Privacy Policy for Boşqapp

Welcome to Boşqapp ("we," "our," or "us"). Boşqapp is an AI-powered nutrition and calorie tracking application designed to help you understand your nutritional intake by analyzing photos of your meals and calculating daily dietary targets.

We are committed to protecting your privacy and being transparent about how your data is handled. This Privacy Policy explains in detail what information we collect, why we collect it, how it is processed and stored, and your rights regarding your personal data.

---

1. Information We Collect and How We Use It

Boşqapp is designed around data minimization. We only collect and process data that is strictly necessary to calculate your nutritional targets, analyze your meals, maintain your food log, and verify your subscription status.

1.1 Sign in with Apple (Identity & Authentication)

• What We Collect: When you sign up or sign in to Boşqapp, you authenticate exclusively through Sign in with Apple. Depending on your selections in the Apple authentication prompt, Apple provides us with:
  • A unique, anonymized user identifier linked to your Apple ID.
  • Your email address (either your real Apple ID email or an anonymized private relay email generated by Apple's "Hide My Email" feature).
  • Your name (if you choose to share it during initial sign-in).
• How We Use It: We use this information solely to establish and maintain your authenticated session, secure your account, and link your Food Log and Profile data across app launches and devices.
• Storage & Security: We do not create, manage, or store passwords. Authentication tokens are securely verified and session management is handled via Supabase Auth.

1.2 Profile Attributes & Dietary Targets

• What We Collect: During onboarding or when updating your Profile settings, you may provide physical attributes and lifestyle goals, including:
  • Gender
  • Age
  • Height (cm)
  • Weight (kg)
  • Daily activity level
  • Personal health and wellness goals (e.g., maintain weight, lose weight, build muscle)
  • Typical meal times
• How We Use It: These attributes are used strictly to calculate your estimated Basal Metabolic Rate (BMR) and Total Daily Energy Expenditure (TDEE). From these calculations, Boşqapp generates your personalized daily Dietary Targets (calories, protein, carbohydrates, and fat).
• Storage & Security: Your profile attributes and dietary targets are stored in our secure database (Supabase) in your private profiles record, protected by database Row-Level Security (RLS) so that only your authenticated account can access them.

1.3 Meal Photos (AI Food Scanning)

• What We Collect: When you use the Scan or Re-scan feature, you capture or upload photos of your meals. You may also provide optional text corrections or notes (e.g., "half portion" or "olive oil dressing").
• How We Use It:
  • Nutritional Estimation: Your photo and optional notes are transmitted via encrypted HTTPS to our secure serverless backend (Supabase Edge Function), which proxies the request to our AI vision provider (Google Gemini API). The AI analyzes the visual elements of the dish and estimates caloric and macronutrient values (protein, carbs, fat).
  • No Direct Third-Party Exposure: The mobile application never contacts AI providers directly, ensuring your device IP address and device credentials remain protected behind our backend proxy.
  • No Model Training: We do not sell your meal photos or use your private images to train public machine learning foundation models.
• Storage & Security: Once scanned, meal photos are saved to a dedicated, encrypted cloud storage bucket (meal-images) linked specifically to your user account folder. Row-Level Security ensures that only you have permission to upload, view, or remove your meal photos.

1.4 Food Log

• What We Collect: Your Food Log consists of your chronological, daily entries of meals, including:
  • Dish name (provided in Azerbaijani Latin script)
  • Calories and macronutrient values (protein, carbs, fat)
  • Portion quantity
  • Timestamp and date of the meal
  • Associated meal photo reference
• How We Use It: To calculate daily nutritional totals, display your progress toward your Dietary Targets, and provide historical tracking over days, weeks, and months.
• Nutrition Buddy Sharing (Optional): If you choose to enable the Nutrition Buddy feature to connect with an accountability partner or personal trainer, you grant directed, read-only permission for that designated user to view your daily Food Log and send in-log accountability prompts ("Buddy Pokes"). You can revoke this permission at any time.

1.5 Subscription Status & In-App Purchases

• What We Collect: Subscription status and entitlement records, including:
  • Subscription status (is_subscribed)
  • Current plan tier (e.g., Monthly or Annual)
  • Subscription expiration and renewal dates
  • Free Scan Quota usage count (the app includes a lifetime quota of 6 free initial scans before requiring a subscription)
• Payment Processing (Apple StoreKit): All financial transactions, billing, payment card details, and renewals are handled directly by Apple via App Store In-App Purchases (StoreKit). Boşqapp never receives, processes, or stores your credit card number, bank details, or billing address.
• Subscription Management (RevenueCat): We utilize RevenueCat to validate App Store purchase receipts and maintain entitlement status. When a subscription is purchased, renewed, or canceled, RevenueCat securely communicates the updated status to our database via an encrypted webhook.

1.6 On-Device Features & Local Notifications

• iOS Calorie Widget: If you add the Boşqapp Calorie Widget to your iOS Home Screen or Lock Screen, the widget reads your current day's calorie and macro progress locally from a private iOS App Group container (group.com.bosqapp.gulnar). No widget data is transmitted to external analytics servers.
• Meal Reminders: Scheduled meal reminders are local notifications triggered directly on your device based on your configured meal times. They do not track your location or transmit background tracking data.

---

2. Third-Party Service Providers

We work with a minimal set of trusted third-party cloud infrastructure and technology providers to operate Boşqapp:

All third-party service providers are bound by strict confidentiality and data protection obligations and process data solely to provide the services described.

---

3. How We Protect Your Data

We employ industry-standard technical and operational safeguards:

• Encryption in Transit: All communications between the Boşqapp client app, our Supabase backend, and third-party APIs are encrypted using modern Transport Layer Security (TLS/HTTPS).
• Encryption at Rest: Your profile, food logs, and stored meal photos are encrypted at rest in our cloud database and storage infrastructure.
• Strict Row-Level Security (RLS): Database tables and storage buckets enforce granular PostgreSQL Row-Level Security rules. Users can only access and modify their own records.
• API Key Protection: Third-party AI API keys and database service keys are stored strictly in server-side environment variables and are never bundled into the client application binary.

---

4. Data Retention and Account Deletion

4.1 Data Retention

We retain your Profile attributes, Food Log, and meal photos for as long as your account remains active so that you can view your ongoing nutritional history.

4.2 Account Deletion (Right to Erasure)

You have complete control over your data. You may delete your account at any time directly within the app:

1. Open the Boşqapp app.
2. Go to Profile > Settings.
3. Select Delete Account and confirm your decision.

4.3 Important Note on Subscriptions

---

5. Children's Privacy

Boşqapp is not directed to individuals under the age of 13 (or under 16 in certain jurisdictions). We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information without parental consent, please contact us so we can promptly delete the data.

---

6. Your Rights and Choices

Depending on your jurisdiction (including the European Economic Area, United Kingdom, and various U.S. states), you may have the following rights:

• Right of Access: You can view your collected profile data, dietary targets, and food logs directly in the app.
• Right to Rectification: You can edit your physical attributes, goals, and logged meals at any time.
• Right to Erasure: You can permanently delete your entire account and all associated data via the in-app delete button.
• Right to Restrict Processing: You can discontinue scanning meals, remove individual logs, or revoke Nutrition Buddy permissions at any time.

We do not sell, rent, or trade your personal information or meal photos to third parties for advertising or marketing purposes.

---

7. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our app features, legal obligations, or technical architecture. When we make updates, we will revise the "Last Updated" date at the top of this page. We encourage you to review this policy periodically.

---

8. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

• App Name: Boşqapp
• Developer: Gulnar Hasanova
• Email: gasanoff.ramil@gmail.com
• Website: https://bosq.app