Privacy policy

The short version

• Proud collects what it needs to run the app: your account, the meals you log, your one buddy, your streaks, and your device basics. Nothing is public. There is no feed.
• Proud never asks for weights, calories, or any number about your body, and does not sell your data or show ads.
• Every meal photo is scanned automatically for safety before your buddy can see it.
• If you talk to Bloom, those conversations are processed by DeepSeek, an AI company based in China. That is a real transfer of personal data abroad, it is optional, and it is explained in full below.
• If a practitioner invites you to Proud Care and you connect, you choose to share your meal logs with them. Your Bloom conversations and journal stay private, and you can disconnect at any time.
• You can request account deletion in the app. Cleanup starts when you confirm; if it fails, retry or contact support. Backups, abuse reports, and payment records have separate retention periods, explained below.

Who runs Proud

Proud is built and operated by Theo Apteker, its founder and only developer. For everything in this policy, including requests about your data, write to theo@proudforus.com. Theo is the data controller for the personal data described here.

What Proud collects

• Account. Email address, username, display name, and a profile photo if you add one.
• Phone number. From app version 2.2 the phone number at signup is optional, Proud does not text you, and the number is stored with your account only if you enter one. In version 2.1.4, signup asks for a number and new consumer accounts confirm it with a one-time code sent by SMS before using the app. Accounts that verified keep that record.
• Onboarding answers. The answers you give while setting up: what brings you here, how you like support, and what you are working through. From version 2.2 a short set of pattern questions follows: when it usually gets hard, what tends to come first, how long it has felt this way, what you have tried, who knows, whether you see a therapist or dietitian, how often you want to log, how a missed day should feel, and who you want as a buddy. If you are here to support someone you love, you answer a different short set instead: your relationship to them, where you would like help, how confident you feel, how you stay connected, and what would help you. Proud never asks about the other person’s health. Proud uses your answers to build your plan or your supporter welcome and to pick your lessons. They are stored privately with your account and your buddy never sees them. When analytics is on, it records your goal, support style and what you are working through as account properties; for the pattern questions it records only which question screen you reached, never your answers, and the same is true of the supporter questions. When you talk to Bloom, your support preferences, your hardest time of day and what tends to come first are included as context.
• Authentication. If you use a passkey, Proud stores the public half of the credential (WebAuthn). The private half never leaves your device. If you use a password, it is stored hashed by Firebase Authentication; Proud never sees it in plain text.
• Content. Meal photos, the notes you attach, the meal type and time, Proud reactions, and anything you write in the Unfold journal.
• Bloom. Your conversations with Bloom and the private profile Bloom builds to remember context between chats.
• Meal ideas. From version 2.2 you can keep a private list of foods you like, save ideas, and write down your own. They are stored privately with your account, your buddy never sees them, and analytics never records them. When you ask Bloom for food ideas, or chat with Bloom, the foods you like are sent with your request so Bloom can suggest things that fit. Proud does not ask for calories, weights or portions.
• Relationship. Who your buddy is, buddy requests you send or receive, and your invite code.
• Activity. Streaks, declared rest days, mends, lesson progress, which screens you use and when.
• Device. A push notification token, your language and timezone, app version, and crash reports.
• Purchases. Whether Proud Plus is active and transaction identifiers. Payment happens entirely through Apple. Your card details never reach Proud.
• Reports. If you report content or a person, or someone reports you, that report is stored.

Proud does not collect weights, calories, macros, BMI, step counts, or any measurement of your body or your food. That is not a missing feature. It is the point.

Phone verification in app version 2.1.4

Version 2.1.4 asks new consumer accounts to confirm their phone number with a one-time code. When the code is sent, Google Firebase receives your phone number and sends an SMS. Google also stores phone numbers provided for this service to help prevent spam and abuse across Google services. Message and data rates may apply, and delivery depends on support for your country and carrier.

Proud records whether the number has been verified. This confirms that you received the code; it does not establish your legal identity. From version 2.2 there is no texted code: the phone number is optional and nothing is sent to Google for verification.

The Android waitlist

proudforus.com shows Android visitors a waitlist for a possible Android version. If you join, Proud stores the address you enter, the moment you joined, and nothing else about you. The entry lives in the same Google Cloud (Firestore) database as the app’s data and is used for exactly one thing: a message from Theo if Proud reaches Android. It is never added to a newsletter, never shared, and never used for anything else. To come off the list, email theo@proudforus.com and the entry is deleted.

Questions you send from the website

proudforus.com has a box for asking a question about Proud. If you use it, Proud stores what you typed, the moment you sent it, and the page you sent it from. If you also give an email address, that is stored with it, and it is used for one thing: sending you the answer. It is never added to a newsletter and never shared.

Questions are read by Theo, who builds Proud, and nobody else. If a question turns out to be one many people ask, the question may be rewritten in general terms and published with its answer on the FAQ. Your email address, your wording and anything identifying you are never published, and nothing you send is published automatically. If you would rather your question was not used that way at all, say so in the message, or write to theo@proudforus.com and it is deleted.

The box is not a way to reach a clinician or a crisis service, and nobody watches it around the clock. If things are urgent, the crisis resources at the bottom of every page are the faster door.

What your buddy can see, exactly

Your buddy, and only your buddy, can see:

• Your meal posts that passed the safety scan: the photo, meal type, time, and your note.
• Proud reactions between the two of you.
• Your display name, username, profile photo, current and longest streak, total posts, days active, and your mix of meal types.

Your buddy can never see:

• Your Unfold journal.
• Your conversations with Bloom.
• Your meal ideas or the foods you like.
• Your email address.
• Photos held back by moderation.

If you have no buddy yet, your posts are visible to you alone. Nothing in Proud is ever public.

Proud Care: what your practitioner can see, exactly

Proud Care lets a dietitian, therapist or other practitioner you already work with follow your meal logging in Proud. It starts only when your practitioner gives you a code and you choose to connect. Before anything is shared, Proud shows you the practice’s name, exactly what will be shared, and which Proud tools your practitioner has turned on for you, and asks for your consent.

While you are connected, the practitioner assigned to you (if your care moves to a colleague at the same practice, that colleague instead) can see:

• Your meal posts that passed the safety scan: the photo, meal type, the time you logged it, your note, how many Prouds it received, whether you edited it, and whether it was a photo-free log card. This includes meals you logged before you connected.
• Weekly numbers worked out from those posts during your programme dates, such as how many meals you logged against the number your practitioner expects.
• Your display name, your connection status and programme dates, whether you have a buddy (never who), the Proud tools turned on for you, and the focus your practitioner chose for you (eating too much, eating too little, or supporting someone).

Your practitioner can never see:

• Your conversations with Bloom.
• Your Unfold journal.
• Notes between you and your buddy, or who your buddy is.
• Your answers to Proud’s personal questions.
• Your email address, username or profile photo.
• Photos held back by moderation.

Other people at the practice cannot open your meals; the practice can see that you are connected and your programme dates. Photos are shown to your practitioner through a link that works for five minutes, and every time your practitioner opens your record or a photo, Proud records that it happened in an audit log.

Proud staff cannot browse Care information. If they need to look at one connection to answer your support request, a data request you made, or a security problem, they open a single time-limited access (at most 60 minutes) that names the reason and a ticket, and every look is recorded in the audit log.

Your practitioner chooses your tools. Your practitioner can turn Bloom chat, Stillness, Unfold, Meal ideas and My Plan on or off for you. A tool that is off is unavailable while you are connected. Turning a tool on does not give your practitioner any access to what you do in it. Logging meals, your buddy, lessons, Progress, and your account and privacy settings are always available.

AI tools. If your practitioner turns on Bloom chat, Meal ideas or Unfold, those features use AI. While you are connected to Proud Care, your requests to them are processed only by Anthropic in the United States, never by DeepSeek.

Cost. While you are connected, your practice covers Proud Plus for you. Proud Care never starts, changes or cancels a subscription you pay for yourself.

Analytics. While you are connected to Proud Care, Proud does not collect product usage analytics from your app.

Disconnecting. You can disconnect at any time from Settings, Care team. Your practitioner’s access stops immediately, the covered Plus access ends, and your tools return to your own settings. Your practitioner or practice can also end the connection, or it ends on the programme end date. Practitioners you connect to are not Proud’s processors; they are people you choose to share with, bound by their own professional confidentiality.

Photo moderation

Every photo you upload is scanned automatically by Google Cloud Vision before your buddy can see it. The scan checks for sexual and explicit imagery. If a photo is flagged, or if the scan cannot complete, the photo stays hidden from your buddy. Proud shares photos only after they pass. This exists because meal photos go to another person, and that person deserves a basic guarantee about what lands in front of them. The scan is automated; no person at Proud reviews your photos in the normal course of things.

Bloom, DeepSeek, and where your words go

This is a cross border transfer of personal data, including whatever you choose to tell Bloom. It only happens when you use Bloom: opening a conversation, asking Bloom for food ideas, or asking Bloom to reflect on a journal entry. If you never use Bloom, nothing is sent.

Please treat conversations with Bloom accordingly. They are not a confidential clinical disclosure, and Bloom is not a therapist, a medical professional, or a crisis service. Do not share what you would not want processed on servers abroad. If you are in crisis, contact a local crisis line; in the US, call or text 988.

API keys and requests are handled on Proud’s servers, not in the app, and your conversations are not used by Proud to train AI models.

If you are connected to a practitioner through Proud Care, your Bloom, Meal ideas and Unfold requests go only to Anthropic, never to DeepSeek.

The companies Proud relies on

Proud is one person, so infrastructure comes from specialists. Each one is named here, with what it does and where it operates.

Why Proud processes your data

• To provide the service you signed up for (contract): your account, content, buddy relationship, streaks, subscriptions, and notifications you asked for.
• Legitimate interests: photo moderation, abuse prevention and the retention of reports, crash diagnostics, and keeping the service secure. These protect you and your buddy as much as they protect Proud.
• Product analytics: understanding which parts of Proud are useful and where the app needs improvement. Analytics is enabled by default; you can turn it off as described below.
• Bloom: processing the conversations and journal reflections you choose to send to it, as described above.
• Legal obligations: transaction records connected to payments, held by Apple and RevenueCat.

Analytics and your choices

Product analytics is enabled by default. It includes app activity, screens viewed, and account identifiers, and is sent to Google Firebase Analytics and PostHog. In the app, go to Settings, then Manage your data, then the Privacy section, and turn Share usage data on or off. It reads: helps us understand which parts of Proud are useful and fix what is not, and never includes your posts, journal entries, or messages.

Turning it off stops product analytics events. Crash reports stay on either way, so problems can be diagnosed. Analytics never includes the content of your meals, journal, or Bloom conversations.

Some earlier app versions use PostHog for masked recordings of signup and onboarding screens when analytics is enabled. On September 28, 2026, we turned off session replay in Proud’s PostHog project. Older apps with cached settings or an offline connection may need to receive the updated setting before recording stops. The next app update removes the recorder itself. Turning off Share usage data also stops new recordings in earlier versions. These changes do not erase recordings previously collected.

International transfers

Proud’s infrastructure runs mostly in the United States, so if you live elsewhere, your data is transferred to the US. Bloom conversations are additionally processed in China by DeepSeek, as described above. Where transfers leave your region, Proud relies on its processors’ data processing agreements and standard contractual protections, keeps what is sent to each processor to the minimum needed for its job, and keeps Bloom strictly optional.

How long data is kept

• While your account exists: your data is kept so the app works.
• When you delete your account: Proud starts removing your profile, posts and photos, journal, Bloom conversations, meal ideas, buddy links, requests, notifications, and subscription record, and releasing your username. Cleanup can fail or be incomplete, including photo removal. If the app reports an error, retry. If you cannot retry or need help with remaining data, contact theo@proudforus.com. See Delete your account for the exact path.
• Backups: encrypted backups can hold copies for up to 30 more days before they clear. (Weekly backups made before October 12, 2026 keep copies until January 17, 2027 at the latest.)
• Proud Care connections: when a connection ends, your practitioner can no longer see anything new or old. The practice keeps a record that the connection existed (its dates, status and the tools that were on) for up to six years, or until you delete your account, whichever comes first.
• Proud Care audit log: a record of each time a practitioner viewed your information is kept for six years, as health privacy rules expect. It holds internal reference numbers, never your name, email or content, and once your account is deleted those numbers no longer lead back to you.
• Proud Care and account deletion: deleting your account also removes your Proud Care connection, the practice’s view of you, your weekly numbers, reminders and exports.
• Reports: reports filed by you or about you are kept after deletion. This stops someone from erasing an abuse record by deleting and re registering.
• Transactions: Apple and RevenueCat retain transaction records as financial regulations require.

Security

• Data is encrypted in transit (TLS) and at rest.
• Database rules enforce that only you, and where relevant your buddy, can read your data. There is no public read path.
• Passkey sign in means there is no password to steal. If you use a password instead, it is stored hashed.
• API keys for moderation and Bloom live in server side secret storage, not in the app on your phone.

A plain word about sensitive data

What you log in Proud can reveal things about your relationship with food, and sometimes about your health. Proud is built on that assumption: content is visible to one chosen person at most, nothing is public, nothing is sold, there are no ads, and no third party gets your content except the ones named above doing the specific jobs described. Proud does not ask for diagnoses and does not want them.

Children

Proud is not directed at children under 13, and you must be at least 13 to create an account. If the law where you live sets a higher age for consenting to data processing, that higher age applies. If you believe a child under the minimum age is using Proud, write to theo@proudforus.com and the account will be deleted.

Your rights

If you are in the European Economic Area, the UK, or anywhere with similar law, you have the right to:

• Access the personal data Proud holds about you.
• Correct it if it is wrong.
• Delete it (the app has a built in path for this).
• Receive a portable copy.
• Object to or restrict certain processing.
• Withdraw consent where processing relies on it. You can also turn off product analytics with the in-app toggle and stop sending content to Bloom by not using it.
• Complain to your local supervisory authority.

To exercise any of these, email theo@proudforus.com from the address on your account. You will get a reply within 30 days.

Changes to this policy

When this policy changes, the date at the top changes with it, and the changelog below says what moved. For significant changes you will be told in the app before they take effect.

• October 12, 2026. Added Proud Care: exactly what a practitioner you connect to can and cannot see, how tools, AI, cost and disconnecting work, and how long Care records and the audit log are kept. Corrected how long backups are kept.
• October 8, 2026. The phone number is optional from app version 2.2 and there is no longer a texted code. Listed the onboarding answers Proud keeps, including the new pattern questions, what they are used for, and which of them analytics records, and the supporter questions. Added Meal ideas: the foods you like and the ideas you save, who can see them, and when they are sent to Bloom.
• September 28, 2026. Clarified that product analytics is enabled by default and can be turned off in Settings, recorded the PostHog replay shutdown and removal of the recorder from the next update, disclosed phone collection and required SMS verification for new consumer accounts in that update, clarified that existing accounts keep access, and explained deletion retries.
• August 28, 2026. Added the Android waitlist section. The website can now store an email address you choose to leave, and this page says how that address is handled.
• July 26, 2026. Complete rewrite. Every processor is now named, including DeepSeek and the Anthropic fallback behind Bloom. Added buddy visibility, moderation, transfers, retention, and GDPR rights sections. Replaces the previous policy, which named no third parties.

Contact

Questions, requests, or something this page should say and does not: theo@proudforus.com.