Dabba Diary Privacy Policy
Last updated: October 16, 2026 · Version: 2026-10-16
This policy covers the Dabba Diary iPhone app, including the TestFlight beta, and the Dabba Diary pages on bumbibeelabs.com.
1. Who we are and who to contact
Dabba Diary is made by Bumbibee Labs Inc, a company based in Ontario, Canada ("we", "us").
- Privacy contact: Privacy Officer at [email protected]
- Mailing address: [Mailing address: to be added before beta emails]
This person is accountable for how we handle your personal information and answers privacy questions and requests.
2. The short version
- We keep what Dabba Diary needs to suggest your family's meals: your sign-in, your family's food rules, and what you cook.
- We never receive your voice recordings. We keep only the text.
- No ads, no tracking, no selling your data. There's no advertising or analytics SDK in the app.
- Some of your data is handled outside Canada by our service providers (Google and Apple). Details are in section 6.
- You can see and edit your family's data in the app, and delete your account and data any time in Settings → Delete account.
3. What we collect, and why
| What | Examples | Why we need it |
|---|---|---|
| Sign-in details | Your email address, or the email Apple gives us with Sign in with Apple (which can be a private relay address). If you create an email account, a password (handled by Google Firebase; we can't see it). A user ID that our sign-in service assigns. | To create your account, sign you in and keep your family's data private to you. |
| Your first name | Only if Apple shares it when you first use Sign in with Apple. | To greet you in the app. |
| Family profile | A family name, the number of adults, each child's nickname and age band, who takes a tiffin, spice levels. No birth dates, photos or school names. | To plan meals that suit everyone, including kids' tiffins. |
| Food rules | Diet (for example vegetarian, vegan, Jain, eggetarian), no-onion/garlic, fasting days, no-non-veg days, foods you avoid (for example beef or pork), and allergies, including anything you type under "Other". | To leave out dishes that don't fit your family. Allergies are health information, and some food rules can hint at religious practice, so we treat all of this as sensitive: we use it only to filter suggestions and never for anything else. |
| What you cook | Meals you log or accept, the text you type or say when logging, dishes you add or mark "never suggest", swaps, your need-to-buy list and ticks, and when you tapped Share plan. | To learn your family's food and make tomorrow's suggestions better. |
| Settings | Your reminder time and on/off setting, school days, and your phone's time zone. | To get dates right and schedule your daily reminder. The reminder is set on your phone, not sent from our servers. |
| Consent records | When you confirmed you're 18 or older, whether you chose to get emails from us (and when), and which version of this policy you saw. | To show we asked for and recorded your permission. |
| Messages you send us | Emails to [email protected] and beta feedback you choose to send. | To answer you and fix problems. |
We don't collect: voice recordings, your location, your contacts, photos, payment details, advertising identifiers, or who you share your plan with.
We don't use an analytics or crash-reporting service in the app today. If we add one, we'll update this policy first and tell you in the app.
4. Voice: how talking to Dabba Diary works
When you tap the mic, your iPhone turns your speech into text on the device when it can. If on-device recognition isn't available for Indian English on your phone, Apple's speech recognition service does it instead, and Apple processes the audio under Apple's own privacy policy. To help it recognise dish names like "bhindi" or "poha", the app may pass your family's dish names to the recogniser as hints.
We never receive or store audio. Only the text comes back to the app, you can edit it, and it's saved with your meal log.
5. Our AI helper
To understand what you typed or said (for example "kal raat rajma chawal banaya"), and to suggest details for a new dish you add, our server sends the following to Google's Gemini API:
- the meal text you typed or said,
- your family's dish names and their other spellings,
- today's date and your local time (so "yesterday" means the right day).
We don't add your name, email address or your family members' nicknames. The meal text is sent as you wrote or said it, so please don't include anything you don't want shared. You always check and edit what the AI suggests before it's saved.
We use Gemini's paid service. Under Google's terms for the paid service, Google doesn't use these requests to improve its products, and keeps them for a limited time only to detect misuse and meet legal requirements. Google may process or briefly store them in any country where it has facilities.
6. Who handles your data for us, and where
We don't sell or rent your personal information. We share it only with these service providers, only so they can run Dabba Diary for us, and under their contracts and security commitments:
| Provider | What they do for us | Where the data is handled |
|---|---|---|
| Google Firebase / Google Cloud (Cloud Firestore database, Cloud Functions) | Stores your family's data; runs our server code (the AI helper and account deletion). | Our database and server code are set up in Google Cloud's Montréal, Canada region (northamerica-northeast1). |
| Google Firebase Authentication | Signs you in; stores your email, user ID, and (for email accounts) your password. It also logs IP addresses for a few weeks to prevent abuse. | United States. Google runs this service only from US data centres. |
| Google Gemini API (paid) | The AI helper described in section 5. | May be processed in any country where Google has facilities. |
| Apple | Sign in with Apple, speech recognition (section 4), TestFlight beta distribution and feedback. | Under Apple's own privacy policy; may be outside Canada. |
Because some of these providers are outside Canada, your information may be stored or processed in the United States or other countries, where it can be accessed by courts, law enforcement and national security authorities under those countries' laws.
We may also share information if the law requires it, or as part of selling or reorganising our business (the buyer would have to keep protecting it under this policy).
When you use Share plan, you send the plan from your own app (for example WhatsApp or iMessage). We never see who you send it to. The default message says "Kids' tiffin" rather than your children's nicknames.
7. How long we keep it
- Your account and family data: while you have an account. If you don't open Dabba Diary for 24 months, we'll email you and then delete the account.
- When you delete your account (Settings → Delete account), we delete your family's data, your profile and your sign-in right away. If you ask us by email instead, we'll delete them as soon as we can and within 30 days. Copies can remain for a limited time in our providers' backup and log systems before they're overwritten:
- our database backups: within 28 days (we keep weekly backups for 28 days);
- Google's sign-in service: up to 180 days, under Google's own deletion schedule.
- Beta: we may need to reset beta data when the beta ends or before public launch; we'll tell you first.
- Emails you send us: up to 2 years, then deleted.
- Email consent records: we keep a record of your consent for as long as we email you and for 3 years afterwards, so we can prove we had permission.
8. How we protect it
- Data is encrypted in transit and at rest by our providers.
- Each family's data can be read only by that family's signed-in account; our database rules block everyone else.
- The AI key is kept on our server, never in the app, and our server logs don't include your meal text.
- Only people at Bumbibee Labs Inc who need access to run the app can get it.
No system is perfectly secure. If you think something's wrong, email us right away.
If there's a data breach that creates a real risk of significant harm to you, we'll tell you and report it to the Office of the Privacy Commissioner of Canada as soon as we can, as Canadian law requires. We keep a record of every breach.
9. Your choices and rights
- See and edit your family's data any time under What we know and Settings.
- Delete your account and all its data in Settings → Delete account. (If you used Sign in with Apple, Apple asks you to confirm once more so we can disconnect it.)
- Turn off the daily reminder in Settings → Reminder.
- Stop our emails with the unsubscribe link in any email, or by writing to us. We'll stop within 10 business days.
- Ask for a copy of your information, ask how we've used it, or ask us to correct it: email [email protected]. We'll reply within 30 days and may need to confirm it's you.
- Withdraw consent for us to use your information at any time (subject to legal limits); since Dabba Diary can't suggest meals without it, the way to do this is to delete your account.
- Complain: talk to us first. If we can't sort it out, you can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca). In Quebec, you can also contact the Commission d'accès à l'information.
These choices apply to everyone who uses Dabba Diary, wherever you live.
10. Children
Dabba Diary is for adults (18 or older) who plan family meals. It isn't made for or directed at children, and children shouldn't use it or create an account. Parents enter only a nickname and age band for each child; we don't collect birth dates, photos or school names. If you think a child has created an account, email us and we'll delete it.
11. Ads, paid plans and grocery partners (not in the app today)
Dabba Diary has no ads, no paid plans and no grocery-store links today. If we add any of these later, we'll update this policy before the change, tell you in the app, and ask for your permission where it's needed (for example, Apple's "Allow tracking?" prompt before any ad tracking). We won't share your family's data with a grocery partner unless you choose to send your list to them.
12. Changes to this policy
If we make an important change, we'll update this page, change the date at the top and tell you in the app before it applies. Earlier versions are available on request.
13. Contact
Bumbibee Labs Inc · [Mailing address: to be added before beta emails] · [email protected]