Privacy policy
How Gutful handles your information – in the app and on gutful.no.
In short
- Everything you log is stored encrypted on your phone – not with us. We never sell data.
- Health information and AI are only used when you have said yes, and you can change your mind at any time.
- No ads, and we don’t track you across apps and websites.
- You can see, download and delete everything – right in the app.
1Who is responsible
Klogt AS (org. no. 935 950 945), Bentsebrugata 23B, 0469 Oslo, is the controller for the personal data processed in Gutful and on gutful.no.
If you have questions about privacy, write to markus.remmen@klogt.no. We reply within 30 days, usually much sooner.
2What we collect
Most of what you give Gutful stays on your phone. It is not synced to any server.
| Information | Examples | Where |
|---|---|---|
| Account | Email and name (optional) | Only on your phone |
| Health information | Gut and symptoms, allergies, goals, body and cycle – only with consent | Only on your phone |
| Food log and check-ins | Meals, times, amounts, notes, how your gut feels after a meal | Only on your phone |
| Consents and the gut garden | What you have said yes to, the microbes you have collected | Only on your phone |
| Photos and voice | Photo of your food (deleted when you finish logging), what you say – as text, never audio | Only on your phone |
| Anonymous ID | A random ID per installation, without email or name | Server in the EU |
| AI usage | How many AI calls the anonymous ID has made per day | Server in the EU |
| AI calls | When a call was made and how long it took – without content and without a link to you | Server in the EU |
| Feedback on answers | Whether you tapped “Helpful” or “Not right” under “Right or wrong?” – without a link to you and without the question | Server in the EU |
| Waitlist | Email address and language | Server in the EU |
3Why – purposes and legal basis
Each consent is separate, and you can change them at any time under Profile → Privacy and consent.
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the app and your account | Contract – Art. 6(1)(b) |
| Personal advice based on health information (“Health information for the advice”) | Explicit consent – Art. 9(2)(a) |
| Advice on cycle and hormones (“Cycle data”) | Separate explicit consent – Art. 9(2)(a) |
| Recognising food in photos and in what you say (“Recognition with AI”) | Explicit consent – Art. 9(2)(a). We ask the first time you take a photo or speak |
| Answers from the Coach and “Your week” with AI (“Coach with AI”) | Explicit consent – Art. 9(2)(a). We ask in the Coach |
| Counting AI usage against daily limits and preventing misuse | Legitimate interest – Art. 6(1)(f) |
| Waitlist and launch notice | Consent – Art. 6(1)(a) |
If you say no to health information, you can still log food and get general dietary advice. If you say no to AI, you write what you ate yourself, and the Coach answers with fixed advice from our knowledge base. If you turn off “Coach with AI”, “Your week” is deleted too.
“Help us improve Gutful” is off by default. For now we collect nothing with it, even if you turn it on. If we start using it, we will say so here first.
4AI in Gutful
We only use artificial intelligence when you have said yes. The AI runs at Amazon Web Services (Amazon Bedrock) in the EU, in Stockholm, with Anthropic’s Claude language models.
What is sent:
- Photo: the photo of your food (made smaller), the language, which meal it is, and the names of up to 8 foods you have logged before. The names come from the Norwegian Food Composition Table (Matvaretabellen) – never text you have typed yourself.
- Voice: your phone’s own speech recognition turns what you say into text. Gutful never records or stores audio. The text (at most 600 characters) is sent to the AI.
- The Coach: your question (at most 500 characters), your goals, what you can’t tolerate and how your gut is, and a summary of your patterns – numbers, not your diary. Email addresses, phone numbers and national ID numbers are removed on your phone before the question is sent, and you are told. Names are not removed, so we ask you not to write them.
- “Your week”: a short summary of your week, made from your numbers when you ask for it.
Never sent: your email, your account ID, your diary, cycle data, and what you have typed yourself about what you can’t tolerate.
- The provider does not store questions or answers and does not use them to train models. We don’t log any of the content.
- Questions about warning signs, eating disorders, pregnancy, medicines and diagnoses get a fixed answer and are never sent to the AI.
- Answers from the AI are marked “AI”, and it says that AI can be wrong.
- Every piece of advice shows its sources and how certain the knowledge is. Until a clinician has reviewed the advice, it is marked “Not yet reviewed by a clinician”.
- The advice is a suggestion. Gutful is not a medical device and does not diagnose, and no decisions with legal or similarly significant effects for you are made automatically.
- Each user can make at most 60 AI calls a day.
5Who we share with
We use a few providers (processors) who may only process the information on our instructions. We enter into a data processing agreement with each of them [to be confirmed]:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Server for the anonymous ID, AI usage and the waitlist | EU (Stockholm) |
| Amazon Web Services (Amazon Bedrock) | AI: recognising food and answers from the Coach | EU (Stockholm) |
| Cloudflare | Running the gutful.no website | Global network, US company |
Some services only get information when you use them:
- Open Food Facts gets the barcode – and with it your IP address – when you scan a barcode.
- Apple or Google turn speech into text if the language is not downloaded on your phone for offline use. Their speech recognition then processes the audio under their own terms.
We never sell information, and we never share it with advertisers. We only hand over information to authorities when the law requires it.
6Where the data is stored
- What you log, and your account, are only on your phone, encrypted.
- The AI and our server run in the EU, in Stockholm.
- The website is run by Cloudflare, a US company with a global network.
- Open Food Facts and Apple’s or Google’s speech recognition may process information outside the EEA.
When information is transferred outside the EEA, we protect it with the EU’s standard contractual clauses [to be confirmed].
7How long we keep it
- What you log, and your account: on your phone until you delete your account or the app.
- Photos of food: a temporary file that is deleted when you finish logging. You cannot choose to keep photos.
- Voice: never stored – only the text, together with the meal.
- AI usage per anonymous ID: 30 days.
- AI calls without content and without a link to you: 90 days.
- Feedback on answers (“Right or wrong?”): 365 days.
- Waitlist: until three months after launch, or until you unsubscribe.
Deletion on the server runs automatically every night.
8How we protect the data
- The database on your phone is encrypted. The key is kept in the phone’s keychain, can only be read while the phone is unlocked, and is never moved to another device. On Android, backup is turned off.
- The server holds no information about you – only an anonymous ID and counts.
- Everything sent across the internet is encrypted, and every table on the server has strict access rules.
- Optional lock with Face ID or a passcode (off by default), and hidden content in the app switcher (on by default).
- Notifications never mention food, symptoms or health on the lock screen.
- If there is a breach, we notify the Norwegian Data Protection Authority within 72 hours – and you, if the risk is high.
9Your rights
You have the right to access, correct, delete, move and restrict your data, and to object to processing. You can withdraw a consent at any time, without affecting the processing before you withdrew it.
You can do most of this yourself under Profile → Privacy and consent: there you can download your data as a file, and delete your account and all data. Because everything is on your phone, we cannot see or delete it for you. For the rest, write to markus.remmen@klogt.no.
If you think we are handling your information wrongly, you can complain to the Norwegian Data Protection Authority (Datatilsynet). We appreciate it if you get in touch with us first.
10Age
Gutful is for people aged 16 or older. We do not knowingly ask younger children for information.
11The gutful.no website
The website does not use cookies, analytics or tracking. Read more under Cookies. To stop attacks, we count requests per IP address for a short while, without storing the address.
12Changes
If we change anything important, we tell you in the app at least 30 days in advance. You can get earlier versions by asking us.
Something unclear?
Write to us and we’ll explain in plain language.