Privacy policy
The short version. Bimsy has no accounts, no ads and no tracking. Your family's details, plans and meal logs stay on your phone. If you use Snap a meal or the fridge scan, that photo is sent to our server and to Google's Gemini AI to be analysed, then thrown away. Apple and RevenueCat handle subscriptions.
1. Who we are
Bimsy ("we", "us") is run by Martas Paplauskas, a sole trader based in England. We are the controller of the personal data described in this policy.
Questions or requests: paplauskasmartas@gmail.com.
This policy covers the Bimsy iPhone app and this website. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and, for people in the United States, US state privacy laws such as the California Consumer Privacy Act (as amended by the CPRA) where they apply (see section 11).
2. What stays on your phone
Most of what you tell Bimsy is stored only on your device, in the app's own storage. We never receive it and cannot see it:
- your quiz answers and preferences: shop, budget, what you spend now, takeaways (takeout) per week, cooking styles, dietary choices, allergies and kitchen equipment;
- your family details: number of adults, and for each child a first name (or nickname), age and the foods they refuse;
- your meal plans, shopping lists and plan history;
- your meal and calorie logs;
- your weekly reminder, which is a local notification scheduled on your phone (we don't use push notifications);
- if you agree to them, occasional offer notifications (at most two, after you first see Bimsy Plus). These are also local notifications. Turn them off with Stop offer notifications on the Bimsy Plus screen, in You > Offers, or in your iPhone Settings.
This information is deleted when you tap You > Delete my data or delete the app. It may be included in your own iCloud or iTunes device backups, which Apple manages under its own privacy policy.
3. What we do receive, and why
| Information | Why we use it | Lawful basis (UK GDPR) | How long we keep it |
|---|---|---|---|
| Photos you take or choose for Snap a meal or the fridge scan | To estimate the meal and its calories, or to recognise the ingredients in your fridge, and send the result back to you. | Consent: we ask before your first photo is sent. You can withdraw it any time in You > Privacy & terms > Photo AI. | Not stored by us. The photo is held in memory only while it is analysed, then discarded, and it is never written to our logs. Google may keep a temporary log of the request, as described in section 4. |
| Anonymous install ID: a random code created when you install Bimsy. It is not linked to your name, email, phone number or Apple ID. | To stop the photo features being overused (rate limits), to credit referral rewards, and as your customer ID with RevenueCat so your subscription follows your app. | Legitimate interests: keeping the service fair, secure and affordable, and running the referral programme. | Rate-limit counters (one count per install per day): deleted after 30 days. Referral records: while the referral programme runs and 12 months after, to handle queries and prevent abuse. |
| Referral codes: your personal invite code, and the code you used, if any, and when it was used | To give your friend a longer free trial and to give you the free weeks you earn. | Legitimate interests, and contract (the referral terms). | As for referral records above. |
| Technical data sent with any request: IP address, time, app version, device type | To run, secure and fix the service. Our hosting providers keep short-lived logs. | Legitimate interests: security and reliability. | A short time, typically between 1 and 30 days depending on the provider's log settings. |
| Subscription status from Apple via RevenueCat: whether you have Bimsy Plus, trial and renewal dates, country/storefront, transaction IDs | To unlock Plus, restore purchases and handle support and refunds questions. | Contract; legal obligation for financial records. | For as long as you subscribe, then as required for accounting and tax (usually 6 years). |
| Emails you send us | To answer you. | Legitimate interests: customer support. | Up to 2 years after the conversation ends. |
Your consent for photos. Before your first photo is sent, Bimsy asks your permission and names Google's Gemini AI. You can withdraw it any time in You > Privacy & terms > Photo AI. After that we won't send any photos until you allow it again. Withdrawing doesn't affect photos already analysed.
Photo requests carry only the photo, its file type and your anonymous install ID. Your preferences, allergies, dietary choices and family details are never sent with them.
We do not sell your data, we do not show ads, and the app contains no advertising or analytics tracking tools. We don't use your data for automated decisions that have legal or similarly significant effects on you.
4. Who we share it with
We use a small number of service providers ("processors") who act on our instructions:
- Supabase hosts our server functions, which receive photo requests and keep rate-limit and referral records. Our database and functions are hosted in London (UK).
- Google provides the Gemini AI model that analyses photos (Gemini API). Google receives the photo and our instructions for analysing it, but not your install ID, name or family details. Google processes the photo under its Gemini API terms and data processing terms. We ask Google not to store the requests; Google may still log them for a limited time solely to detect and prevent abuse and for legal reasons, and may process them in any country where it has facilities.
- RevenueCat manages subscriptions on our behalf. It receives your anonymous install ID, App Store transaction details, basic device information and, if you used one, the friend's or creator's code you entered, so we can credit referrals.
- Apple handles all payments, free trials, offer codes and refunds. We never see your card details, name or Apple ID email. Apple's use of your data is covered by Apple's own privacy policy.
- Vercel hosts this website and keeps standard access logs.
Each of these providers is bound by a data processing agreement or equivalent terms. They provide the same or equal protection of your data as described in this policy and as required by Apple's App Store Review Guidelines, and they may use your data only to provide their service to us.
We may also share information if the law requires it, or to protect the rights and safety of our users or others.
5. International transfers
Some of our providers are based in, or may process data in, the United States or elsewhere outside the UK. Where that happens we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses. The safeguard each provider uses is set out in its data processing terms. You can ask us for a copy of the relevant safeguards.
6. Children
Bimsy is made for parents and carers. It is not meant to be used by children, and you must be 18 or over to subscribe. Parents can add their children's first names, ages and the foods they refuse so the app can suggest kids' plates. That information stays on your phone and is never sent to us. You can use a nickname or initial instead of a name if you prefer. Bimsy is not directed to children under 13, and we don't knowingly collect personal information from them.
7. Health and dietary information
Allergies, dietary choices and calorie logs can reveal information about health or beliefs. That's why they stay on your phone. A meal or fridge photo you choose to analyse could also show something about your diet; we don't keep photos, and we don't try to infer anything about your health from them.
8. Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct it, or to delete it;
- ask us to restrict how we use it, or object to our use of it based on legitimate interests;
- ask us to transfer it to you or someone else in a machine-readable format, where that applies.
Because we don't have accounts, we may only be able to find records linked to your install ID. Email us your personal referral code (shown in the app under You) and we'll use it to find and act on those records. We'll reply within one month. To delete everything on your phone, and the referral and usage records our server holds for your install, use You > Delete my data. Deleting the app removes what's on your phone. To cancel or manage a subscription, use your iPhone's Settings (see our help page).
If you're unhappy with how we've handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.
9. Security
Requests between the app and our server are encrypted in transit (HTTPS). Our AI and service keys are kept on the server, never in the app. Access to our systems is limited to the people who need it. No system is perfectly secure, but we keep what we hold to a minimum so there's very little to lose.
10. This website
This website does not use cookies, analytics or tracking. It loads fonts from Google Fonts, so your browser connects to Google's servers, which receive your IP address (see Google's privacy policy).
11. If you live in the United States
In the last 12 months we have collected these categories of personal information, as described in section 3: identifiers (the anonymous install ID and referral codes), commercial information (subscription status from Apple via RevenueCat), photos you choose to analyse (processed and not kept), and internet activity limited to technical request data. We collect them for the purposes in section 3 and disclose them only to the service providers in section 4.
- No selling or sharing. We do not sell your personal information and we do not share it for cross-context behavioural advertising.
- Sensitive information. We don't use or disclose sensitive personal information to infer characteristics about you. Health-related details such as allergies and calorie logs stay on your phone.
- Your rights. Depending on your state, you may have the right to know what personal information we hold about you, to get a copy, to correct it and to delete it. Use You > Delete my data, or email us your referral code at paplauskasmartas@gmail.com. We'll confirm and respond within 45 days. You can use an authorised agent, and we will never treat you differently for using your rights.
12. Changes to this policy
If we change how we use your information, we'll update this page and the date at the top. If the change is significant, we'll also tell you in the app.