1. Introduction
Welcome to Healthy Buddy ("we," "our," or "us"). Healthy Buddy is a mobile health and wellness application owned and operated by Healthy Buddy, registered in Spain.
We are committed to protecting your privacy and ensuring you understand how we collect, use, and safeguard your personal information. This Privacy Policy explains our practices regarding your data when you use the Healthy Buddy mobile application.
2. Information We Collect
2.1 Account Information
When you create an account, we collect:
- Email address
- Authentication credentials (via Firebase Authentication)
- Account identifiers from Google Sign-In or Apple Sign-In (if used)
- Display name (optional)
2.2 Health & Wellness Data
To provide our services, we collect data you voluntarily input, including:
- Nutrition Tracking: Food photos, meal descriptions, voice inputs for food logging, and AI-analyzed nutritional estimates
- Wellness Diary: Mood entries, emotional states, and AI-generated weekly insights
- Workout Tracking: Exercise types, duration, and estimated calories burned
- Intermittent Fasting: Fasting start/end times and fasting protocol preferences
- Supplements Tracking: Supplement names, dosages, and reminder schedules
- Challenges: Participation in Body/Mind/Soul wellness challenges
- Streak Data: Daily engagement metrics and streak history
2.3 Device & Technical Information
- Device type and operating system
- App version
- Timezone settings
- Language preferences
- Anonymous usage analytics
2.4 Payment Information
Subscription payments are processed through RevenueCat and your device's app store (Apple App Store or Google Play Store) for in-app purchases, or through Stripe for web-based purchases made on our website. We do not directly collect or store your credit card or payment information. Stripe may collect your email address and payment details in accordance with their privacy policy.
3. How We Use Your Information
We use your information to:
- Provide and improve our wellness tracking features
- Generate AI-powered nutritional analysis and wellness insights
- Send push notifications for reminders (supplements, fasting, mood logging)
- Track your progress and maintain streak data
- Process subscription payments through third-party providers
- Respond to your support requests
- Improve app performance through anonymous analytics
- Ensure app security and prevent fraud
4. Data Storage & Security
Your data is stored securely using Firebase (Google Cloud Platform) services:
- Firebase Authentication: Secure user authentication and identity management
- Cloud Firestore: Encrypted database for user data
- Firebase Cloud Storage: Secure storage for food photos
We implement industry-standard security measures including:
- Data encryption in transit (TLS/SSL) and at rest
- Secure authentication protocols
- Access controls and regular security audits
- Firestore security rules to ensure users can only access their own data
5. Third-Party Services
We share data with the following third-party processors to provide our services:
5.1 Firebase / Google Cloud Platform
Used for authentication, database storage, and file storage. View Firebase Privacy Policy
5.2 OpenAI
Food photos and meal descriptions are processed by OpenAI's GPT models for nutritional analysis. Wellness diary entries are analyzed to generate weekly insights. View OpenAI Privacy Policy
5.3 RevenueCat
Manages subscription processing and payment entitlements. View RevenueCat Privacy Policy
5.4 Stripe
Processes web-based subscription payments for users who purchase through our website. Stripe may collect your email address, payment method, and billing information. View Stripe Privacy Policy
5.5 Apple & Google
App store platforms process payments and may collect additional data per their privacy policies.
5.6 TikTok (Pixel & Events API)
Our website (healthybuddy.app) uses the TikTok Pixel and the TikTok Events API to measure the performance of our advertising campaigns, attribute conversions, and improve audience targeting. The following events may be tracked: page view, content view (quiz landing), quiz completion, lead capture (when you submit your email), checkout view, payment information entered, and subscription completed.
We share with TikTok: a SHA-256 hashed version of your email address (so TikTok cannot read it directly), your IP address, your user agent, and TikTok-specific identifiers when present (the ttclid URL parameter set when you arrive from a TikTok ad, and the _ttp first-party cookie). Subscription value and currency are also shared at the moment of purchase. We do not share your name, your password, or any of your in-app health data with TikTok.
The legal basis is your consent (where required by your jurisdiction) and our legitimate interest in measuring advertising effectiveness. You can opt out of TikTok ad personalization in your TikTok account settings, and you can block the pixel and the cookie via browser tracking protection or an ad-blocker. View TikTok Privacy Policy.
5.7 Meta (Facebook Pixel)
Our website also uses the Meta (Facebook) Pixel for advertising measurement on Facebook and Instagram, with the same scope as the TikTok Pixel above (page views, quiz events, checkout events, subscription events). Hashed personal identifiers and IP/user-agent may be shared with Meta. View Meta Privacy Policy.
5.8 Cloudflare
Our website is served through Cloudflare's content delivery network for performance and security (DDoS protection, bot mitigation). Cloudflare may process IP addresses and other technical data. View Cloudflare Privacy Policy.
6. Health Data Sensitivity
- The health and wellness data you provide is considered sensitive personal information.
- We do not sell your health data to third parties.
- Health data is processed solely to provide app functionality.
- AI analysis is for informational purposes only—not medical advice.
- Consult a qualified healthcare provider before making dietary changes based on app data.
7. Your Rights
You have the right to:
- Access: Request a copy of your personal data
- Rectification: Correct inaccurate or incomplete data
- Erasure: Request deletion of your data ("right to be forgotten")
- Portability: Receive your data in a portable format
- Objection: Object to certain types of data processing
- Restriction: Request limited processing of your data
- Withdraw Consent: Withdraw consent at any time for consent-based processing
To exercise these rights, contact us at [email protected].
8. GDPR Compliance (EU Users)
If you are located in the European Economic Area (EEA), you are protected by the General Data Protection Regulation (GDPR).
Legal Bases for Processing
- Contract: Processing necessary to provide the app's services
- Consent: Processing based on your explicit consent (e.g., push notifications)
- Legitimate Interests: App improvement and security
Data Protection Officer
For GDPR-related inquiries, contact: [email protected]
9. CCPA Compliance (California Users)
If you are a California resident, the California Consumer Privacy Act (CCPA) provides additional rights:
- Right to Know: What personal information we collect and how it's used
- Right to Delete: Request deletion of your personal information
- Right to Opt-Out: Opt out of the sale of personal information (Note: We do not sell your data)
- Right to Non-Discrimination: We will not discriminate against you for exercising your rights
To submit a CCPA request, contact: [email protected]
10. Data Retention & Deletion
We retain your data as follows:
- Active Accounts: Data is retained as long as your account is active
- Inactive Accounts: Data may be deleted after 24 months of inactivity
- Deletion Requests: Data is permanently deleted within 30 days of a valid request
- Backup Copies: May persist in encrypted backups for up to 90 days
To request data deletion, contact [email protected] or use the in-app account deletion feature.
11. Cross-Border Data Transfers
Your data may be processed in countries outside your residence, including the United States (where Firebase and OpenAI servers are located).
For EU users, we ensure adequate protection through:
- EU-approved Standard Contractual Clauses (SCCs)
- Adequacy decisions where applicable
- Privacy Shield frameworks (where still applicable)
13. Children's Privacy (COPPA)
Age Requirement: Healthy Buddy is designed for users aged 16 and older. We do not knowingly collect personal information from children under 16.
If you believe a child under 16 has provided us with personal information, please contact us immediately at [email protected] and we will delete the data.
14. Changes to This Policy
We may update this Privacy Policy periodically. When we make significant changes:
- We will update the "Last Updated" date at the top
- We may notify you via email or in-app notification
- Continued use after changes constitutes acceptance
15. Contact Us
For privacy-related questions or to exercise your rights, contact:
Healthy Buddy
Email: [email protected]