Privacy Policy

• Your profile, food diary, weight, water, plans, reminders and chat history are stored on your phone, not on our servers.
• Optional Steps access only reads step counts from Apple Health or Health Connect. Imported step history stays on your phone and is not sent to AI or our servers.
• Voice entry is transcribed on your phone. Audio is not recorded or sent to us.
• The online AI food assistant is optional. When you use it, your request goes to our server and to OpenAI.
• While you test the AI assistant, your Food chat messages are shared with us to improve B-MAD. You can turn this off and delete them in the app.
• No ads, no selling or renting of data, no analytics or advertising trackers, and no tracking across other apps or websites.

Your profile and body measurements (such as the name you choose, height, weight, goal weight and the answers you give during setup), goals and calorie targets, food diary, water, meal plans, reminders, achievements, appearance choices and Food chat history are saved in the app’s storage on your phone. We cannot see them. They are protected by your phone’s own storage security; B-MAD does not add separate encryption. The app has no cloud sync: nothing in your diary is uploaded to us.

Backups you export are files you choose where to save, and anyone with the file can read it. Meal reminders are scheduled as notifications on your phone; no reminder content is sent to us. You can delete everything in All → Profile & data → Delete all data on this phone, or by removing the app.

If you connect Steps in All, B-MAD asks only to read step counts from Apple Health on iOS or Health Connect on Android. It does not request permission to write health data. Manually entered steps are excluded. On Android, a source containing manual or unknown entries is omitted for that day, so some totals may be partial.

Imported daily totals, their dates, health source, time zone and last-read time stay in B-MAD’s local storage. They are not sent to food AI, our servers, advertising services or cloud sync, and are not included in exported food backups. Connected steps refresh while the app is active and when you return to it, using history available in your health app. B-MAD does not run a separate background recording service.

If you also allow Physical activity (Android) or Motion & Fitness (iOS), B-MAD reads your phone’s step sensor only while the app is open, so today’s count moves as you walk. That live count is shown on screen and never saved or sent anywhere; your health app’s saved total replaces it when it updates.

You can stop updates in All → Steps and revoke health access in your phone’s health app. Stopping updates keeps previously imported history; Delete all data on this phone or removing B-MAD clears the local copy. It does not delete records from Apple Health or Health Connect. Step calories and the optional walking suggestion are estimates calculated on your phone from your saved weight, height and recent activity; they are not a measured calorie burn or a guarantee of weight or fat loss.

When you tap the microphone, B-MAD asks your phone to recognise speech on the device only. The audio is not saved and is not sent to us. Your phone may need to download a language for offline use; that download is between you and your phone’s maker.

Joining the AI assistant. You enter your email so we can send a 6-digit sign-in code through our email provider, Resend. We store only a keyed one-way hash of your email, never the address itself. Codes expire after 10 minutes. To limit abuse we also keep a keyed hash of your network (IP) address for up to one day. The trial length and daily reply limit are shown in the app before you join.

Using the AI food assistant. The message you send, with recent messages from the same chat for context, goes to our server and to OpenAI, which interprets the food and estimates nutrition. We do not store the text you sent. We store the interpreted result together with usage and cost records, linked to your sign-in on that phone, not to your email. OpenAI handles requests under its own API terms and privacy policy.

Shared test messages. While you test the AI assistant and sharing is on, your Food chat messages and B-MAD’s replies are saved in our database to help us improve B-MAD. They are linked to a random ID created for this install of the app, the app version and the time, not to your name or email, and we remove email addresses and phone numbers from the text before saving it. Because the text is yours, it can still contain personal details you typed, so please avoid writing them. Turn sharing off or delete these messages in All → Profile & data → AI chat data.

Meal photo scanning. If you choose to scan a photo of a meal, that photo, any note you add and recent messages from the same chat for context are sent to our server and OpenAI to identify the food. We do not keep the photo after returning the result. A small copy stays in the app’s storage on your phone so the chat can show it; it is deleted once that message leaves the chat history, or when you delete the app. Photos are sent only when you choose to scan one.

Reference food photos. To show a picture of a food, the app looks up the food’s name on Wikipedia and loads the image from Wikimedia. They receive that food name and your network address, under their own privacy policies. The picture never changes your nutrition values.

B-MAD website accounts. If you create an account on the B-MAD website, we store your name, email, a securely hashed password, your sign-in sessions (including IP address and browser type) and any records you choose to sync. The mobile app does not create website accounts.

The B-MAD website uses no analytics, advertising or social-media trackers. The home page sets no cookies, and the previews on it show a fictional sample day; choices you make in “Customize preview” are not saved or sent anywhere. If you sign in to a website account, we set a strictly necessary, HttpOnly session cookie to keep you signed in. It is not used for anything else.

Like any website, our hosting provider receives standard request information, such as your IP address, browser type, the page requested and the time, and keeps it in short-lived logs for security and troubleshooting. Our own server logs record only the type and outcome of a failure, never what you typed, your email or your health data.

• To run the features you ask for, such as sending your sign-in code, answering food questions, and scanning a meal photo.
• To keep the AI assistant fair and affordable: daily limits, preventing repeated free trials, and tracking costs.
• To improve B-MAD, using shared test messages while sharing is on.
• To keep the service secure, prevent abuse and meet legal obligations.

We do not sell or rent personal information, show ads, build marketing profiles, or use your health or diary information to decide anything about you.

Under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) we process personal information:

• To provide what you ask for: sign-in codes, AI answers, meal photo scans and website accounts.
• With your consent: sharing test messages, reading steps from your health app, and sensitive details such as health information you choose to send in a Food chat message. You can withdraw consent at any time in the app.
• To meet legal obligations: answering lawful requests from authorities.
• For legitimate interests that do not override your rights: security, abuse prevention and cost limits.

• Vercel hosts our website and server.
• Supabase hosts our database.
• OpenAI interprets AI food requests and meal photos.
• Resend delivers sign-in code emails.

These providers may process information outside the Philippines, including in the United States. They act on our instructions under their own security and data-processing terms, and we send each only what its job needs. Apple Health and Health Connect stay on your phone and send nothing to us. We share information with authorities only when the law requires it. If B-MAD is ever transferred to someone else, this policy and your choices would continue to apply to your information.

If you open Plus in a configured store build, RevenueCat receives a pseudonymous B-MAD account identifier and purchase information to verify and restore store subscriptions. Its SDK also processes the device and app information needed to communicate with your app store. Our server checks subscription status with RevenueCat before granting paid AI access. We do not send your email, diary, food messages, photos, weight or steps to RevenueCat. Apple or Google processes your payment details; B-MAD does not receive your card number. Purchase records follow the store’s and RevenueCat’s retention requirements. Contact support for subscription-data requests.

• Sign-in codes: until used or 10 minutes, whichever is sooner. Network-address hashes: up to one day.
• Interpreted AI results: until you delete your AI chat data or the AI service ends.
• Shared chat messages: until you delete them or the AI service ends, whichever is sooner.
• Your trial record (the keyed email hash, trial dates and usage counts): for as long as the AI service runs, so a free trial cannot be restarted and costs stay accounted for. Verifying the same email again continues the same trial.
• Website accounts: until you ask us to delete the account.
• Hosting request logs: short-lived, as set by our hosting provider.

Under the Data Privacy Act you have the right to be informed, to access your personal information, to object to its processing, to have it corrected, to have it erased or blocked, to receive a copy in a portable format, to withdraw consent, and to claim damages and file a complaint.

Much of this you can do yourself in the app: export a backup, delete local data, stop sharing test messages, revoke health access and delete your AI beta data; see Delete your data. For anything else, email support@trybmad.com and say what you would like. We may ask you to confirm you own the account or email involved before acting. We reply within 30 days. You may also complain to the National Privacy Commission at privacy.gov.ph.

B-MAD is for people aged 18 and over. We do not knowingly collect information from anyone younger. If you believe a minor has used the AI assistant, email us and we will delete their AI beta data.

Connections to our server use HTTPS. Emails, sign-in credentials and codes are stored only as one-way hashes, and server keys never ship inside the app. Access to our database is limited to the people who run B-MAD. No method is perfect, so keep your phone locked and back up anything you cannot lose.

If a security breach affects your personal information, we will notify you and the National Privacy Commission as the law requires. To report a security problem, email support@trybmad.com with “Security” in the subject.

When this policy changes we update the date at the top. If a change affects what leaves your phone, we say so in that app update’s release notes as well as here.

Questions or requests about your privacy: support@trybmad.com. See also our Terms of Use and Support page.