Privacy policy

1.Who we are

Budo is an iPhone food journal published by Sand & Signal Studios LLC (“we”). This policy explains what Budo collects, why, who processes it and how you can delete it.

2.What Budo collects

Account. Your email address, your name if your Apple or Google sign-in provides one, and an account ID. Sign-in is handled by Google Firebase Authentication, with email and password, Sign in with Apple or Google Sign-In.

Your journal. The food notes you write or dictate, their calorie and macro estimates, your nutrition goals and the times you logged meals.

Your profile. Birthday, gender, height, current and goal weight, activity level, any considerations you choose (such as vegetarian, training, or pregnant or breastfeeding) and anything you type in the optional “Anything else?” field. Budo uses these to calculate your starting goals and to limit AI estimates in your journal to accounts with an adult birthday.

Pregnant or breastfeeding is sensitive and optional. It is used only to avoid a calorie deficit and to flag goals, is stored with your profile in Firebase, is never sent to Gemini or food databases, and is deleted with your account.

Your account, journal, goals and profile are stored with Google Firebase so they sync to your other devices. Saved meal templates stay on the device where you made them.

3.AI estimates

Budo asks your permission before using AI. With it, Budo sends a note shortly after you stop typing, or the photo you choose, through Budo’s servers to Google Gemini to estimate nutrition, together with your language and time zone, and the name of your approximate area (city, region and country) if you turn on nearby restaurant matching. When you correct an estimate, the original note, the current estimate and your correction are sent too.

Your sign-in details and Apple Health data are never sent to Gemini. Photos are used only for the estimate you asked for; Budo does not store them.

You can turn AI off in Settings → Privacy & AI. Manual entries and saved meals work without it. Turning AI off stops future requests; it cannot recall information already sent.

4.Food databases

With AI on, Budo’s servers look up the food words in your note in USDA FoodData Central and, for branded or packaged foods, Open Food Facts. Scanned barcodes go to Open Food Facts whether or not AI is on. These requests contain only the food words or barcode, not your account details.

5.Trying a meal before signing up

You can try one text estimate after confirming you are 18 or older and agreeing to AI processing. That note, your language and time zone are sent to Gemini. The note and estimate are kept in your device’s Keychain until they are imported into a new account, so an interrupted signup can resume. If you never create one, they stay in the Keychain, and removing the app may not delete them.

On the server, the estimate can be recovered for 24 hours. To prevent repeated trials, Budo keeps a hashed trial identifier and request digest, with no food note or account identifier, indefinitely, and aggregate counters that expire after 40 days (daily) and 400 days (monthly).

6.Apple Health, camera, microphone and location

Every device permission is optional. The camera scans barcodes, labels and meals. The microphone and Apple’s speech recognition turn dictation into a note; dictated audio may be processed by Apple. Location, if you enable it, is read at about 1 km accuracy and sent to Apple’s geocoding service to get your city, region and country; only that name is kept, on this device. Meal reminders, if you turn them on, are local notifications.

With Apple Health connected, Budo reads only the categories you choose (such as your latest weight and activity) to show them in the app, and writes only the meals and weights you choose. Readings from Health stay on your device; Budo syncs your connection choices, not your Health records.

Health data is never used for advertising and never sold. Turning a connection off stops future reads and writes; it does not remove samples already saved in Health.

7.Service records and retention

To enforce the free plan’s limits, Budo keeps per-account usage counters that expire after about a day (short windows) and 32 days (daily windows), and service-wide totals with no account or food content that expire after 40 and 400 days. A cache of nutrition estimates is reused for up to 30 days and then removed. It is keyed on a one-way hash and holds no account ID, but stores estimates in readable form, including food names and assumptions that can repeat words from your note. Deleting your account does not remove it early. Expired records are cleaned up automatically, which can take a little longer than the stated period.

We keep your account, journal, goals and profile until you delete them or your account. Emails you send us stay in our mailbox.

Budo’s servers log technical failures and when an account deletion starts or finishes. These logs contain no food notes, photos or email addresses; deletion entries use a shortened one-way hash of your account ID. Google Cloud also records request details such as IP address. Alerts about failures are emailed to us and stay in our mailbox.

Google Cloud keeps ordinary service logs for 30 days and required audit logs for 400 days. Firebase App Check and Apple’s App Attest verify that requests come from the genuine app. Budo uses Gemini’s paid service. Google says it does not use these requests or responses to improve its products, and it keeps them for a limited time to detect misuse and meet legal requirements.

8.Deleting your account

In Budo, open Settings → Account → Delete account and confirm your sign-in. Budo deletes your sign-in account, your journal, goals, profile and usage counters from its servers, asks Apple to revoke Budo’s Sign in with Apple access if you used it, and removes your saved data from the device. If the Apple step doesn’t complete, you can remove Budo in your Apple Account settings under Sign in with Apple.

A small deletion record holding your account ID, a hashed receipt and timestamps (no journal content) lets the app confirm progress. It expires about two days after the app confirms deletion finished, or about 30 days after deletion finishes if the app never confirms. Data already saved to Apple Health stays in Health, where you can remove it.

If you can’t open the app, email john@sandandsignalstudios.com from the address on your account and we will delete it.

Signing out stops syncing but leaves that account’s journal, profile and saved meals on the device for when you sign back in. Another account can’t open them. Deleting your account removes them.

9.Sharing

We share data only with the service providers and public food databases named above, to run Budo: Google (Firebase, Gemini, Google Sign-In), Apple (Sign in with Apple, speech recognition, location lookup, App Attest), USDA FoodData Central and Open Food Facts.

We do not sell personal information, show ads, use your data for tracking or advertising, or include third-party analytics.

10.Your rights

You can view and edit your journal and profile in the app at any time, and delete individual entries or your whole account. For access, correction or deletion requests, or any privacy question, email john@sandandsignalstudios.com.

11.Adults only

Budo is for adults 18 and older and is available in the regions shown on the App Store. Budo relies on what you tell it: setup asks for your birthday and the free first estimate asks you to confirm you are 18 or older. We do not verify age. We do not knowingly collect information from anyone under 18. If you believe someone under 18 has an account, email us and we will delete it.

12.This website

This site is hosted on Firebase Hosting. It sets no cookies, runs no scripts or analytics and has no forms. Like any web host, Firebase processes connection information such as IP addresses to deliver the pages.

13.Changes

If this policy changes, we will update this page and its effective date.