The controller of your personal data is Dariusz Gugała, conducting business (legal name: "Dariusz Gugała"; trading as two71) in Wrocław, NIP 8961368047, REGON 366648559. Contact for all matters concerning data: kontakt@two71.io.
Account data: e-mail address, display name, password hash (argon2 — the password itself is never stored) or Google sign-in identifier, language, settings.
Health data (special category, Art. 9 GDPR) — only what you enter yourself:
Health Connect and device data (optional, off by default): if you enable the device integration in Settings and install the Android app, then — after you grant permission in Health Connect — we read your body weight, steps and sleep from it, plus blood glucose readings if you grant that permission (we only STORE them while the glycemia module is on; with it off the server refuses them). The read is one-way (we never write to Health Connect), runs automatically about every 12 hours, and serves only the app's own features: your weight trend, the adaptive calorie target and the context of your daily balance. The values we read are stored in your check-ins exactly like the ones you type yourself — which means the daily figures (steps, hours of sleep, weight) can travel as context into the AI-generated daily note and weekly summary (processor: OpenAI, see section 4), the same way your own entries do. Health Connect data is never sold, never given to advertisers and never used to train models; if you would rather it played no part in AI content, switch the daily-note module off in Settings. You can withdraw the permission in Health Connect and switch the whole integration off in Settings, which cuts paired devices off immediately. A Bluetooth scale (Mi Scale) talks to your phone directly; the Bluetooth permission is used solely to find the scale and we do not collect location.
Problem reports and suggestions: the text you send plus — so the report can be reproduced — your browser/device name, the screen it was sent from, your language and window size. These go to the operator's mailbox.
Notifications: if you enable them — the push subscription address issued by your browser (it contains none of your data), or the token of a paired Android device.
Voice recording (optional): if you use the microphone button in the chat, the recording is sent for transcription (processor: OpenAI, see section 4) and is never stored by us — only the resulting text remains, as your message in the conversation. Nothing is recorded unless you tap the microphone.
Assistant conversations: your chat history is stored on your account so you can return to it; it is deleted with the account, or per conversation.
Technical data: active login sessions (date, approximate IP address, browser/device) — so that you can see who is logged in to your account and cut off any sessions that are not yours.
Household: if you link your account with a household member, only the pantry, shopping lists and shared meal plans are shared. Each person's health data remains private and is not visible to other household members.
| Purpose | Legal basis |
|---|---|
| Providing the service (account, login, operation of the application) | Art. 6(1)(b) GDPR (contract) |
| Processing health data (diary, analyses, plans, AI assistant) | Art. 9(2)(a) GDPR (your explicit consent, collected at registration) |
| Security (sessions, abuse prevention, backups) | Art. 6(1)(f) GDPR (legitimate interest) |
| Billing — if you use a paid subscription | Art. 6(1)(c) GDPR (tax and accounting obligations) |
You can withdraw your consent to the processing of health data at any time by deleting your account (Settings → danger zone) — without this consent the application cannot provide its core functions. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
| Entity | Role | Scope |
|---|---|---|
| Hetzner Online GmbH (Germany, EU) | server hosting | all data (server in the EU, encrypted connections) |
| OpenAI (USA) | AI models via API | the content of the given request: meal description/photo, photo/PDF of a lab report printout, messages to the assistant, the voice recording from the microphone button (for transcription), planner input data and the daily check-in figures used by the daily note. Under the API terms the data is not used to train models. Transfers outside the EEA: EU-US Data Privacy Framework / standard contractual clauses. |
| Google Ireland Ltd. | "Continue with Google" sign-in (optional) | Google account identifier and e-mail — only if you choose this sign-in method |
| Open Food Facts (open database, France) | barcode product lookup | the scanned barcode only — no account identifier, no health data |
| Frisco.pl (Poland) | optional transfer of your shopping list into the shop's basket | only when you tap "send to basket": the product list, the delivery postcode and the chosen warehouse. In the Android app the shop opens in an in-app browser window on your own Frisco session — we never see your login or your payment, and no health data reaches the shop. The Bilberry server also fetches product prices from Frisco (with no information about who is asking). |
| Resend Inc. (servers in the EU — Ireland) | sending transactional e-mails | e-mail address and the content of system messages (address verification, password reset, trial-period reminders, referral notifications, account deletion warnings). No newsletters without separate consent. |
| Paddle.com Market Ltd / Paddle Payments Ltd (UK/EU) | payment processing — merchant of record (paid plans only) | e-mail, country, transaction and payment method data. Paddle acts here as an independent controller of payment data (card details never reach our servers); details: paddle.com/privacy |
Your data is never sold to anyone. The application contains no ads and no third-party trackers. For visit statistics we use our own, self-hosted analytics (Umami, on our server in the EU) in cookieless mode: no cookies, no identifiers stored on the device, respecting the "Do Not Track" setting and passing nothing to third parties. Only feature-level events are counted (e.g. "planner opened") — never health content. Visit uniqueness is counted using an ephemeral, salted hash rotated daily; the raw IP address is not stored. No decision concerning you is made fully automatically — every AI output (meal readout, plan, lab-result readout) requires your confirmation before it is saved.
Profiling: the application analyses the data you enter (food diary, body weight, profile, preferences, lab results) in order to personalise your calorie target, meal plans and guidance — that is what the service consists of. We do not make decisions about you based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you: every AI proposal is a suggestion and requires your confirmation.
You have the right to: access your data, rectification, erasure ("the right to be forgotten"), restriction of processing, data portability (export of your entire account to a JSON file — a button in Settings), objection to processing based on legitimate interest, and withdrawal of consent at any time. Most of these you can exercise yourself in the application; for anything else, write to kontakt@two71.io — we respond within one month at the latest.
You also have the right to lodge a complaint with the President of the Polish Data Protection Authority (UODO) (uodo.gov.pl).
The application is intended for persons who are at least 16 years old.
The application uses only cookies that are strictly necessary for its operation — there are no analytics or advertising cookies and no tracking mechanisms of any kind. That is why we do not display a cookie banner: under the provisions on electronic communications, consent is not required for storage that is necessary to provide a service you have requested.
| Name | Purpose | Lifetime |
|---|---|---|
ha_session |
keeping you signed in (HttpOnly — inaccessible to page scripts) | up to 30 days or until logout |
ha_oauth_state |
securing the "Continue with Google" sign-in (CSRF protection, PKCE); created only when you use this method | approx. 10 minutes, single-use |
In addition, the browser stores locally on your device: the selected theme and interface preferences (localStorage), the files needed for the application to work without a network connection (the PWA cache), and — in an IndexedDB database — diary entries made while offline, including the photo of the meal if you took one. The theme and the application files are not sent anywhere. Pending entries are, by definition, waiting to be sent: when the network returns they go to your account for estimation, and you confirm them like any other entry. Signing out removes the pending entries (photos included) and the rest of your account's data from this device; what stays is the device's own settings — theme, accent and the files the app needs offline. Clearing the site data in your browser removes everything.
The visit statistics (section 4) work without cookies and without writing to the device's storage — which is why a consent banner is still not needed.
The "buy at Frisco" links on the shopping list lead to the external service frisco.pl, which applies its own privacy and cookie policy.
We will announce material changes in the application and ask for your renewed acceptance. Previous versions are available on request.