BellyMystery Privacy Policy

Last updated: 2026-07-27

BellyMystery helps you track meals, symptoms, and stools to notice patterns that may be worth discussing with a doctor. BellyMystery never diagnoses you, it surfaces patterns in your own data.

This policy explains what data BellyMystery collects, what stays on your device, and the small amount that leaves it.

The short version

• BellyMystery works without an account. There is no sign-up, no login, and no server-side profile of you.
• Everything you log (meals, symptoms, stool entries, notes, and photos) is stored locally on your device, in a local database BellyMystery controls.
• Two kinds of data leave your device, only when you use specific features, and only to power that feature: a meal photo, when you use photo-based meal logging, sent once to identify ingredients, and a computed summary of patterns in your data (not your raw diary), when you use the Analysis screen's AI narration feature.
• If you purchase BellyMystery's lifetime unlock, standard purchase/receipt data is handled by Apple, Google, and our subscription platform (RevenueCat) to validate and manage that purchase, as described below.
• We do not use advertising trackers, and we do not run analytics or crash-reporting SDKs in the app.

Data stored only on your device

BellyMystery stores the following locally, in a database on your device, for as long as you keep the app installed (or until you delete a profile or entry yourself): meal logs, including any photos you attach and any ingredients you or the app record, symptom logs, stool logs (Bristol stool scale), free-text notes, and any PDF summary you generate for a doctor (created and stored on your device, you choose who to share it with via your device's normal share sheet).

None of this is uploaded to, or stored on, any BellyMystery server. If you delete the app, or delete a profile within the app, this data is removed from your device and we have no copy of it anywhere.

Data that leaves your device

BellyMystery is designed so that logging never depends on the network, and so that as little data as possible leaves your device. Two features send data to our backend (a Cloudflare Worker we operate), which forwards it to an AI provider (Anthropic and/or OpenAI, depending on the feature) to generate a response, and does not store it:

• Ingredient extraction from meal photos. If you log a meal using a photo, that photo is sent once to identify likely ingredients, which are then saved to your local diary. The photo itself is not retained by our backend or the AI provider after the request completes.
• AI narration of your patterns. If you use the Analysis screen's narration feature, a computed statistical summary of correlations in your data (for example, "dairy exposure is associated with a symptom more often than chance") is sent, not your raw diary entries, to generate a plain-language explanation. This summary and the generated narration are not retained by our backend or the AI provider after the request completes.

Our backend also keeps a short-lived, per-device usage counter (an anonymous, randomly generated identifier created on your device, not an advertising ID and not linked to your name or account) so we can apply a daily usage limit and prevent abuse. This counter automatically expires within 48 hours and contains no content from your logs.

Purchases

BellyMystery offers an optional one-time "lifetime unlock" purchase after a free trial. Purchases are processed by the Apple App Store or Google Play, and purchase validation/entitlement management is handled by our subscription platform, RevenueCat. This involves sharing standard purchase data (such as a purchase receipt and an anonymous app-user identifier) with RevenueCat and the relevant app store. We do not receive or store your payment details (card numbers, etc.), those are handled entirely by Apple/Google.

What we don't do

• We don't require an account, login, email address, or any other personal identifier to use BellyMystery.
• We don't use advertising SDKs or advertising identifiers.
• We don't run analytics or crash-reporting tools that track your usage.
• We don't sell or share your data with data brokers or advertisers.
• Reminder notifications are scheduled entirely on your device, no reminder content is sent anywhere.

Data retention and deletion

Because your logs live on your device, deleting a profile in BellyMystery (or uninstalling the app) deletes that data. There is no server-side account or backup for us to delete on your behalf, because none exists. The short-lived usage counter described above expires automatically within 48 hours regardless of any action on your part.

Children's privacy

BellyMystery is not directed at children and is not intended for use by anyone under 16. We do not knowingly collect data from children.

Changes to this policy

If this policy changes, we will update the "Last updated" date above. We encourage you to review it occasionally.

Contact

Questions about this policy or your data can be sent to olahalvorsen@gmail.com.