Privacy Policy

Zabetha is provided by شركة مابعد التقنية (mabaad altqnia Company, trading as BeyondTech), the data controller. Commercial registration no. 7055106723; Jeddah, Saudi Arabia; beyondtech.sa. Contact and Data Protection Officer: privacy@beyondtech.sa.

Much of what you log is health information, which the Saudi Personal Data Protection Law (PDPL) treats as sensitive data. We collect it only because you choose to log it, and we use it only to run the features you use. You can delete entries, disconnect services, or ask us to erase your account at any time.

We collect the data you give the app in order to run it. Specifically:

• Account: name, email, a hashed password, and sign-in sessions.
• Nutrition: every food, meal and portion you log, macros, micronutrients, timing, recipes, meal plans, food preferences, allergies and intolerances.
• Body: weight logs, body-fat estimates, measurements, biometrics, and any progress photographs you upload.
• Health: over-the-counter and prescription medication names, doses and times; supplements; a hair/skin regimen tracker if you use it.
• Daily context and reflections: morning check-in scores and free-text notes, training/rest days, energy level, celebration days, journal entries, and evening debrief reflections.
• Wearables, if connected: sleep, heart rate and heart-rate zones, steps, activity and workout sessions from Google Health, which can include data from your Fitbit device, and from the older direct Fitbit connection until Google switches it off on 2 November 2026.
• Optional: a Telegram chat id if you link the logging bot; your own Google Gemini API key if you supply one.
• Diagnostics: bug reports you submit, including any screenshot you attach.
• Meal-delivery connections: if you connect a meal-delivery service, a sign-in token for it (stored encrypted) and the meals it delivers to you, which we add to your food log.
• Sign-in sessions: when you sign in on the mobile app we keep a session for up to 90 days. For each sign-in session (web or mobile) we record the time, your device/browser type and your IP address, to keep your account secure.
• Website enquiries: if you request a demo, your name, role, organization, email and phone number; if you join the waitlist, your email address. We use these only to reply to you. A demo request is also sent to our team by email and Telegram.

Your data is stored in a database on a cloud server in Saudi Arabia, run by a cloud provider that acts as our data processor. Images you upload are stored on the same server. Encrypted backups are kept in the same country, as described under Retention. Sign-in tokens for connected services (Google Health, Fitbit, meal-delivery providers) and any Gemini API key you supply are encrypted at rest. The rest of the database is not encrypted at rest — we state this plainly rather than implying blanket encryption.

We share data with the following third parties, and only for the reasons below:

• Google (Gemini API) — for AI coaching and text/label reading. See "AI features and what reaches Google" below for the full detail.
• USDA FoodData Central — only the search text you type when looking up a food. No personal data.
• Google Health / Fitbit — outbound only, and only if you connect them; the app reads your data from them, it does not write your app data to them.
• Meal-delivery companies — only if you connect one. We read your orders from them; we do not send them your health data.
• Websites you paste links to — pasting a recipe or food URL causes the server to fetch that page; that site sees a request from the server, not from you directly.
• Telegram — only if you link the bot; messages you send it and the food/supplement names in replies pass through Telegram's servers. We store your Telegram chat ID so we can match messages to your account, and the text of messages you use to log food is also sent to Google's AI to read it. You can unlink the bot at any time in Profile, which removes the chat ID. Our team also receives website demo requests through Telegram.
• Our email provider — for password resets, email-change confirmations, reminders you set, bug reports, and website demo requests.

We do not use advertising networks or analytics/tracking software, we do not sell your data, and we do not share it with data brokers.

We use data we receive from Google Health only to show you your own stats and the features you use in the app. We do not sell it or use it for advertising. It is not sent to the AI features today. If we add AI features that use it, we will first ask for your separate consent inside the app, and you can say no.

We use only cookies the app needs to work: a sign-in session cookie, a language preference cookie, a temporary cookie while you connect Google Health, Fitbit or a meal-delivery service, and, if you are a coach viewing a client's account, a signed cookie that records that. We do not use advertising or tracking cookies.

Our own storage is in Saudi Arabia. Some features send data to services outside it, only when you use them:

• Google (Gemini AI): when you use an AI feature.
• Telegram: if you link the bot.
• Fitbit / Google Health: we read your data from them if you connect them.
• USDA FoodData Central: only the food name you search for.

Other countries may protect data differently than Saudi Arabia does.

Using an AI feature (the coach, quick-log parsing, label reading) sends the following to Google:

• Your coach profile and nutrition trends. Targets, active diet phase, and your nutrition and weight trends over recent days.
• Check-ins, including your free-text notes. Your check-in scores and anything you write in the notes field.
• Daily context. Training or rest day, energy level, and celebration days.
• Medications, by name, dose and time. Both over-the-counter and prescription medications you log — this is the most surprising item on this list, so it is stated plainly.
• Micronutrients, strategies, meal plans and recipes. Micronutrient gaps, your active personal strategies, how your day compares to your meal plan, and your saved recipe names and macros.
• Coach chat history. In the coach chat feature: the full conversation history for that conversation, plus your new message.
• Food preferences. In meal suggestions: your food likes, allergies and intolerances.
• Text and photos you submit for AI parsing. In quick-log and label-reading features: the text you type or paste, and any food-label photo you upload, sent as an image.
• Telegram messages, if linked. If you link the Telegram bot: the message text you send it.

Your journal entries and evening debrief reflections are never sent to the AI. Neither is your password, your email address, or any file you upload other than a food label photo you explicitly submit for reading.

If you add your own Google Gemini API key in Profile, the same categories of data go to Google under your own Google/AI Studio account instead of the app's shared key. The app's shared key is on Google's free tier, under which Google may use what you submit to improve its own products and a human reviewer may read it (after disconnecting it from any account/project). If you supply your own key, whether Google can do the same depends on your own key's tier and billing, which the app has no way to check.

Google's own handling of data sent to the Gemini API is governed by Google's terms, which the operator does not control.

If you accept a coach request, that person can see:

• Everything you eat and drink. Every meal, food and portion you log, with macros, micronutrients and timing — plus your recipes, meal plans, saved presets, and how your actual intake compared to your plan.
• Weight and body composition. Weight logs, body-fat estimates, measurements and biometrics.
• Progress photos. Any physique photos you have uploaded.
• Medications and supplements. The names, doses and times of the medications you log — over-the-counter and prescription — and your supplements.
• Daily check-ins. Your check-in scores and the free-text notes you write in them, energy levels, training vs. rest days, and celebration days.
• Journal and evening reflections. Your journal entries and evening debrief reflections, in full.
• Sleep and activity. If you connect Fitbit or Google Health: sleep, heart rate, steps, workouts and activity.
• Goals, phases and progress. Diet phases, targets, goals, milestones, sprint protocols, deviations, evaluations and progress charts.
• Preferences and calendar. Food likes/dislikes, allergies and intolerances, and upcoming occasions on your calendar.

AI summaries for coaches. A coach can generate an AI summary of your data to prepare for a session. It is created by sending the same kinds of data listed under "AI features" to Google, using either the app's Google key or the coach's own key if they have added one. We keep the summary so the coach can reopen it.

This is all-or-nothing — there is no way to share only part of it today. You can remove your coach at any time, which cuts off their access immediately.

You can remove your coach at any time from the Clients page, which revokes their access immediately.

You can edit or delete individual entries, disconnect Fitbit, Google Health or Telegram, remove your coach, and remove your Gemini key at any time.

You can download a complete export of your account data at any time from Settings → Export your data, and you can deactivate your account from Settings → Danger zone. Deactivating signs you out and blocks further sign-in, and immediately removes you from any coach's client list or friend list — but it does not erase your underlying data from the database. Deactivation can be undone: attempting to sign in again offers a self-service reactivation link sent to your email, though any coach/friend connections removed at deactivation are not restored. If you want your data permanently and completely erased instead, email privacy@beyondtech.sa; see Retention for the timing.

You can ask for access to, correction of, or erasure of your data at any time by emailing privacy@beyondtech.sa, and you can withdraw your consent at any time. Deactivating your account in Settings stops it being used and hides it from other users, but it does not erase your data. Erasure requests are handled as described under Retention. For access, you can also download your data from Settings → Export your data. If data-protection law gives you a right to complain to a supervisory authority, nothing in this policy takes that away; see Contact for SDAIA.

We keep your data while your account is active. If you ask us to erase your account, we delete your data from the live app and database within 30 days of verifying the request.

Backups. We keep encrypted backup copies of the database and uploaded photos on a separate storage service so we can recover from a failure. These copies are locked and cannot be edited or deleted early. Anything you delete, including progress photos, can therefore remain in backups for up to 365 days, then expires automatically. We do not restore deleted data into the live app, and backups are used only for disaster recovery. Backups made before 30 September 2026 are not encrypted, and they expire on the same schedule.

Demo-mode guest accounts, if enabled, are throwaway and seeded from a template rather than real user data.

Zabetha is intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, contact privacy@beyondtech.sa and we will delete it.

We may update this policy as the app or the law changes. The date and version at the top always show the latest one. For material changes we will notify you by email or in the app before they take effect.

Questions, access, correction, erasure or withdrawal requests: privacy@beyondtech.sa. We reply within 30 days, extendable by another 30 days with notice. If you are not satisfied, or we do not reply in time, you can complain to the Saudi Data & AI Authority (SDAIA, sdaia.gov.sa).