Privacy policy
This policy explains what Bovvio collects, why, and what you can do about it. Bovvio is designed so that most of your data never has to leave your phone: you can use the app fully without an account.
What we collect
- Account details - if you create an account: your email address, name, and either a securely hashed password or your Google account identifier and profile photo link. We never see your Google password.
- Your synced log - if you're signed in, a copy of your app data is stored so it survives a new phone: your profile (such as age, sex, height, weight and goals), food diary, water, weigh-ins, check-ins, biomarkers you enter, saved foods and settings. This includes health-related information, which we process only to provide the service you asked for, with your explicit consent given when you turn on sync by signing in.
- Meal photos - when you use photo scanning, the photo is sent to our server, analysed, and discarded. We do not store it. Photos stay on your phone and are not included in sync.
- Guide messages, meal descriptions and meal plans - when you chat with the Guide, describe a meal (typed or spoken) or ask for a meal plan, the text and a short summary of your targets are sent to our server to generate a reply. We do not store them on our servers. Speech is turned into text by your phone's own speech recognition before anything reaches us.
- Health Connect - only if you connect it. Bovvio reads steps, active and total calories burned, exercise sessions, sleep, heart rate and resting heart rate, weight and body fat from Health Connect (which may come from apps and devices such as a watch, fitness tracker or smart scale), and writes the meals, water and weight you log. Activity, sleep and heart rate data stays on your phone and is never sent to our servers. Weights you choose to import become part of your log, which is synced if you're signed in. Health Connect data is used only to show your activity and adjust your targets - never for advertising, never sold, and never used to train AI models. You can disconnect at any time in the app or in Health Connect's settings.
- Invite rewards - if you use or share an invite code, we record which accounts are linked so we can add free Pro days to both.
- Leagues and duels - only if you join them. We store the nickname you pick and, for each day you log food, your day score, protein eaten, protein target and calories eaten. Other players in your league or duel see your nickname and your points (and, in a protein duel, your daily protein) - never your food diary, account or email. This data isn't linked to your account. Leave from the app at any time and it is deleted immediately.
- Plate verdicts, ingredient scans and restaurant suggestions - to write a verdict on a scanned plate, the names of the foods with their calories and protein are sent to our server; to read an ingredients list, the photo of the pack is sent, analysed and discarded; to suggest what to order, the restaurant you type and what's left of your day's targets are sent. None of it is stored.
- Your phone's identifier - when you claim an invite reward, your app sends a one-way fingerprint of your phone so the same phone can't claim free Pro over and over with new accounts. We only ever see the fingerprint, never the identifier itself, and it is used for nothing else - no advertising, no tracking, no profiles.
- Technical data - your IP address is used briefly to prevent abuse (for example rate limits on sign-in attempts). These counters are deleted automatically within about a day.
- Purchases - subscriptions are handled entirely by Google Play. We receive confirmation that you're subscribed, never your card details.
How we use it
To run your account and sync, to analyse photos and answer Guide questions, to send essential emails (sign-in codes, password resets, security notices and account deletion confirmation), and to keep the service secure. We don't sell your data, we don't show ads, and we don't use your data to train AI models.
Who processes it for us
- Cloudflare - hosting, database, and running the AI models that analyse photos and power the Guide.
- Our email delivery provider - to send account emails.
- Google - Sign in with Google and Google Play billing, if you use them.
- Open Food Facts - when a barcode isn't in the built-in library, the barcode number (not your identity) is looked up in this open database.
- Shopping links - some "Buy online" links go to retailers such as Amazon or to partner shops, which may pay us a commission. Tapping one opens that site under its own privacy policy; we don't share your data with them.
How long we keep it
Account and synced data are kept while your account exists. When you delete your account, your account and synced data are deleted from our database immediately. Short-lived security data expires within a day; one-time codes within an hour. League and duel data is kept while you take part and deleted as soon as you leave.
Your rights
Under UK and EU data protection law you can access, correct, export or delete your data, withdraw consent, and object to processing. In the app you can export everything (Settings → Account → Export) and delete your account (Settings → Account → Delete account), or use this page. You can also complain to the Information Commissioner's Office (ico.org.uk).
Security
Connections are encrypted. Passwords are never stored - only a salted PBKDF2-SHA256 hash, checked in constant time. Sign-in tokens and email codes are stored only as hashes, weak and commonly guessed passwords are refused, repeated sign-in attempts are rate limited, and you can end other sessions from the app.
Children
Bovvio is not intended for anyone under 16.
Contact
Questions or requests: support@bovvio.com. If we change this policy in a meaningful way, we'll tell you in the app.