
If you complete setup, we store the answers you gave: sex, age, height, weight, activity level, goal, the pace you chose, an optional target weight, your preferred units, and the date you started. These are stored so your targets follow you to a new device. We store your answers, never the calorie target they imply — that is recalculated on the phone, so a corrected formula reaches you rather than leaving you on a frozen number.
Meal photographs
When you photograph a meal, the image is sent to our analysis service and passed to a vision model. The photograph itself is not stored by us, in the database or anywhere else. What is stored is:
- a one-way SHA-256 hash of the image, so that a retry or a duplicate submission can be recognised as the same photograph;
- what the model returned — the foods and portions it proposed;
- whether you accepted, edited or rejected that proposal, any corrections you made, and the calories you committed;
- the model used, how long it took, and what it cost, so we can watch accuracy and spend.
These rows are linked to your account. We keep them because they are the only evidence of whether the estimates are any good.
Your meal diary
The diary itself — the meals you logged and when — is stored on your phone and is not uploaded. Uninstalling the app or losing the phone loses the diary with it.
Preventing abuse
Analysis costs money per photograph, so we limit how much any one caller can use. When you are signed in, the limit counts your account. When you are not, it counts your network address — and we store only a keyed one-way hash of that address, never the address itself. The app also sends a device identifier it generates; it is not tied to your phone’s hardware or advertising IDs.
Crash reports
If the app crashes we receive a report describing what failed, the device model and the operating system version. Our crash reporting is configured not to store IP addresses and to scrub data before sending.
Who else processes your data
We use these providers. They process data on our instructions.
| Provider | What for | Where |
|---|---|---|
| Supabase | Accounts, profile, analysis records | Needs your decision region not yet chosen (the region you pick when creating the production project) |
| Needs your decision the vision model provider (Stage 0: Anthropic (Claude) or Fireworks (Kimi) — this decides the answer) | Analysing meal photographs | Needs your decision not yet chosen (follows from the provider) |
| Sentry | Crash reports | Needs your decision region not yet chosen (US or EU — chosen when the Sentry org is created) |
| Resend | Sending account emails | United States |
| Cloudflare | Serving this website | Global edge network |
Food figures come from USDA FoodData Central and Open Food Facts. We send them a search term or a barcode. We do not send them anything about you or your account.
How long we keep it
Your account, profile and analysis records are kept until you delete your account, after which they are removed as described in Delete your account. Crash reports and operational logs are kept for Needs your decision a period that still has to be confirmed against each provider (retention windows — check the defaults on each provider's plan) .
Your rights
You can ask for a copy of your data, ask us to correct it, or ask us to delete it. The quickest route to deletion is the deletion page. For anything else, write to privacy@konbran.com.
Needs your decision Depending on where you live you may have further rights, and we may have to name a supervisory authority and a legal basis for each purpose. (your jurisdiction — it decides whether GDPR/UK GDPR rights, a supervisory authority and a legal-basis table must be named here)
Children
BiteSense is not intended for children. Needs your decision The minimum age is not yet fixed. (the minimum age — app setup currently accepts 16; it must agree with the Play target-audience declaration)
Changes
If this policy changes materially we will update the date at the top and, where the change affects how your data is used, tell you in the app.