What Bite does with your data

Who is responsible

Bite is made by Elias Hanken, Norway, who is the controller of your personal data. Questions, requests or complaints: [email protected].

What we collect

• Account: your email address and password (stored only as a secure hash), or your Apple ID sign-in if you use Sign in with Apple (Apple may give us a private relay address instead of your email). With Apple, we also keep the token Apple gives us, only so we can disconnect Bite from your Apple ID when you delete your account. The name you choose to be called, if any.
• About you: sex, birth date, height, activity level and how you train — used only to calculate your targets.
• What you log: foods and portions with their calories, macros, fibre, sugars, salt, vitamins and minerals, caffeine and alcohol and the time you logged them, the water you record, the photos you take of meals, weigh-ins and their times, saved meals, recipes, favourites and foods you create, and the supplements you take (name, dose, days, reminder time) with the days you ticked them off.
• Notes: a short note on a day (“long run, hungry all day”) and on a logged food (“half the sauce”), if you write them. A food’s note is deleted with the food.
• Your goals and settings: your targets, including different targets on weekends if you set them; your food needs (allergies, what you avoid or watch) and, if you use the IBS check-in, how a meal sat with you; your fasting window (on or off, its length, whether to tell you when it is done, and whether coffee and tea break it); and your units, kg or lb and kcal or kJ.
• Usage needed to run the service: how many AI actions you used each day (the free plan’s allowance is counted over the week), whether you have Pro, and when you gave consent — for health data, and for the AI. Each AI request also carries a random ID, kept for a day, so a request sent again on a bad connection is counted once.
• Your iPhone, for fair limits: the free AI scans a week are counted per iPhone as well as per account. For that the app sends the ID iOS gives Bite on your iPhone (the same for every account on that phone, different in every other app), and we store it only scrambled (a one-way hash), next to the scans it counted. The free Pro week is once per iPhone: the app sends a token from Apple’s DeviceCheck, and we ask Apple whether this iPhone has had its week. Apple keeps that answer as two bits per device; neither side learns who you are from it.
• Your voice, only when you use the mic: in Describe you can say what you ate instead of typing it. Apple’s speech recognition turns it into text, on your iPhone where the language allows it and otherwise on Apple’s servers. Bite never records or keeps the sound; only the words are used, as if you had typed them. The mic is on only while it shows orange.
• Bite Pro: bought through the App Store. RevenueCat, which handles subscriptions for us, receives your account ID and your purchase history (which plan, when it renews or ends) so the app knows whether you have Pro. We never see your payment details; Apple handles payment.
• Feedback you send: when you answer “How’s Bite going so far?” or use Help → Send feedback: good or could be better, the topics you tick, what you write, whether we may reply by email (to your account’s address), and the app and iOS version. It is linked to your account and read only by us; it is never linked to an App Store rating.
• Usage analytics, only with your yes: which screens you open and for how long, each setup step reached, which way you log (photo, voice, search, barcode…), scans started, logged or thrown away, the Pro screen seen, which Pro feature was offered and whether it was tried, a trial or purchase started, Undo used, the kind of error shown (such as “no connection”), features used (Siri, widgets…), a button tapped several times fast, and leaving a screen within seconds — with your account ID and your device model, iOS and app version, language and time zone. Never food names, photos, notes, amounts, weight or any other health value, and no screen recording or tap tracking beyond that list. Bite asks once, after setup; until you say yes nothing is sent. Change it in Settings → Privacy → Share usage.
• Crash reports: when the app crashes or an error occurs, technical details (device model, iOS version, app version, what went wrong) with your account ID — never your email, meals, notes or weight. A sample of sessions also sends how long screens took to load, with the same details.

Some things never leave your phone: your reminders (meal reminders, the weigh-in reminder and the note when your fast is done are all notifications your iPhone sets for itself — no push service is involved), light or dark mode, your Home layout, the numbers your widgets show, what you chose in Build a meal and the ideas you turned down, a dish from a menu you saved for later, and an AI result you have not logged yet (kept for up to a day).

The AI, and asking first

Bite reads food with OpenAI’s models. The first time you ask it to read something, the app asks whether it may send it; nothing goes until you say yes, and we keep the date you did. You can turn it off again in Settings → Privacy → AI reading, and the app asks again next time. Searching, barcodes and adding food by hand never use the AI.

• A photo, a label or a menu: the photo you took or picked. It is also kept in your private storage with Bite, like a meal photo, until you delete your account.
• Unsafe photos: every photo is checked for unsafe content by OpenAI before it is read. A refused photo is not read or kept; we note only that it happened, the kind and the time, for 90 days.
• Describe it: what you typed or said, and a note you add to a photo.
• A recipe: the text or photo you give it. For a link, our server opens the page and sends its text.
• Build a meal: what is left of your day’s calories and macros, the kind of meal and food you picked (quick, no cooking, veggie), the names and amounts of foods you often log, what you would rather avoid along with your food needs, ideas you turned down and, with “what can I make”, the photos of your fridge or cupboard and the foods found in them.

Never your name, email, weight, your day and food notes, or anything else in your account. OpenAI does not use it to train its models and deletes it within 30 days.

Apple Health

Connecting Apple Health is optional, off until you turn it on in Settings → Apple Health, and made of two separate switches you control one by one. iOS asks for its own permission on top of ours, and you can take it back at any time in the Health app under Sharing → Apps.

• Weigh-ins in: we read body-mass samples so a smart scale fills your weight trend without retyping. Each day’s last reading is saved as a weigh-in in your account, exactly like one you type in yourself, and is covered by the same consent as the rest of your health data.
• Steps in, shown only: we read your daily step totals to show them on your Home screen. They are never saved to your account or sent to us, and they never change your calorie target.
• Meals out: we write the calories, protein, carbohydrate, fat, fibre and caffeine of what you log, the number of alcoholic drinks, and the water you record into Health — numbers only, never a meal’s name, its note or its photo. Edit or delete a meal in Bite and the matching entry in Health is corrected or removed. Turning the switch off stops new meals going over; what is already in Health stays yours to keep or delete there.

We read nothing else from Health — no workouts, heart rate, sleep or medical records — and health data from Health is never used for advertising, sold, shared with anyone, or sent to OpenAI. Data written to Health is stored by Apple on your device under Apple’s terms, not by us. The app keeps a list on your iPhone of what it wrote, so an edit can correct the right entry.

Why, and on what legal basis

• Running the app — your account and what you log — is necessary to provide the service you asked for (GDPR art. 6(1)(b)).
• Health data — food, notes, weight, body details, goals, food needs and check-ins, and weigh-ins read from Apple Health if you connect it — is processed with your explicit consent (art. 9(2)(a)), which you give at sign-up, again per switch for Health, and can withdraw at any time.
• Sending food to OpenAI is done with your explicit consent too, asked the first time and withdrawn in Settings → Privacy.
• Crash reports are our legitimate interest in keeping the app working (art. 6(1)(f)).
• Usage analytics are sent only with your consent (art. 6(1)(a)), asked once and withdrawn any time in Settings → Privacy.
• Feedback is kept because you chose to send it, to make Bite better and answer you if you asked (art. 6(1)(f)).
• Emails are only sent when you ask for them, such as a password reset code.

Who handles it for us

Food searches go to Open Food Facts and the USDA database without anything that identifies you. Transfers to the USA rely on the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses. Generic foods, with their vitamins and minerals, come from Matvaretabellen 2026 (Mattilsynet, www.matvaretabellen.no, under the Norwegian Licence for Open Government Data) and are kept in our own database, so searching them sends nothing anywhere else.

What we do not do

We do not sell your data, show ads, share it with advertisers, or track you across other apps and websites. Bite is not a medical service and your data is not used to make decisions about you.

How long we keep it

For as long as you have an account. Deleting your account (Settings → Account → Delete account) removes everything linked to it straight away — your log, notes, weigh-ins, goals, settings, saved meals and recipes, foods you created, photos, feedback, consents and usage counts. If you signed in with Apple, we also ask Apple to disconnect Bite from your Apple ID. Copies in our hosting provider’s backups are gone within 30 days. What stays is the daily count of free AI scans for the scrambled iPhone ID, which is not linked to any account. Crash reports at Sentry, usage analytics at PostHog (kept up to 12 months) and purchase records at RevenueCat expire under their own retention; write to us and we remove them sooner.

Your rights

• See and get a copy of your data — Settings → Your data. “Export” gives your log as a spreadsheet (a CSV file for Numbers, Excel or Google Sheets): a row per food with its time, meal, amount, numbers and note, or a row per day with its totals and the day’s note, for 30 days, 90 days or everything. “Export everything” gives all of it as one JSON file: your profile and settings, goals, log, weigh-ins, water, saved meals and recipes, favourites, foods you created, AI use, check-ins, day notes and subscription status. Both go straight to your share sheet; nothing is kept on a server on the way.
• Correct it — everything you log can be edited in the app.
• Delete it — Settings → Account → Delete account.
• Withdraw consent — turn AI reading or Share usage off in Settings → Privacy, turn the Apple Health switches off in Settings → Apple Health, delete your account, or write to us.
• Restrict or object to processing, or ask any question — write to [email protected].
• Complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no), or the authority where you live.

Age

Bite is for people aged 13 and over. Under 18, Bite helps you eat well and keep steady, and never plans weight loss.

Changes

If this policy changes in a way that matters, we will tell you in the app before it takes effect. The date at the top shows the latest version.