Privacy Policy
Last updated: 30 July 2026
Who we are
Rumbelly is made by Mele Apps, Switzerland ("we", "us"). We are the data controller for the Rumbelly app and for rumbelly.com. Contact: info@rumbelly.com.
The short version
Your food and gas logs stay on your device. Meal photos are analysed and never stored by us. No account is needed, we show no ads, and we never sell your data. On the website, analytics only runs if you say yes.
What the app processes
Anonymous ID: the app creates a random anonymous account (Google Firebase) so our server can serve and rate-limit your requests. It contains no name or email. Meal & menu photos: when you scan, the photo is sent over an encrypted connection to our server and forwarded to Google's Gemini API, which returns the analysis. We do not store your photos. Google may retain API inputs for a limited time for abuse monitoring under its API terms. Your logs: meals, gas entries and settings are stored locally on your device only. Optional Google sign-in: if you choose to sign in, we receive your email address and name from Google and store a private backup of your logs in our database (Google Firestore). The backup contains your logs and the identifier of the device that last synced, so we can keep your devices consistent. Only your account can access it. Usage limits: a daily counter linked to your anonymous ID prevents abuse of the scan service. Reminders: optional daily reminders are scheduled locally on your device. Abuse prevention: when you submit the sign-up form we store a hashed, shortened form of your network address for up to 3 days, only to limit how many sign-ups come from one network. It is never shown to anyone and deletes itself.
What the website processes
Email list: if you leave your email, we store it in our own database (Google Firestore, hosted in the United States) and use it only to tell you about Rumbelly's launch and important updates. We do not share it with an email marketing provider. Write to info@rumbelly.com at any time and we will delete it. Analytics: Google Analytics 4 runs only after you accept the consent banner (IP anonymised). If you decline, no analytics loads. Server logs: our hosting (Google Firebase App Hosting) keeps technical logs (such as IP address and request time) for security and operations. Self-check quiz: the quiz on our home page runs entirely in your browser. Your answers and result never leave your device and are never sent to us or to analytics. Storage on your device: we store your consent choice in your browser's local storage. If you accept analytics, Google Analytics sets cookies (kept up to 2 years). You can change your choice any time via "Cookie settings" in the footer.
Legal bases
We process data based on your consent (email list, website analytics, photo analysis when you trigger a scan), on providing the service you request (returning your analysis, backups you enable), and on our legitimate interest in preventing abuse and keeping the service secure. Health data: your meal and gas logs and the analysis results say something about your digestion, so we treat them as health data. Where we process them — analysing a photo you scan, and the optional cloud backup — we rely only on your explicit consent (Art. 9(2)(a) GDPR; Swiss nDSG). You can withdraw that consent at any time by turning backup off or deleting your data; withdrawal does not affect processing already carried out. Our legitimate interest in preventing abuse covers only technical data such as the daily scan counter and server logs.
Who we share data with
Only processors that run the service for us: Google (Firebase, Firestore, Gemini API, Analytics). We do not sell data, we show no ads, and we take no money from the food industry.
International transfers
Our processors may process data outside Switzerland and the EEA, notably in the USA. Safeguards such as the EU Standard Contractual Clauses and the Swiss–US / EU–US Data Privacy Framework apply.
Retention
Photos: not stored by us. Backup: kept until you delete it or your account. Email address: until you unsubscribe or shortly after launch communications end. Rate-limit counters: rolling daily values. Server logs: limited periods set by our hosting provider.
Your rights
You can access, correct, delete and export your data, restrict or object to processing, and withdraw consent at any time. In the app: Settings → Export my data / Delete all my data. For anything else email info@rumbelly.com. You may also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your local data-protection authority.
Deleting your data and account
In the app: Settings → Delete all my data erases the logs stored on your device. To delete your cloud backup and your Rumbelly account as well, use rumbelly.com/delete-account or email info@rumbelly.com — if you used Google sign-in, write from that address so we can verify you. We complete verified requests within 30 days.
Children
Rumbelly is not directed at children. You must be at least 16 to use Rumbelly, or 14 where your country's law allows it (for example Spain), or have your parent's or guardian's permission. We do not knowingly process children's data; if you believe a child has, email info@rumbelly.com and we will delete it.
Health note
Rumbelly helps you spot the foods behind excess gas and bloating. It is an educational tool, not a medical device; analysis results are estimates and no substitute for medical advice.
Changes
We will post any changes to this policy here with a new date.