Privacy Policy

Last updated: November 2, 2026

This notice explains how the GutBloom Android app and the gutbloom.de website use personal data. GutBloom is a food and symptom journal, so much of what you enter is health data. Below we explain what we collect, why, who processes it for us, how long we keep it, and how you can export or delete it.

In short

  • Your meals, symptom check-ins, bowel entries, context entries and Patterns are stored on your phone and, once you agree, in your GutBloom account with Supabase in Ireland (EU).
  • Meal photos and meal names you ask about go to Google's Gemini AI only if you turn on AI meal analysis. GutBloom doesn't store the photo.
  • The app always sends crash reports, performance data and usage statistics to Google Firebase. These never contain what you write in your journal.
  • You can export everything and delete your account in the app at any time, or delete your account at gutbloom.de/delete-account.
  • We don't sell your data, show ads, or use your data for advertising.

Who is responsible

Ben Vollrath, Auf dem Greite 22, 37081 Göttingen, Germany, is responsible (the “controller”) for the app and this website. Questions and privacy requests can be sent to support@gutbloom.de.

The GutBloom app

Your account

You can use GutBloom as a guest, or sign in with an email address and password or with Google.

  • Guest: we create an account without a name or email address. Only this phone can reach it.
  • Email and password: we store your email address and a hashed form of your password, and send you sign-in and account emails.
  • Google: Google tells us your name, email address and profile picture. We use the email address to identify your account.

Account data is stored with Supabase. We use it to provide the account you asked for (Art. 6(1)(b) GDPR). Supabase also records technical service logs, which include IP addresses, to run and secure the service.

Your journal (health data)

GutBloom stores what you enter: meals and their ingredients, drinks, symptom check-ins and their severity, bowel entries, and context such as stress, sleep quality, illness, medication changes, menstrual cycle and unusual activity, together with times, time zones and any notes. From these entries the app calculates Patterns. Patterns are observations about your own entries, not diagnoses.

Entries are kept on your phone in encrypted storage and synchronized to your account, so they aren't lost and can move with you to another phone. On our servers they are stored in Supabase's data center in Ireland (EU), and only your account can read them.

Because this is health data, we process it only with your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR), which you give in the app under “Store and analyze my journal”. You can withdraw it at any time in Settings → Consent and privacy. Withdrawal doesn't affect processing that happened before, but GutBloom can't store new entries without it. We keep a record of your consent decisions so we can show what you agreed to and when.

AI meal analysis

AI meal analysis is optional, needs your separate explicit consent (Art. 9(2)(a) GDPR), and is part of GutBloom+. When you use it:

  • a meal photo you take or choose, or a meal name you type, is sent through our server to Google's Gemini API, which suggests the dish and its ingredients;
  • our server removes a photo's location and other metadata before sending it, and nothing else about you, such as your name, email address or account, goes to Google;
  • GutBloom doesn't save the photo, on our servers or in your journal. Only the result you confirm becomes an entry.

Google processes these requests under its terms for paid Gemini API services: it doesn't use them to train or improve its models, and keeps them for a limited period only to detect abuse and meet legal obligations. Google may process them in any country where it has facilities, including the USA.

For GutBloom+ members, if a scanned product's ingredient list can't be read automatically, its text is also sent to Gemini to read it. That text comes from the product database and contains nothing about you.

We count how many analyses each account uses so we can apply fair-use limits. You can turn AI analysis off at any time in Settings → Consent and privacy; GutBloom then stops sending photos and meal names.

Barcode lookup

When you scan a packaged food, the app sends the barcode number to our server, which looks it up in Open Food Facts, a public food database. Open Food Facts receives only the barcode, from our server, and never your IP address or anything about you. We keep a cache of looked-up products that isn't linked to anyone.

GutBloom+ subscriptions

Purchases are made through Google Play. Google handles payment under its own privacy policy, and we never receive your payment details. We use RevenueCat to check that a purchase is valid and to keep your subscription status in sync. RevenueCat receives a random identifier that our server creates for your account, the products you bought and the purchase records from Google Play. It doesn't receive your email address, name or journal. We store your subscription status and purchase events in your account. This is needed to provide the subscription you bought (Art. 6(1)(b) GDPR).

App diagnostics

To find crashes and keep the app fast and working, GutBloom always uses three Google Firebase services. There is no setting to turn them off.

  • Firebase Crashlytics receives crash and error reports: the error and where in the code it happened, the app version, phone model, operating system version and similar device state.
  • Firebase Performance Monitoring receives how long app start and a few app operations take.
  • Google Analytics for Firebase receives usage statistics. These are the screens you open and actions you take, such as signing in, giving or withdrawing a consent, viewing the subscription page, or adding, editing or deleting an entry. For an entry it records the type (meal, check-in, bowel or context) and how it was added, for example typed, scanned or by photo. It also receives coarse properties such as your plan, sign-in type, whether reminders are on, and a rough range of how many entries you have. Google derives your approximate country and region from your IP address.

These services use identifiers that Firebase creates for the app installation. Diagnostics never contain the contents of your journal, such as what you ate, your symptoms, severities or notes, and never your photos, name, email address or account ID. We don't give Firebase any identifier that links them to your account, and the analytics identifier is reset when the account on the phone changes. Advertising ID collection, ad personalization and automatic screen tracking are switched off.

We rely on our legitimate interest in a stable, secure and working app (Art. 6(1)(f) GDPR). You can object to this processing at any time (see Your rights). Diagnostics can't be switched off for a single installation, so uninstalling the app is the way to stop it entirely.

Operations monitoring

We use Anthropic's Claude as an automated assistant that reviews crash reports, service logs and app health once a day and summarizes problems for us. It reads crash reports, Supabase service logs, and statistics from Firebase, Google Play and RevenueCat. It has no access to the GutBloom database, so it can't read your journal; from our database it receives only overall counts. It doesn't copy crash reports or logs into its summaries. We rely on our legitimate interest in operating the app reliably (Art. 6(1)(f) GDPR).

Reminders and phone permissions

  • Camera: to take meal photos and scan barcodes, only when you choose to.
  • Notifications: for check-in reminders you turn on. Reminders are scheduled on your phone, and their times aren't sent to us.

GutBloom doesn't use your location, contacts or advertising ID.

Export and deletion

  • Export: Settings → Export my data creates a complete JSON file and a readable CSV file of your entries, which you can save or share.
  • Delete entries: you can delete single entries in the app.
  • Delete your account: use Settings → Delete account and data, or gutbloom.de/delete-account for accounts with a sign-in. This permanently deletes your account, journal, Patterns, consent records, preferences and subscription records from our database. What is kept explains what deletion doesn't cover.

The website

Waitlist

The website no longer collects waitlist sign-ups. If you joined the waitlist before the app launched, we keep the email address you submitted so we can send launch and product-research updates (Art. 6(1)(a) GDPR). We do not send your email address to our analytics provider. Waitlist records are stored with Supabase and are not available directly to anonymous website visitors. You can ask us to remove your waitlist record at any time.

Website analytics

We use PostHog Cloud EU only to count homepage loads. A homepage load sends a credential-free request to GutBloom's own measurement endpoint. The endpoint creates a fresh random event identifier and forwards the count to PostHog; that identifier is never stored in your browser or reused.

We do not use analytics cookies or browser storage, identify visitors, link activity across pages or visits, create person profiles, or send page paths, referrers, campaign tags, device details, engagement activity, performance measurements, or email addresses to PostHog. The resulting counts cannot show unique or returning visitors.

Free tools

The free tools at gutbloom.de/tools, such as the appointment summary, run entirely in your browser. What you type into them is not sent to us or to any service provider and is not saved in your browser. It disappears when you close or reload the page, unless you print it or save it as a PDF yourself.

Account deletion page

If you sign in on gutbloom.de/delete-account, the page uses your sign-in only to show which account you are deleting and to delete it. The sign-in is held in the page's memory and isn't stored in your browser.

Service providers and international transfers

These providers process data on our behalf under data processing terms:

  • Supabase (Supabase Inc., USA): database, accounts, sign-in emails and server functions, hosted in Ireland (EU).
  • Google Gemini API (Google): AI meal analysis, only with your consent.
  • Google Firebase (Google): Crashlytics, Performance Monitoring and Google Analytics for Firebase.
  • RevenueCat (RevenueCat, Inc., USA): subscription validation and status.
  • Anthropic (Anthropic, PBC, USA): automated operations monitoring.
  • Vercel (Vercel Inc., USA): website hosting and delivery.
  • PostHog Cloud EU (PostHog Inc.): website visit counts, stored in the EU.

Google Play (payments and app distribution), Google Sign-In and Open Food Facts are independent services that apply their own privacy policies. Our providers may use subprocessors. Some providers or their subprocessors process data outside the EU, especially in the USA. Where they do, the transfer relies on the provider's certification under the EU-U.S. Data Privacy Framework or on the European Commission's Standard Contractual Clauses in its data processing terms.

How long we keep data

  • Account, journal, Patterns, consent records and subscription status: until you delete them or your account. Guest accounts are kept the same way, so delete a guest account in the app before uninstalling if you want its data removed. After deletion, data leaves our hosting provider's encrypted backups within 30 days.
  • Entries on your phone: until you delete them, delete your account in the app, or uninstall the app.
  • Meal photos: not stored by GutBloom. Google keeps Gemini requests only for its limited abuse-monitoring period.
  • AI usage counts: kept with your account to apply fair-use limits and deleted with it.
  • Supabase service logs: a few days.
  • Firebase: Crashlytics keeps crash reports for 90 days, Performance Monitoring keeps data for 30 to 60 days, and Google Analytics keeps event data for at most 14 months.
  • RevenueCat: purchase records are kept so purchases can be restored and accounted for. Deleting your GutBloom account doesn't delete them automatically; email us and we will delete your RevenueCat record. Google keeps its own purchase records.
  • Waitlist: until it is no longer needed for launch and product-research updates, or until you ask us to remove it. Website analytics retention is controlled in the PostHog EU project.
  • Support emails: as long as needed to answer your request and keep a record of it.

Security

Data is encrypted in transit. On your phone, entries are kept in encrypted storage backed by the Android Keystore, which also keeps them out of Android device backups. On our servers, each account can reach only its own data, and server keys are never shipped in the app. No online service can promise absolute security. If a breach affects your data, we will inform you and the authorities where the law requires it.

Your rights

You have the right to access your personal data and receive a copy, to correct it, to have it deleted, to restrict its processing, to receive it in a portable format, and to withdraw any consent at any time with effect for the future. Where we rely on legitimate interests, you have the right to object on grounds relating to your particular situation.

You can do most of this directly in the app: export, edit and delete entries, change consents in Settings → Consent and privacy, and delete your account. For anything else, email support@gutbloom.de. We may need enough information to verify that a request comes from the account holder before we act on it. Guest accounts have no sign-in, so we can't verify guest requests by email; use the in-app controls instead.

You also have the right to complain to a data protection authority, for example the one where you live or the one responsible for us: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

GutBloom doesn't make automated decisions about you that have legal or similarly significant effects. Patterns are observations for you to review, not diagnoses or decisions.

Age

GutBloom is not directed at children under 16.

Changes to this notice

We will update this page when the app's or website's processing materially changes and will revise the date above. If a change affects something you consented to, we will ask you again in the app.