1Who runs Biscuit
Biscuit is an independent app built and operated by Raana Golzar, an individual developer based in British Columbia, Canada. There is no company behind it. When this policy says "we", it means one person.
For the purposes of the General Data Protection Regulation (GDPR) and UK GDPR, Raana Golzar is the data controller for personal data collected through the Biscuit app.
All privacy, data and legal requests are handled by email at biscuitbearapp@gmail.com.
2What Biscuit collects
2.1 Information you enter
- Profile: name, email address, age, gender, height, weight, and your weight goal.
- Health numbers: fasting insulin, fasting glucose, A1C, and the HOMA-IR values calculated from them, when you choose to enter them.
- Lifestyle: dietary restrictions, eating pattern, and your main goal.
- Daily habits: which of the five habits you mark complete each day, plus water, fasting windows, and the weekly challenge.
- Meals: the photo or description you submit for a scan, and the resulting analysis. Photos are sent for analysis and discarded immediately. They are never written to storage.
- Check-ins: your daily mood selection and your weekly symptom check-in answers.
2.2 Information collected automatically
- Device and app: device type, operating system version, app version.
- Usage counts: how many meal scans and meal plans you have used, so daily limits can be enforced.
- Crash reports: technical error data, containing no health information.
- Account identifier: a random ID that links your data across sessions on your device.
2.3 What Biscuit never collects
No GPS or precise location, no contacts, no microphone access, no camera access beyond the meal photos you deliberately take, no payment card details, and no data from other apps on your phone.
Please read: how your account works
Biscuit creates an account on your device the first time you open it. If you have not added an email address, that account exists only on that device. Deleting the app, or resetting the device, permanently loses your history, streak and saved numbers, and there is no way to recover them. Adding your email address is what makes your data recoverable.
3Why Biscuit uses your data
- To provide the features you use: meal analysis, meal plans, HOMA-IR, scores, streaks and weekly reviews.
- To enforce daily usage limits fairly and control running costs.
- To fix bugs and improve the app.
- To send notifications you have turned on.
- To meet legal obligations.
4Legal basis (GDPR)
If you are in the European Economic Area, the United Kingdom, or a country with equivalent law, processing relies on: contract performance for the features you signed up for, legitimate interests for security, abuse prevention and improving the app, consent for anything optional, and legal obligation where required.
Your health data is special category data. It is processed on the basis of your explicit consent, given when you choose to enter it. You can withdraw that consent and delete the data at any time from Settings, then Delete my account and data.
5Services Biscuit relies on
| Service | What it does | What it receives |
|---|---|---|
| Supabase | Database and accounts. Servers in Canada. | Your profile, health logs, habits and usage counts. |
| Anthropic | The AI behind meal scans, meal plans and weekly reports. | Your meal photo or description and relevant profile context. Anthropic does not train its models on this data. |
| Apple | App distribution and all subscription payments. | Payment details, which Biscuit never sees or stores. |
| RevenueCat | Manages subscription status. | Your account identifier and whether your subscription is active. |
Not used: Google Analytics, Meta or TikTok pixels, advertising networks, data brokers, or any third-party tracking that profiles you for advertising.
6Data leaving your country
Your data is stored in Canada. Some processing happens in other countries, including the United States, where Anthropic operates. For users in the EEA and UK, those transfers are covered by Standard Contractual Clauses approved by the European Commission.
7Your rights
These rights are honoured for everyone, everywhere, regardless of which law applies where you live:
- Know what is held about you, and get a copy.
- Correct anything inaccurate.
- Delete everything.
- Withdraw consent for health data processing.
- Object to or restrict processing.
Region-specific routes also apply: GDPR and UK GDPR including complaints to your national Data Protection Authority, CCPA and CPRA in California including the right to opt out of sale, though no data is ever sold, PIPEDA in Canada including complaints to the Privacy Commissioner of Canada, APPI in Japan, PIPA in Korea, and the Privacy Act in Australia.
The fastest route is Settings, then Delete my account and data. For anything else, email biscuitbearapp@gmail.com. Requests are answered within 30 days, and identity verification may be needed.
8How long data is kept
| Data | Kept for |
|---|---|
| Profile, health logs, habits | As long as your account exists |
| Meal photos | Not kept. Discarded straight after analysis |
| Deleted accounts | Erased within 30 days of the request |
| Anonymised crash and usage data | Up to 24 months |
9Security
- Everything between your phone and the servers is encrypted using TLS 1.2 or higher.
- Data at rest is encrypted with AES-256.
- Row-level security means your account can only ever read its own rows.
- AI keys are held server-side and never shipped inside the app.
No system is completely secure. Reasonable measures are in place, but no server or internet transmission can be guaranteed. You provide your information at your own risk.
To the fullest extent the law allows, Raana Golzar is not liable for unauthorised access, alteration, theft or destruction of data caused by events outside reasonable control. That includes criminal hacking, malware, phishing, denial of service attacks, security failures at Supabase, Anthropic, Apple or RevenueCat, failures of the public internet, or acts of government.
If a breach affects your rights, you and the relevant authorities will be notified within 72 hours where GDPR or PIPEDA requires it.
Keeping your own device secure is your responsibility, as is any activity through your access to the app.
10Children
Biscuit is not intended for children under 13, and data is not knowingly collected from them. Where the local age of digital consent is higher, such as 16 in some EU member states, that higher age applies. If you believe a child has provided personal data, email biscuitbearapp@gmail.com and it will be deleted promptly.
11Changes to this policy
This policy may be updated. Material changes will be announced in the app and the date at the top will change. Continuing to use Biscuit after a change means accepting the updated policy.
Terms of Service
1Agreeing to these terms
Downloading, installing or using Biscuit means agreeing to these terms. If you do not agree, do not use the app. They apply to free users and paying subscribers alike, and are governed by the laws of British Columbia, Canada.
2Who can use Biscuit
- You must be at least 13 years old.
- Where the local age of digital consent is higher, you must meet it.
- If you are between 13 and 18, you need permission from a parent or guardian.
Biscuit is not a medical device
Biscuit is a wellness and education app. It does not diagnose, treat, cure or prevent any disease, and nothing in it is medical advice. That includes the HOMA-IR calculator, meal spike scores, metabolic age, the symptom check, meal plans and every AI response. Always consult a qualified healthcare professional before changing your diet, exercise, fasting or medication. In an emergency, call your local emergency number.
3Your account
- Keep your account details secure. You are responsible for activity under your account.
- Enter accurate information. Inaccurate health data produces inaccurate results.
- Do not share your account, and do not create multiple accounts to get around usage limits.
4Free and paid features
4.1 Free
Daily habit tracking, streaks and milestones, the HOMA-IR calculator, logging your lab numbers, the metabolic symptom check, the Learn section, the water tracker, the fasting timer, the daily quiz, mood check-ins, the weekly metabolic score, the weekly challenge and smart swaps. These are free, and may be changed or discontinued with reasonable notice.
4.2 Premium
Premium covers the features that run on AI or on your accumulated history: the meal scanner, weekly meal plans, the weekly habit report, lab result trends, the Sunday check-in and the symptom timeline.
Premium is an auto-renewing subscription, available monthly or annually. Prices vary by country and the exact price in your local currency is always shown on the subscription screen before you buy.
4.3 Usage limits
Because every AI feature costs real money to run, fair-use limits apply to Premium:
- Meal scans: up to 18 per day, counted in your own local day and reset at your midnight.
- Weekly meal plan: one per rolling six-day period.
- Weekly report: up to two per day.
These limits are enforced on the server. They may be adjusted with reasonable notice if costs or abuse patterns change. Deliberately working around them is a breach of these terms.
4.4 Cancelling and refunds
Cancel any time through your Apple ID subscription settings. Cancellation takes effect at the end of the current billing period and you keep access until then. Refunds are handled entirely by Apple under their policies. Refunds are not issued directly.
5Acceptable use
Do not use Biscuit to break the law, submit deliberately false health information, try to reach anyone else's data, reverse engineer or decompile the app, use bots or scripts against it, get around usage limits or paywalls, harm other users or the infrastructure, or resell access to Premium.
6AI-generated content
Meal analyses, meal plans and weekly reports are generated by Anthropic's Claude. By using them you accept that:
- AI output can be wrong, incomplete or misleading.
- It is not a substitute for a qualified healthcare professional.
- Output quality depends on what you provide. A blurry photo produces a worse estimate.
- The same input can produce different output at different times.
- Decisions you make based on AI output are your own responsibility.
7Intellectual property
The Biscuit name, the bear, the design, the written content and the code belong to Raana Golzar and are protected by copyright and trademark law. You may not use the name, bear or branding without written permission.
The health data you enter stays yours. Using the app grants a limited, non-exclusive licence to process it solely to provide the app's features to you.
8Privacy
The Privacy Policy above forms part of these terms. Using Biscuit means accepting it.
9Disclaimers and limits on liability
Please read this section carefully
Biscuit is provided "as is" and "as available", with no warranties of any kind. There is no guarantee that it will be error-free or uninterrupted, or that any health information in it is accurate, complete or right for your circumstances.
To the fullest extent the law allows, Raana Golzar is not liable for indirect, incidental, special, consequential or punitive damages arising from your use of or inability to use Biscuit. That includes health outcomes, data loss, lost revenue and lost goodwill.
Total liability for any claim will not exceed whichever is greater: what you paid in the 12 months before the claim, or 100 CAD.
Some places do not allow these exclusions. Where that is the case, liability is limited as far as local law permits.
10Your responsibility
Metabolic health involves individual factors no app can fully account for. By using Biscuit you accept that:
- Health, diet, exercise, fasting and lifestyle decisions are yours alone, whether or not the app informed them.
- Every calculation in Biscuit, including HOMA-IR, metabolic age, spike scores and the symptom check, is an educational estimate that may be inaccurate for you.
- Fasting, dietary change and exercise carry real risks, especially with an existing medical condition, during pregnancy, or while on medication. Consult a professional first.
- Biscuit is not a substitute for professional diagnosis, treatment or emergency care.
- Using the app creates no doctor-patient or other professional relationship.
To the fullest extent the law allows, you waive any claim against Raana Golzar arising from health outcomes or decisions connected to your use of Biscuit.
11Indemnification
You agree to indemnify and hold harmless Raana Golzar from claims, damages, losses and reasonable legal costs arising from your use of Biscuit, your breach of these terms, your violation of anyone else's rights, or content you submit.
12Changes
Biscuit may be modified, suspended or discontinued in whole or part with reasonable notice, and these terms may be updated. Material changes will be announced in the app. Continuing to use Biscuit means accepting the updated terms. If you do not accept them, stop using the app and cancel any subscription.
13Ending your account
Your account may be suspended or terminated, with or without notice, where there is reasonable belief you have breached these terms or the law. You can end your account any time from Settings, then Delete my account and data.
On termination your right to use Biscuit stops immediately. Sections that should survive by their nature, including intellectual property, disclaimers and limits on liability, continue to apply.
14Law and disputes
These terms are governed by the laws of British Columbia, Canada.
In the European Union, nothing here limits your consumer rights, including bringing a dispute in the courts of your own country. In the United Kingdom, disputes may go to UK courts under the Consumer Rights Act 2015.
Please email biscuitbearapp@gmail.com first. Most things are resolved quickly that way.
15Whole agreement
These terms and the Privacy Policy are the entire agreement between you and Raana Golzar about your use of Biscuit, replacing anything agreed before.
16Contact
Everything, including privacy requests and legal notices, goes to biscuitbearapp@gmail.com. Privacy requests are answered within 30 days.