Biscai — Privacy Policy

Last updated: 14 October 2026

This Privacy Policy explains how Biscai ("Biscai", "we", "us") collects, uses, and protects your information when you use the Biscai mobile application (the "App"). The App is published and operated by SIY ENTARTEYNMANT EOOD (UIC 148017035, Varna, Bulgaria), of which Pavel Nikolov is the sole owner. Contact: support@biscai.ai.

By using the App you agree to this Policy. If you do not agree, please do not use the App.

1. Information we collect

Account information. When you create an account we collect your email address and your display name. Authentication is handled by our backend provider (Supabase).

Without an account ("Try without an account"). You can use the App for up to 48 hours without an account. We then create an anonymous account with only a random identifier — no email, name or password. Your entries are stored on our servers under that identifier, just like with a regular account, but only the device you started on can open them. When you save your account (with Apple, Google or an email), the sign-in method is linked to the same account and everything you logged stays.

Food and meal data. To provide the App's features we process:

• Photos you take of ingredients, meals, and drinks;
• food descriptions you type in words ("Describe it") and the foods you pick from the built-in list;
• foods and drinks identified from those photos and descriptions, with estimated calories and macronutrients (protein, carbohydrates, fat), including the individual components of a mixed meal;
• recipes you generate and save, and your shopping list;
• your daily water intake (logged manually or from drinks you record).

Health and activity data. With your permission, the App reads your step count and active energy burned from Apple HealthKit (iOS) or Google Health Connect (Android) to show your daily activity and estimated calories burned. See Section 5 for how this data is handled.

Preferences. App settings such as your chosen language and your daily calorie/step goals.

Body profile (optional). To calculate your recommended daily calories you can provide your sex, year of birth, height, weight, activity level, goal (lose/maintain/gain) and diet type. These are used only for that calculation and for tailoring recipes to your diet; they are never shared or used for advertising.

Weight history (optional). If you log your weight over time, we store those entries to show your progress in the App's statistics.

Setup progress. We record when you finish or skip the in-app tour, when the setup wizard was first shown to you, and whether — and how many times — you chose "Later" in it. This keeps your first-run state on your account rather than on one device, so a second phone does not repeat the setup and "Later" is actually remembered. It also shows us where people get stuck while setting the App up. It is never shared, never used for advertising, and never combined with data from other apps or websites.

Technical diagnostics (anonymous). When the App uses an AI feature, our server records basic technical facts about that request: the type of request, whether it succeeded or why it failed, the size of the photo, how long it took, how much AI processing it used, and the App's platform (iOS or Android) and version. These records contain no account identifier and no photo or food content, so they cannot be linked to you. We use them only to find and fix errors and to manage the service's costs, and delete them after at most 12 months.

Free plan allowance. We count how many AI actions (meal photos, ingredient photos, food descriptions, recipe ideas) your account uses each day, and how many of them are descriptions, so the free plan's daily allowance can be applied. Only the counts and the day are stored.

Entries made without internet. Entries you make without an internet connection (from the list, quick add, drinks, water, portion changes) are kept temporarily on your phone and sent to your account once there is a connection. The phone also keeps the server's last word on your subscription/gift, so Premium keeps working offline.

Purchases and subscriptions (Biscai Premium). Premium is bought through Apple's App Store or Google Play. The payment itself is handled by Apple or Google under their own privacy policies — we never see or store your card or other payment details. To know whether your account has Premium we use RevenueCat, which receives from the store the details of your subscription (product, price, purchase, renewal and expiry dates, trial status, store country and currency) linked to your account's random user ID — not your email or name. On our own server we store only when your subscription ends, which store it was bought in, and a log of subscription events (such as purchase, renewal or cancellation) for support.

We do not intentionally collect special-category data beyond the health and activity metrics described above, and we do not use tracking for advertising.

2. How we use your information

We use your information to:

• provide and operate the App's core features (ingredient scanning, recipe generation, meal and drink logging, water tracking, calorie/macro, weight and activity tracking);
• save your account, preferences, history, and goals;
• estimate nutrition and calories burned;
• maintain the security and reliability of the service;
• apply the free plan's daily AI allowance and check whether your account has Premium (a gift or a subscription), and that the gift is given once per person (Section 7);
• understand where the initial setup loses people, so we can improve it.

We rely on your consent and on the performance of our agreement with you (providing the App) as the legal bases for this processing (GDPR Art. 6). For the fingerprints that keep the gift to one per person (Section 7), the basis is our legitimate interest in preventing abuse (GDPR Art. 6(1)(f)).

Health data. Your body profile (sex, age, height, weight, goal), your weight history, and the steps and active energy read from HealthKit / Health Connect are data concerning health — a "special category" under the GDPR. We process them only with your explicit consent (GDPR Art. 9(2)(a)), which you give when you fill in the body profile in the App and when you allow HealthKit / Health Connect access in your phone's prompt. They are optional — the App works without them but can't calculate a personal calorie goal. You can withdraw consent at any time by turning off access in your phone's settings, by writing to us, or by deleting your account. Withdrawal doesn't affect processing that happened before it.

3. Sharing and service providers (sub-processors)

We do not sell your personal data. We share it only with the service providers needed to run the App:

These providers process data on our behalf under their own terms and data protection commitments.

4. AI processing of your photos and descriptions

When you scan an ingredient, photograph a meal or describe in words what you ate ("Describe it"), the photo or description and related text are sent to Anthropic's Claude AI (through our secure server) to identify the food and estimate its nutrition. Only what is needed for that analysis is sent, and your photos and descriptions are not stored on our servers or in our database — they are used only for this real-time analysis. Only the entry you confirm stays in your diary. Do not include people, documents, or other sensitive content you would not want processed in your food photos or descriptions.

5. Health and fitness data (HealthKit / Health Connect)

Health and activity data is treated with particular care:

• it is read only with your explicit permission, which you can revoke at any time in iOS Settings (Health) or the Health Connect app;
• it is used solely to provide in-App activity and calorie features;
• we do not use health or fitness data for advertising or marketing;
• we do not sell it and do not share it with third parties for their own purposes;
• we do not use it for any purpose unrelated to the App's clearly described features.

This reflects Apple's HealthKit and Google's Health Connect requirements.

6. Data storage and international transfers

Account and app data is stored with Supabase on servers located in the European Union (eu-west-1). When photos or descriptions are analyzed by Anthropic (United States), or subscription data is processed by RevenueCat (United States), the relevant data is transferred outside the EU under appropriate safeguards (e.g. Standard Contractual Clauses).

7. Data retention

We keep your data for as long as your account is active. When you delete your account, or ask us to delete your data, we remove your personal data from our systems within a reasonable period, except where we must retain it to comply with the law. Anonymous technical diagnostics (Section 1) are kept for up to 12 months. An unsaved anonymous account (Section 1, "Without an account") cannot be recovered if you sign out, delete the App or change devices. Anonymous accounts with no activity for 30 days are deleted automatically, together with all their data. The gift — once per person. When an account receives a Premium gift, we keep one-way cryptographic fingerprints (HMAC-SHA256) of its email address and of the Google / Apple profile it is linked to — not the email itself, no name and no link to the account. They stay after the account is deleted, so the gift can't be taken again with a new account. A fingerprint can't be turned back into the email; it is only compared at a new sign-up. When you delete your account we also ask RevenueCat to delete your subscription data. Deleting your account does not cancel a subscription — cancel it in your App Store or Google Play account settings; records of past payments stay with Apple or Google as required by law.

8. Your rights

If you are in the EU/EEA you have the right to access, correct, delete, restrict, or object to the processing of your data, to data portability, and to withdraw consent at any time. To exercise these rights, contact support@biscai.ai. You may also lodge a complaint with your local supervisory authority — in Bulgaria, the Commission for Personal Data Protection (CPDP / КЗЛД).

9. Security

We use industry-standard measures, including encryption in transit and access controls, to protect your data. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

10. Children

Biscai is not directed at children under 16, and we do not knowingly collect data from them. If you believe a child has provided us data, contact us and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. We will change the "Last updated" date above and, for material changes, notify you in the App.

12. Contact

Questions about this Policy or your data: support@biscai.ai.