Privacy policy

In short

LowFodmaps is a diary and a guide for people following a low-FODMAP diet. To work, it stores what you choose to write in it: what you ate, how you felt, and how your food tests went. That is information about your health, so we treat it with extra care.

We do not sell your data, we do not show ads, we do not use your entries to profile you, and nobody at AlternativePurple reads your diary unless you ask us for help with it. You can download everything, or delete everything, from Settings at any time.

1. Who is responsible

The data controller is Alternativepurple, Unipessoal Lda, NIPC 516357948, Rua da Mata de São Mateus, Nº 34, Alto de Santa Catarina, 1495-735 Cruz Quebrada - Dafundo, Portugal ("AlternativePurple", "we"). For anything about your data, write to hello@mudacorp.com.

2. What LowFodmaps is — and is not

LowFodmaps is a self-tracking tool. It is not a medical device, it does not diagnose or treat anything, and nothing in it is medical or dietetic advice. We do not review, interpret or act on what you log. See the Terms of service for the full disclaimer.

3. What we collect

Account data: your email address, your language, and the date you joined. If you sign in with Google, Google tells us your email address and name; we do not receive your Google password or contacts.

What you log — health data: meals and drinks you write down, your daily gut score and notes, the phase of the diet you say you are in, the reintroduction tests you start, their day-by-day results and your verdicts. You decide what to enter; none of it is required to open the food table.

Billing data: payments are handled by Stripe. We receive your subscription status, the plan, the dates and a customer reference. We never see or store your full card number.

Technical data: like every website, the servers that deliver LowFodmaps record your IP address, browser type and the time of each request, for security and to fix faults. The app keeps you signed in and remembers your language using your browser's local storage.

Usage data: to understand how LowFodmaps is used we use PostHog (hosted in the European Union): which screens are opened, which buttons are tapped, and session replays. In the app, every piece of text and every field is masked in those replays — we see the layout and the taps, never what you write or what your entries say. On our pages PostHog only counts visits, anonymously: no cookie, nothing stored on your device, no recordings and no IP address kept — and nothing at all if your browser sends Do Not Track or Global Privacy Control, or if you turn statistics off at the bottom of this page. The app keeps a PostHog identifier in your browser's local storage.

The free food table works without an account. What you search for there stays in your browser and is not sent to us.

4. What we do not do

No advertising and no advertising trackers on LowFodmaps. No sale or rental of personal data. No sharing of your entries with insurers, employers or data brokers. No automated decisions about you, and no use of your entries to train artificial-intelligence models.

5. Why we use it, and on what legal basis

To give you the service you signed up for — your account, your diary, your plan (performance of our contract with you, GDPR Art. 6(1)(b)).

For your health data specifically: your explicit consent (GDPR Art. 9(2)(a)), which LowFodmaps asks for before you log anything. You can withdraw it at any time by deleting your entries in Settings or by writing to us; withdrawing does not affect what was done before.

To bill you and keep the invoices the law requires (contract, and legal obligation, Art. 6(1)(c)).

To keep the service secure and working — preventing abuse, diagnosing errors (our legitimate interest, Art. 6(1)(f)). We do not use your diary entries for this.

6. Who processes it for us

We use a small number of providers, each bound by a data processing agreement and allowed to use your data only to provide their service to us: Supabase (database and sign-in; your entries are stored in the European Union, in Ireland), Cloudflare (delivers the website and app), Stripe (payments and invoices), Resend (sends sign-in and service emails), PostHog (usage statistics and masked session replays, stored in the European Union) and, only if you choose to sign in with it, Google.

Some of these companies are based in the United States or may process data there. Where personal data leaves the European Economic Area, it is protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

We may disclose data if a law or a court order requires it. If LowFodmaps is ever transferred to another company, your data would move with it under this policy and we would tell you first.

7. How long we keep it

Your entries stay until you delete them. You can erase everything you logged from Settings, immediately.

If you cancel your subscription, your account and entries are kept so you can come back to them. To delete your account entirely, write to hello@mudacorp.com; we do it within 30 days. Backup copies are overwritten on a rolling basis within a further 30 days.

Invoices and payment records are kept for as long as tax and accounting law requires (ten years in Portugal). Server logs are kept for a limited period and then deleted.

8. Your rights

You can see your data (it is all in the app), correct it, download it in a standard format (Settings → Download my data), delete it, ask us to restrict or stop a use of it, and withdraw your consent. Write to hello@mudacorp.com for anything the app does not let you do yourself; we answer within one month and it costs nothing.

If you think we have handled your data wrongly, you can complain to your data protection authority. In Portugal that is the Comissão Nacional de Proteção de Dados (cnpd.pt). We would rather hear from you first and put it right.

9. Security

Connections to LowFodmaps are encrypted. Each entry is stored against your account, and the database itself enforces that only your account can read or change it. Access by our own staff is limited to what is needed to run the service and to help you when you ask.

No online service can promise perfect security. If a breach affecting your data ever occurs, we will tell you and the authorities as the law requires.

10. Age

LowFodmaps is for adults. It is not intended for anyone under 18, and a restrictive diet for a child or teenager should only be followed with a health professional. If you believe a minor has created an account, write to us and we will remove it.

11. Changes to this policy

If we change this policy we will update the date at the top. If a change affects how we use your health data, we will tell you in the app and ask for your consent again where the law requires it.