Privacy Policy

Biteday is an iOS app developed and operated by 42pixels FZ-LLC, a company registered in Abu Dhabi, United Arab Emirates. In this policy, "Biteday", "we" and "us" mean that company. The policy covers the app "Biteday" on the App Store (listed as "Biteday: AI Calorie Counter", App Store ID 1644637948), formerly called Cal Counter and its pages on 42pixels.co. It explains what we collect, who processes your data, how long we keep it and how you can delete it. It takes effect on 7 November 2026 and replaces the privacy policy previously published on the xrlab.ai website. Where earlier versions of the app worked differently, this policy says so.

The promise in one sentence: your meals, photos and body details are used only to estimate your nutrition and build your plan, and you can delete all of it from the app at any time.

What we collect

Your account

You can use Biteday without an account. From version 1.17, when you start, Firebase Authentication creates an anonymous user ID for your device. To keep your progress on other devices, you can link Sign in with Apple or Google in Settings. Firebase then receives the name and email address that Apple or Google share, and they are stored with your profile. If you use Hide My Email, we receive Apple's relay address, not your own. Earlier versions asked you to sign in with Apple or Google before using the app.

Your profile and plan

During setup you answer questions about yourself: sex, date of birth, height, weight, goal weight, how fast you want to reach it, workouts per week, the diet you follow, what holds you back and what you want to achieve. From these answers the app builds your daily targets for calories, protein, carbs and fats. From version 1.17 it works them out on your iPhone with a standard formula, and your answers are not sent to our AI partners. Earlier versions sent them to our AI partners to build the targets. Your answers, your targets and the weights you log later are stored with your account.

Meals

When you log a meal, the app stores it with your account: its name, calories, protein, carbs, fats, health score and ingredients, and the day it belongs to.

• A meal photo you take is uploaded to Biteday's storage and kept with the meal so that you can see it in your log.
• A meal you describe in words is sent as text.
• To estimate the nutrition, Biteday's backend sends the photo or your words to our AI partners, Anthropic and OpenAI. From version 1.17 the app asks for your permission before your first meal is sent. In versions before 1.17, the backend also sent your setup answers (sex, date of birth, height, weight, goals, workouts and diet) to them to build your daily targets.
• Our AI partners receive only what the step needs, process it on our behalf to return the result, may not use it to train their models, and protect it with safeguards equal to those described in this policy.
• We do not use your meals, photos or body details to train AI models, and we do not sell them.

Purchases

Biteday Pro is billed by Apple through your Apple Account. We do not receive your payment details. To check what you are entitled to, the app sends the App Store receipt to RevenueCat, which manages subscriptions for us. From version 1.17 RevenueCat also receives your Biteday user ID, so that your subscription follows your account, and a token from Apple's AdServices framework that tells us whether an Apple Search Ads campaign led to the install. This works without tracking and without the advertising identifier.

Analytics and crash reports

From version 1.17 we use Firebase Analytics to understand how Biteday is used, for example which setup steps people finish and how many meals are logged. These events are keyed by your Biteday user ID, not by an advertising identifier. Firebase Analytics derives a general location, such as your country or city, from your IP address. Crash reports are collected with Firebase Crashlytics so that we can find and fix bugs. Events never contain your meals, photos, exact weight, height or date of birth. To understand how setup goes, we also record your setup choices as categories: sex, age range, goal, pace, workouts per week, diet, measurement units, other calorie apps you tried, where you heard about Biteday, and whether you allowed notifications.

Biteday does not track you. From version 1.17 it uses no advertising identifier, shows no iOS tracking prompt and shares nothing with advertisers or data brokers. Versions before 1.17 could measure installs with the advertising identifier if you allowed tracking in the iOS prompt. Updating to 1.17 removes it.

Reminders

If you allow notifications, Biteday schedules reminders on your iPhone, for example before a free trial ends. They are created on the device. No push token is sent to us.

The website

Biteday's pages are part of 42pixels.co, which sets no cookies and runs no analytics or advertising. See the 42pixels privacy policy for the website.

Support requests

If you email support@42pixels.co, we keep your message and our replies so that we can answer you and follow up if needed. We keep support emails for a reasonable period after the request is closed and then delete them.

Who processes your data

Biteday runs on services from the providers below. Each receives only what it needs for its task.

These providers process data only to provide their service to Biteday. While a provider processes your data, its own terms apply to that processing.

How we use your data

We use your data to:

• provide the service: estimate your meals, keep your log, weights and progress, and build your plan
• check your Biteday Pro subscription
• keep the service safe and prevent abuse, for example too many requests from one account
• understand how Biteday is used and fix crashes
• answer your support requests.

We do not sell your data, and we do not use it for advertising.

Health information

Your weight, height, goals and meals can say something about your health. We treat them as sensitive. We use them to provide Biteday to you and never share them for advertising. Analytics receives only broad setup choices, such as your goal and age range, never your exact weight, height, meals or photos. Biteday does not read from or write to Apple Health.

Legal bases

Where the law requires a legal basis for processing, for example in the EU and the UK, we rely on the following.

• Contract. Providing the service you asked for, keeping your log and billing Biteday Pro.
• Explicit consent. Processing your body details and meals, and sending your meal photos and words to our AI partners (from version 1.17 the app asks before the first meal is sent, and versions before 1.17 also sent your setup answers). You can withdraw consent at any time by deleting your account. Withdrawing it does not affect processing that happened before.
• Legitimate interests. Understanding how Biteday is used, fixing crashes, keeping the service secure and preventing abuse. We keep this processing to what a user would reasonably expect.
• Consent, in versions before 1.17, for tracking through the iOS prompt.

Retention and deletion

• Your profile, targets, weights, meals and meal photos are kept with your account until you delete them or delete your account.
• To delete a meal, delete it in your log. The meal and its photo are deleted from our servers.
• To delete everything, open Settings in the app and choose Delete Account. We delete your profile, targets, weights, meals, every meal photo and your sign-in account. Deleting the app alone does not delete your account.
• If you cannot open the app, email support@42pixels.co from the address you linked with Apple or Google, and we will delete your account. Without a linked account we cannot tell which data is yours, so use Delete Account in Settings before you delete the app.
• Our AI partners keep the data they receive only as long as their API terms allow for abuse monitoring, and not for training.
• Server logs are kept for about 30 days, the standard Google Cloud logging retention. They do not contain your meals or body details.
• Analytics and crash data are kept for the default retention period of each provider.
• Support emails are kept for a reasonable period after the request is closed.

International transfers

Biteday's backend and the providers above process data in the United States. If you live in the EU, the UK or another place whose law restricts transfers abroad, we rely on standard contractual clauses or equivalent safeguards where the law requires them.

Security

• Database and storage rules restrict each account to its own data. One user cannot read another user's meals, photos or profile.
• From version 1.17, every request to Biteday's backend carries your Firebase identity token, so the backend knows which account is asking.
• Data travels over TLS. Google Cloud encrypts it at rest.

No system is completely secure. If you have found a security problem, email support@42pixels.co.

Children

Biteday is not directed at children under 13, or under 16 where the law sets that age, for example in the EU. We do not knowingly collect personal data from children below that age. If you believe a child has given us personal data, email us and we will delete it.

Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you
• correct it if it is wrong
• delete it
• receive a copy in a portable form
• object to, or ask us to restrict, certain processing
• withdraw consent you have given
• complain to a supervisory authority.

You can do much of this yourself in the app: change your details and goals in Settings, edit or delete any meal, and delete your account in Settings. In versions before 1.17, change your tracking choice in iOS Settings under Privacy and Security, then Tracking.

For anything else, email support@42pixels.co. We may ask you to confirm that the data is yours before we act. We respond within the time the applicable law requires.

If you live in the European Economic Area or the United Kingdom, you have these rights under the GDPR and the UK GDPR, and you can complain to your national data protection authority. If you live in California, you have the rights to know, delete and correct your personal information and not to be discriminated against for exercising them. We do not sell or share your personal information as those terms are defined in California law. If you live in the United Arab Emirates, you have rights under the UAE Personal Data Protection Law, including access, correction, deletion and objection. Residents of other places may have similar rights under their own laws. Wherever you live, write to the same address and we will apply the rights that your law gives you.

Changes to this policy

We will update this policy when Biteday changes, for example when we add a feature or change a provider. The date at the top of this page shows when the current version took effect. If a change is significant, we will tell you in the app before it takes effect.

Contact

Biteday is developed and operated by 42pixels FZ-LLC, Abu Dhabi, United Arab Emirates. For questions about this policy or your data, email support@42pixels.co. Our Terms of Use are at /p/biteday/terms.