Privacy Policy

Last updated: November 6, 2026

BiteWise is a nutrition-guidance app, not a medical service. We collect health-related information solely to personalize your nutrition analysis. We never sell your data, never share it with advertisers, and never share it with any other OmniWise product.

Contents

1. Who We Are 2. Information We Collect 3. How We Use Your Information 4. Third-Party Services 5. Data Retention 6. Your Rights & CCPA/CPRA Notice 7. International Transfers & GDPR Lawful Basis 8. Security 9. Children’s Privacy 10. Cookies & Tracking Technologies 11. Changes to This Policy 12. Contact

1. Who We Are

BiteWise is a product operated by OmniWise LLC, an Illinois limited liability company ("OmniWise", "we", "our", "us"). This Privacy Policy explains how we collect, use, and safeguard information when you use BiteWise at trybitewise.app (the "Service"). By using the Service you agree to the practices described here.

BiteWise is one of several products OmniWise operates, and it runs on its own, separate infrastructure. Your health information (conditions, medications, meal data) is used only within BiteWise — it is not shared with, and is not accessible to, any other OmniWise product or service.

2. Information We Collect

a) Account Information

Email address only. BiteWise is passwordless — sign-in uses a one-time code (OTP) or magic link sent to your email, handled by our authentication provider. We never ask for or store a password. If you ask for an invite while access is limited, we also store the email address and optional note you submit, so we can review your request and let you know when you are approved.

b) Health Profile

Name, age, gender, dietary goal, health conditions you select (e.g. diabetes, hypertension), and food allergies. You provide this voluntarily to enable personalized analysis.

c) Medications (Sensitive Data)

Medication names you enter to enable medication & food interaction insights. This data is encrypted at the field level before storage. Our staff tools do not show your medication list, with one exception: if you send feedback or report a problem while signed in, a copy of your medications at that moment is attached to the report, and the authorized team member handling it can read it.

d) Meal Photos & Analysis

Images you upload for analysis. Photos are processed by Google Gemini AI and may be stored in our cloud storage to power the meal photo gallery (paid plans). We strip EXIF metadata (including GPS location) from uploaded images.

e) Usage Data

Daily analysis counts, streak data, water intake logs, and nutrition goal progress — used solely to provide the Service features.

f) Technical Data

IP address (for rate limiting), browser type, and standard server logs. We also use PostHog (product analytics) and Sentry (error monitoring) — see Section 4 for what they do and do not receive. We do not use advertising or ad-retargeting trackers, and we do not sell technical data to data brokers.

3. How We Use Your Information

To analyze meal photos and provide AI-generated nutrition information
To personalize analysis based on your health conditions and goals
To check for potential drug-food interactions
To generate weekly nutrition reports and meal suggestions
To enforce subscription limits and manage your account
To send transactional emails (sign-in codes, welcome and account emails, weekly reports)
To comply with legal obligations and prevent misuse

We do not use your data for advertising, sell it to third parties, or use it to train AI models. We reach our AI providers through their developer APIs; their own terms govern how they handle the content we send (see Section 4).

4. Third-Party Services

We use the services below to run BiteWise. They are grouped by what they can see. Each is governed by its own privacy policy as well as the limits described here.

Services that handle your health information

Needed to analyze your meals and run your account. These may process your health profile, medications, and meal photos or descriptions.

AI providers: Google Gemini and Anthropic Claude. Power meal photo and text analysis and the personalized nutrition and drug-food interaction guidance based on your health conditions, medications, and dietary goals. Which provider handles a request can change as we tune the Service, so we don’t commit to a fixed assignment. We never send your name, email, or account identifiers to either. Google / Anthropic.
Supabase. Our database and authentication provider. Sends the one-time sign-in code or magic link email. Your account data, health profile, medications (field-level encrypted), meal history, invite requests, and any feedback or problem reports you submit (message content field-level encrypted) are stored on SOC 2 certified infrastructure with encryption at rest and in transit.
Google Cloud Run. Hosts our backend API. Every request you send, including your health profile, medications, and meal images or descriptions, passes through its infrastructure to reach our application code, governed by Google’s Cloud Privacy Notice.
Resend. Sends our transactional email: welcome messages, weekly reports, streak reminders, and invite emails (request received, approval). Resend receives your email address and the email content, which may include a summary of your nutrition report.

Services that see only technical or operational data

None of these receive your health profile, medications, or meal content.

Vercel. Hosts our web application and routes requests. Processes standard request metadata (IP address, request headers); it has no application-level access to your health profile or medications.
Cloudflare Turnstile. Bot protection that runs when you open the site, before any cookie choice. It checks the browser and connection (for example IP address and browser signals) to tell people from automated traffic, and receives no health, meal, or account information.
Upstash (Redis). Rate limiting and short-lived caching, keyed by your account ID or IP address rather than name or email. See Upstash’s Privacy Policy.
Sentry. Error monitoring for our web and mobile apps. PII collection is disabled (no IP, cookies, or request bodies attached to error reports) and session replay masking is on, so medications, health conditions, and meal analysis text are never captured, even in a recorded session.
PostHog. Product analytics limited to page views and a small set of UI interaction events (for example, which button was clicked). We do not send health conditions, medications, meal content, or image URLs as event properties.
Langfuse. Internal monitoring of our AI pipeline’s performance and cost: which step ran, which model handled it, token counts, and cost. For signed-in users this is linked to your internal account ID (not your name or email) so we can investigate a specific report or bug. We never send meal photos, meal descriptions, medications, health conditions, or AI-generated text to Langfuse. See Langfuse’s Privacy Policy.

Public databases

Free public reference data. No personal data is sent to them, with the one narrow exception noted below.

Open Food Facts, USDA FoodData Central, and RxNorm. Barcode lookups use Open Food Facts (CC BY-SA 4.0 / ODbL), with USDA FoodData Central (public domain) as a fallback; neither receives personal data. When a medication you type doesn’t match our own drug reference, we check it against RxNorm (a free U.S. government drug-naming service). Only the medication text itself is sent, never your name, email, or account identifiers.

Payments (future). When payment is enabled, it will be processed by a PCI-compliant processor (Stripe or LemonSqueezy). We will never store raw card numbers.

5. Data Retention

Plan	Meal History	Account Data
Free	14 days	Until deletion
Pro	90 days	Until deletion

After account deletion, we permanently erase all personal data within 30 days, except where retention is required by law.

6. Your Rights & CCPA/CPRA Notice

Depending on your location, you may have the following rights:

Access — Request a copy of all data we hold about you
Correction — Update inaccurate information via your profile settings
Deletion — Delete your account and all associated data from Settings → Privacy
Portability — Export your meal history as CSV (paid plans)
Restriction — Request that we limit processing of your data
Objection — Object to certain types of processing

For GDPR requests or any privacy concern, contact us by email. We respond within 30 days, or within the period your state’s law requires. If we decline a request, you may appeal by emailing us with “Appeal” in the subject line; we will answer within the time your state’s law requires and explain how to contact your state attorney general if you are still not satisfied.

California Notice at Collection & "Do Not Sell or Share" (CCPA/CPRA)

We do not sell or share your personal information as those terms are defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), and we do not use your information for cross-context behavioral advertising.

In the preceding 12 months we have collected the following categories of personal information, for the business purposes described in Section 3:

Identifiers — email address, account ID, IP address
Sensitive personal information — health conditions, medications, meal photos (processed only to provide the Service; never sold)
Internet/network activity — usage data, analytics events (see Section 4)
Commercial information — subscription tier and billing history, once payments are enabled

California residents may exercise the rights above, including the right to limit use of sensitive personal information, by emailing us or using the account controls in Settings → Privacy. We will not discriminate against you for exercising any of these rights. You may designate an authorized agent to submit a request on your behalf; we may require verification of the agent’s authority and your identity before fulfilling the request.

Washington & Nevada Residents — Consumer Health Data Notice

Washington’s My Health My Data Act and Nevada SB 370 require a separate, standalone disclosure for "consumer health data" — see our Health Data Notice for the categories collected, sources, third parties, and how to exercise your rights under these specific laws.

8. Security

We implement industry-standard security measures including: TLS encryption in transit, field-level encryption for sensitive health data (medications), UUID-based resource identifiers, rate limiting, and input sanitization. Despite these measures, no system is completely secure. In the event of a data breach affecting your personal data, we will notify you and the relevant authorities as and when applicable law requires.

9. Children’s Privacy

BiteWise is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately by email. If you are 13 to 17, please use BiteWise only with the permission of a parent or guardian.

10. Cookies & Tracking Technologies

We use browser local storage to cache your session, subscription status, and preferences for a faster experience, and a session cookie for secure authentication. Optional tools are off until you choose “Accept all” in the cookie banner: PostHog (product analytics), Sentry (error monitoring) and Vercel Analytics (page views). PostHog and Sentry set their own cookies/local-storage identifiers to associate events with a session — see Section 4 for what they collect. If you choose “Necessary only”, none of them load. You can change your choice at any time with “Cookie settings” in the page footer. We do not use advertising cookies, ad-retargeting pixels, or sell data collected through cookies.

11. Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes, we will update the "Last updated" date at the top and notify you by email or in-app notice at least 14 days before the changes take effect. Continued use of the Service after that date means you accept the updated policy, and where the law requires your consent to a change, we will ask for it.

12. Contact

For privacy questions or to exercise your rights, contact us: Send us a note

Back to BiteWise

Loading BiteWise…

Back to BiteWise BiteWise