Legal
Privacy policy
Last updated: November 4, 2026
At thebean, we believe your health and personal information should remain private, secure, and under your control.
thebean is a weight-management and wellness application operated by UAB Good Boy Labs ("we", "us", or "our").
This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices and rights you have.
1. Who We Are
Company: UAB Good Boy Labs
Company registration number: 307770120
Registered address: Gabijos 42, Vilnius, Lithuania
Email: privacy@thebean.ai
UAB Good Boy Labs is the data controller responsible for processing personal information through thebean.
For any privacy-related questions, contact us at privacy@thebean.ai.
2. Information We Collect
We collect and process information necessary to provide thebean's features.
Account information
When you sign in with Apple, we receive an account identifier and authentication information needed to create and maintain your account.
We may also receive your email address or an Apple private relay address, depending on the authentication configuration.
Profile and goals
We collect information you provide, including:
Birth year
Height and weight
Weight-management goals and target dates
Activity level
Measurement units and app preferences
Weight and progress
We store weight entries, progress history, goals, and calculated estimates to help you understand changes in your weight over time.
Meals and nutrition
When you log meals, we process information such as:
Food descriptions and meal notes
Estimated calories and nutritional information
Food photos
AI-generated meal estimates
Corrections you make to estimated values
Physical activity
We process exercise and activity information, including activities you log manually and activity information imported through Apple Health with your permission.
Apple Health
With your permission, thebean may access the following Apple Health information:
Body weight
Step counts
Workout information
We use this information to support weight tracking, physical activity tracking, and calorie-balance calculations.
You can revoke Apple Health permissions at any time through your device settings.
Diagnostics and error reporting
We use Sentry to identify application errors, crashes, and performance problems.
Depending on the configuration, diagnostic information may include device details, operating system version, application version, error messages, technical identifiers, IP addresses, and performance information.
We aim to minimize the personal information included in diagnostic reports.
Subscription and purchase information
We use RevenueCat to manage subscriptions and access to paid features.
When you purchase or restore a subscription, RevenueCat may process information such as your subscription status, purchase history, transaction identifiers, app user identifier, receipt information, subscription expiration dates, and limited technical information.
Payments made through the Apple App Store are processed by Apple. We do not directly collect or store your full payment card details.
We use this information to verify purchases, activate subscription features, restore purchases, prevent subscription fraud, and provide subscription-related support.
Subscription information may be processed by RevenueCat and Apple according to their applicable data-processing arrangements. Relevant records may be retained where necessary for transaction verification, legal compliance, or fraud prevention.
3. How We Use Your Information
We use your information to:
Create and maintain your account.
Track meals, calorie intake, weight, and physical activity.
Calculate calorie balance and estimated weight trends.
Provide progress insights and personalized weight-management estimates.
Analyze food photos when you request AI assistance.
Synchronize your information across supported devices.
Identify and fix technical problems.
Maintain security and prevent misuse.
Respond to support and privacy requests.
Comply with applicable legal obligations.
We do not sell your personal information.
We do not use your health or fitness information for targeted advertising.
4. Legal Basis for Processing
We process personal information in accordance with the General Data Protection Regulation (GDPR).
Depending on the purpose, our legal bases include:
Contractual necessity (Article 6(1)(b))
To create your account and provide the services you request.
Consent (Article 6(1)(a))
For processing activities where we rely on your permission.
Explicit consent for health-related data (Article 9(2)(a))
Information such as body weight, weight history, and certain nutrition or activity information may be considered special-category health data under GDPR.
Where explicit consent is our applicable condition for processing health information, we will request it before the relevant processing begins.
You may withdraw consent. Withdrawal does not affect processing carried out lawfully before withdrawal. Some features may no longer be available if the information needed to provide them cannot be processed.
Legitimate interests (Article 6(1)(f))
For proportionate security measures, abuse prevention, error monitoring, and maintaining the reliability of our service, after considering your rights and interests.
Legal obligations (Article 6(1)(c))
When processing is necessary to comply with applicable law.
5. AI Food Photo Analysis
thebean provides optional AI-assisted food analysis.
When you choose to analyze a food photo, thebean processes the image and sends it through our backend to OpenAI, an external AI service provider.
The AI service analyzes the image to identify food items and estimate their calories and nutritional values.
Before transmission, our application is designed to reduce the image size and remove embedded metadata, including GPS information.
The audited implementation does not intentionally send your complete weight history, health profile, or personal account information to OpenAI as part of the food-analysis request.
AI-generated calorie estimates are not guaranteed to be accurate. You can review and correct estimates before saving a meal.
According to OpenAI's API data policies, API content is not used to train its models by default unless the customer opts into data sharing.
OpenAI may retain API content and metadata in abuse-monitoring logs, generally for up to 30 days, with certain exceptions and account-specific data controls.
6. Where We Store Your Information
We use Supabase for:
Account authentication
Database storage
Secure backend functionality
Cloud synchronization
Storage of meal-photo thumbnails
Our Supabase database is hosted in the United States (AWS US East, Ohio region).
Some supporting infrastructure, processing, or backups may operate in other locations depending on our service providers' arrangements.
We also store certain information locally on your device to support app functionality and synchronization.
Food photos submitted for analysis are processed temporarily. The audited implementation does not intentionally retain the original analysis image as a permanent server-side file. Smaller meal-photo thumbnails may be stored in private cloud storage associated with your account.
7. Third-Party Service Providers
We use trusted third-party services to operate and maintain thebean.
Supabase
Provides authentication, database hosting, cloud storage, and backend infrastructure.
OpenAI
Provides AI technology used for optional food-photo analysis.
Sentry
Provides crash reporting, diagnostic monitoring, and performance troubleshooting.
Apple
Provides Sign in with Apple, Apple Health permissions, and related platform services.
These services receive only the information relevant to their respective functions, subject to the actual configuration of each integration.
We do not share your information with advertising networks for targeted advertising.
8. International Data Transfers
Because we use international service providers, your personal information may be processed outside the European Economic Area, including in the United States.
Where required by GDPR, international transfers must be supported by an applicable adequacy decision, Standard Contractual Clauses, or another recognized transfer mechanism.
You can contact privacy@thebean.ai for information about the safeguards applicable to your data.
9. How Long We Keep Your Information
We retain your information only for as long as necessary to provide our services, support legitimate operational needs, or comply with applicable legal requirements.
Account information, weight history, meal records, goals, and activity records are generally retained while your account is active, unless you delete records through an available feature.
When you delete your account, we initiate deletion of the associated information from our active systems.
Some information may remain temporarily in backups, technical logs, or third-party systems according to their applicable retention periods.
Diagnostic information collected through Sentry is retained according to the retention settings applicable to our Sentry account.
AI providers may apply their own limited retention periods for security and abuse monitoring.
10. Account Deletion
You can initiate account deletion from within thebean's account settings.
Account deletion is designed to remove your account and associated personal information, including:
Profile information
Weight history
Goals and progress records
Meal logs
Activity history
Stored meal-photo thumbnails
Information may remain temporarily in service-provider backups or logs, or where continued retention is required by law.
Deleting your thebean account does not delete information independently stored in Apple Health.
You can also contact privacy@thebean.ai to request assistance with deleting your account or personal information.
11. Your Privacy Rights
Under GDPR, you may have the right to:
Access: Request a copy of your personal information.
Correction: Request corrections to inaccurate information.
Deletion: Request erasure of your personal information.
Restriction: Request that certain processing be limited.
Portability: Receive eligible information in a structured, commonly used format.
Objection: Object to certain processing, including processing based on legitimate interests.
Withdrawal of consent: Withdraw consent where our processing relies on it.
Complaint: File a complaint with a competent data protection authority.
You can submit privacy requests to:
We will respond within the time limits required by applicable law, generally within one month under GDPR, subject to permitted extensions.
You may also lodge a complaint with the Lithuanian State Data Protection Inspectorate (VDAI) or another competent supervisory authority.
12. Apple Health Data
Connecting Apple Health is optional.
thebean requests only the Health permissions needed for its features.
Information imported from Apple Health may be stored in your thebean account to support weight trends, exercise tracking, and calorie calculations.
We do not sell Apple Health information or use it for advertising.
You can revoke future access in your device settings.
Revoking access does not automatically delete information already imported into your thebean account. You can request deletion of previously imported information through your available account controls or by contacting us.
13. Data Security
We use technical and organizational measures designed to protect your information, including:
Account authentication
Access-controlled database storage
Database row-level security
Private storage for meal-photo thumbnails
Device-level protection for locally stored data
Monitoring for application errors and security issues
No method of electronic storage or transmission is completely secure. We review our safeguards as the service develops.
14. Health and Nutrition Information
thebean is intended for general wellness and weight-management purposes.
Calorie estimates, activity-energy estimates, calorie-balance calculations, and weight projections are approximations.
AI-assisted meal analysis may misidentify foods, ingredients, portions, or nutritional values.
thebean does not provide medical diagnosis, treatment, or individualized medical advice.
You should consult a qualified healthcare professional about medical concerns or before making significant changes to your diet or activity, particularly if you have an existing medical condition.
15. Age Requirements
thebean is intended for people aged 18 years and older.
We do not knowingly provide accounts to children under 18.
If we discover that an account does not meet our age requirements, we may restrict access and delete associated information in accordance with applicable law.
16. Changes to This Privacy Policy
We may update this Privacy Policy when our features, data practices, service providers, or legal obligations change.
The most recent version will be made available on our website with an updated date.
Where required by law, we will provide additional notice or request consent before introducing changes to processing activities.
17. Contact Us
For privacy questions, requests, or concerns, contact:
UAB Good Boy Labs
Company registration number: 307770120
Gabijos 42, Vilnius, Lithuania
Email: privacy@thebean.ai
Website: https://thebean.ai