Your data, in plain English.
No legalese, no buried clauses. Here's what Gunny touches, where it lives, and what we'll never do with it.
Last updated: July 15, 2026
What Gunny reads
The meals you log — by photo, voice, or barcode — plus the Apple Health or Health Connect data you choose to share (HRV, resting heart rate, sleep, weight, steps, workouts), your journal, your meal ratings, and any health conditions you log. You decide what's on, and you can turn any of it off in Settings, any time.
Where it lives
Your logs, health metrics, journal entries, ratings, photos, health conditions, and profile are stored on your device — in your own private iCloud account on iOS, or your device's local storage on Android.
To make that same data available across your devices, and to protect it against a lost or wiped phone, we also keep an encrypted copy in our own database. It's encrypted at rest, in a form we can't casually read, and it exists for exactly two reasons: syncing between your devices, and backup. It's never sold, never used for advertising, and never used to train AI models.
How the coaching works
To answer you, the details needed for that answer are processed by our coaching engine — Cloudflare plus Anthropic's Claude API — over an encrypted connection, and the response comes back. Your data is never sold, never used for advertising, and the coaching inputs are not used to train AI models. Nothing is kept on the engine beyond your profile, so Gunny remembers your goals between chats.
The specifics
Meal photos are sent only to read the plate — they aren't stored on the engine. Calendar titles can go along for schedule-aware coaching; that includes shared and family calendars, so we tag which calendar an event came from and never assume it's yours. Location is only ever a city or the place you're standing in — never your coordinates.
Web search
Gunny searches the web in three places: when you ask something that needs current information, automatically while logging a meal at a restaurant (to match your order to the real menu), and in the Restaurant Concierge feature. Those searches run on Anthropic's servers. Your name, health conditions, and other personal details are never placed into a search query.
Barcode scanning
Scanning a packaged food's barcode looks it up against OpenFoodFacts, a free, third-party, open nutrition database — without needing the AI coaching engine at all. Only the barcode is sent, no data that identifies you.
Health Records & conditions
If you connect Apple Health Health Records, Gunny can import diagnosed conditions — read-only, only when you tap Import, revocable any time. When you log a condition, Gunny keeps a private daily record while it's active so coaching accounts for it over time. Delete a condition and every trace of it, including that daily history, is gone for good.
What we store, and for how long
Your profile and synced logs (meals, workouts, weight, journal, and similar) are kept until you delete your account. Deleting your account erases your profile and health data from our systems immediately. A small amount of account bookkeeping (IDs, timestamps, billing history — no health data) is kept for 30 days for fraud prevention and financial recordkeeping, then permanently deleted.
Who can see your data
James, Gunny's founder, can look up individual accounts through an internal admin tool for support and business operations — profile info, subscription status, usage and cost — never the content of your conversations, journal, or photos. Those aren't visible through that tool; they're not stored in a form that would allow it.
Your call, always
Delete your data whenever you want, right from the app. Questions about any of this? Write us at privacy@gunnyhealth.com and a human will answer.