Privacy Policy

1. Who is responsible

This policy is provided by KetoBunny (formerly KetoBuddy), operated by Daniel Hangan, an individual sole operator based in New York, United States (“KetoBunny,” “we,” “us”). Daniel Hangan decides how your personal information is used, is the controller of it for data-protection purposes, and is your contact for every privacy request.

KetoBunny was previously called KetoBuddy. The name changed; the operator, the app, your account and this policy’s commitments did not. References to KetoBuddy in older emails, receipts, App Store records or the app bundle mean the same service.

This policy covers the KetoBunny iOS app, the website at ketobunny.app (including the plan quiz at /start, web checkout and the subscription page at /account), and messages you send us. It is written for users in the United States, the United Kingdom, the European Economic Area, Canada and Australia.

2. Adults only

KetoBunny is intended for adults aged 18 and over. It tracks weight, body measurements and calorie restriction, and it is not directed to children or teenagers. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us information, contact us and we will investigate and delete it.

3. Information you provide

Account and profile

You sign in with Apple or Google; authentication is handled by our backend provider, Supabase. We receive an account identifier and the name and email address the provider shares with us. Apple may give us a private relay address instead of your real one. We also process your display name, optional avatar, buddy code, time zone, preferences and settings.

Nutrition and meals

The foods, drinks, meal descriptions, meal photos, recipes, portions, dates and notes you record, and the calories, protein, fat, total carbohydrates, fiber, sugar alcohols, net carbs, targets and corrections that go with them. If you scan a barcode, see section 11.

Body measurements and goals

Date of birth or age, the sex used in energy calculations, height, weight and weight history, target weight, optional waist measurement, activity level, training days, diet preferences, pace and goals. Some onboarding inputs are processed on your device rather than synced to your account.

Ketones and wellness records

Ketone readings you enter (method, value, time and notes), our food-based ketosis estimates and their confidence or calibration, and the habit, activity, water, fasting, program and progress records you keep. These records, and the inferences drawn from them, can reveal information about your health. See section 12.

Answers and photos that stay on your phone

Your answers to the onboarding questions about medical conditions and medications are processed on your phone and are not included in account sync or in meal-analysis requests. Progress photos and ketone-strip photos are stored locally on your device in the current app. Your device-backup settings (for example iCloud Backup) may affect local copies. If you choose to put sensitive details in a meal description, a support message or a community post, those details follow the handling of that feature.

Community, buddies and challenges

If you use the social features, we process your buddy connections and invitations, challenge membership, scores, messages and photos, your sharing settings, and any questions, answers, votes, saves, reports and blocks in the community Q&A. Community posts may be held for review before they are published, and we review reports to enforce our rules.

Support

If you email us, we receive your contact details and the contents of your message.

4. Information collected through use

The app, the website and our providers process account and device identifiers, IP addresses, app, browser and operating-system versions, authentication activity, timestamps, errors, security events and service usage needed to run and protect KetoBunny.

For each AI meal analysis we keep the result and a technical record (request status, model, processing time, image size and errors) linked to your account. This lets us enforce fair-use limits and find failures. A saved meal can stay in your diary separately from that record.

KetoBunny does not request your precise GPS location, your contacts, or access to your whole photo library. The current app does not read or write Apple Health (HealthKit) or connect to a ketone meter. Reminders are optional and can be turned off in iPhone Settings.

Analytics and advertising data are described in sections 9 and 10.

5. Purchases and payment

App Store subscriptions

Purchases in the app are processed by Apple. Apple and our subscription-management provider, RevenueCat, give us the product, transaction identifiers, entitlement status, trial eligibility, renewal or expiry, purchase dates, storefront, currency and amounts. We do not receive your payment-card details from Apple.

Web subscriptions on ketobunny.app

If you subscribe on our website, payment is processed by Stripe. Stripe collects your card or other payment details, billing country or address where required, and email, and handles fraud screening. We never see or store your full card number or security code. Stripe tells us the customer and subscription identifiers, plan, price, trial and renewal dates, payment status and the email and country used at checkout. Stripe may also show us the card brand, last four digits and expiry so we can help with billing questions.

To connect a web purchase to your app account, the checkout carries your KetoBunny account ID, the plan and price you chose, the anonymous campaign tags in the link you arrived from (such as utm_source), and the browser identifiers, IP address and browser type described in section 10. Our server reports the subscription to RevenueCat so the app unlocks Pro when you sign in with the same Apple or Google account.

You can see, change or cancel a web subscription at ketobunny.app/account, which opens Stripe’s customer portal. See Stripe’s Privacy Policy.

6. Why we use your information

• Create and secure your account, save and sync your records, and restore them when you sign back in.
• Calculate nutrition targets, totals, trends and wellness estimates from what you enter.
• Analyse a meal photo or description you submit, using the AI service in section 7.
• Look up a barcode you scan.
• Run the buddy, challenge, community and sharing features you choose, and moderate them.
• Sell, verify, restore and support subscriptions bought in the App Store or on the web.
• Understand where onboarding, sign-in and checkout fail so we can fix them (section 9).
• Measure whether our ads lead to installs, sign-ups and subscriptions, and improve them (section 10).
• Respond to support and privacy requests, investigate errors and abuse, prevent fraud, and meet legal duties.

We do not sell your meal photos, ketone readings, body measurements, medical answers or other health records. We do not use them to target advertising, give them to advertising partners, use them to train AI models, or use them as public testimonials.

7. AI meal analysis: Google Gemini

When you submit a meal photo or a written meal description, it goes through our backend (a Supabase Edge Function) to Google’s Gemini API, which estimates the foods, portions, calories and macros. Only subscribers can run an analysis; our server checks the subscription with RevenueCat first.

The request contains the image or description and our food-analysis instructions. It does not intentionally include your name or email, your diary, your body profile, your ketone history or your medical answers. The app re-encodes meal images before upload, which removes embedded metadata such as GPS location. That does not remove anything visible in the picture itself, so avoid photographing people, documents or anything you would not want processed.

We use Gemini through a billing-enabled Google Cloud project. Under Google’s paid-service terms, Google does not use submitted prompts or responses to improve its products. Google may keep and process content for a limited time for service operation, safety, abuse prevention and legal reasons. This is not a promise of zero retention. See the Gemini API terms and Google’s Privacy Policy.

Camera or photo permission is not consent to AI processing. The app explains the AI step before you use it, and where the law or Apple’s rules require your permission we ask for it. You can avoid AI processing entirely by entering food manually or by barcode, and you can withdraw consent or ask us to delete earlier submissions by contacting us.

8. The website and web plan quiz

The plan quiz at /start asks the same kinds of questions as the app (goal, body measurements, activity, diet and health screening) to build a plan. Your quiz answers are kept in your browser’s local storage and are not sent to our servers, to analytics, or to Meta. Clearing your browser data removes them. We record which step you reached and how long it took, not what you answered.

To subscribe on the web you sign in with Apple or Google through Supabase, so your purchase is attached to the same account the app uses. The website is hosted on Cloudflare, which processes requests (including IP address and an approximate country) to deliver pages and protect the service.

9. Product analytics: PostHog

We use PostHog (US-hosted) for product analytics in the app (version 1.1 and later) and on the website. We send a pseudonymous installation, browser or account identifier, app or build version, device type and operating-system or browser version, page and onboarding screen names and timing, sign-in, paywall and checkout interactions, campaign tags, and subscription events from RevenueCat and Stripe. We use this to see where people get stuck and to improve onboarding and the subscription experience.

We do not send onboarding answers, medical conditions, body measurements, meal or photo content, names, email addresses, advertising identifiers or free-text error messages to PostHog. Session recording and automatic capture of clicks and page content are off. PostHog receives your IP address when an event is sent, so we do not describe this data as anonymous; we have turned off IP-based location enrichment for the app. PostHog is separate from Meta advertising and does not depend on the Apple tracking choice. See PostHog’s privacy policy.

10. Advertising measurement: Meta

We advertise on Facebook and Instagram and use Meta to find out whether those ads lead to installs, sign-ups, trials and subscriptions, and to improve who sees them. Meta may combine these events with information it already holds about you, under its own Privacy Policy.

In the iPhone app

• The app includes Meta’s SDK with automatic event logging turned off. It reports app opens, and our subscription provider RevenueCat reports subscription events (trial started, purchase, renewal) to Meta.
• The app asks for permission through Apple’s App Tracking Transparency prompt. Only if you allow tracking can Meta receive your device advertising identifier (IDFA), vendor identifier and IP address through the app.
• Whatever you choose, these app and subscription events are linked to a random identifier that Meta’s SDK creates for KetoBunny on your device (not your advertising identifier), so we can count conversions without tracking you across other companies’ apps.

On ketobunny.app

• The website uses the Meta Pixel in your browser and the Meta Conversions API from our server. Both send page views and funnel events (quiz started and completed, sign-up, checkout started, plan selected, App Store button clicked), and our server sends trial and purchase events after Stripe confirms them. The same event ID is used on both paths so Meta counts each event once.
• With these events Meta may receive: your email address and an account or browser ID, both hashed (converted to an irreversible code) before sending; a hashed country; the Meta browser and click identifiers _fbp and _fbc (or the fbclid in the ad link you clicked); your IP address; your browser’s user agent; the page address; and the plan, price and currency.

What never goes to Meta

We do not include meal photos or descriptions, macros, ketone readings, weight, body measurements, quiz answers or medical answers in any advertising event. The fact that someone uses a keto and nutrition app may still let a recipient infer an interest in diet or wellness.

Your choices

• In the app: refuse the tracking prompt, or change it any time in iPhone Settings → Privacy & Security → Tracking → KetoBunny. Refusing never affects your access to the app or to paid features.
• On the website: block or clear cookies and site data, use a browser or extension that blocks the Meta Pixel, or use your Facebook ad preferences.
• Anywhere: email dan@dansugcmodels.com with “Do not sell or share” and the email on your account. We will stop sending your account’s events to Meta for advertising, including from the app and from web purchases.

Withdrawing permission stops future sharing; it does not erase what Meta already received. Contact us and we will help with a deletion request.

11. Service providers and other recipients

We use the following providers to run KetoBunny. They process personal information on our behalf or, where noted, under their own terms.

• Supabase: sign-in, database, file storage and backend functions. Your synced profile, diary, meal-photo records, ketone and weight entries, programs and community content are stored here. Privacy Policy.
• Google: Gemini meal analysis (section 7) and Google sign-in if you use it.
• Apple: Sign in with Apple, App Store distribution and in-app purchases. Privacy Policy.
• RevenueCat: checks and restores subscriptions from the App Store and Stripe, and forwards subscription events to PostHog and Meta. It receives account and purchase identifiers, never your diary, ketone readings or body measurements. Privacy Policy.
• Stripe: web payments, the customer portal, fraud prevention and receipts (section 5). Stripe also acts as an independent controller for some payment and fraud data.
• PostHog: product analytics (section 9).
• Meta: advertising measurement (section 10). Meta uses the data it receives under its own terms.
• Cloudflare: website hosting and delivery.
• Open Food Facts: when you scan a barcode, the app sends only the barcode number, with no account information, to this open food database to look up the product.

Other users. Buddies, challenge members and community readers see what the feature and your sharing settings expose, such as your display name, avatar, streak, ketosis band, score, posts, messages and photos, and, only if you turn them on, your weight, calories or meal photos. They may keep screenshots outside our control.

Legal and safety. We may disclose information to professional advisers or authorities when the law requires it, or when necessary to address fraud, security, safety or legal claims. If KetoBunny is ever transferred to a new owner, your information stays subject to this policy and applicable law, and a transfer does not create permission to sell consumer health data.

12. Health information

Much of what you record in KetoBunny is health information: what you eat, your weight and measurements, ketone readings, fasting, and the estimates we calculate from them. We treat it as sensitive. We use it only to provide the features you ask for, keep it out of analytics and advertising events, protect it with access controls, and do not sell it.

Consumer health data (Washington, Nevada and similar laws). We collect consumer health data from what you enter or upload, your use of the app, and our calculations and AI analysis of your inputs. We disclose it only to the processors listed in section 11 for the purposes in section 6, and to other users you choose to share with. We do not sell it, do not use geofences around healthcare facilities, and do not buy health data from anyone. Where these laws require consent beyond what is necessary to provide the service you asked for, we ask before collecting or sharing, and separately from accepting our Terms. You may ask whether we collect, share or sell your consumer health data, access it, get a list of the third parties that received it, withdraw consent, request deletion, and appeal a decision. Email us with “Consumer health data request” (or “appeal”). If applicable, you can also contact the Washington or Nevada Attorney General.

13. Legal bases (UK and EEA)

• Contract: running your account, syncing your records, the features you request, and selling and supporting your subscription.
• Explicit consent: health information is special-category data. We process it for the wellness features you request on the basis of your explicit consent, which you can withdraw by deleting the records or your account, or by contacting us. Accepting the Terms is not that consent.
• Consent: the Meta Pixel, Meta’s identifier collection after the App Tracking Transparency prompt, and other non-essential cookies and identifiers used for advertising measurement.
• Legitimate interests: security, fraud and abuse prevention, scan fair-use limits, fixing errors, aggregate product analytics, and app-scoped ad conversion counting that does not use your advertising identifier. You can object at any time by contacting us.
• Legal obligation: tax, accounting and records we are required to keep.

14. Cookies and browser storage

The website uses cookies and your browser’s local storage for these purposes:

• Necessary: your sign-in session (Supabase), your quiz answers and progress, the price and plan you were shown, and Stripe’s checkout and fraud-prevention cookies on Stripe’s pages.
• Analytics: PostHog’s identifier cookie and storage.
• Advertising measurement: Meta’s _fbp and _fbc cookies, a copy of the ad click ID and campaign tags from the link you arrived on, and a random browser ID we use to deduplicate events.

If you visit from the UK, the EEA or Switzerland, we ask first: the Meta Pixel and the Conversions API do not run, and no advertising data is sent from our server about your purchase, unless you choose Accept on the cookie notice. You can change your choice at any time by clearing this site’s cookies, which shows the notice again.

You can delete or block cookies and site data in your browser settings. Blocking necessary storage may stop sign-in or checkout from working.

15. Retention and account deletion

We keep your account and synced records while your account is active and you need them. AI-analysis results and operational records are kept only as long as needed for the service, troubleshooting, security and legal requirements. Community reports keep text snapshots, which we review for deletion after 30 days unless there is a documented safety or legal reason to keep them. Payment records are kept as long as tax and accounting law requires. Retention depends on purpose, sensitivity and any legal duty, so we do not promise one fixed period for everything.

To delete your account, use Delete Account in the app’s settings, or email us from the address on your account if you cannot sign in. Deletion removes your account and its private records from our active backend, including your uploaded files and your community posts, answers and votes, and the app clears its local account data and local progress and ketone photos. We pass on deletion requests to processors such as PostHog and RevenueCat where the law requires it, and you can ask us to do so.

Limited records may remain where needed for accounting, fraud prevention, disputes, legal compliance or to document your request. Backups and provider security logs can hold copies until their cycle ends. Apple, Stripe and RevenueCat may keep transaction records for their own legal obligations. Content another user copied may remain with them. Deleting a diary entry does not necessarily delete the separate AI-analysis record; ask us if you want that removed too.

Deleting the app or your account does not cancel a subscription. Cancel an App Store subscription in iPhone Settings → your name → Subscriptions. Cancel a web subscription at ketobunny.app/account before you delete your account.

16. International processing and security

KetoBunny is run from the United States, and our providers may process information in the United States and other countries where they operate. Those countries may have different privacy laws. Where UK, EEA or other law requires a safeguard for an international transfer, we rely on an adequacy decision (including the UK Extension and the EU-US Data Privacy Framework where a provider is certified), standard contractual clauses, or another lawful mechanism. Contact us for details.

We use encrypted connections, sign-in through Apple or Google, row-level access controls in our database, and protected storage. Model and payment credentials stay on our servers and never ship in the app. No system is perfectly secure; if a breach affects your personal information, we will notify you and regulators as the law requires.

17. Your privacy rights

Email dan@dansugcmodels.com with “Privacy request” (or “Privacy appeal”) and the email on your account. We may ask for proportionate information to verify you or an authorized agent; please do not send identity documents or medical records unless we explain why they are needed. We respond within the time the law that applies to you allows, and we will not discriminate against you for using your rights.

United Kingdom and EEA

You may request access, correction, erasure, restriction or a portable copy, object to processing (including any processing based on legitimate interests), and withdraw consent at any time without affecting earlier lawful processing. You can complain to the UK Information Commissioner’s Office (ico.org.uk) or your local EEA supervisory authority. We would welcome the chance to fix it first.

United States, including California

Depending on your state, you may have rights to know and access, correct, delete, receive a portable copy, opt out of the sale or sharing of personal information and of targeted advertising, limit the use of sensitive personal information, and appeal a denial.

California (CCPA/CPRA). We do not sell personal information for money. However, sending identifiers, internet activity and purchase events to Meta for ad measurement and optimisation (section 10) may be “sharing” for cross-context behavioural advertising, and in some states a “sale” or “targeted advertising.” The categories involved are identifiers (hashed email, account and device or browser IDs, IP address), internet and app activity, and commercial information (subscription events). To opt out, email us with “Do not sell or share,” decline tracking in the app, and block Meta cookies in your browser. We do not use or disclose sensitive personal information, including health information, beyond what is needed to provide the service you request, and we do not sell or share it. We do not knowingly sell or share the personal information of anyone under 16. We do not make decisions with legal or similarly significant effects based only on KetoBunny’s wellness estimates.

Canada

You may request access to your information and how it has been used or disclosed, request correction, and withdraw consent subject to legal or contractual limits. You can complain to the Office of the Privacy Commissioner of Canada or your provincial authority.

Australia

You can request access and correction and complain about how we handled your information. Contact us first; you may also contact the Office of the Australian Information Commissioner.

18. Changes to this policy

We update this policy when our practices or the law change, and the date at the top shows the current version. For material changes, such as a new category of data, a new recipient or a new purpose, we will give additional notice in the app or by email and ask for new consent where the law requires it before the change applies.

19. Contact

Questions, requests, appeals or complaints:

KetoBunny (formerly KetoBuddy), operated by Daniel Hangan, an individual sole operator based in New York, United States
447 Broadway, 2nd Floor, #3326
New York, NY 10013, United States
Email: dan@dansugcmodels.com

See also our Terms of Use.