Privacy Policy

Last updated: June 18, 2026

This Privacy Policy explains how BiteSizeSkills, LLC (“we,” “us,” or “our”) collects, uses, and protects your information when you use the Pula mobile application and related services (the “Service”). We are the data controller for the personal information described below.

Pula supports people working on hair pulling (trichotillomania) and other body-focused repetitive behaviors (BFRBs). Some information you choose to enter may relate to your health or wellbeing. We treat this information as confidential and process it only as described here.

1. Information we collect

Information you provide

Account information — your email address and authentication credentials, used to create and secure your account.
Your activity and reflections — lesson progress, streaks, journal entries, logs, and other responses you enter in the app.
Voice recordings — if you choose to dictate a text entry instead of typing, the audio you record is captured and sent to our speech-to-text provider to convert it into text. Using your voice is always optional; you can type any entry instead.
Communications — messages you send us (for example, support requests).

Information collected automatically

Device and usage data — app version, device type, operating system, and basic diagnostic/log data used to keep the Service reliable.
Subscription status — whether you have an active subscription or purchase, provided to us by our payments partner.

Payments

Purchases are processed by the Apple App Store or Google Play, and subscription status is managed through RevenueCat. We do not receive or store your full payment card details.

2. How we use your information

Provide, maintain, and personalize the Service;
Sync your progress securely across your devices;
Manage subscriptions, purchases, and access to content;
Respond to your requests and provide support;
Monitor, secure, debug, and improve the Service;
Comply with legal obligations.

3. Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we process personal data on the following bases: performance of our contract with you (to provide the Service); your consent (for any health-related reflections you choose to enter); our legitimate interests (to secure and improve the Service); and compliance with legal obligations.

4. How we share information

We do not sell your personal information. We share it only with service providers who process it on our behalf, including:

Supabase — authentication, database, and storage hosting;
RevenueCat — subscription and entitlement management;
Google (Gemini API) — generating lesson audio narration and converting your optional voice recordings into text. Google processes this content only to provide these features and does not use it to train its models;
Sentry — crash and error diagnostics that help us keep the Service reliable;
Apple and Google — app distribution and payment processing.

These providers act on our behalf under agreements that limit them to processing your information only as needed to provide their service to us. We do not use your activity, reflections, logs, or voice recordings for advertising, and we do not allow our providers to do so. We may also disclose information if required by law or to protect the rights, safety, and security of our users and the Service.

5. Data retention

We keep your information for as long as your account is active or as needed to provide the Service. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain it to comply with legal obligations.

6. Your rights and choices

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Some of the information you may choose to enter is sensitive (for example, reflections relating to your health or wellbeing); we process it only with your consent and only to provide the Service, you can withdraw that consent at any time, and where applicable law gives you the right to limit the use of sensitive personal information, you may exercise it. We do not sell or “share” your personal information for cross-context behavioral advertising, and we will not discriminate against you for exercising any of these rights. You can request to delete your account and associated data at any time by contacting us at privacy@bitesizeskills.com.

7. Security

We use industry-standard safeguards, including encryption in transit and access controls, to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. International transfers

We and our service providers are based in or process data in the United States, so your information may be transferred to and processed in countries other than where you live. Where such transfers are subject to the GDPR or UK GDPR, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), to protect your information.

9. Children’s privacy

The Service is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, please contact us so we can remove it.

10. Not medical advice

Pula provides educational and self-help content and is not a medical device or a substitute for professional diagnosis or treatment. See our Terms of Service for more.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date above and, where appropriate, notify you in the app.

12. Contact us

BiteSizeSkills, LLC
privacy@bitesizeskills.com