Privacy Policy
Last updated: 24 September 2026
Who we are
GutBox is a gut health diary for iPhone, built and run by the GutBox team in the United Kingdom. We are the data controller for the information described on this page. The way to reach us about any of it is support@gutbox.app.
The short version
GutBox is a gut health diary. Almost everything it stores is information about your body: what you ate, how your bowels behaved, your symptoms and weight. That is health data, and it deserves more care than an app's usual analytics.
We do not sell your data. We do not use it for advertising. We do not build profiles for anyone else. It exists so that GutBox can show you patterns in your own logs, and so we can keep the app working.
What we collect
Information you give us
- Account details. Your email address, and your name and profile photo if you sign in with Apple or Google and choose to share them.
- Health and profile information from onboarding. Your goals, any diagnosed conditions, symptoms, treatment and medication details, dietary restrictions, date of birth, height, and weight.
- Your diary. Meals and their ingredients, Bristol stool scale entries, urgency, symptoms, weight over time, and any free-text notes you write.
- Photos of food that you take or choose in order to log a meal.
- Voice recordings when you describe a meal out loud.
Information collected automatically
- Usage data: which screens you open, which features you use, and whether actions succeed or fail.
- Diagnostic data: crash and error reports.
- A random installation identifier created by our analytics provider. It is not your name, your email, or your account ID.
We do not collect your precise location, your contacts, or your advertising identifier, and GutBox contains no advertising or tracking SDKs.
Where your information goes
GutBox relies on a small number of providers. Each one receives only what it needs to do its job.
| Provider | What it receives | Why |
|---|---|---|
| Supabase | Your account, profile, and full diary | Stores your data and syncs it across your devices |
| Google (Gemini API) | Food photos, meal descriptions, and a summary of your recent logs | Recognises food in photos, estimates ingredients, and writes your gut insights |
| Apple | Audio of your voice when you dictate a meal | Speech-to-text |
| Open Food Facts | Barcodes you scan | Looks up the product |
| USDA FoodData Central | Food search terms | Looks up nutrition data |
| PostHog | Usage data, and diary content without your name, email, or account ID | Tells us which features work and where the app fails |
Some specifics worth stating plainly:
Voice dictation goes to Apple. When you describe a meal out loud, iOS sends the audio to Apple's speech recognition service to turn it into text. This is Apple's standard system service and is covered by Apple's own privacy policy. We receive only the resulting text, and we do not keep the audio.
Food photos go to Google. To recognise what is on the plate, the photo is sent to Google's Gemini API. Google states that data sent through the paid Gemini API is not used to train its models. The photo itself stays on your own device, and we do not upload it to our servers or keep a copy.
Analytics carries what you logged, but not who you are. We send diary content to PostHog because knowing which foods people log, and where food recognition gets it wrong, is how the app gets better at its one job. We deliberately do not send your email, name, date of birth, or account ID alongside it, and we do not use session replay, so the analytics stream cannot be tied back to you from inside PostHog. We host it in the EU.
Legal basis for using health data
Under UK GDPR, information about your health is “special category” data and needs a specific lawful basis. Ours is your explicit consent, given when you create an account and enter this information. GutBox cannot do what it does without it. A gut diary that cannot record symptoms is not a gut diary.
You can withdraw that consent at any time by deleting your account, which erases the data. Withdrawing consent does not undo processing that already happened.
For usage and diagnostic data, our basis is legitimate interests: keeping the app working and understanding whether it helps.
How long we keep it
Your diary and profile are kept until you delete them or delete your account. Deleting your account removes your profile, journal entries, and saved foods from our systems, and it is immediate rather than scheduled.
Two things survive deletion, and neither identifies you: analytics events already collected, which carry no identifier that can be traced back to your account; and anonymous, aggregated food data, meaning the nutrition figures behind a dish, not the fact that you ate it.
Where your data is stored
Your account and diary are stored in London, United Kingdom. Analytics are hosted in the European Union.
Some providers process data outside the UK, notably Google, which operates globally. Where data leaves the UK or EEA, we rely on the safeguards those providers offer, such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.
Your rights
Under UK GDPR you have the right to access your data, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent.
Deleting your account is available directly in the app in Settings. For anything else, contact support@gutbox.app and we will respond within one month.
If you think we have handled your data badly, you can complain to the Information Commissioner's Office at ico.org.uk.
Children
GutBox is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has given us information, contact us and we will delete it.
Changes
We will update this page when what we do changes, and change the date at the top. Significant changes will be flagged in the app rather than left here for you to find.
Contact
GutBox
support@gutbox.app