Covers the Bioma iOS application and the service behind it. Last updated 14 September 2026.
The short version. Bioma keeps what you log, which is your meals, your photos, your profile and your weight, so it can measure your day against your own targets. Meal photos and descriptions go to AI providers to be analysed. We do not sell your data, we run no advertising, and we never see the raw contents of your address book. You can delete everything from inside the app at any time.
The data controller is Humblebee Solutions Limited, registered in the Republic of Cyprus under number HE 449911, registered office Vasili Michailidi 9, 3026 Limassol, Cyprus. You can reach us at privacy at humblebee dot ltd.
| Data | Why we hold it |
|---|---|
| Email address | It is your account. Signing in is passwordless, so the address is how we know it is you. |
| Display name, avatar, short bio, handle | Your public card, shown to friends in the feed. All optional. |
| Profile: sex, age, height, weight, activity level, goal, dietary preferences, life stage | Daily energy and nutrient targets cannot be worked out without them. This is the difference between a calorie counter and a plan. |
| Body weight over time | Targets follow the trend we can actually see, instead of a formula’s guess about you. |
| Meal photographs, descriptions and voice input | The input to the analysis. A photo you attach to a meal can appear in the feed, visible to people you are connected with. |
| Diary entries, analyses, supplements, streaks, badges, quests | The record of your days and how you are getting on. |
| Friends, followers, likes, comments, shared meals | The social features do not work without a social graph. |
| A hashed contact identifier | See “Finding friends” below. |
| Technical logs | Keeping the service running and working out what went wrong when it does not. |
Your weight, sex, age and what you eat count as data concerning health, which European law treats more carefully than ordinary personal data. We process it only to provide the service you asked for, on the basis of your explicit consent, which you give when you fill in your profile. You can withdraw that consent whenever you like by deleting your account. The app cannot work without this information, so withdrawing consent and deleting the account come to the same thing.
You can sign in with a one-time code sent to your email, with Sign in with Apple, or with Google. We store only a hash of the emailed code and never the code itself. If you use Sign in with Apple with a private relay address, we hold the relay address and never learn your real one.
To match people you already know, the app works out a salted SHA-256 hash of an email address and compares hashes on our server. Raw addresses and phone numbers from your address book never reach us. We cannot turn those hashes back into contact details, and neither can anyone who somehow obtained them from us.
We use a small number of providers, each for one job. They act on our instructions and may not use your data for their own purposes.
| Provider | What it receives |
|---|---|
| AI model providers, for image and text analysis | The meal photograph or description being analysed, and the language to answer in. Not your name, email or account identifier. |
| Cloudinary | Meal photographs, for storage and delivery. |
| Resend | Your email address, to deliver sign-in codes and service messages. |
| Render | Hosting for the application server and the database, and therefore everything stored in it. |
| USDA FoodData Central | Food names only, to look up reference nutrition values in a public database. No personal data. |
We do not sell personal data, we do not share it with advertisers, and Bioma contains no advertising and no third-party analytics.
Your display name, avatar, bio and handle are visible to people who find you in the app. Meals appear in the feed only when a photo is attached, and only to people you are connected with. The leaderboard shows avatars and scores, and deliberately not names. A note you write on a meal becomes its first comment, visible to the same people.
You can delete your account from inside the app, and you do not have to ask us or wait for us. Open Settings from the You tab, scroll to Delete account, read what the screen tells you and confirm.
Deletion runs as a single operation, so it either completes or nothing is touched. You will not be left with half an account. Once it is done it is permanent, we cannot restore it, and we keep no copy for ourselves. Deleted data disappears from routine backups as those rotate.
Deleting your account does not cancel a subscription. Subscriptions are held by Apple, not by us, and only you can cancel one from your Apple account settings. If you delete the account and leave the subscription running, Apple will keep charging you.
Comments you left on other people’s meals go too. That is the correct outcome under data protection law, but it does mean a conversation someone else remembers may lose your side of it.
The in-app route is faster and entirely in your hands, but you are welcome to email privacy at humblebee dot ltd from the address you signed up with. We will do it and confirm when it is done.
Our servers and database are run by Render, and some of our providers process data outside the European Economic Area, including in the United States. Those transfers rely on the European Commission’s Standard Contractual Clauses or an equivalent lawful mechanism.
We keep your diary for as long as your account exists, because a food diary that forgets last month is not a diary. Sign-in codes expire within minutes. Technical logs are kept only as long as they help us diagnose problems.
You can ask us for access to your data, for it to be corrected, for it to be erased, for our processing to be restricted, or for a portable copy. You can also object to processing. You can complain to a supervisory authority, which in our case is the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus. We answer requests within one month.
Bioma is not intended for anyone under 16 and we do not knowingly collect data from children. If you think a child has created an account, write to us and we will remove it.
If this policy changes in a way that matters, we will say so in the app before the change takes effect. The date at the top always reflects the version you are reading.