Privacy Policy for PowerBite

Last Updated: July 22, 2026

Effective Date: July 2, 2026

1. Introduction

This Privacy Policy explains how PowerBite ("we," "us," or "our") collects, uses, discloses, and safeguards your information when you use our mobile application, website, and related services (collectively, the "Service"). Please read this policy carefully. By accessing or using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with the terms, please do not use the Service.

2. Information We Collect

We collect several types of information to provide and improve our Service.

2.1 Information You Provide Directly

• Account Information: Your name and email address when you create an account.

• User Content: Meal entries, energy inputs, and any other content you submit through the Service.

• Payment Information: Billing details necessary to process subscriptions. Payment transactions are processed by third-party payment processors; we do not store full credit card numbers on our servers.

• Communications: Information you provide when you contact us for support, submit feedback, or participate in surveys.

2.2 Information Collected Automatically

• Usage Data: Information about how you interact with the Service, and the features you use.

2.3 Information Generated with AI

• Insights and Recommendations: PowerBite uses the OpenAI API to generate requested meal analysis, wellness analysis, insights, and recommendations from the information submitted for those features. OpenAI states that API inputs and outputs are not used to train its models by default. PowerBite requests that responses not be stored for later retrieval. OpenAI may retain API content in abuse-monitoring logs for up to 30 days, unless longer retention is required by law or reasonably necessary to protect its services or third parties from harm. See OpenAI's data controls (https://developers.openai.com/api/docs/guides/your-data).

2.4 Optional Apple Health Data

• Apple Health access is optional. If you choose to connect it, PowerBite requests read-only access to the HealthKit categories shown in Apple's permission sheet. You may grant or deny access separately for each category, and PowerBite continues to work if you do not connect Apple Health.

• Health data read: Depending on device and operating-system support, PowerBite may read sleep analysis; workouts; workout effort; workout heart rate and active energy; recorded dietary energy, carbohydrates, protein, total fat, fiber, sugar, caffeine, and water; step count; Apple Stand Hour; and time in daylight.

• Events stored in your account: PowerBite may create Sleep, Nap, Activity, Meal, Caffeine, and Hydration events from complete, qualifying Apple Health records. These normalized events are stored with your other PowerBite events in your account through Supabase and can be edited or deleted. A Meal is created only when the required recorded nutrition values are present, plausible, and internally consistent.

• Data kept on your device: Raw workout heart-rate samples, step and Stand Hour context, daylight observations, Health data coverage, and other passive calculation context remain on your device. They are not uploaded to Supabase, OpenAI, PostHog, or RevenueCat.

• Requested wellness analysis: If you request wellness analysis, Apple Health-derived events already stored as PowerBite events may be sent to OpenAI with your other relevant PowerBite history. Raw HealthKit samples and on-device passive context are not sent to OpenAI.

• Purpose and restrictions: Apple Health data is used only to provide and personalize PowerBite's health and fitness features. It is not sold or used for advertising, marketing, cross-app tracking, data-broker services, or AI model training.

• Your controls: You may change Health permissions in Apple Health or iOS Settings and disconnect Apple Health in PowerBite at any time. Disconnecting stops future imports and lets you keep or delete previously imported events. Deleting your PowerBite account deletes account-linked Apple Health-derived events from active PowerBite systems, subject to the retention terms below.

3. How We Use Your Information

We use the collected information for the following purposes:

• To provide, operate, maintain, and improve the Service.

• To personalize your experience and deliver content and features relevant to your habits and goals.

• To process transactions and send related information, including confirmations and invoices.

• To communicate with you, including sending service updates, security alerts, and support messages.

• To analyze usage trends and preferences to enhance the Service and develop new features.

• To detect, prevent, and address technical issues, fraud, or security breaches.

• With your permission, to convert qualifying Apple Health records into PowerBite events and use permitted on-device context in energy predictions and recommendations.

4. Legal Basis for Processing (For EEA/UK Users)

If you are in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases:

• Performance of a Contract: To fulfill our obligations under the Terms of Service.

• Consent: For specific purposes where we have asked for and you have given clear consent.

• Legitimate Interests: For our operational interests, such as security, fraud prevention, and service improvement, provided these interests are not overridden by your data protection rights.

• Legal Obligation: To comply with applicable laws and regulations.

5. How We Share and Disclose Information

We do not sell your personal data. We may share information in the following limited circumstances:

• Service Providers: With service providers that process data for PowerBite, including Supabase for authentication and cloud data storage, OpenAI for requested AI analysis, PostHog for product analytics, and RevenueCat and the applicable app store for subscription management. These providers process data under their applicable agreements and privacy terms.

• Legal Requirements: If required to do so by law or in response to valid legal requests (e.g., court orders, subpoenas).

• Business Transfers: In connection with a merger, sale of company assets, financing, or acquisition of all or a portion of our business.

• With Your Consent: For any other purpose disclosed to you with your prior permission.

• Aggregated or Anonymized Data: We may share data that has been aggregated or de-identified so that it is not reasonably linked to an individual for analytics or service improvement. We do not use HealthKit data for advertising or marketing.

6. Data Security

We implement appropriate technical and organizational security measures designed to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encryption, access controls, and secure server infrastructure. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States. We ensure such transfers are compliant with applicable data protection laws by relying on adequacy decisions, Standard Contractual Clauses, or other valid transfer mechanisms.

8. Data Retention

• We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law (e.g., for tax, legal, or accounting purposes). Typically, we retain account data for as long as your account is active. Upon deletion, data is removed from active systems but may persist in backup archives for a limited period before being overwritten.

• Apple Health-derived events stored in your PowerBite account follow the same retention rules as equivalent manually entered events. You can delete individual events, disconnect Apple Health, and choose whether to keep or delete imported events, or delete your account.

• To prevent rate-limit and subscription-quota abuse, PowerBite may retain a pseudonymous subscription-quota identifier derived from verified App Store subscription information, together with request categories, usage counts, and usage-window timestamps, for up to 90 days. This identifier does not reveal or contain your Apple Account identifier, Apple Account email address, PowerBite profile, Health data, meal content, prompts, recommendations, or AI responses. Account-linked monthly AI cost history is deleted when the PowerBite account is deleted.

9. Your Data Rights and Choices

Depending on your location, you may have certain rights regarding your personal data:

• Access & Portability: Request a copy of your personal data in a structured, machine-readable format.

• Correction: Update or correct inaccurate data.

• Deletion: Request deletion of your personal data, subject to certain exceptions.

• Restriction/Objection: Object to or restrict certain processing activities.

• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time. For Apple Health, you may change permissions in Apple Health or iOS Settings and use PowerBite Settings to stop future imports and choose whether to keep or delete imported events.

10. Children's Privacy

The Service is not intended for individuals under the age of 9 or the age of majority in their jurisdiction. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal data, please contact us. We will take steps to delete such information.

11. Third-Party Links and Integrations

The Service may contain links to or integrations with third-party websites, apps, or services. This Privacy Policy does not apply to those third parties. We encourage you to review their privacy policies before providing any information.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal obligations. We will notify you of any material changes by posting the new policy on the Service, updating the "Last Updated" date, and, where required by law, seeking your consent. Your continued use of the Service after such changes constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us at:

PowerBite
Email: powerbite.assist@gmail.com