Privacy Policy

Who We Are

GutMap is operated by Mohammad Harba, an independent developer based in Italy. For any privacy matter — including questions about this policy or requests to exercise your rights under the GDPR — contact support@gutmap.app. Mohammad Harba is the data controller for the purposes of GDPR.

What Data We Collect

We collect only the data needed to run the app. Here is everything we collect:

• Account: Email address and password. If you sign in with Apple or Google, we receive a unique identifier and email from those services instead of your password.
• Profile (all optional): Nickname, birth date, gender, height, weight.
• Health conditions (optional): Any GI conditions you choose to disclose, such as IBS, Crohn's disease, ulcerative colitis, GERD, celiac disease, diverticulitis, or gastroparesis. Used only to personalise your insights.
• Meal logs: Dish names, ingredients, portion size, meal type, timestamps, notes, and meal photos you choose to scan.
• Symptom logs: Symptom type (bloating, gas, abdominal pain, diarrhea, constipation, nausea, fatigue, heartburn), severity, timestamps, and notes.
• Daily check-ins: Stress level, sleep quality and hours, exercise intensity, hydration, eating speed, alcohol notes, and menstrual cycle day and phase (if you choose to log this).
• Generated reports: Weekly and monthly insight reports created from your data by AI analysis.

We do not collect location data, HealthKit data, device contacts, or any analytics telemetry.

Why We Collect It (Legal Basis)

We process your data for the following reasons:

• To provide the service: Storing and displaying your logs, generating reports, and syncing data across your devices. This is necessary to fulfil our agreement with you.
• Your consent: Sensitive health data (GI conditions, symptoms, menstrual cycle) is processed only because you actively choose to enter it. You can omit or delete any of this at any time.
• Legitimate interest: Keeping the service secure and functioning correctly.

How We Store Your Data

Your data is stored on a secure cloud database provider with row-level security, meaning each user can only ever read or write their own data. All data is transmitted over HTTPS/TLS. Authentication tokens are stored in the iOS Keychain on your device.

When you delete a record in the app, it is first marked as deleted and then permanently removed from our servers during the next sync. When you delete your account, all your data is permanently deleted from our servers. Deletion cannot be undone.

Our database is hosted on servers in the European Union (Ireland).

Third-Party Services

We use the following third-party services. We do not use advertising networks, analytics SDKs, or any other tracking services.

Google LLC — Gemini API (United States)
When you scan a meal photo or generate a weekly or monthly report, we send data to Google's Gemini API for analysis. This data includes your meal history, symptom history, daily check-ins (including menstrual cycle data if logged), and disclosed GI conditions. Meal photos are sent for ingredient analysis but are not stored on our servers — only the text result is saved. Google processes this data under its Privacy Policy and the EU-US Data Privacy Framework.

Supabase Inc. (US company — servers in Ireland, EU)
We use Supabase for database storage, user authentication, and edge-function processing. Supabase stores your account and logs on our behalf under their Privacy Policy and a Data Processing Agreement. Transfers are covered by Standard Contractual Clauses; you can request a copy by emailing us.

Apple Inc. and RevenueCat, Inc. (subscription billing)
Paid subscriptions are processed by Apple through the App Store. RevenueCat manages subscription state and entitlement on our behalf. We never see your payment details. See Apple's Privacy Policy and RevenueCat's Privacy Policy.

Sign in with Apple / Sign in with Google
If you use these login methods, Apple or Google handle authentication and share a user identifier and email with us. We do not receive your Apple or Google password. See Apple's Privacy Policy and Google's Privacy Policy.

What We Do Not Do

• We do not sell your data to anyone.
• We do not use your data for advertising.
• We do not share your identifiable health data with any third party, except as described above (AI processing and infrastructure providers).
• We do not use remote push notifications or analytics tracking.

Your Rights

You have the following rights over your data:

• Access: You can see all your logged data inside the app at any time.
• Correction: You can edit any log entry inside the app.
• Deletion: You can delete individual entries or your entire account from Settings. Account deletion permanently removes all your data from our servers.
• Data export / portability: To request a copy of your data in a portable format, email us at support@gutmap.app.
• Withdraw consent: Because sensitive health data is logged voluntarily, you can stop logging it or delete it at any time. Withdrawing consent does not affect the lawfulness of prior processing.
• Restriction / objection: You can ask us to stop processing your data in specific ways. Email us and we will respond within 30 days.

EU / UK users (GDPR): You have the right to lodge a complaint with your local data protection authority if you believe we are handling your data unlawfully. For Italian users, this is the Garante per la protezione dei dati personali.

California users (CCPA): We do not sell personal information. You have the right to know what personal information we collect, request deletion, and not be discriminated against for exercising these rights. To submit a request, email support@gutmap.app.

Children's Privacy

GutMap is not intended for children under 14. We do not knowingly collect personal information from anyone under 14. If you are a parent or guardian and believe your child has provided us with data, please contact us at support@gutmap.app and we will delete it promptly. The age threshold of 14 reflects the minimum age for digital consent under Italian law (D.Lgs. 101/2018, implementing GDPR Art. 8).

Users between 14 and 17 should use the app with parental awareness. The sensitive wellness data in this app (symptoms, menstrual cycle, GI conditions) is intended for mature, autonomous decision-making.

Data Retention

We keep your data for as long as your account is active. If you delete your account, all data is permanently deleted. We do not retain anonymised or aggregated copies of your personal health data after account deletion. Note: subscription and billing records held by third-party payment processors (such as the relevant app store or payment provider) are retained under their own policies and the legal obligations that apply to them, which we cannot override.

International Transfers

Our infrastructure and third-party service providers may process your data in countries outside your own, including the United States. These providers have appropriate data transfer mechanisms in place (such as Standard Contractual Clauses for EU data). By using GutMap, you acknowledge this cross-border processing.

Changes to This Policy

If we make material changes to this policy, we will update the "Last Updated" date at the top and notify you via an in-app message or email before the changes take effect. Continued use of the app after the effective date means you accept the updated policy.

Not Medical Advice

GutMap is a personal food and symptom tracking tool, not a medical device or diagnostic system. It does not diagnose, treat, cure, or prevent any disease or medical condition. Insights and correlations shown in the app are based on the data you log and generated by AI analysis — they may not be accurate. Always consult a qualified healthcare provider before making changes to your diet or treatment plan.

Contact

Questions about this policy or requests about your data? Email us at support@gutmap.app. We aim to respond within 30 days.