Privacy Policy

1. Scope and operator

This notice describes BellySignal’s current app data handling. The operator is Picko (픽코), represented by Jeonghyeon Yu. Contact: [email protected]. Features can vary by installed version and platform.

Your diary is stored on your device. Selected health values are also sent in analytics events, and if you sign in and turn on automatic backup, a copy of your diary is uploaded to Google Firebase. The app is therefore not an exclusively on-device service. An account is not required to record entries.

2. Records on your device

The local database contains stool and urine observations, water intake, food, drinks (caffeine and alcohol), medicines and supplements, symptoms, sleep, stress, mood, exercise, manually entered or imported weight, period records, notes and timestamps. Settings include language, appearance, reminders, the items shown when you add an entry, water-goal preferences and the sex and body weight you enter to personalize your water goal.

Your operating system may separately back up or transfer the app’s local data and settings, including your period-tracking consent, according to your device settings. BellySignal’s automatic backup switch does not control these system services.

3. Automatic cloud backup (optional)

Automatic backup is available only after you sign in, and it is off until you turn it on. After you sign in, the app asks whether to turn it on if this device has not asked for that account before. This is remembered on the device, so another device may ask again. You can change the setting later in Settings.

• What is uploaded: all diary entries, period records, your medicines and supplements list, foods you added and the settings listed in section 2. Your period-tracking consent and the usage analytics setting are not included.
• When: while backup is on for the signed-in account, the app tries to upload when you turn it on, when your account becomes available at startup or sign-in, when you leave or return to the app, and before you sign out. It normally skips the upload if nothing has changed; turning backup on or restoring a cloud backup can trigger a fresh upload. Failed uploads are retried at a later opportunity.
• Where: Google Firebase Storage in the United States (us-east1), in a file under your account (users/{account ID}/devices/{device ID}.json). Each device keeps its own file; the device ID is a random value created by the app.
• Protection: Firebase encrypts backups in transit and at rest, and the app can read or write a backup only when signed in to the matching account. Backups are not end-to-end encrypted: authorized administrators of our Firebase project and the storage provider can access their contents.
• Restoring: when you turn on backup, records from the most recent backup made by another device on the same account are added to this device; records and settings already on this device are kept. In Settings › Restore, you can choose an exported backup file or, while signed in, your account’s most recent cloud backup. You can add its records to the ones on this device or replace them; both options also apply the settings saved in that backup.

Each device keeps its own backup, so changes do not sync between devices. While backup is on, records you delete are removed from this device’s backup at its next successful upload, but other devices and their backups can still have earlier copies, and restoring from them can bring those records back.

Turning off backup stops new uploads. If backup is on, signing out makes one last backup attempt and then pauses uploads; signing back in to that account resumes uploads if backup is still on for that account on this device. Neither action deletes existing backups.

Deleting your account deletes all of the account’s backups before the sign-in account is removed; the diary on your device stays. “Delete all data” deletes the diary and saved lists on this device and turns off automatic backup. While you are signed in, it also deletes the account’s backups when backup is on on this device or the app still remembers a previous backup for that account; the confirmation message says whether backups are included. Otherwise, including when you are signed out, backups remain. If a required backup deletion fails, the account or diary on your device is not deleted. After backups are deleted, an empty marker file is kept under the account ID, even after the account is deleted, so that other devices signed in to the account turn off automatic backup when they see it. Their local diaries are not deleted.

Deleted or overwritten backup files are removed from active storage right away, but the storage provider keeps recoverable copies for 7 days before they are permanently erased. You can also ask us to delete backups.

4. Analytics and diagnostics

The app uses PostHog and Google Analytics for Firebase to measure usage and analyze recorded patterns. PostHog can receive:

• Stool type and color, blood or mucus, pain, bloating, abdominal distension, urgency, incomplete evacuation and straining, and how many stool forms and pain locations you selected.
• Urine color, the selected hydration level and foam; water amounts; symptom scores and the scale used; sleep-quality and stress ratings; exercise type and duration; and manually entered weight.
• During setup: the purposes you select (for example constipation or medicines), your answer about your last bowel movement, and the optional note you can write about why you use the app (up to 80 characters).
• Whether heart rate variability readings were found after the health-platform permission request, the kinds of fields you change when editing an entry, and the kind of message shown after you save an entry.
• While period tracking is on with your consent and PostHog is enabled, a yes/no flag showing whether period records are currently saved in the app is attached to later analytics events. Period dates, counts, flow and pain details are not sent.

The values above are sent to PostHog only. Both PostHog and Firebase Analytics receive screen and feature usage, entry counts, language, settings, app/OS/device information and device or app-instance identifiers. This usage information can reveal which health features you use, for example whether you record alcohol, caffeine, mood, symptoms or weight. PostHog also receives error reports and stack traces. Analytics providers process network information, including IP addresses, and may derive approximate location. On Android, Firebase Analytics also collects the advertising ID when your device settings allow it.

On Android, PostHog also receives the source and medium of the link that led to the install (for example Google Play search, a social network or this website). The app reads them once from the Google Play install referrer and attaches them to later events. Values we do not recognize are sent as “other”, and campaign names are not sent to PostHog. Separately, Firebase Analytics collects install attribution from Google Play on its own, which can include the source, medium and campaign name of that link.

Free-text diary notes and food or drink names are not attached to analytics events. Measurements read from Apple Health or Health Connect are not sent in analytics; the usage information described above may still be sent. Device identifiers allow events to be associated over time; we do not describe this data as completely anonymous.

Both analytics services are enabled by default in the current implementation. The analytics switch in Settings controls PostHog only. Firebase Analytics, including the usage information above, remains active when this switch is off; there is currently no separate in-app switch to stop it.

5. Optional accounts and sharing

• Sign-in: Google or Apple sign-in uses Firebase Authentication. Account identifiers, email and profile information provided by the sign-in service, authentication tokens and technical access data are processed for authentication and automatic backup. Account deletion is available in Settings (see section 3).
• Health platforms: with permission, the app writes water entries to Apple Health or Health Connect and reads sleep, weight and heart rate variability. Imported weight becomes part of your diary and is included in backups. Sleep and heart rate variability are read to show them in the app and are not saved in your diary or backups.
• Exports: PDF reports and backup files are sent to the location or recipient you select using the device’s sharing tools. Copies you export are outside the app’s deletion controls.
• Feedback: when you submit feedback, your message, its category, optional contact information, selected images and their file names, app/OS version, language and the time of submission are sent to our support channel through Discord. Include only information you want to send; diary records are not automatically attached.

6. Purposes, providers and transfers

We process data to provide the diary and requested integrations, authenticate optional accounts, store and restore automatic backups, handle feedback, measure usage and recorded patterns, and diagnose errors. PostHog handles analytics and diagnostics on its US cloud. Google/Firebase handles analytics, authentication and backup storage; Apple and Google handle platform integrations and sign-in; Discord handles submitted feedback. Provider infrastructure may process data outside your country, including in the United States. Turning off PostHog does not stop Firebase transfers. We do not sell your data.

7. Retention and deletion

You can view, edit and delete diary entries in the app. “Delete all data” does not reset all app settings. It keeps the sex and body weight saved for your water goal, which you can change in Settings. Cloud backups are kept as described in section 3. Removing records on your device or uninstalling the app does not automatically erase previously transmitted analytics, cloud backups, account information, feedback or copies you exported. Analytics and support information are retained according to service settings and the purposes described above. Contact us to request access or deletion of information we hold; we may need information to locate the relevant records.

8. Your controls and rights

You can use the diary without signing in, choose whether to turn on automatic backup, choose exports, revoke health-platform permissions and disable PostHog in Settings. You can withdraw period-tracking consent from Edit log items; this stops the period flag described in section 4 from being attached to later events, while your period records stay saved, and stay in automatic backups while backup is on, until you delete them. The PostHog switch is not a withdrawal control for all processing. Depending on applicable law, you may have rights to access, correction, deletion, restriction, objection, portability and withdrawal of consent. Contact [email protected] to exercise them. You may also complain to the competent data-protection authority. We do not discriminate against you for exercising your rights. This notice does not waive rights or replace consent where law requires it.

9. Security and children

Records on your device are protected by the operating system’s app sandbox. On supported devices, you can turn on App lock in Settings: the app then asks for Face ID, Touch ID or your device passcode on iOS, or a supported biometric or your device PIN, pattern or password on Android, when it starts and when you return after at least 30 seconds away. App lock does not cover widgets, notifications, Live Activities, Apple Watch or Siri. Cloud backups are protected as described in section 3. Keep your device, account and exported files secure; no system is completely secure. The app is not directed to children under 16 or the minimum age required in their country. Contact us if you believe a child’s information has been submitted.

10. Changes and contact

This notice now describes automatic cloud backup, heart rate variability reading, period-related analytics and the setup information sent to PostHog. We will post further updates here and give notice of material changes. Privacy and deletion requests: [email protected].