Privacy Policy

This Privacy Policy explains how Bay (“we”, “us”) handles personal information when you text Bay, use the member dashboard, or visit the Bay website. It is part of our Terms of Service. Because Bay is about food, weight and exercise, much of what it handles is health-related information. We treat all of it as sensitive.

We use your information to:

• run Bay: log what you send, estimate nutrition, build and adjust your training plan, calculate and recalibrate targets, and send your morning plan, evening recap, reminders and check-ins;
• personalise it: remember your preferences and history so advice fits you, and generate the summary cards it texts you;
• keep it safe and working: detect abuse, enforce daily limits, debug problems, and keep records our messaging provider and carriers require (such as your STOP and START requests);
• improve it: look at aggregate, de-identified patterns, such as how often photo logging is used, to decide what to build;
• comply with law and respond to lawful requests.

We do not sell your personal information, share it for advertising, use it to build profiles for anyone else, or use your messages or photos to train AI models of our own.

Bay’s replies are generated by large language models run by OpenAI. To answer you, we send OpenAI the relevant parts of your conversation, the photo or voice note you just sent, and a summary of your profile, targets and recent logs. OpenAI processes this under its API terms, which state that it does not use API data to train its models and that it retains API inputs for a limited period (currently up to 30 days) for abuse monitoring before deleting them. We do not send OpenAI your phone number.

Automated processing is how Bay works, and it produces estimates, not decisions with legal effect on you. You can always correct an entry by text or on the dashboard.

We share personal information only with providers who process it for us under contract, and only what each needs:

• Linq (messaging). Delivers Bay’s texts over iMessage, RCS and SMS and receives yours. Linq necessarily sees your number and the full content of messages and media, and stores them on its platform under its own retention rules.
• OpenAI (AI replies, photo understanding and voice transcription). See section 4.
• Nutritionix and the USDA FoodData Central database (nutrition lookups). We send the food description being looked up, not who asked.
• Render (hosting). Our servers, database and the storage that holds copies of your photos run on Render in the United States.
• Sentry (error monitoring), if enabled. Receives technical error reports.

Separately, mobile carriers and Apple carry your messages. iMessage is encrypted between your phone and Apple’s servers; SMS and RCS are handled by carriers under their own policies and are not end-to-end encrypted. If you connect Apple Health, the export tool you install is a third party with its own privacy policy.

We may also disclose information if the law requires it, to protect someone’s safety, to enforce our Terms, or to a successor if Bay is acquired or merged, in which case this policy continues to apply to it until you are told otherwise.

• While you use Bay, we keep your conversation and logs so it can coach you with context. Older history informs your long-term trends.
• If you text STOP, we keep your data so that START brings everything back; we just stop messaging you.
• If you ask us to delete your account (email hello@usebay.ai with the phone number on the account; texting “delete my data” gets you these instructions), a person verifies the request and deletes your profile, messages, photo copies, logs, memories and targets from our systems within 30 days, usually much sooner, and texts you once when it is done. Nothing you type in the thread deletes an account, so it cannot happen by accident. Copies in encrypted backups expire within 30 days of that. We keep only what we must to honour your opt-out (your number and the date you stopped) and any records the law requires.
• Inactive accounts. We may delete accounts that have been inactive for a long time; we will text you first.
• Messages held by Linq and inputs held briefly by OpenAI are deleted on their schedules, described above.

You do not need to file a request for most things; just text Bay:

• STOP pauses all messages; START resumes. “Stop tips” turns off feature tips only.
• “delete my data” tells you how to request that your account be erased (section 6).
• “forget …” removes something Bay remembered; “delete that” removes the last entry; or correct any number in plain words.
• Dashboard. Reply “dashboard” for a sign-in link to see, edit and delete every food, workout and weigh-in entry, and to export your data as CSV files.
• Apple Health. Turn off the export in the tool you installed; we stop receiving data immediately.

Depending on where you live you may also have legal rights to access, correct, delete, restrict or port your personal information, to object to certain processing, and to withdraw consent. To exercise any of them, email hello@usebay.ai from a message that identifies your phone number, or text Bay directly. We will verify that the request comes from the number on the account, respond within the time the law allows (usually 30 to 45 days), and never treat you differently for asking.

Bay is a consumer wellness service, not a healthcare provider or health plan, so laws such as HIPAA do not apply to it, and we do not share your information with insurers, employers or clinicians. We still handle it as sensitive: we use it only to provide the service, we limit who at Bay can see it to people who need to for support and engineering, and we never use it for advertising or sell it.

Data moves between our systems and providers over encrypted connections, our database and backups are encrypted at rest by our hosting provider, incoming webhooks are signature-checked, dashboard sign-in uses one-time links that expire, and access to production data is limited and logged. No method is perfect, and text messaging itself is only as private as your phone, your carrier and whoever can see your screen. If we learn of a breach affecting you, we will tell you and the authorities as the law requires.

Bay is for adults. We do not knowingly collect information from anyone under 18. If you believe someone under 18 has been texting Bay, email us and we will delete the account.

When we change this policy we will update the date at the top. If a change materially affects how we use your information we will text you before it takes effect, and where the law requires it we will ask for your consent.

Privacy questions and requests: hello@usebay.ai.