Your log stayson your phone.

On your device

Everything you log is stored on your phone and syncs through your own private iCloud account, so it reaches your other Apple devices and your new phone. That is Apple's private database, not a BiteDeck one: we cannot read it, and we never receive or store a copy. BiteDeck's data is also included in your personal iOS backup automatically. Read more about local-first.

What BiteDeck sends off-device

• Food photos you scan

  Sent through BiteDeck's own proxy to Google Gemini Vision for recognition, then returned as an item list. We do not retain your images. We do not train on them. If you'd rather not scan, skip it — every meal can be logged by search, barcode, label OCR, or freeform.

• Exercise descriptions you paste

  Sent through the same proxy for parsing into duration/intensity/calories. Not retained. Not trained on.

• Ingredient descriptions you add

  Sent through the same proxy for structured parsing. Not retained. Not trained on.

• Coach messages

  On-device context about your day (macros, recent meals, profile basics) accompanies each Coach turn so the reply is relevant. Chat history lives on your device; you can delete it at any time.

No message, photo, or description is ever tied to a BiteDeck account, because there is no account.

Apple Health

HealthKit is the only integration that touches your health data, and it is opt-in. You choose to connect. Every metric — steps, active energy, workouts, weight, body fat, dietary energy, macros, fiber, sugar, sodium, water — has its own toggle. Turn any one off without disconnecting everything.

The Health connection itself is on-device: readings move between HealthKit and BiteDeck's local store without touching a server. Imported entries then sync through your iCloud like the rest of your log, and if you use the optional AI Coach, your recent totals, weight trend, and body fat — including values imported from Health — are part of the request that generates its answer.

Analytics in the app

The app measures how it is used, through PostHog. That covers which onboarding screen people leave on, whether a scan succeeded or failed, and whether the paywall was shown and converted.

What it cannot cover is your health data, and that is enforced in code rather than by policy. Screens all over the app report events with details attached, and every one of those details is checked against a fixed list of permitted fields before anything is sent: the product identifier, the onboarding step and its position, which feature asked for the paywall, the outcome and a coarse reason, the layout variant, the plan price and currency, and which food database answered a search. A field that is not on that list is dropped. There is no entry on it for a weight, a meal, a photo, or a body measurement. Session replay, which would record those straight off the screen, is switched off in the same file that starts PostHog.

Separately, the Meta SDK reports that the app was installed and that one of two things happened afterwards: a trial started, or a subscription began. Each of those carries the plan's list price and the currency, and nothing else. A plan price is the same number for everyone who buys that plan, so it describes the product rather than you. No other event reaches Meta. The app asks for tracking permission through Apple's own prompt, at the end of onboarding, and you can refuse it there or later in iOS Settings.

This is why the App Store privacy card for BiteDeck reads “Data Used to Track You” and lists purchases, identifiers and usage data. That label is accurate. It covers the two paths above, not your log.

This website

This site sets no cookies of its own. If you accept in the cookie banner, it loads Google Analytics to count page visits and to see which pages lead people to the App Store. That is ordinary website traffic measurement: it tells us a page was read and roughly where the visitor came from — nothing about who you are. Google Analytics writes its own cookies (_ga and _ga_<id>) to tell repeat visits apart.

If you refuse, nothing is loaded — no request to Google, no cookie, no page view counted. Nothing else on the site changes. Your choice is remembered in your browser's local storage, and you can change it any time with the Cookie settings link at the bottom of any page; switching from accept to refuse deletes the analytics cookies as well.

It has no connection to the app, and no connection to the app's own analytics described above. There is no BiteDeck server holding your log, and the permitted-field list means nothing you log, weigh, eat, or photograph can reach this or any other analytics tool. The three systems never touch.

Your controls

• Export

  Settings → Export Data → CSV (weights + meals) or PDF (30-day summary). Share anywhere or keep a local copy.

• Erase

  Settings → Erase All Data → type ERASE to confirm. Nukes SwiftData, progress photos, UserDefaults, and every BiteDeck-authored HealthKit sample. Irreversible on purpose.

• Revoke HealthKit

  Apple Health app → Sharing → BiteDeck → turn off any metric or all of them. BiteDeck detects the change silently and stops writing.

Contact

Questions? support@bitedeck.app. We read every message.