Privacy Policy

1. Who we are

Besly (the "App", "we", "us") is a calorie, nutrition and fitness tracking app (previously published as "FitRaptor" and "Doyla"). Besly is developed by Ali Tarakçı. Contact: support@besly.co. This policy explains what data the App and our website besly.co collect, why, who processes it, how long we keep it and what choices you have.

2. What we collect

Account. You can continue as a guest (we create an anonymous account ID) or sign in with Apple or Google. If you sign in we receive an account identifier and, depending on your choice, your email address (Apple may give us a private relay address) and display name.

Profile. Optional name, age, sex, height, weight, goals, activity level, dietary preferences and exclusions that you enter to personalize targets.

Your logs. Meals and foods, water, workouts, sleep and lifestyle notes, favorites and your own recipes. These are stored on your device and backed up to our cloud database so they can be restored on a new device or after reinstalling (guest accounts too).

Conversations. Your messages to the AI coach and chef, and the short notes the coach keeps about you ("coach memory"), are stored on your device and synced to our cloud database.

Voice and photos. If you log or talk by voice, or photograph a meal, the audio, transcript or image is processed to produce a result (see section 4). We do not keep your audio recordings or meal photos in our database.

Health data (Apple Health). Only with your permission, the App reads these Apple Health items: steps, active and resting energy, workouts, exercise time, walking/running distance, flights climbed, heart rate, resting heart rate, heart-rate variability, heart-rate recovery, VO2 max, sleep, body weight, body fat, lean mass, height, date of birth, biological sex, and dietary energy and water. The App does not write data to Apple Health. Section 5 explains the rules that apply to this data.

Usage statistics (can be turned off). Pseudonymous product events (for example which screens or features are used, coarse buckets such as calorie ranges, app version, device model, time zone and the country setting of your device) linked to a random account ID (or a random installation ID before you sign in) and not to your name or email. They do not contain free text, search queries, weight values or the contents of your meals or chats. Turn them off in Settings > Diagnostics > Share usage statistics.

Pre-sign-up funnel. Before you create an account, a few onboarding steps are counted using a random installation ID that is not linked to your account.

Crash and performance reports. Crash, freeze and performance information (device model, OS and app version, technical state) via Sentry and Apple's MetricKit. Screenshots are not captured.

Ad attribution. If you came from an Apple Search Ads campaign, the App reads Apple's AdServices attribution token once per install and stores the resulting campaign information with your account ID. We do not use Apple's advertising identifier (IDFA), we do not track you across other companies' apps or websites, and we show no third-party ads.

Subscription. Purchases are handled by Apple and RevenueCat. We store your subscription status, product and expiry date against your account ID. We do not receive your payment card details.

Notifications. If you allow notifications, we store your device push token and notification status and a log of notifications we sent.

Food lookups we could not answer. When the food database has no match, the (normalized) food name, language and region may be logged to improve the database. These records are not linked to your account.

Diagnostic logs and feedback. Detailed logs stay on your device (auto-deleted after 7 days) and reach us only if you tap "Share Logs" or send feedback. You choose which categories are included. Feedback you send is delivered to us by email (EmailJS) and error tracking.

Website. besly.co uses Cloudflare Web Analytics, which counts visits without cookies. For visitors outside the EU/EEA, the United Kingdom and Switzerland, the site also loads a Google Ads tag (Google LLC) that counts taps on our App Store links to measure how our advertising performs; this tag may set cookies. It is not loaded for visitors in the EU/EEA, the United Kingdom or Switzerland.

3. How we use data

To provide the App (calorie and macro estimates, daily targets, progress, coach and chef answers, recipes); to back up and restore your data; to send notifications you allowed; to manage subscriptions; to keep the service secure and prevent abuse (including daily AI usage limits); to find and fix crashes and improve features; and to measure how our own advertising performs. We do not sell your personal data and we do not use it for advertising profiles.

4. AI processing (Google Gemini)

When you describe a meal by text or voice, photograph a meal, or talk to the coach or chef, the relevant content is sent to Google's Gemini API to generate the answer. This can include: the text you type or dictate, a live audio stream when you use a voice conversation, meal photos, your basic profile (such as age, weight and goals) and context from your own logs needed to answer you. When you use the coach, this context can include Health-derived figures: your steps, sleep duration, heart-rate variability, resting heart rate, body weight and workouts (type, duration, estimated energy) for the days that matter to your question. Requests pass through our server gateway (Supabase Edge Functions), which checks your account and applies usage limits and keeps counters, not the content (live voice conversations connect to Google directly, using a short-lived token that our server issues). Speech-to-text for dictation uses Apple's Speech Recognition, which may run on your device or on Apple's servers. Google processes this data under its own terms (Gemini API terms). Our Gemini API usage is on a billing-enabled (paid) project; under Google's Paid Services terms Google does not use your prompts or responses to improve its products, and logs them only for a limited period to detect and prevent abuse. AI output is an estimate, not medical advice.

5. Health data

Data obtained through Apple HealthKit is used only to provide health and fitness features to you. It is not used for advertising or marketing, is not sold, and is not used for data mining or shared with data brokers. Our usage statistics do not contain health values. HealthKit-derived data that you allow may be backed up to our cloud database (Supabase) and included in AI requests to personalize your coaching (section 4). It reaches third parties only in these two ways: Supabase stores it for us, and Google processes it as a service provider (sub-processor) solely to generate the AI answer. We do not give it to anyone for their own purposes. You can revoke Health access at any time in iOS Settings > Health > Data Access & Devices.

6. Service providers

We use these providers to run the App. We do not sell your data to them or to anyone else.

• Supabase: authentication, database, file storage and server functions (cloud backup, sync, usage statistics, AI gateway).
• Google: Gemini API (AI processing); Google Sign-In if you choose it.
• Apple: Sign in with Apple, Speech Recognition, push notifications, App Store billing, Apple Search Ads attribution (AdServices), Health (on device).
• RevenueCat: subscription management (receives your account ID and purchase data; no health data).
• Sentry: crash and error reports (random installation ID, no screenshots).
• Turso: hosts the food database; receives food names searched (without your account ID).
• EmailJS and Resend: delivery of feedback and diagnostic notification emails to us.
• Cloudflare: website hosting and cookie-free web analytics.
• Google Ads (Google LLC): measures App Store link taps from our website for advertising (outside the EU/EEA, UK and Switzerland only).

We may also disclose data if required by law or to protect rights and safety, or in a business transfer, with notice.

7. Retention

• Account data (profile, logs, conversations, coach memory, subscription status, push tokens): kept until you delete your account (or reset your data) in the App.
• Usage statistics, pre-sign-up funnel events and performance reports: deleted automatically after 180 days; usage statistics are also deleted with your account.
• Crash reports in Sentry: up to 90 days (Sentry's retention depends on its plan: 30 or 90 days).
• Diagnostic logs on your device: 7 days.
• Shared diagnostic files and records, and notification logs: up to 90 days, then deleted automatically.
• Feedback emails: kept until we resolve the issue, then deleted on request.
• Backups at providers may persist for a short period after deletion.

8. Your choices and rights

• Reset data: Settings > Account > delete all your data (device and cloud) while keeping the account.
• Delete account: Settings > Account > Delete Account permanently removes your account and cloud data.
• Usage statistics: switch off in Settings > Diagnostics.
• Health, microphone, camera, speech recognition and notifications: manage in iOS Settings.
• Access, correction, export: email support@besly.co. We aim to respond within 30 days.

9. Security

Data travels over TLS-encrypted connections. In our database (Supabase), row-level security rules ensure each account can reach only its own rows, and our database provider states that customer data is encrypted at rest (AES-256; Supabase security). No system is completely secure; if you suspect a problem write to support@besly.co.

10. International transfers

Our providers are mainly in the United States and may process data in other countries. Where required, transfers rely on a lawful transfer mechanism, such as Standard Contractual Clauses.

11. EU, UK and Turkey (GDPR / UK GDPR / KVKK)

The controller is Ali Tarakçı (contact above). Legal bases: performing our contract with you (providing the App, backup, AI features, subscriptions); your consent (Health data, microphone, camera, notifications, diagnostic sharing; you can withdraw at any time); our legitimate interests (security, crash fixing, product analytics) (usage statistics are on by default and you can switch them off at any time); and legal obligations. You have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent, and to lodge a complaint with your data protection authority (in Turkey, the KVKK Board). Health data is special-category data; we process it on your explicit consent.

12. US state privacy rights (CCPA/CPRA and similar)

In the past 12 months we collected these categories: identifiers (account ID, email, device push token); health and fitness data and other sensitive personal information (only to provide the features you request); commercial information (subscription status); internet/app activity (usage statistics); approximate location (country setting only); audio/visual content you submit for AI processing; and inferences within the App. We do not sell personal information, do not "share" it for cross-context behavioral advertising, and use sensitive information only to provide the App. You may request to know, access, delete or correct your personal information and to opt out of sale/sharing (not applicable); we will not discriminate against you for exercising these rights. Email support@besly.co; an authorized agent may act on your behalf with proof of authority.

13. Children

Besly is not directed to children under 13 (or under 16 where local law sets that age) and we do not knowingly collect their data. If you believe a child has given us data, write to us and we will delete it.

14. Changes

We may update this policy. Material changes will be shown in the App or by updating the date above.

15. Contact

support@besly.co