Gutsy — Privacy Policy

Last updated: July 29, 2026

Gutsy ("Gutsy", "we", "us") is a general wellness and educational app for people managing Crohn's disease, type 2 diabetes or prediabetes, and related conditions. This policy explains what we collect, why, and your choices. Gutsy is not a medical device and does not provide medical advice, diagnosis, or treatment.

Information we collect

• Account info: your email address (via Apple or Google sign-in).
• Health-related info you enter: the condition you choose to tailor scores to (such as Crohn's disease or type 2 diabetes / prediabetes), Crohn's severity and disease phase, diabetes type, allergies, food sensitivities, and your onboarding answers. This is sensitive / consumer health data.
• Scan activity: products you scan and the resulting scores/history.
• Monthly Report: when you open it, we save the written summary generated for that month, together with the scan counts it was based on, so it does not have to be rewritten each time you look at it.
• Photos: when you photograph a label, the image is sent for one-time automated reading (OCR), and is then kept privately so we can verify user-submitted corrections against the actual label. These label photos are stored under the product's barcode with no link to your account, are visible only to us — never to other users — and, because nothing ties them to you, they remain part of the catalog's verification records even if you delete your account. If you photograph the front of a package while adding a missing product, that image is shown as the product's picture to all users — please keep anything personal out of the frame.
• Approximate area (optional): if you allow location access, we derive coarse values — your state and city (like "California" / "Irvine"), plus the approximate 2 km grid square a scan happened in — to show scan activity in your area on an in-app map. Only those coarse values are stored — never your coordinates or precise location. Deny or revoke access anytime; the feature simply stays off.
• Leaderboard and territory map: other users can see a shortened form of your display name (first name plus last initial), your profile photo, your total scan count, and — if you allow location access — the approximate 2 km areas you have scanned in, how many scans you made in each, and the total area you hold. These appear on the in-app leaderboard and on a shared map. Your full name, email, exact location, and health data never appear there. Turning location off keeps you off the map entirely; you stay on the leaderboard with no areas.
• Subscription status: whether your optional subscription is active, so we can unlock the features you paid for. Payment itself is handled by Apple; we never see your card details.
• Basic technical/diagnostic data needed to run the app.

We do not collect precise location, and we do not use Apple HealthKit.

How we use it

• To provide the core feature: scoring foods against the settings you entered.
• To save your scan history and preferences.
• To operate, secure, and improve the app.

We do not sell your personal or health data, and we do not use your health data for advertising.

Service providers we share with (only to run the app)

• Supabase — secure database & authentication (stores your account and entries).
• OpenAI — one-time label image OCR (text extraction; images are not retained by us); a one-time plausibility check on a newly-scanned product's text details (name, brand, ingredients, and nutrition numbers) before we score it; and the written commentary in your Monthly Report (for which it receives the condition your scores are tailored to plus the month's scan count, average score, and score breakdown — never your identity).
• Google / Apple — sign-in.
• RevenueCat + Apple App Store — subscription status and receipts for the optional paid features; we never see your payment details.

These providers process data only to provide their service to us, under their own terms.

Data retention

We keep your data while your account is active. Label photos you submit are kept privately, with no link to your account, as verification records for the shared catalog — account deletion does not remove them (product front photos added to the shared catalog are kept as the product's picture). Subscription and payment event records — kept to prevent duplicate charges and for accounting — are retained in de-identified form, with no link to your account, after deletion. You can delete everything else at any time (see your rights below).

Your choices and rights

• Access / delete: to delete your data, use "Delete account" in the app — it removes your account, profile, settings, and scan history. Catalog verification photos and de-identified subscription records, which carry no link to you, are retained as described under Data retention. To request a copy of your data, or to request deletion by email, contact rdh2993@gmail.com.
• Withdraw consent: the optional "share data to improve Gutsy" consent can be turned off anytime in Settings → Consent & data sharing.
• Depending on where you live (e.g., California, Washington, EU), you may have additional rights to access, correct, delete, or restrict use of your data. Email us to exercise them.

Consumer health data (Washington "My Health My Data" Act and similar laws)

The health information you enter is treated as protected consumer health data. We collect it only to provide the service, with your consent; we do not sell it, and we share it only with the service providers above to operate the app. See our separate Consumer Health Data Privacy Policy for the additional details that law requires.

California privacy rights

If you are a California resident, you have the right to know the categories of personal information we collect (identifiers such as your email, and sensitive information such as the health data you enter), to access, delete, and correct it, and to opt out of any "sale" or "sharing" of personal information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Because we use the sensitive information you enter only to provide the app you requested, we do not use it in ways that would require a "Limit the Use of My Sensitive Personal Information" option. We will not discriminate against you for exercising these rights. To make a request, email rdh2993@gmail.com.

International users

We operate the app from, and store data on servers located in, the United States. If you use Gutsy from outside the United States, you understand that your information will be transferred to and processed in the United States, which may have data-protection laws different from those in your country.

Security

Data is encrypted in transit and at rest. No method is 100% secure, but we use industry-standard safeguards and minimize what we collect.

Children

Gutsy is not directed to children under 13 (or the minimum age in your region) and we do not knowingly collect their data.

Changes

We may update this policy; we'll revise the "Last updated" date and, for material changes, notify you in the app.

Contact

Questions or requests: rdh2993@gmail.com — Gutsy.