Bulk Privacy Policy
Effective date: 14 July 2026
Bulk ("the app") is a nutrition, weight, and workout tracker operated by Amibi AB (org. nr 559389-6201), Tjärhovsgatan 22, 116 21 Stockholm, Sweden ("we", "us"). This policy explains what data the app handles, where it goes, and what your rights are. Contact: support@joinbulk.app.
Summary
- Your logs (meals, weight, workouts) are stored on your device and synced to our servers in the EU so you can restore them.
- Progress photos never leave your device.
- Meal photos, meal descriptions, and voice recordings you submit for calorie estimation are processed by AI providers on our behalf. They are not used to train AI models.
- We use analytics (including screen recordings with text and images masked) to find bugs and improve the app.
- We never sell your data and we show no ads.
- You can delete your account and all server data from inside the app.
Data we collect and why
Account data
When you sign in with Apple, Google, or email, we store your user ID, email address, and sign-in method with Supabase (hosted in the EU, region Ireland). If you use the app without an account, an anonymous ID is created to enforce fair-use limits on AI features.
Legal basis: performance of a contract.
Content you log
Meals, ingredients, calorie and macro data, weight entries, workouts, routines, strength goals, saved foods, and profile settings are stored on your device and synced to Supabase (EU) so your data survives reinstalling and can move between devices.
Progress photos are stored only on your device. They are never uploaded.
Legal basis: performance of a contract.
Photos, voice, and text sent for AI estimation
When you scan a meal with the camera, describe it by voice, or type it, that input is sent through our server to:
- Anthropic (Claude models): estimates nutrition from your meal photo or description.
- Deepgram: converts your voice recording to text.
Both process the data to produce the result and do not use your data to train their models. Your API traffic is authenticated through our server; the providers do not learn your identity. Meal photos are processed and not retained by us; we store only the resulting nutrition data in your log.
Food name lookups are also sent to the USDA FoodData Central database (a US public database) as search text only.
Legal basis: performance of a contract.
Health data (Apple Health / Health Connect)
With your permission, the app reads weight and step data from Apple Health or Health Connect to improve calorie estimates and track progress, and can write weight entries you log. Health data is used only for the app's features. We never use Apple Health / Health Connect data for advertising or marketing, never sell it, and never share it with third parties. You can revoke access at any time in system settings.
Legal basis: consent.
Social features
If you use social features, your profile alias, chat messages, accountability posts, reactions, friend connections, and challenge participation are stored with Supabase (EU) and visible to the users you interact with. Reported content is stored for moderation review.
Legal basis: performance of a contract.
Usage analytics and error data
We use PostHog (EU Cloud) to understand which features are used and to find bugs:
- Usage events (for example "meal logged"), screens viewed, app version, device model, OS version, and language.
- Crash reports and error logs.
- Session recordings of the app's screens, in which all text and images are masked (we see layouts and taps, not what you typed or photographed).
Analytics are linked to your user ID when you are signed in so we can investigate problems you report.
Legal basis: legitimate interest in keeping the app working and improving it.
Purchases
Subscriptions are processed by Apple App Store or Google Play and managed through RevenueCat. We receive subscription status (active, expired) and anonymized transaction data. We never see your payment details.
Legal basis: performance of a contract.
What we do not do
- We do not sell your data.
- We do not show ads and do not share data with advertisers or data brokers.
- We do not use your health data, photos, or logs for AI training.
- We do not upload your progress photos.
Data processors
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Account, database, sync, chat | EU (Ireland) |
| Anthropic | AI nutrition estimation | US |
| Deepgram | Voice transcription | US |
| USDA FoodData Central | Food nutrition lookups (search text only) | US |
| PostHog | Analytics, error tracking, masked session replay | EU |
| RevenueCat | Subscription management | US |
| Apple / Google | Sign-in, payments, app distribution | per their policies |
Transfers to US providers are covered by the EU-US Data Privacy Framework and/or standard contractual clauses.
Retention
Your content stays as long as your account exists. Analytics and error data are retained by PostHog per our settings and then deleted. AI inputs (photos, audio, text) are processed transiently and not stored by us. If your account is inactive for an extended period we may delete it after notice to your email.
Deletion and your rights
You can delete your account in the app: open Profile, scroll to the bottom, and choose Delete account. This permanently removes your server-side data (logs, profile, messages sent in shared chats may be removed or anonymized). Local data is removed when you delete the app.
Under the GDPR you also have the right to access, correct, export, restrict, or object to processing of your data. Email support@joinbulk.app and we will respond within 30 days. You may lodge a complaint with your supervisory authority; in Sweden this is IMY (Integritetsskyddsmyndigheten).
Children
Bulk is not directed at children and requires you to be at least 16 years old.
Changes
We will post changes to this page and update the effective date. Material changes will be announced in the app.
Contact
support@joinbulk.app Amibi AB, Tjärhovsgatan 22, 116 21 Stockholm, Sweden