Bowli is a nutrition and macro tracking app operated by Alberto Aquino in Ireland. This Privacy Policy explains what personal data Bowli collects, why it is used, where it is processed, and the choices you have. It applies to the Bowli website, beta waitlist, and iOS app.
1. Information we collect
Waitlist information
When you join the beta waitlist, we collect your email address, the date and time you joined, the signup source, and the version of the consent notice you accepted. We also record a coarse device platform, such as PC, Mac, iPhone, iPad, or Android, derived from your browser's User-Agent. We do not store the complete User-Agent in the waitlist record. We use this information to manage beta access, understand broad platform demand, and send occasional Bowli product updates. You can unsubscribe at any time.
Account and authentication information
When you create an account, Supabase Auth processes your email address, authentication credentials, session information, and limited profile details supplied by an identity provider if you choose Google or Apple sign-in. Bowli does not receive your Google or Apple password. Passwords created for Bowli are stored by Supabase as salted hashes, not as readable passwords.
Profile and nutrition information
To calculate and display your targets, Bowli may process information you provide such as your name, date of birth, height, weight, biological sex, body fat estimate, activity level, daily steps, nutrition goal, food preferences, and calorie and macro targets. Some of this information may be considered health-related data under applicable law.
Food history stored on your device
In the current Free experience, meals, food entries, and day-to-day nutrition history are stored locally on your device and scoped to your Bowli account. Bowli does not currently upload that history to its servers. Copies may still be included in device backups according to the settings and services you control through Apple.
Food search and technical data
When you use authenticated food search, Bowli processes the search text and the technical information needed to secure and deliver the request. Search text may be sent to USDA FoodData Central to return matching food data. We do not send your meal history or Bowli profile to USDA.
Website analytics and communications
The website uses Vercel Web Analytics to collect aggregated page-view information such as the page visited, approximate region, referrer, browser, operating system, and device type. Bowli does not send your waitlist email to analytics. If you contact us, we also process the information in your message so we can respond.
2. Why we use your information
We use personal data only where we have a lawful reason, including:
- Your consent, for beta updates and, where required, health-related information you choose to provide.
- Performance of our agreement with you, to create your account, provide Bowli, calculate targets, and respond to your requests.
- Our legitimate interests, to keep Bowli secure, prevent abuse, understand aggregate website use, and improve reliability.
- Compliance with legal obligations that apply to us.
We do not sell or rent your personal data, and we do not use it for third-party advertising.
3. Service providers and data sharing
We share data only when needed to operate Bowli, comply with law, or protect the service. Current providers include:
- Supabase for authentication and hosted database services.
- Cloudflare for the Bowli API, security, and rate limiting.
- Vercel for website hosting and privacy-focused web analytics.
- USDA FoodData Central for food search results.
- Apple or Google when you choose their sign-in services.
These providers process data under their own terms and privacy notices. We may also disclose information if required by law, or in connection with a genuine business reorganisation, subject to appropriate safeguards.
4. Retention
- Waitlist records are kept until you unsubscribe or they are no longer reasonably needed for the beta and launch process.
- Account and profile data are kept while your account is active. If you request deletion, we aim to delete or anonymise this data within 30 days, unless law requires longer retention.
- Local nutrition history remains on your device until you delete it, remove the app, or erase the device data, subject to your backups.
- Support messages and security records are kept only as long as reasonably necessary for the purpose for which they were collected.
5. Security
We use technical and organisational safeguards designed to protect personal data, including encrypted connections, access controls, account-scoped database policies, and restricted server credentials. No system can be guaranteed completely secure, so please use a strong, unique password and protect access to your device.
6. Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of your personal data, object to certain processing, and withdraw consent. Withdrawing consent does not affect processing that was lawful before withdrawal.
To exercise a right or unsubscribe from the waitlist, email alberto.aquino.dev@gmail.com. We may need to verify your identity before completing a request. If you are in the EEA, you may also complain to your local supervisory authority. In Ireland, this is the Data Protection Commission.
7. Cookies and similar technologies
Bowli does not use advertising cookies. The website stores a functional language preference cookie after locale detection or when you choose a language, so future visits can respect that choice. Vercel Web Analytics is designed to provide aggregated traffic measurement without third-party cookies or persistent cross-site tracking. Authentication in the iOS app uses secure session storage on your device.
8. International transfers
Bowli is operated from Ireland, but some providers may process data in other countries. Where required, we rely on recognised safeguards such as adequacy decisions, standard contractual clauses, and provider data protection agreements.
9. Children
Bowli is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided data, contact us so we can investigate and delete it.
10. Changes to this policy
We may update this policy as Bowli develops or legal requirements change. We will publish the revised policy with a new effective date and give appropriate notice of material changes.
11. Contact
Questions or requests about privacy can be sent to alberto.aquino.dev@gmail.com.