gutput.com / privacy
Privacy policy
Last updated 6 October 2026
This policy explains what GutPut collects, why, who processes it and how long it’s kept. It covers the GutPut apps for iPhone and Android and this website. The short version: your log is health data, it stays in the EU, it’s used only to run GutPut for you, and you can delete it whenever you like.
Who we are
GutPut is run by Alex McFarlane, a sole trader based in Bologna, Italy (VAT number IT03588671200). Alex McFarlane is the data controller for the personal data described here, and “we” in this policy means Alex McFarlane. The full postal address is on the legal notice.
For anything about your data, email support@gutput.com.
What we collect, and why
| What | Why | Legal basis |
|---|---|---|
| Your email address | To create your account and send you sign-in codes | Contract (GDPR Art. 6(1)(b)) |
| Food and drink entries: what you ate, when, the ingredients and tags | To keep your diary and look for patterns | Your explicit consent (Art. 9(2)(a) and 6(1)(a)) |
| Bowel movements: the time, Bristol type and any details you add | To keep your diary and look for patterns | Your explicit consent |
| Your conversation with GutPut’s assistant | So it has context, and so you can scroll back | Your explicit consent |
| Food photos | Read once to work out what’s in a meal, then discarded | Your explicit consent |
| Technical data: IP address, device type, app version, the time of each request | To run the service, fix faults and keep it secure | Legitimate interests (Art. 6(1)(f)) |
| Emails you send to support | To answer you | Legitimate interests |
Food entries, movements, the conversation and photos are health data. We don’t ask for your name, date of birth, location, contacts or anything else, and the app has no advertising or analytics code.
Your consent to process health data
Before you log anything, the app asks for your explicit consent to process health data, including by AI. GutPut can’t work without it, so it isn’t optional, but it is yours to withdraw: delete your account in the app, or email support@gutput.com. Withdrawing doesn’t affect what was processed before.
How the AI works
GutPut’s assistant is Claude, an AI model made by Anthropic, which we use through Amazon Bedrock in Frankfurt, Germany. Your messages, recent entries and photos are sent to it so it can turn them into entries and look for patterns.
- Amazon Bedrock doesn’t keep what you send after replying, doesn’t pass it to Anthropic, and doesn’t use it to train models. Neither do we.
- Patterns are worked out from your own log only, never from other people’s.
- GutPut makes no automated decisions about you that have legal or similarly significant effects. It shows you patterns; what you do with them is up to you.
What we don’t do
- No ads, and your data isn’t sold, rented or shared for marketing.
- No tracking across other apps or websites, and no analytics.
- No marketing emails. The only emails GutPut sends are sign-in codes, and they never contain anything about your health.
- No passwords to leak. Sign-in codes are stored only as a keyed hash, expire after 10 minutes and work once.
Who processes it for us
These companies process data on our behalf, under contracts that limit them to doing so:
| Company | What for | Where |
|---|---|---|
| Amazon Web Services EMEA SARL (Amazon Bedrock) | The AI that reads your messages and photos | Frankfurt, Germany |
| Amazon Web Services EMEA SARL (Amazon SES) | Sending sign-in codes | Frankfurt, Germany |
| Laravel Holdings Inc. (Laravel Cloud) | Hosting the GutPut server and its database | Frankfurt, Germany |
| Google Cloud EMEA Limited (Google Workspace) | The support@gutput.com mailbox | Google data centres |
| Amazon Web Services EMEA SARL (Amazon CloudFront) | Serving this website | The nearest AWS edge location |
Your account, entries and conversation are stored and processed in the EU. AWS, Laravel and Google belong to groups based in the United States. Where their staff could reach data from outside the EU, for example to provide support or keep systems secure, the transfer is protected by the European Commission’s Standard Contractual Clauses and, where the company is certified, the EU–US Data Privacy Framework. We would only share data with anyone else if the law required it.
How long we keep it
| What | How long |
|---|---|
| Entries, movements and the conversation | Until you delete them, or your account |
| Your email address | Until you delete your account |
| Food photos | Not kept. Discarded once the meal has been read |
| Sign-in codes | 10 minutes, as a keyed hash |
| Server logs | Up to 30 days. They never contain your entries or email address |
| Database backups | Up to 30 days, then overwritten |
| Support emails | Up to 2 years after your last message |
Deleting your data
In the app, go to Settings, then Delete my data and account. Your entries, conversation and email address are deleted straight away, and drop out of our backups within 30 days. You don’t need the app to do it: see how to delete your account.
Your rights
You can ask us to:
- give you a copy of your data, in a format you can take elsewhere;
- correct anything that’s wrong (you can also edit any entry in the app);
- delete your data;
- restrict or object to how we use it;
- withdraw your consent.
Email support@gutput.com from the address you use for GutPut. It’s free, and we reply within a month. We may ask you to confirm the request from that address before acting on it.
If you’re unhappy with how we handle your data, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali, to the authority where you live in the EU, or in the UK to the Information Commissioner’s Office. We’d appreciate the chance to put it right first.
Keeping it safe
All traffic to GutPut is encrypted in transit, and the database is encrypted at rest. Access to the systems that hold your data is limited to Alex McFarlane, who runs GutPut. Sign-in codes go only to your email address, so keep that mailbox secure.
Age
GutPut is for adults aged 18 and over. If we learn that an account belongs to someone younger, we delete it.
This website
gutput.com sets no cookies and has no analytics, trackers, forms or scripts. It’s served by Amazon CloudFront, which handles your IP address to deliver the page, as any web server must. We don’t keep access logs. If you email us, the privacy terms above for support emails apply.
Changes to this policy
When we change this policy we update this page and the date at the top. If a change affects how your health data is used, we tell you in the app before it applies and, where it needs your consent, ask for it again.