Privacy Policy

Last updated: October 19, 2026

This policy explains what data BiteStride (the "app") collects, what we use it for and what rights you have over it. It applies to the mobile application and this website.

1. Who is responsible for your data

Mirko Petrov Radev, with NIF X4975575P and address at Calle Buenavista 27, Entreplanta izquierda, 29100, Coín, Málaga, Spain, is the data controller for the data collected by BiteStride. You can contact us at [email protected] for any privacy-related questions.

2. What data we collect

Account data

• Email address and password (always stored encrypted, never in plain text).
• If you sign in with Google or Apple, the identifier those services provide us to recognize your account.

Profile and health data

This is the data you enter when setting up your profile (and that of each member of your family plan). Some of it is considered health data:

• Profile name, country, date of birth (from which we calculate your age) and sex.
• Weight, height, activity level, goal (lose fat, gain muscle, maintain) and goal dates.
• Allergies, intolerances, diet type and preferences: proteins you like and ingredients you want to avoid.
• Injuries or conditions you tell us about, in order to adapt the exercises.
• Training location, available equipment, level and training days.
• Unit system (metric or imperial).
• Weight history, if you log it.
• Steps and weight synced from Health Connect, only if you enable that connection and give your permission.
• Profile picture, if you upload one.

Content you generate while using the app

• Photographs (of your fridge, your plate or a receipt) that you take or upload for automatic food recognition. To do this, the app requests access to the camera, only when you enable it.
• Voice dictation: if you use the microphone to dictate, speech recognition is performed by your Android device's voice service. BiteStride does not record or store your audio; it only receives the resulting text.
• The menus, routines and responses the AI generates for you, and the questions you ask the assistant.
• Your training progress, logged meals, water, steps and weekly goals.
• The items in your fridge, pantry and shopping list.
• Your points, redeemed rewards and any cosmetics you have unlocked.

Family account data

If you create a family plan, we store which profiles belong to your family group and who administers it. Each profile stores its own nutrition and training data, managed by the account holder.

Technical data

• IP address and date of login attempts, to prevent unauthorized access.
• Basic device information and push notification token (Firebase Cloud Messaging), to send you alerts if you enable them and to control the number of devices on the family plan.
• App usage logs for diagnostic purposes and service improvement.

Payment data

We do not store your card details. Subscriptions are managed through Google Play or the App Store, and through RevenueCat as a technical intermediary; we only receive confirmation that your subscription is active.

3. How we use your data and legal basis

• To generate your menus, routines and AI assistant responses, personalized with your profile.
• To recognize the food in the photos you upload and calculate approximate calories and macronutrients.
• To calculate your points, maintain your progress and sync data across your devices.
• To manage your subscription and the family plan.
• To detect and prevent abuse, fraud or improper access to your account.
• To send you operational emails (such as password recovery) and, if you enable them, app notifications.

The legal basis for providing the service is the performance of the contract you accept when creating your account (art. 6.1.b GDPR). We process health data (weight, injuries, allergies, goals) only with your explicit consent (art. 9.2.a GDPR), which you give when filling in that data and which you can withdraw at any time by deleting that data or your account. Preventing fraud and improper access is based on our legitimate interest in the security of the service.

We do not make automated decisions with legal effects on you. The AI's recommendations are for guidance only and do not replace the advice of a doctor or nutritionist.

4. Who we share your data with

We do not sell your data. We only share it with the providers we need to deliver the service, each with its own privacy policy:

Provider	What we use it for
DeepSeek	Generating AI assistant responses and recognizing food in the photos you upload
Google (Firebase, push notifications, Health Connect, sign-in)	Authentication, notifications, health sync and app security
Apple	Sign in with Apple, if you use it
RevenueCat	Technical management of paid subscriptions
Open Food Facts	Looking up a product's data when you scan its barcode (only the barcode number is sent)
OVHcloud	Hosting of our servers, in the European Union
Cloudflare	Protection and secure delivery of app traffic

We only share the minimum data necessary with each of them. For example, DeepSeek receives only the text of your question to the assistant, the photo you upload or, for a fallback menu, data from your nutrition profile; never your name, email or password.

Health Connect. The steps and weight data you choose to sync from Health Connect are used only to provide the features you see in the app (progress and goals). We do not sell this data, we do not use it for advertising or to build advertising profiles, and we do not share it with anyone other than the providers described in this policy, only as needed to deliver the service. You can revoke access at any time in the Health Connect settings of your device.

If you scan a barcode, the image is analysed on your device with Google ML Kit; Google may receive technical diagnostic data (device model, app version, an installation identifier and performance metrics).

Communications with support

If you write to us by email (info@, support@ or [email protected]), we keep your message, your email address, your name if you give it and our reply, in order to handle your enquiry. The legal basis is our legitimate interest in handling your request (art. 6.1.f GDPR).

Before you use the AI features for the first time (assistant, photo recognition and menu generation) we ask for your consent, which you can withdraw at any time. To protect your privacy, do not enter other people's personal data in the assistant or upload photos of documents containing personal data, such as receipts showing your card or membership number.

5. Where your data is stored

Our servers are in the European Union. Some providers may process data outside the European Economic Area. In the case of DeepSeek, its servers are in China, a country that may not offer a level of protection equivalent to Europe's: we only send it data if you agree to use the AI features, and by agreeing you expressly consent to that transfer (art. 49.1.a GDPR). For the other providers (such as Google) we rely on the safeguards required by the GDPR, such as standard contractual clauses.

6. How long we keep your data

We keep your data for as long as your account is active. If you delete your account from the app (Settings), we permanently and without delay delete your account and all associated data: family profiles, health data, history, photos, points and device records. We will only keep what we are legally required to keep (for example, billing information). See how to delete your account.

Important: deleting the account does not automatically cancel a paid subscription. You must cancel it yourself from Google Play (or the App Store) to stop being charged.

Support emails: we keep the messages you send us and our replies for up to 12 months after the last reply, unless the law requires us to keep them longer; if you ask us to delete them, we delete them. Technical error logs are kept only for a short period and are overwritten automatically.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability at any time by writing to [email protected]. You can edit your data from the app and delete your account directly in Settings.

You can also withdraw at any time the consents you have given us (for example, for the use of AI or of your health data), without affecting the lawfulness of the processing carried out before.

If you believe we have not handled your data correctly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).

If you live in another country, you can also contact the data protection authority of your country of residence.

8. Minors

The minimum age to create a BiteStride account is 16 years old. If we detect that an account belongs to a person younger than that age, they are informed and offered the option to delete it. The family plan allows managing profiles of minors under the supervision and responsibility of an adult account holder, who enters and consents to the processing of their data.

9. Changes to this policy

If we make relevant changes to this policy, we will notify you inside the app before the change takes effect.