1. Information We Collect

Personal Information

• Name, as provided by Sign in with Apple or entered by you
• Email address. If you use Sign in with Apple's “Hide My Email”, this is the private relay address Apple gives us
• Your device's time zone, so that entries are grouped into the right days

Health Information

• Food journal entries: the foods, amounts and times you log
• Water you log
• Symptoms (type and severity) and notes you write in the journal
• Fasting sessions: start and end times, and the goal you set
• Your daily oxalate target, water goal and serving preferences
• Food lists you create or import, recipes you save or create (including any recipe photos you add), meal plans and grocery lists
• Saved favourite meals: a name you choose and the foods and serving sizes in it. No oxalate figure is stored with a saved meal; it is worked out from the foods each time

Subscription Information

• Your subscription tier and when it renews or ends
• The subscription transactions Apple signs for your purchase (product, transaction identifiers, expiry and any refund), which the app and Apple's own App Store notifications send to our server so that we can confirm a subscription is paid. We never receive your card or payment details

Device Information

• A device identifier, device name and model, and iOS version, used to alert you when your account signs in on a new device
• Your Apple push notification token, with the app and iOS version, to send notifications

Usage Information

• Crash reports and diagnostic data, through Firebase Crashlytics. These carry no account identifier and no journal content
• A count of your AI requests (which feature, and when) so that we can apply usage limits. The count does not include what you sent
• No usage analytics leave your device

2. How We Use Your Information

Service Provision

• Personalized oxalate tracking and dietary management
• Health insights and pattern analysis
• Reminders and notifications
• Cross-device data synchronization
• Looking up products you scan by barcode (see Section 3)

AI Processing

When AI is on, each feature sends only what it needs:

• Food photos and described meals: the photos of a meal you take or choose, or the description you type or dictate, to identify the foods and estimate amounts. Dictation uses Apple's speech recognition: on devices that support it, the audio stays on your device; otherwise Apple processes it under its own privacy policy. Only the resulting text is sent. The AI returns food names and amounts only; every oxalate figure comes from the app's own food data. Photos and descriptions are not stored by us
• Recipe scanner: the text of a recipe you photograph. The text is read from the photo on your device, and only the text is sent
• Recipe creation and meal suggestions: what you ask for, the number of servings, the meal type, your oxalate limit, and the names of candidate foods the app has picked
• Insights: a summary of the last few weeks of your journal (daily oxalate totals and food names). Your symptoms and notes are included only if you turn on “Journal Notes”, which is off by default
• Food list import: the food names in a list you import, to sort them into categories

Our servers send each request to OpenRouter, which routes it to Google Gemini, OpenAI or TypeSafe. Every request is restricted to providers that do not collect the data it contains or use it to train their models; if no such provider is available, the request fails. AI responses are for education, not medical advice.

Service Improvement

• Bug fixing and crash resolution
• Anonymous community averages (see Section 3)

3. Information Sharing

Limited Sharing

We may share your information only in the following circumstances:

• With your explicit consent, including the AI features in Section 2
• Legal obligations: When required by law or legal process
• Service providers: Third parties who help us operate the app, listed below
• Anonymous community averages: The Dashboard shows daily averages calculated across all users. No identities are stored with them, an average is shown only when at least 10 people contribute to it, and a food is listed only if at least 5 people logged it

Third-Party Services

• Supabase: Database hosting and authentication, in the United States
• OpenRouter, Google Gemini, OpenAI and TypeSafe: AI processing, only if you allow AI features (see Section 2). See OpenRouter's Privacy Policy
• Open Food Facts and USDA FoodData Central: When you scan a barcode, the barcode number is sent to Open Food Facts, and if it is not found there, through our server to the USDA. Nothing else about you is sent
• Apple: Sign in with Apple, App Store subscriptions, push notifications, and syncing some app preferences through your own iCloud account
• Firebase Crashlytics: Anonymous crash reports. See Firebase Privacy Policy
• Resend: Sends account emails, such as the confirmation that your account was deleted

Bio Break, Widgets and Apple Watch

• Bio Break: If you turn on sharing in our Bio Break app, Bio Break places the times of your BB1 and BB2 entries in storage shared between our two apps on your iPhone, and Low Ox Life reads them to show today's counts. The choice is made and turned off in Bio Break. Low Ox Life does not send these times to any server
• Widgets and Apple Watch: The app writes a short summary (today's oxalate budget, water and any running fast) to storage on your iPhone for its widgets, and sends the same summary directly to your paired Apple Watch

4. Data Security

Technical Measures

• Encryption at rest: Stored data is encrypted by our database host
• Encryption in transit: TLS for all data transmission
• Account isolation: Database rules allow each account to read and change only its own data
• Key management: Sign-in credentials are kept in your device's Keychain, and AI provider keys are held only on our servers

Access Controls

• Sign in with Apple
• Optional Face ID lock for your health data
• Alerts when your account signs in on a new device

5. Data Retention

Active Accounts

• Data is retained while your account exists
• You can choose to have journal entries older than a set period deleted automatically, in Settings > Data Retention. This is off unless you turn it on
• You can export your data, and delete your account and all its data from within the app at any time. Deletion takes effect immediately; copies in our database host's backups expire on their own schedule
• When an account is deleted we keep a record of the deletion (the email address, the time, and the IP address and device type of the request) as evidence that it was carried out

When a Subscription Ends

• Nothing is deleted
• Your journal, food lists and other saved data stay in your account, and you can still view them in the app (read-only)
• You can resubscribe at any time and carry on where you left off

Inactive Accounts

• One year: An account that is not used for 12 consecutive months is deleted, with all its data. “Used” means signing in, opening the app while signed in, or saving anything to the account
• The year is counted from the latest of the last time the account was used, the day its subscription ended, and September 26, 2026. An account with an active, paid subscription is never deleted for inactivity
• Warnings: We email the address on the account 30 days and again 7 days before deletion. Using the account at any point before then cancels the deletion and starts the year again
• This rule starts with this version of the policy. No account can be deleted for inactivity before September 26, 2027

AI Requests

• Photos, descriptions and other content sent to AI features are not stored by us, and are routed only to providers that do not collect them
• AI results shown in Insights are kept on your device, not on our servers

6. Cookies & Tracking

What the App Stores

• The app uses no cookies
• Your sign-in session, kept in your device's Keychain
• Your preferences and cached data, kept on your device

What We Don't Do

• No advertising identifier (IDFA) and no App Tracking Transparency requests
• No advertising or behavioral analytics services
• No cross-app or cross-site tracking
• No behavioral advertising

7. Children’s Privacy (COPPA)

Age Requirements

• Minimum age: 13 years old
• Ages 13-17: Parental or guardian consent required
• Under 13: Not permitted to use the app

How We Handle Age

• The app does not ask for your date of birth
• We do not knowingly collect personal information from children under 13
• If we learn that an account belongs to a child under 13, we delete the account and its data

Parental Consent

• A parent or guardian of a user aged 13 to 17 must agree to this policy on their behalf before they use the app
• Parents and guardians can use the rights below by contacting us

Parental Rights

• Review: Request to see your child's data
• Delete: Request deletion of your child's data
• Refuse: Decline further data collection
• Opt-out: Remove your child from the service
• Access: Obtain a copy of collected data

Enhanced Privacy for Minors

• No advertising of any kind, for any user

8. International Data Transfers

• Primary servers: Located in the United States
• AI providers: If you allow AI features, requests may be processed by OpenRouter and the model providers in other countries
• Transfer safeguards: Standard Contractual Clauses (SCCs) for international transfers

9. California Privacy Rights (CCPA/CPRA)

Your Rights Under California Law

• Right to Know: What personal information we collect and how it's used
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate information
• Right to Opt-Out: Opt-out of sale or sharing of personal information
• Right to Limit: Limit use of sensitive personal information
• Right to Non-Discrimination: Equal service regardless of privacy choices

Categories of Information Collected

• Identifiers: Name, email, device identifiers, push notification token
• Commercial Information: Subscription status and Apple-signed subscription transactions
• Health Information: Food, water, symptom, note and fasting logs, and your targets
• Internet Activity: Crash diagnostics and counts of AI requests
• Audio or Visual Information: Meal photos you submit for AI analysis, and recipe photos you save
• Inferences: Health patterns and dietary insights
• Sensitive Personal Information: Health data (with consent)

How to Exercise Your Rights

• Email: privacy@bfl.design
• Subject line: “CCPA Request”
• Response time: 45 days

10. European Privacy Rights (GDPR)

Legal Basis for Processing

• Consent: For health data and optional features, including AI
• Contract: To provide the services you've requested
• Legitimate Interests: For security, fraud prevention, and service improvement

Additional Rights for EU/EEA Users

• Right to Lodge a Complaint: With your local data protection authority
• Right to Withdraw Consent: At any time, without affecting prior processing. For AI, turn it off in Settings > AI Data Access
• Right to Transparency: Clear information about data processing

11. Your Data Rights

Rights Available to All Users

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data (“right to be forgotten”), or delete your account yourself in the app
• Portability: Receive your data in a portable format, or export it from the app
• Object: Object to certain types of processing
• Restrict: Limit how we process your data

How to Exercise Your Rights

• Support Portal: bfl.design/support/low-ox-life/
• Response Time: Within 30 days

Contact Us