Last updated: 12 October 2026 · Version 2026-10-12
Bayda is a training, running and nutrition tracker for iOS. This policy describes exactly what it stores, where, for how long, and on what legal basis. It is written against the app's actual database schema rather than from a template. Every category below corresponds to a real table.
How you may use Bayda is in the Terms of Use. Help with the app is on the support page.
Controller: David Bayard, trading as Baydalabs, a sole trader (enterprise number KBO/BCE 0744.778.668), Avenue Oscar Van Goidtsnoven 67, 1190 Forest, Belgium.
Contact for anything about your data: david@baydalabs.com
Bayda has no data protection officer, because the law does not require one at this size. Write to the address above for any question or request in this policy.
The GDPR asks for a legal basis for every use of personal data. These are Bayda's, purpose by purpose.
| What Bayda does | Legal basis |
|---|---|
| Runs your account: sign-in, your profile, logging your workouts, food and weight, the social features (follow, like, comment, tag, the feed, notifications in the app) | Contract, Article 6(1)(b): this is the service you asked for |
| Processes your health data: weight, body fat, food diary, training, height, date of birth, sex, and the heart rate and energy read from Apple Health | Your explicit consent, Article 6(1)(a) and Article 9(2)(a), given on the consent screen at setup (see Health data below) |
| Shows your heart rate, heart-rate zones, power and calories to other people | Your explicit consent, Article 6(1)(a) and Article 9(2)(a), given with a separate switch that is off unless you switch it on |
| Estimates a plate of food from a photo (the AI food scan) | Your consent, Article 6(1)(a) and Article 9(2)(a), asked before the first photo is sent |
| Sends push notifications | Your consent, Article 6(1)(a): the notification permission on your phone |
| Keeps the service secure and fair: rate limits, reports and moderation, refusing blocked words in comments and names, diagnostic logs and crash reports, the check for a newer build | Legitimate interests, Article 6(1)(f): keeping Bayda safe, working and free of abuse. You can object, see Your rights |
| Keeps a deletion receipt, and answers your requests | Legitimate interests, Article 6(1)(f), to prove an erasure was done, and legal obligation, Article 6(1)(c), to answer your rights requests |
You can take back a consent whenever you like, and doing so does not undo what was lawful before. How, for each one, is under Your rights.
Only your username is required, together with the Apple or Google sign-in itself. A username is how other people find you. Every other field in Bayda is optional: your display name, picture, height, date of birth, sex, goals, photos and the rest. Leaving a field out only means a feature that needs it, such as a calorie estimate, cannot work.
Your consent to process health data is required to use Bayda, because storing and working with that data is the service itself (Article 7(4)). If you do not agree on the consent screen, you cannot use the app. Showing your heart rate to others, the AI food scan and push notifications are not required.
Bayda stores weight, body fat percentage, food and drink you log, and your training: exercises, sets, weights, repetitions, durations and session times. It also stores what you tell it so that it can estimate and track your targets:
Under the GDPR this is special-category data concerning health (Article 9). The lawful basis is your explicit consent (Article 9(2)(a)), which Bayda asks for on a screen of its own before you enter any health information, at the start of setup. It says what is stored and why, and you agree by tapping I agree. Bayda records when you agreed and to which version of this policy, and that record is part of your data. Accounts created before 12 October 2026, during testing, were not shown this screen; your data export shows this as "pre_launch_tester", and you can withdraw by deleting your account. Bayda cannot work without this consent, so if you do not agree you cannot use the app. You can withdraw that consent at any time by deleting your account, which erases the data (see Deleting your account). In the app that is Profile ▸ Settings ▸ Data & account ▸ Withdraw health data consent, which asks the same two confirmations as Delete my account. A consent to process health data is needed for Bayda to work at all, so there is no way to keep the account and withdraw it.
Showing your heart rate to other people is off unless you switch it on. What your body measured during a session (heart rate, its readings, your heart-rate zones, power and calories) is shown with that session to whoever can see it only if you switch on sharing: the separate switch on the consent screen (Also share my heart rate), which starts off and is not needed to use Bayda, or Share heart rate and calories under Profile ▸ Settings ▸ Visibility. Turning it off removes these figures from every session already shared, and while it is off the database itself refuses to publish them. You can also hide them on any single session (Hidden details, below). From 6 to 12 October 2026 sharing was on by default; on 12 October 2026 it was switched off for every account that had not switched it on itself, and the figures shared under that default were taken down.
Your food diary, weight and body fat, height, date of birth, sex, calorie and macro targets, goals, the history of your targets and goals, the days you mark complete, and your choice of Home cards are never shared with anyone. There is no setting that shares them. They are readable only by your own account, enforced in the database itself and not merely in the app.
Your activities are different. Workouts, runs, walks, rides, swims and every other sport, including sessions you bring in from Apple Health and history you import from a file, are activity posts. Who can see them follows Profile ▸ Sharing, which is Anyone on Bayda unless you choose otherwise; see Training you choose to share. Someone you tag on a session can see that session even if it is set to Only me; see Tagging someone you trained with. GPS routes have their own, separate setting, which is public unless you change it, and a map is never shown more widely than the activity it belongs to.
Your account identifier, and the username, display name, profile picture and the short line about what you are working towards that you choose to show on your profile, plus what you use Bayda for and which summaries your Home screen shows. A username is required, because it is how other people find you. Your email address is never searchable and is never shown to another user.
Bayda has a social feed. You can search for other accounts, follow them, and see the workouts of the people you follow; they can see yours on the same terms.
Who can see your workouts is Profile ▸ Sharing ▸ Who can see my workouts, and it defaults to Anyone on Bayda. The three values are Only me (nobody but you), Followers (the accounts that follow you), and Anyone on Bayda (any signed-in Bayda account). The setting is read at the moment somebody tries to look, not stored onto each workout, so changing it applies to everything you have already logged as well as everything new, in both directions. Tightening it hides your existing workouts immediately.
You can also set a single workout to Followers or Only me. That setting can only make one workout more private than your account already is; it can never make it less. On an account set to Followers, a workout left on Default is not published to everyone.
Anyone on Bayda can follow you, and there is no approval step: following is a one-tap action on both sides, and unfollowing is the same tap again. Bayda has no private accounts and no follow requests. If you do not want your training seen, the visibility setting above is the control: Only me hides everything you have logged from everyone, followers included. Your followers and the accounts you follow are visible to you.
Follows, likes and comments are stored, because storing them is what makes them work. A like or a comment carries your account and is visible to everyone who can see the workout it is on. Deleting a comment removes it. You can block an account, which stops it following you, tagging you, finding you in search and seeing your workouts; the accounts you have blocked are stored, and only you can see them. You can also report a workout, a comment or an account; see Reports.
Your email address is never searchable and is never shown to another user. Search matches the beginning of a username or of any word in a display name, from two characters, and shows at most 20 accounts at a time. You appear in it only while you leave Findable by username switched on, and never to an account you have blocked or that has blocked you, or while an account is suspended. An account that does not exist, one that has switched discoverability off, and one that has blocked you all look the same, simply absent, so search cannot tell anyone why a particular account is missing. Searches are rate-limited, so the directory cannot be quickly walked through. We should be clear that a search of this kind can be used, slowly, to list many of the accounts that have left discoverability on; if you would rather not be listed, switch it off. Tagging a training partner still needs their exact username.
Suggested athletes. Bayda can suggest accounts that are followed by people you follow, ranked by how many of them do. The most a suggestion can reveal about that is a count, never which of the people you follow follow them, because who someone else follows is not yours to see. Accounts that have switched off Findable by username, and accounts on either side of a block, are never suggested. If you dismiss a suggestion that choice is stored, and it is visible only to you; the person you dismissed is never told.
You can tag another Bayda account on a session you recorded, the person you ran or lifted with. Two separate things happen, and the difference between them is deliberate.
On your own card, immediately. The tag is part of your post, so their name appears on it as soon as you add it, to everyone who can already see that workout under the rules above. This needs no permission from them, in the same way that writing a name in a caption does not.
On their profile, only if they accept. They are notified, and until they say yes the session does not appear on their profile and their name is not shown publicly on your card either; only you, in that workout's own screen, can see a tag nobody has answered yet. They can accept, decline, or withdraw an acceptance later. Declining is not announced to you; the tag simply stops appearing.
A tag lets the tagged person read that session, from the moment they are tagged, so they can see what they are being asked about, even if the workout would otherwise be outside what they are allowed to see, including a session set to Only me. Declining takes that access away again. The GPS route is never included: being tagged on a run does not give anyone the route it followed, because a route usually starts and ends at somebody's home.
Only the account owner can tag on their own session, and only the tagged person can answer. Nobody can add a name to a workout that is not theirs, and nobody can answer on someone else's behalf. Blocking an account, in either direction, prevents tags between you and ends any that already exist.
Bayda may suggest a tag, worked out on your phone. When you and someone you follow, or who follows you, recorded the same kind of session at the same time, and the routes you can already see stayed close together for a good part of it, the app may ask "Ran with Florence?" on your save page or under your own post, with a button that sends the ordinary tag request above. The comparison runs on your phone, only over sessions and routes your account is already allowed to see (anyone else's route arrives with its ends cut off, as described below); nothing is sent to Bayda's servers or to anyone else, and the only thing remembered is which suggestions you dismiss, kept on this phone. Indoor sessions, pool swims and strength workouts are never compared. You are never suggested to anyone outside that follow circle, nobody is told a suggestion was made, and dismissing one is remembered only on your phone (and forgotten when you sign out). It is on by default and you can turn it off in Settings › Privacy & social › Suggest me to people I train with: whoever turns it off is never suggested to anyone and is not shown suggestions either. Whether you allow suggestions can be seen by people who can view your profile. Bayda does not keep a location history to compare against, and runs no matching on its servers.
A session partner can add your photo to their own recording of a session you did together. When you and someone both recorded a session and one of you tagged the other (and the tag was accepted), either of you can add the other's session photo to your own recording. The photo is not copied: it stays yours, it is shown on their session credited to you ("Photo by …"), and it is shown there only to people who are already allowed to see your session and its photo, so it never reaches anyone you have not shared it with. When you add a photo to a session like this, your partner is notified and asked whether to add it. You can remove your photo from their session at any time: it stays off, and they cannot add that photo again (only a new photo you add later can be offered to them). It also disappears from their session on its own if you delete or replace the photo, delete the session, the tag between you is removed or declined, either session is edited so the two no longer match, or either of you blocks the other.
Bayda records your location only while a run or a walk is recording (a ride counts as a run here), and only if you allow it. It asks for "while using the app" permission, never "always", so it cannot locate you when you are not recording. The background permission it does use keeps a recording you started running with the screen off, and stops when you stop.
What is kept is the path itself: a list of the positions your phone reported, stored with the workout, plus the distance, pace and elevation worked out from it. Positions your phone reported inaccurately are discarded rather than stored, and when the signal drops out Bayda never invents a path across the gap. The route you and anyone else see is only the ground your phone actually reported.
A recording log, kept with each run, walk or ride you record. To find out why a recording missed part of a session, Bayda keeps a short log of how the recording went: how many positions your phone reported, how many were kept and, for the ones discarded, why (too inaccurate, too old, too close to the last one to be movement, or faster than a person moves); every stretch longer than ten seconds with no usable position; when the app went to the background or came back; when location permission changed; when you paused, resumed and stopped; the distance your phone measured, worked out two ways (the way Bayda counts it, and a second way being tested against it); the distance estimated from your steps; the time you spent moving; and how accurate your phone said its positions and speeds were. These figures stay in the log even when a watch's recording of the same session is the one kept. It contains no positions and no places, only times, counts, reasons and those figures. It is saved to your account with the activity, only you can read it, it cannot be changed afterwards, and it is deleted with the activity or your account. When you pause a recording, the times of those pauses are also kept on your phone for 30 days, so that the heart rate and energy read for the activity can leave the pauses out; they are removed when you sign out.
A background-import log, only while automatic import is on. When automatic import is switched on, Bayda keeps a short technical record of each time your phone woke it in the background to look for new workouts: when it happened, what woke it, whether your phone was locked, whether you were signed in, and how many workouts it found, uploaded or had to leave for later. It contains no health measurements, no routes and no workout details. It is saved to your account so that missed uploads can be found and fixed, only you can read it, it cannot be changed afterwards, and it is deleted with your account. If a workout your phone read from Apple Health cannot be uploaded straight away (no connection, for example), it is kept on your phone for up to 7 days, with its route and the heart rate and energy measured by the app or watch that recorded it, until it can be sent; it is removed when you sign out or switch automatic import off.
Bayda can read your step count from your phone's motion sensor, which is a separate permission from location and is optional. It asks the first time you record a walk, or the first time a run loses its GPS signal, not when you sign up.
It is used for two things. It shows how many steps a run or a walk took, and when GPS drops out it asks the step counter how far you went during exactly that stretch, so the distance is not missing the tunnel you ran through. Any distance worked out this way is labelled on the summary as an estimate, with its size in kilometres, and it never changes your route or your pace. Both of those stay measured from GPS alone. How much of the distance was estimated is saved with the run, so the label travels with it: the feed card and the run's own page say the same thing the summary did, rather than showing an estimate as though it had been measured. Steps are read on your phone; the step count itself is not uploaded.
If you refuse this permission, or your phone has no step counter, Bayda behaves exactly as it did before: a stretch with no GPS is reported as not counted, and the steps figure shows a dash rather than a zero.
GPS routes are governed by a separate setting, because a route usually begins and ends at your home. It is Anyone on Bayda unless you change it, so by default the map of a run is shown to whoever can see the run. A new route takes the more private of that setting and the run's own visibility, so if your routes are set to private a public run still posts without a map. The setting is stamped onto each route when it is saved, so loosening it later never retroactively publishes a route you already recorded. Tightening it works the other way, at once: setting your routes to private, or a run to Only me, hides maps you have already shared, including from anyone tagged on the run. One exception, made once: on 16 September 2026, while Bayda was a small invited test group, route maps recorded before that date were opened to match the visibility of the run they belong to, when routes stopped being private by default. A run or an account set to Only me kept its map private.
When someone else can see one of your routes, by default they do not see roughly the first and last 100 metres of it: every point within about 100 metres of where it started, or of where it finished, is removed on the server before anyone else can see the route, and the map is labelled to say its ends are hidden. On a short loop that never gets 100 metres from its start, such as a run around the block, the cut is closer, about 50 metres, so the loop still shows; only a route that never goes further than about 50 metres from its start shows them no map at all. You can show the full route of one run with its Show full route switch, on the save page or later in Edit; it is off unless you turn it on. You always see your own full route.
While a route's ends are hidden, other people do not see its elevation profile either, because it would show the climb of the parts that are cut. You always see your own, and others see it when you show the full route.
Hiding the ends is not a guarantee: because a route usually begins and ends at your home, several runs from the same door each stop their visible line about 100 metres from it (about 50 metres on a short loop), and someone comparing them could narrow down where you live. From 24 September 2026 until 11 October 2026, routes were shared in full, start and finish included. On 11 October 2026 every route already shared was cut back by about 200 metres at each end, and on 12 October 2026 the cut became the one described above: routes already shared were re-cut to it, so other people may now see up to about 100 metres more of them, and a short loop that showed no map may now show one. Routes from sessions before 1 September 2026 that were saved before 25 September 2026 keep their older, wider cut.
If you would rather not share your maps at all, set your route visibility to Only me (Profile ▸ Settings ▸ Visibility): your runs still post, with their distance and time, but without maps. You can also hide one run's map by setting that run to Only me. Tightening either takes effect at once, including for maps you have already shared.
Your recorded route is kept in a table no other account can read under any setting. The copy other people see is made from it on the server, only when your settings allow it, and it is removed as soon as they no longer do.
If you turn off Precise Location, Bayda will not record a run at all. The positions it would get are accurate to about a kilometre, which is not a route, and recording one anyway would mean storing a path you did not take.
Bayda asks for its Apple Health access all at once, in one Apple sheet, the first time you use anything that needs Health, or when Bayda notices it has never been given part of it. Asking for everything together is so that nothing ends up half connected: a walk from your watch arriving without its map, for example. Each item in Apple's sheet is still a separate permission you can switch off, there or later in your iPhone's Health settings, and Bayda works without any of them. Being allowed to read something is not the same as reading it: each item below is read only when you use what it is for.
Your Apple Health connection belongs to your Bayda account, on your iPhone. Apple gives Health access to the app on a phone, not to a person. So Bayda reads Apple Health only for a Bayda account that has connected Apple Health on that iPhone, by choosing Connect Apple Health there. Accounts created before 12 October 2026 that already used Apple Health on their iPhone stay connected, so they are not asked again. If somebody else signs in to Bayda on your iPhone, Bayda reads nothing from your Apple Health for them and writes nothing into it, unless they choose Connect Apple Health themselves. Your choice is kept on the phone for your account until you delete it.
What it reads.
There is one thing it reads without being asked. When it saves a run, walk or ride to Health, Bayda first looks at the workouts Health already holds around that same time, to see whether your watch recorded the same session, so that it does not add a second copy of it. That check reads only when those workouts started, how long they lasted, and what type they were. It is limited to the session you have just finished, it happens only when saving to Health is on, and nothing it finds is stored or uploaded.
What it writes, and only if you turn it on. Saving activities to Apple Health is a choice you make for your account. You choose it with the Save to Apple Health switch on the page where you save an activity, and you can change it at any time there or in Profile ▸ Preferences ▸ Save activities to Apple Health. Nothing is written to Health unless that switch is on and iOS allows it; either way, your activity is saved in Bayda. Turning it on never copies your earlier sessions across. It applies to activities you save from then on.
With it on, Bayda writes the workouts, runs, walks and rides you finish, with their distance, when you paused, and an estimate of the energy burned, so they count towards your Activity rings. The pauses are written so that the workout in Health is as long as the run rather than as long as the afternoon. For an outdoor activity it also writes the route it recorded, so the map appears in Health beside the workout. That copy is the complete route, on your own device, in your own Health store. If you later change a gym session's length or sets in Bayda, its copy in Health is replaced by the edited one; deleting a session in Bayda removes it from Health.
It does not write the same thing twice, and this is deliberate. If your watch already measured the energy for a session, Bayda writes no energy figure of its own. Your Activity rings are a total across every app, so a second figure for the same minutes would count that session twice. And if Health already holds an overlapping workout of the same type from another source (a Watch recording the run you also tracked in Bayda), Bayda writes nothing at all for it: no workout, no route, no energy. One session should be one entry in your day, and when there are two the one Bayda skips is its own.
When your watch and Bayda both recorded the same run, walk or ride, they become one activity. If Apple Health holds an outdoor workout recorded by Apple (your Apple Watch or the Fitness app) that covers most of the same minutes as a run, walk or ride you recorded in Bayda, of the same type, Bayda takes the watch's measurements for that activity: its start and end, time, distance, pace and splits, climb, the route your watch recorded and, only if you have switched on Share heart rate and calories, the average heart rate and energy it measured. The activity itself stays yours as it was (its name, notes, photo, tags, visibility, likes and comments), and its route keeps the privacy setting it was saved with. If Bayda had written its own copy of that session to Apple Health, it removes that copy, so the session is counted once in your Activity rings. This happens only for your own activities, only once per activity, and only when Health can give Bayda the watch's route; it happens when you open Bayda, or in the background if automatic import is on.
What leaves your device, and what does not. Your steps are read and used on your device only. They are never uploaded to Bayda's servers. Four things are different, and all four are things you ask for: height, date of birth and sex you fill from Health (or type) while setting up a calorie estimate are saved to your account, as described under Health data; a weight you choose to save becomes a weigh-in on your account; and a session brought in from Health is copied to your account as a workout of your own, with its date, duration, distance, which sport it was (and, for a triathlon, each leg's sport, times and distance) and, for a sport that has a map, the route recorded with it. If you have switched on heart-rate sharing and do not hide them on that session, the copy also carries the average heart rate and the energy measured for that session by the app or watch that recorded it, and the heart-rate readings, zone times and power readings described under Health data, which are then as visible as the session itself. That copy is then treated exactly like a session Bayda recorded itself, including the visibility rules above; the route is stored with its own separate privacy setting, which defaults to public, exactly as a route Bayda recorded does. Bayda also keeps which app recorded an imported session (its app identifier), so that the same session is not added to your account twice. Nothing is copied until you tap Add on that particular session, unless you have switched on automatic import, in which case sessions from Apple Health that end after you turned it on (or after you accepted the change described below) are copied as they happen: from any app, but walks only from Apple Watch or iPhone.
What a saved run, walk or ride keeps. Alongside its kilometre splits, each activity keeps a timeline of elapsed time, distance covered and moving time, so its pace chart and its splits can be drawn again later. It holds no locations, and anyone who can see the activity can read it, exactly as they can read its splits. Its altitude profile is kept separately and is shown to whoever can see its route, under the route's own privacy setting. It is the climb along the way, with no positions in it. When Bayda estimates the calories an activity used, that estimate is saved to your account together with the weight and the published method it was worked out from, and only you can read those. If you have switched on heart-rate sharing and not hidden calories on that session, the estimate's number alone is shown to whoever can see the activity, labelled as Bayda's estimate; the weight it was worked out from is never shown to anyone. Where the app or watch that recorded the activity measured its energy, that measurement is what a viewer sees instead. Bayda also keeps whether an activity was recorded indoors (on a treadmill, say) and whether its distance was estimated by the watch, and shows that to whoever can see the activity, so its page explains a missing map the same way for everyone.
Bringing sessions in automatically. There is a switch, off unless you turn it on, under Profile ▸ Settings ▸ Health ▸ Add Apple Health workouts automatically. With it on, iOS wakes Bayda in the background whenever a new workout is saved to Apple Health, and that session is added to your account, with its route, without you opening the app. Three things follow, and all three are worth saying plainly:
Turning the switch off stops the background wake-ups as well as the importing.
Where Apple Health data goes. Apple Health data is used only to run the features above. It is never used for advertising or marketing, never sold, and never given to a data broker, to Anthropic, to GIPHY or to any other company. Nothing from Health leaves your phone except what is described above as saved to your account, and that is shown to other people only as far as the visibility and sharing settings described above allow.
You can revoke any of it at any time in iOS Settings → Privacy & Security → Health.
Profile ▸ Settings ▸ Apple Health ▸ Import your history brings in training you recorded in another app. It only runs on a file you choose. The file is read on your phone and is not uploaded: Bayda keeps no copy of it, and nothing in it is stored except what is listed here.
What was read is stored in your account as workouts of your own, with the dates they happened, and is then treated exactly like a session Bayda recorded itself. An imported session takes your default visibility (Anyone on Bayda unless you have changed it), and an imported route takes your route setting, which is public unless you change it, under all the rules above. Imported sessions sit at their old dates in your history and in the feed, and your followers are not notified of them. If you would rather they were not shared, set Who can see my workouts to Only me before you import. An exercise from a Strong file that is not in Bayda's list is added to your own exercises. Importing a file writes nothing to Apple Health. You can delete an imported session like any other, and deleting your account removes them all.
If you add a photo to a workout or a run, it is uploaded to Bayda's storage and shown to whoever can see that workout, which is the same set of people its privacy setting already governs, and no one else. A session set to Only me keeps its photo to you (and to anyone you tagged on it); a Followers session's photo is visible to followers.
Before this, a photo you added was stored only on the phone that took it, so nobody else ever saw one. That has changed, and it is worth saying plainly: a photo on a workout is shared content, governed by that workout's visibility. Deleting the workout deletes the photo with it.
A custom exercise you create can carry a photo. It is uploaded to Bayda's storage and shown to whoever can see a workout that exercise is in, governed by that workout's visibility exactly like a workout photo (Only me, Followers or Anyone, plus anyone you tagged on it, and never anyone in a block with you). Nobody else can see it, and the rest of your exercise library (the exercises you have not used in a workout they can see) stays yours alone. Deleting the exercise deletes its photo.
A comment can carry a photo you take or pick from your library. It is stored like a workout photo: in Bayda's private storage, re-drawn and downscaled on your phone before it is sent, so the location, camera and time it was taken are removed and never leave your phone. It is shown to exactly the people who can see the comment: whoever can see the workout, minus anyone in a block with you, and it is deleted with the comment, with the workout it is on, and with your account, and removed from storage shortly after.
A comment can also carry a GIF from GIPHY. Your GIF searches go to GIPHY through Bayda's server: GIPHY receives the words you search for, but not your IP address, your device or your account. Bayda keeps no record of what you searched, only when, for a day, to cap how many searches one account can make. The GIFs you see load from GIPHY's servers, like any picture on the web, so GIPHY's content delivery network does see your phone's IP address when a GIF is shown. A GIF comment stores GIPHY's identifier for the GIF, its size and its address.
Fuel's Scan can estimate what is on a plate or in a glass from a photo. This is the only part of Bayda that uses AI, and it only runs when you choose Food in the scan camera and take or pick a photo.
The Label mode reads a nutrition table with text recognition on your phone itself. The photo never leaves the phone. The Barcode mode works as described under Open Food Facts below.
If you enable them, Bayda sends you reminders you set yourself: to weigh in, to log a meal, to train. These are scheduled on your device and their content never leaves it.
Bayda also stores your device's push token so that the server can notify you when somebody follows you, likes or comments on one of your workouts, tags you on a session, or accepts a tag you added. Those notifications are also kept in your account's notification list. The notification's content is generated on the server at the moment it is sent; the request that triggers the send carries only an identifier and a timestamp, never your name and never the text of a comment.
When Bayda crashes, hangs or is stopped for using too much memory, Apple's diagnostics service (MetricKit) hands the app a report on the next launch, and the app sends it to Bayda's own database in the EU. A report holds technical data about the fault: which part of the program was running, the app and iOS versions, the kind of device and when it happened. It holds no workouts, food, health values, routes or names. Bayda uses it to find and fix faults, which is its legitimate interest. No third-party crash service is used, and nothing is sent to one. Reports are deleted after 90 days.
You can report a workout, a comment or an account, choosing a reason and, if you like, adding a note. Bayda stores the report, what it referred to, the reason, your note and who sent it, so it can be reviewed by a person. The account reported is not told who reported it. You can block the account in the same step; see Training you choose to share.
Comments, display names and usernames that contain a word on a blocklist are refused automatically when you try to save them, and you are told so. The check runs in Bayda's database, on the text you write and nowhere else; a refused text is not stored. It is a floor and not a moderator: it will not catch everything, which is why reports and blocking stay. A person reviews reports.
Bayda uses Supabase (database, sign-in, file storage and server functions) hosted in the European Union (AWS eu-west-1, Ireland). Bayda's server functions (the account deletion, the food scan, the GIF search and the push dispatch) are pinned to the same region, so they run in the EU too. Supabase acts as a processor.
Bayda is run by one person and uses a small number of outside services. Some are processors: they handle data only on Bayda's instructions, under a written data processing agreement. The others are independent companies whose service your phone or Bayda's server talks to; for those, their own privacy policy applies.
| Service | What it does for Bayda | Data it handles | Where | Safeguard |
|---|---|---|---|---|
| Supabase, Inc. (on Amazon Web Services) | Database, sign-in sessions, file storage, server functions | Everything stored in your account: profile, training, routes, food diary, weigh-ins, targets, photos, notifications, push tokens | Stored in the EU (Ireland). Some Supabase support and security staff and subprocessors are in the United States | Supabase's Data Processing Addendum, which includes the EU Standard Contractual Clauses (supabase.com/legal/dpa) |
| Anthropic (makes the Claude AI models) | Recognises foods and estimates amounts when you use the AI food scan | The one photo you scan, made smaller and stripped of location, camera and time, and your phone's language. No name, account or identifier | United States | Anthropic's Data Processing Addendum with the Standard Contractual Clauses, Modules 2 and 3 (anthropic.com/legal/data-processing-addendum). Anthropic does not train on it and deletes it within 30 days. A photo flagged for misuse may be kept up to 2 years, and trust and safety scores up to 7 years |
| Service | When | What it receives | Where | Its policy |
|---|---|---|---|---|
| Apple | Sign in with Apple, push notifications, Apple Health (on your phone only), map tiles | Sign-in: your Apple identifier, and your name and email if you share them. Push: your device's push token and the notification text (a name and "liked your run", never comment text). Maps: the area being drawn | United States and worldwide | apple.com/legal/privacy |
| Only if you sign in with Google | Your Google account identifier and email | United States and worldwide | policies.google.com/privacy | |
| GIPHY (Shutterstock) | When you search for or see a GIF in a comment | Searches: only the words, sent by Bayda's server with no IP address or identifier of yours. Showing a GIF: your phone's IP address, when it loads the GIF from GIPHY | United States | GIPHY's privacy policy |
| Open Food Facts (non-profit association) | When you search for a food or scan a barcode | The search words or barcode, your IP address, and the app's name, version and a contact address (as the User-Agent). Never what you logged. Open Food Facts keeps logs for up to 3 years | EU (France) | world.openfoodfacts.org/privacy |
| GitHub (Microsoft) | Checking for a newer build; hosting this policy and the support page; storing Bayda's nightly backups | The update check and these pages: your IP address, nothing about your account. The backups: a file encrypted with a key only the controller holds, which GitHub cannot read | United States | GitHub's privacy statement |
GIPHY. When you search for a GIF in a comment, Bayda's server sends that search to GIPHY (rated PG-13) and returns the results; GIPHY does not receive your IP address or any identifier of yours with it. The GIFs themselves load from GIPHY's servers.
Push notifications are delivered through the Apple Push Notification service. Sign-in is handled by Apple and, if you choose it, Google; Bayda receives only the identifier and, on first sign-in with Apple, the name you allow it to share.
Anthropic. When you scan food with the AI estimate, the photo goes from Bayda's server to Anthropic's API to be analysed, with no account, name or identifier of yours. Anthropic does not train on it and deletes it within 30 days, unless it is flagged for misuse (then it may be kept for up to 2 years); Bayda's server never stores it. See Food photos you scan above.
Open Food Facts. When you search for a food or scan a barcode, that search term or barcode is sent to Open Food Facts, a public food database, so it can be looked up. Bayda sends no account, no name, no device identifier, and no record of what you actually logged. Open Food Facts never learns whether you ate the thing you searched for. As with any request to any website, they do receive your IP address, and Bayda names itself to them (the app name and version, and the contact address david@baydalabs.com) as they ask every app to do. They may log these.
Apple Maps. Drawing a route on a map means your device asks Apple for the map tiles that cover it. Apple therefore sees the area a map is being drawn for, whether the route is yours or somebody else's. That is Apple's own service under their privacy policy, and it is how any map on iOS works.
GitHub, for the update check. To tell you when a newer build is available, the app downloads a small public file from GitHub that holds the latest build number. The request carries nothing about you or your account, but as with any website GitHub receives your IP address and may log it.
Your account data is stored in the EU. Data reaches the United States in these cases:
For the processors (Supabase and Anthropic) the transfer is covered by the European Commission's Standard Contractual Clauses, which are part of their data processing agreements. Apple, Google, GIPHY and GitHub are responsible for their own transfers; where a US company is certified under the EU-US Data Privacy Framework, that adequacy decision applies as well. You can ask for a copy of the safeguards at david@baydalabs.com.
Your data is kept for as long as your account exists, and erased when you delete the account (see Deleting your account). These things are kept for a set time, or outlast the account, and this is how long:
| What | How long |
|---|---|
| Your account data: profile, training, routes, food diary, weight, targets, photos, follows, comments, likes | While the account exists |
| Recording logs and background-import logs (diagnostic logs) | 90 days, or until you delete the activity or the account if that is sooner |
| Crash and hang reports | 90 days |
| Notifications you have read | 12 months. Unread ones are kept until you read them |
| Reports about a post, comment or account, once closed | 12 months after closing. A report about an account that is later deleted keeps that account's identifier and the reporter's note until then |
| Deletion receipts | 3 years (see Deleting your account) |
| Search records, username look-ups | 2 hours |
| GIF search rate-limit records | 1 day |
| Food scan counts | 40 days |
| Nightly encrypted backups of the database | 30 days. They are encrypted with a key only the controller holds and stored on GitHub, and are used only to recover from a disaster |
| Supabase's own platform logs, which include IP addresses | As long as Supabase keeps them under its own policy. Bayda cannot shorten that |
| Messages to david@baydalabs.com about your rights | 3 years, to show the request was answered |
Two more things can outlast a deleted account on other people's side: an @mention of your old username inside another person's comment, and the copy of your profile that another person's phone may keep until its next refresh. Both are explained under Deleting your account.
Under the GDPR you may access, correct, export, restrict, object to, or erase your data, and take back a consent. Several of these are built into the app and need no request:
For anything else, write to david@baydalabs.com.
Deletion removes your profile, workouts, sets, routes (and the copies other people could see), routines, custom exercises, food log, weight history, recipes, targets and settings (including height, date of birth, sex and goals), the history of your targets and goals, the days you marked complete, notifications and push tokens, tags you added or were asked about, comments, likes, follows, blocks, dismissed suggestions, recording logs and background-import logs, history you imported from a file, your food-scan counts and consent record, your health-data consent record, and the reports you sent. The server function that does this runs in the EU (Ireland).
Stored files are deleted too, not just the records pointing at them. Your profile picture and any workout, exercise and comment photos are removed from storage before any row is deleted, and the deletion is refused if any file survives. Photos other people attached to comments on your workouts go with those comments and are removed from storage straight afterwards. Food-scan photos are kept only on your phone, so they are not in Bayda's storage to delete; deleting the account on that phone clears them there, along with the other files the app keeps for your account.
If you signed in with Apple, Bayda also asks Apple to revoke its access when you delete the account, so Bayda no longer stays in the list of apps that use your Apple ID.
What stays after deletion, and why.
Bayda does not sell anything today and handles no payment details. If purchases or subscriptions are added later, what they mean for your data will be shown to you at the moment of purchase, before you pay, and this policy will be updated before they take effect.
Bayda is not intended for anyone under 16 and should not be used by them.
Material changes will be announced in the app before they take effect. The date and the version at the top of this page show the current version.