Privacy Policy — BloatLess

Effective: April 18, 2026 · Last updated: April 18, 2026

This Privacy Policy explains how BloatLess (also marketed as GutLog) collects, uses, and shares information when you use the app. By using the app, you consent to the practices described here.

1. Information We Collect

1.1 You provide

Account data: email, password (hashed), or Apple ID identifier
Onboarding responses: primary symptom, dietary questionnaire
Meal logs: food names, meal type, time, ingredients, optional photos, optional barcodes
Symptom check-ins: severity ratings (bloating, cramping, diarrhea, constipation, fatigue, brain fog, mood)
Free-text notes

1.2 Automatically collected

Anonymized app version, OS version, device model, coarse locale
Subscription state via RevenueCat (hashed Apple ID, entitlement status, product ID)
Crash reports (if you opt in via iOS settings)

1.3 Not collected

Precise location, contacts, advertising identifiers (IDFA), microphone, audio

2. How We Use Information

Provide core features (logging, analysis, weekly reports)
Generate personalized trigger insights from your logs
Process subscription purchases and manage entitlements
Send on-device local notifications (not sent to our servers)
Improve app quality via anonymized aggregate metrics
Comply with legal obligations

3. AI and Automated Analysis

When you encounter a high-risk meal, the app may send the meal name and anonymized aggregate log counts to Anthropic's Claude API to generate a pre-trigger alert. No personally identifying information is shared with Anthropic. Anthropic's privacy terms apply to this processing.

4. Third-Party Services

Service	Purpose	Data shared
Supabase	Backend, auth, database	Account and logs
RevenueCat	Subscription management	Hashed Apple ID, subscription status
Anthropic (Claude)	AI pre-trigger analysis	Meal name, aggregate counts (no identifiers)
Apple	Sign in with Apple, IAP	Apple ID identifier, purchase receipt
Open Food Facts	Barcode lookup	Scanned barcode (no user identifiers)

We do not sell your data.

5. Data Storage and Security

Data is stored on Supabase with TLS in transit and encryption at rest
Row-level security ensures each user can only access their own records
API keys are kept out of version control where feasible

6. Data Retention

We retain data while your account is active. Upon account deletion, associated personal data is deleted or anonymized within 30 days, except records required for legal, tax, or fraud-prevention purposes.

7. Your Rights

Depending on your jurisdiction (GDPR, CCPA, PIPA, etc.) you may have the right to access, correct, delete, export, object to, restrict processing, or withdraw consent. To exercise any of these rights, email [email protected]. We respond within 30 days.

8. Children's Privacy

The app is not directed to children under 16. We do not knowingly collect personal data from children.

9. International Transfers

Your data may be stored or processed in countries other than your own (e.g., United States for Supabase, RevenueCat, Anthropic). By using the app, you consent to such transfers subject to appropriate safeguards.

10. Cookies and Tracking

The app does not use cookies or advertising trackers. We do not participate in ad networks or cross-app tracking.

11. Changes

Material changes will be announced via in-app notice or email at least 7 days before taking effect.

12. Contact

Email: [email protected]. We are the data controller responsible for personal information processed through the app.