Privacy Policy
Last updated: April 19, 2026
Our Privacy Manifesto
At GutGraph, we believe your health data is your most private possession. We do not sell your personal information for money, and we do not use advertising pixels to build health-data profiles for advertisers. We focus on encryption, limited access, and clear consent choices.
Your data stays encrypted where appropriate and under your control through export, deletion, and consent settings.
Your Security is Our Foundation
Unlike other health apps, GutGraph is built with security and privacy at its core—not as an afterthought.
Encrypted Storage
Sensitive health data is encrypted at rest with AES-256-GCM where applicable, and protected in transit with HTTPS/TLS plus access controls.
User-Controlled Backups
Your backup data is encrypted and stored securely on our infrastructure with your consent. You control when backups happen and can export or delete your data at any time. We never access your backups without your explicit permission.
Consent-Based Analytics
With your permission, we may use tools such as PostHog and, when configured, Google Analytics and Google Tag Manager to understand product usage and site performance. We do not use advertising pixels to build health-data profiles.
How We Handle Your Sensitive Data
Different types of health data require different levels of protection. Here's how we handle each category:
🥗 Nutrition & Meal Logs
We process your food entries and macronutrients solely to provide you with personal insights. This data is never used to build a "consumer profile" for food companies. Your meal descriptions are encrypted where supported, and AI analysis is limited to the data needed to provide requested features. We do not sell your food preferences to third parties.
Privacy Policy Details
GutGraph ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal health information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our health tracking application.
We understand that health data is among the most sensitive personal information, and we take our responsibility to protect it seriously. Please read this policy carefully to understand our practices regarding your data.
Your Data Security
All sensitive personal health data is encrypted using industry-standard AES-256-GCM encryption before being stored in our database. This includes your weight, height, date of birth, personal notes, and mood labels.
Information We Collect
Account Information
- Name: Your first and last name for personalization
- Email Address: For account authentication and communication
- Password: Securely hashed and never stored in plain text
- Google Account ID: If you choose to sign up with Google
- Profile Picture: Optional avatar for your account
Health Profile Data (Encrypted)
- Weight: Your body weight (encrypted at rest)
- Height: Your height (encrypted at rest)
- Date of Birth: For age-related health insights (encrypted at rest)
Daily Health Logs
- Symptoms: Type and severity (1-5 scale) of symptoms you experience
- Mood Entries: Your emotional state and mood scores
- Meal Quality: General assessment of daily nutrition
- Personal Notes: Any notes you add to daily logs (encrypted at rest)
Nutrition Data
- Meal Logs: Breakfast, lunch, dinner, and snack entries
- Meal Descriptions: What you ate (encrypted at rest)
- Nutritional Information: Calories, protein, carbohydrates, and fat
- Ingredients: Individual food items with portion sizes
- AI Analysis Results: Nutritional data derived from AI processing
Mood Tracking Data
- Mood Scores: Daily mood ratings on a 1-5 scale
- Mood Labels: Descriptive labels like "Happy," "Calm," or "Anxious" (encrypted at rest)
- Mood Notes: Additional context about your emotional state (encrypted at rest)
How We Use Your Information
- Provide Core Services: Log and track your health data including nutrition, symptoms, and activity
- Generate Insights: Analyze patterns in your data to provide personalized health insights
- Improve Accuracy: Use your historical data to improve health analytics and recommendations
- AI-Powered Features: Process meal descriptions to estimate nutritional content
- Account Management: Authenticate your identity and maintain your account
- Communication: Send essential service updates and respond to your inquiries
- Research (Optional): If you opt-in, use anonymized data to improve our algorithms
How We Protect Your Data
Encryption at Rest
Sensitive health data is encrypted using AES-256-GCM before storage
Encryption in Transit
All data transfers use HTTPS/TLS encryption
Access Controls
Strict authentication and authorization for data access
Password Security
Passwords are hashed using bcrypt with secure salt rounds
HIPAA Disclosure
GutGraph is NOT a HIPAA-covered entity and does not provide HIPAA protections. While we implement strong security measures including AES-256-GCM encryption for sensitive health data, our service is not designed to meet HIPAA compliance requirements. If you require HIPAA-compliant health data management, please consult your healthcare provider about appropriate tools and services.
Third-Party Services
We use carefully selected third-party services to provide our application:
Authentication
- Google OAuth: If you choose to sign in with Google, we receive your name, email, and profile picture from Google. We do not have access to your Google password.
Payment Processing
- Stripe: Our payment processor handles all payment information. We never store your credit card details. Stripe is PCI-DSS compliant. Please review Stripe's Privacy Policy.
Consent-Based Analytics
- PostHog: When analytics consent is enabled, PostHog may collect page views, click and form interaction telemetry, and masked session replays to help us improve the product.
- Google Analytics 4: When configured and enabled by consent, GA4 measures site usage and performance.
- Google Tag Manager: When configured and enabled by consent, GTM loads analytics tags managed by GutGraph.
These analytics tools are optional and only load after analytics consent. They are separate from the AI processing choices described below.
AI Processing Services
To provide nutritional analysis, pattern detection, and health insights, your data may be processed by the following AI services:
- Google Gemini — Used for nutritional analysis, food image recognition, and ingredient identification. Food descriptions and meal photos you provide may be sent to Google's AI services for processing.
- OpenAI — Used for pattern analysis, insight generation, and natural language processing of health data. Anonymized health patterns from your tracked data may be processed by OpenAI's services.
- Voice input — If you dictate a meal, the audio is transcribed on GutGraph-operated servers using open-source speech recognition (Whisper). The recording is processed in memory, never stored, and is not sent to any third-party AI service. Only the resulting text is then handled like a typed meal description.
Important: We minimize the data sent to these services and do not send personally identifiable information such as your name or email. However, the health-related content of your meals, symptoms, and tracking data is processed by these services to provide analysis features. These services have their own privacy policies governing data handling.
You can opt out of AI-powered features at any time through your account settings, though this will limit the analysis capabilities available to you.
Infrastructure
- Cloud Hosting: Our application is hosted on secure cloud infrastructure with appropriate security certifications.
- Database: PostgreSQL database with encryption enabled.
Your Rights
You have the following rights regarding your personal data:
Right to Access
Request a copy of all personal data we hold about you
Right to Export
Export your data in a portable format (available in Premium)
Right to Rectification
Correct any inaccurate personal data
Right to Deletion
Request complete deletion of your account and data
To exercise any of these rights, please contact us at legal@gutgraph.com.
Regional Privacy Rights
European Union (GDPR)
If you are located in the EU/EEA, you have rights under the General Data Protection Regulation including the right to access, rectify, port, and delete your personal data. Health data is classified as "special category data" under GDPR Article 9 and is processed based on your explicit consent. Contact legal@gutgraph.com to exercise your rights.
California (CCPA)
If you are a California resident, you have the right to know what personal information we collect, request deletion, and opt out of the sale or sharing of personal information. GutGraph does not sell personal information for money. To manage California privacy choices, visit our Do Not Sell or Share My Personal Information page or contact legal@gutgraph.com.
Data Retention
- Active Accounts: We retain your data for as long as your account is active
- Account Deletion: Upon account deletion, all personal data is permanently removed within 30 days
- Backup Retention: Encrypted backups may be retained for up to 90 days for disaster recovery
- Anonymized Data: If you opted into research sharing, anonymized data may be retained indefinitely
Children's Privacy
GutGraph is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For significant changes, we will provide additional notice via email or in-app notification.
Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us: