Privacy policy

Who we are

Bucket is made and operated by Chris Tomlinson, trading as SoleGrit, a sole trader at 9 Conway Close, Wirral, CH63 2JT, United Kingdom. ICO registration number: ZC288061. For anything in this policy, email bucket@solegrit.io. Where UK data protection law applies, we are the controller for the small amount of data described under What reaches us, Problem reports and This website and the waitlist, and you are in control of everything else.

How Bucket is built, and why it matters here

Bucket is designed so that we cannot see your health data, rather than promising not to look. Everything you log — symptoms, food, exposures, life events, check-ins, conditions, patterns — is stored on your device and synced through Apple's CloudKit to your own iCloud account, in a private database that only your devices can read. Apple is your provider for that storage, not ours; we have no server that holds it and no means of access. The one exception is a problem report you choose to send us.

What stays on your device, and what syncs to your iCloud

What reaches us — smart parsing

Smart parsing is off until you turn it on, and turning it on happens on a screen that explains exactly what follows. With it on:

• The text of a note you save, or a photo of a meal or rota you choose to send, is sent to our server (a Cloudflare Worker) and from there to Anthropic, our AI provider, to be turned into structured entries. It is used to produce your result, read once, and not stored by us. Anthropic processes it under its commercial API terms, which do not permit training on it.
• A photo of a staff rota may show colleagues' names. It is sent only when you pick that photo for that purpose, and only your own shifts are kept — as plain entries with no names on them.
• To meter your allowance, our server keeps an account: a one-way hash of your Sign in with Apple identifier (not the identifier itself, and never your name or email, which we do not ask for), a running allowance balance, and a token that lets your device stay connected. That is all it holds — no health data of any kind.
• When you ask Bucket to guess what's in a product, a dish or a cannabis strain, only its name (and, for a product, whether it's a fragrance, a cleaning product and so on) is sent. The answer is kept on our server so the next person who asks gets it instantly — the name and its contents only, with nothing that links it to you or says when you asked. Dishes named after a person ("Mum's lasagne") are never kept. When you tap a guess as right or wrong, a count on that entry goes up; nothing says who.

Turning smart parsing off stops all of this immediately. Notes made while it is off never leave your phone, unless you choose to include one in a problem report.

Barcodes and labels

Barcodes and ingredient lists are read on your phone. To look up a barcode, only its number is sent to our server, which asks Open Food Facts (an open, public database) and keeps the answer by barcode for the next person. If nobody knows a barcode, the ingredients you photograph for it are kept the same way — the product's name and list only, never linked to you. A photo of a safety data sheet is read by our AI provider when smart parsing is on, used once and not stored. As you type a product's name, the letters are sent to suggest names others have looked up; they aren't kept.

Medicine labels

When you tap Look up the label on a medicine, its name is sent to our server, which fetches the side-effects section of the official US label from the FDA's public openFDA service and keeps a copy by medicine name — never linked to you. The FDA sees our server, not you. This needs you signed in, but not smart parsing, because no AI is involved.

Weather, air quality and pollen

If you enable local conditions, Bucket asks Open-Meteo for the day's air quality, pollen, pressure, temperature, humidity and UV for a coarse area — your location rounded to roughly 11 kilometres, or a postcode you type, geocoded on your device by Apple. No identifier accompanies the request. Bucket asks iOS for reduced-accuracy location by default.

Apple Health

With your permission, Bucket reads the measures listed above to give its pattern-finding a steady daily baseline, and can write the symptoms you log back into Apple Health so your records stay in one place. Health data is never used for advertising or marketing, never shared, and never placed in iCloud by Bucket. You control every category in the Health app, and can stop Bucket reading at any time in Bucket's settings.

Problem reports

If something goes wrong, you can report it from Something wrong? on a saved log, from Settings, or by shaking your phone. Reports are optional, and nothing changes for anyone who never sends one.

• What's in one: your note, a picture of your screen, and a short record of what happened — the words of a recent log, which reader handled them and what it made of them, the app and phone versions, and recent error codes.
• You stay in charge of it: you see all of it first, and can switch off the picture and any log. It goes as an ordinary email from your own account to bucket@solegrit.io. Nothing is sent unless you press Send, and the app has no server for this.
• It may hold health details: whatever your screen or those logs show. We use a report only to fix the problem, and delete it once that's done, within 90 days at most. To have one deleted sooner, email bucket@solegrit.io.
• Where it sits: our mailbox is held by Apple, through iCloud Mail. A copy may also stay in your own email account's sent mail, which is yours to delete. Delete everything in the app can't reach an email once it has gone.

Your rights, built in

• Export — a complete, documented file of everything you have logged, from Settings › Your data. It is yours to keep, move or hand to a clinician.
• Delete — Settings › Your data › Delete everything removes your data from this phone, from your iCloud, and from our server, and can also remove the symptoms Bucket wrote to Apple Health. Because we hold no copy, deletion is complete when it finishes. The one exception is a problem report you chose to email us: it can't be reached from the app, so email us and we'll delete it.
• Correct — every entry can be edited or deleted individually.
• Withdraw consent — turn smart parsing off at any time; stop Apple Health or calendar access at any time; ask us to delete a problem report you sent.
• In the UK you can complain to the Information Commissioner's Office (ico.org.uk); elsewhere, to your local data-protection authority.

This website and the waitlist

Visiting the site. This website sets no cookies and carries no adverts or trackers. We count visits with Cloudflare Web Analytics, which uses no cookies and builds no profile of you: it records which page was viewed, the site that linked to it, the kind of device and browser, the rough country, and how quickly the page loaded. Like any web host, Cloudflare handles your connection (including your IP address) to deliver the site and protect it from abuse. Cloudflare also tells the site your rough country as each page is requested, so that the page can show the price for where you are; we don't store it, and it isn't linked to you. Your Calm view and font choices are remembered in your own browser and never sent to us.

Joining the waitlist. The form asks for your email address and nothing else — never anything about your health. If you join, we hold:

• your email address;
• when you joined and when you confirmed;
• which version of the sign-up wording you saw, as a record of your consent.

We use it for one thing: to send you one email when Bucket launches, with the App Store link. Before that, we send a single email asking you to confirm the address is yours; if you don't confirm within 7 days, your address is deleted automatically. The list is stored in our database on Cloudflare and the emails are sent through Cloudflare. It is never shared, sold or used for anything else, and we delete the whole list within 30 days of sending the launch email.

To bot-proof the form, Cloudflare Turnstile runs a quiet check in your browser when you use it. It tells people from bots by looking at signals from your browser and device; it is not used for advertising or to follow you across other sites.

Leaving. Every email we send has a link that deletes your address straight away, or you can write to bucket@solegrit.io.

Lawful basis

Health data is special-category data. Everything Bucket stores for you is stored under your explicit consent, given when you set the app up and each time you grant a permission, and it never leaves your control. The transient processing for smart parsing is under your explicit, separate consent, given on the consent screen and withdrawable there. A problem report is handled under your explicit consent, given by choosing to send it. Waitlist emails are held under your consent, given when you join and confirm, and withdrawable at any time.

Visit counts, showing the price for your country and the bot check rely on our legitimate interest in keeping this website working, accurate, secure and free of abuse; none of them uses cookies or identifies you.

Retention

Your data stays on your devices and in your iCloud until you delete it. Our server keeps the metering account until you delete it in the app. Nothing sent for smart parsing is retained after your result is produced. Problem reports are deleted once the problem is fixed, within 90 days at most. Waitlist addresses are deleted 7 days after signing up if not confirmed, straight away if you leave, and within 30 days of the launch email otherwise.

Children

Bucket is for adults managing their own health and is not directed at children under 16.

Processors

Changes

We will update this page and its date when our practices change, and tell you in the app if a change affects what leaves your phone.