Privacy Policy
Health records stay on your phone in an encrypted database. Subscriptions use store services and RevenueCat.
LAST UPDATED 23 OCTOBER 2026 · VERSION 1.2
In short
- No account, sign-in or email address is needed.
- Your records are stored on your device in a database encrypted with AES-256. Optional AI interpretation sends selected records with separate consent.
- The diary and statistical health analysis run on your device; optional AI interpretation runs in the cloud. Subscription verification and purchases require internet access. There are no advertising or tracking tools.
- Apple Health and Health Connect data is read on the device only; it is not used for advertising or marketing and is not shared with anyone.
- Health records leave the device only when you share them: a PDF report, a CSV file, an encrypted backup or optional AI interpretation.
1. Data that reaches us
Health records are not sent to our server unless you request AI interpretation; RevenueCat does not receive health records. RevenueCat processes a random app user identifier, purchase/transaction information, product and subscription status, and technical connection information needed to provide the service (such as IP address, app and operating system versions). This supports access verification, purchase restoration and payment troubleshooting; subscription information is visible in the RevenueCat dashboard. Bulgu does not receive payment card details; Apple or Google processes payment.
2. Data you enter, which stays on the device
For Bulgu to be useful you enter some personal and health-related information. All of it is kept in the encrypted database on your device. Selected food and symptom records can be shared for AI with separate consent as described below:
| DATA | PURPOSE |
|---|---|
| Profile answers: optional name, birth year, sex, height, diagnosis and tests, symptom pattern, treatments tried, goals | Building your starting profile and the report |
| Meal, symptom (pain, bloating, gas, urgency), stool (Bristol type) and daily check-in (stress, mood, energy, sleep) logs | Diary, charts and possible-trigger analysis |
| Weight history and treatment records | Profile and report |
| Protocol phases, test plans and results | Following elimination and reintroduction |
| Daily sleep, steps, water and weight read from Apple Health / Health Connect | Showing them next to your logs as context |
| Language, theme and reminder settings | Remembering your preferences |
The statistical possible-trigger analysis runs on your device. Optional AI interpretation is a separate cloud service.
3. Encryption and device backups
- The database is encrypted with SQLCipher using AES-256. The key is generated at random the first time the app opens and is kept in the iOS Keychain or the Android Keystore.
- The key is tied to this device only: it is never moved to another device or synced to a cloud.
- On Android, app data is excluded from Google's automatic backup. On iOS, the encrypted database file may be part of a device backup, but its key is not, so that copy cannot be opened on another device.
- To move your data to a new phone, use the app's encrypted backup (see section 6).
4. Apple Health and Health Connect
The connection starts off; switching it on and choosing which data types to allow is up to you.
- Read: sleep duration, step count, water and weight.
- Written: only the glasses of water you log in Bulgu, so other apps can see them.
- This data is read on the device only, to show it next to your logs and to use it as context in the analysis. It is not used for advertising, marketing or data sales; it is not transferred to any third party; it is not written to iCloud or any other cloud.
- You can revoke access at any time on iPhone in Settings → Health → Data Access & Devices, and on Android in the Health Connect settings.
5. Notifications
Reminders start off. When you switch one on, the time you pick is scheduled on the device's own timer. Bulgu does not register a push token, talks to no notification server, and no health information appears in reminder text.
6. Sharing you start
Data leaves the device only in these cases, and only to the place you choose. Sharing uses your phone's own share sheet. AI interpretation uses the separate transmission flow described below.
- Doctor report (PDF): not encrypted. Be careful who you send it to.
- CSV export: not encrypted.
- Encrypted backup: a single file encrypted with a passphrase you choose. Bulgu never stores the passphrase; if you forget it, the backup cannot be opened.
Wherever you save or send these files (e.g. iCloud Drive, email, a messaging app) is subject to that service's own privacy terms.
6a. Optional AI interpretation
This feature is off by default. For every request, choose a food or date range, review the records and give separate consent. Food names, types, amounts, declared ingredients, and selected manually entered symptom scores and their dates/times are sent through our EAS Hosting server to OpenAI. Profile answers, meal notes, Apple Health and Health Connect data are excluded. Avoid putting identifying information in food names or ingredients.
Our server does not save request or response content in a database or application logs. AI responses are shown in screen memory; accepted food suggestions are saved to your device. OpenAI may retain content for abuse monitoring for up to 30 days; API data is not used for model training by default. See OpenAI data controls. Processing may occur outside your country. Stop future sharing by not sending another request; deleting local records does not delete data already sent to the provider.
For abuse and cost control, a salted hash derived from the connection IP and request counters are held in Upstash Redis for up to 48 hours. Raw IP addresses are not saved in this counter database. EAS Hosting networking and OpenAI process connection information under their own service terms. AI interpretation is not a diagnosis, a verified FODMAP measurement or proof of a food trigger.
7. Third parties
Bulgu does not use advertising networks or behavioral tracking services. The app uses RevenueCat and Apple App Store / Google Play for subscriptions. RevenueCat does not receive health records. See the RevenueCat privacy policy. Other components include Keychain/Keystore, local notifications, the share sheet and, if you allow it, Apple Health or Health Connect.
On Android, if Health Connect is not installed, tapping the related button opens its Google Play page. Subscription status is also refreshed over the internet on launch and when the app returns to the foreground.
8. Deleting your data
Deleting local records does not cancel a subscription or delete RevenueCat or store transaction records. Manage subscriptions in your store account; contact us for requests concerning subscription data.
- Profile → Delete all data removes all your records from the device (confirmed with a second tap).
- Uninstalling the app deletes the database too.
- Because we hold no copy, deleted data cannot be recovered by us, and we have no other record to delete.
9. Your rights
For locally stored records, you exercise rights such as access, correction and erasure under the GDPR and Turkey's KVKK directly in the app: you can view, edit, export as CSV and delete your records. Write to us with any question.
10. Children
Bulgu is designed for adults and is not directed at anyone under 18.
11. Changes
This policy may be updated. Changes take effect on the date they are published here, and the date and version at the top are updated. If a future version of the app gains a feature that collects data, this page is updated before that version ships.
12. Contact
Developer: Mahir Uslu