Privacy Policy

Introduction

Welcome to Calorie Calculator ("we," "our," or "the App"). Your privacy is important to us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application.

By using Calorie Calculator, you agree to the collection and use of information in accordance with this policy.

If you do not agree with the terms of this Privacy Policy, please do not use the App.

1. Information We Collect

1.1 Personal Information You Provide

Google Account Information:

• When you sign in with Google OAuth, we collect:
  • Email address
  • Google user ID (used as your unique identifier)
  • Profile name (if provided by Google)
  • Profile picture (if provided by Google)

Purpose: Authentication, account management, and personalized app experience.

1.2 Automatically Collected Information

Usage Data:

• AI Request Logs: When you use our AI-powered food recognition feature, we log:
  • Timestamp of requests
  • Analysis type (image or text)
  • Whether the response was served from cache
  • User ID (linked to your Google account)

Purpose: Service optimization, rate limiting, abuse prevention, and improving AI accuracy.

Analytics Data (Optional - Requires Your Consent):

• When you opt-in to analytics, we collect via PostHog:
  • App events (button clicks, feature usage, screen views)
  • User properties (app version, platform, device type)
  • Session data (session duration, app opens)
  • Anonymous device ID (randomly generated UUID, not personally identifiable)

Important: Analytics collection is opt-in only. You will be asked for consent after 24 hours of first use, and you can opt-out anytime in Settings.

Purpose: Understand how users interact with the app, improve features, fix bugs, and prioritize development.

Device Information:

• IP Address (collected for rate limiting and security purposes)
• User Agent (browser/device type)
• Accept-Language (for localization)

Purpose: Security, fraud prevention, rate limiting, and service optimization.

Advertising Identifiers:

• Google Advertising ID (Android)
• IDFA (iOS, if applicable)

Purpose: Displaying relevant advertisements via Google AdMob.

1.3 Camera and Photo Library Access

Camera Access:

• Required for capturing food photos for AI analysis
• Images are temporarily processed and NOT permanently stored on our servers
• Images are only transmitted to Google Gemini AI API for food recognition

Photo Library Access:

• Required to select existing photos from your device
• You control which photos are shared with the app

Purpose: AI-powered food recognition and nutritional analysis.

1.4 Local Device Storage

SQLite Database:

• All your food logs, nutritional data, and app settings are stored locally on your device
• Data is NOT automatically synced to our servers unless you explicitly opt-in
• You retain full control over your data

App Preferences (Stored Locally):

• Analytics consent (whether you opted in or out)
• First app open timestamp (to determine when to show analytics consent dialog)
• Update dialog tracking (when you last dismissed an update reminder)
• Theme preferences (dark mode, text display settings)
• Nutrition goals (daily calorie and macro targets)

Purpose: Provide personalized app experience and respect your preferences.

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Core Functionality

• Authentication: Verify your identity via Google Sign-In
• Food Recognition: Analyze food photos using AI (Google Gemini API)
• Nutritional Tracking: Calculate and store calorie/macro data locally
• App Personalization: Customize your experience based on preferences

2.2 Security & Abuse Prevention

• Rate Limiting: Prevent abuse of AI services (50 requests/hour per user)
• Fraud Detection: Identify suspicious activity patterns
• IP-Based Restrictions: Block malicious actors (200 requests/hour per IP)

2.3 Service Improvement

• Analytics (PostHog): Understand feature usage and app performance (opt-in only)
• Product Analytics: Track which features are most used to prioritize improvements
• Bug Detection: Identify crashes and errors to improve stability
• User Experience: Understand user flows to optimize the app interface
• Cache Optimization: Reduce API costs by caching common food items
• App Updates: Check Google Play Store / Apple App Store for newer versions
• Update Reminders: Track when you dismiss update notifications to avoid spam (shown every 7 days)

2.4 Advertising

• Display Ads: Show relevant advertisements via Google AdMob
• Ad Personalization: Based on Google Advertising ID (you can opt-out in device settings)

3. Data Sharing and Disclosure

3.1 Third-Party Services

We share data with the following third-party services to operate the App:

Google Services:

• Google Sign-In: Authentication (email, user ID, profile)
• Google Gemini AI API: Food image analysis (temporary image transmission)
• Google AdMob: Advertising (device identifiers, usage data)
• Google Play Services: App update checking (version comparison)

Supabase (Backend Infrastructure):

• Authentication: User accounts and JWT tokens
• Database: AI request logs, rate limiting data, cached responses
• Edge Functions: Secure API proxy for Gemini AI

Deno Deploy:

• Edge Functions: Serverless functions for AI request processing

PostHog (Analytics - Opt-In Only):

• Product Analytics: App events, feature usage, user flows (only if you consent)
• Session Recording: NOT enabled (we don't record screens)
• Data Location: US Cloud (PostHog Cloud)
• Privacy: Uses randomly generated UUID, NOT personally identifiable
• Opt-Out: You can disable in Settings at any time

3.2 We DO NOT Sell Your Data

We do NOT sell, rent, or trade your personal information to third parties for marketing purposes.

3.3 Legal Compliance

We may disclose your information if required by law, such as:

• Court orders or subpoenas
• Government investigations
• Compliance with GDPR, CCPA, or other data protection laws
• Enforcing our Terms of Service

4. Data Retention

4.1 Account Data

• User accounts: Retained while your account is active
• Deletion: You can delete your account anytime (see Section 6)

4.2 AI Request Logs

• Retention Period: 90 days
• Purpose: Security, abuse prevention, and service optimization
• After 90 days: Automatically deleted from our servers

4.3 Cached AI Responses

• Retention Period: 24 hours
• Purpose: Reduce API costs and improve response times
• Privacy: Does NOT contain personal identifiers (hashed cache keys)

4.4 Analytics Data (PostHog)

• Retention Period: Indefinite (until you request deletion or opt-out)
• Anonymization: Data is pseudonymized (linked to randomly generated UUID, not your identity)
• Deletion: You can opt-out anytime in Settings, which stops future collection
• Data Removal: To delete past analytics data, contact us at ziepakker@gmail.com

4.5 Local Device Data

• Your Control: All food logs and nutritional data stored locally
• Deletion: Uninstalling the app removes all local data

5. Data Security

We implement industry-standard security measures:

5.1 Technical Safeguards

• Encryption in Transit: All data transmitted via HTTPS/TLS
• JWT Authentication: Secure token-based authentication
• Row-Level Security (RLS): Database access restricted to authenticated users
• API Key Security: Gemini API key stored server-side (never exposed in app)

5.2 Access Controls

• Supabase RLS Policies: Only you can access your own data
• Rate Limiting: Prevents brute-force attacks and abuse
• Atomic Transactions: Prevents race conditions in rate limiting

5.3 No Guarantees

While we strive to protect your data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

6. Your Privacy Rights

6.1 Access and Correction

• You can view and edit your profile information in the App settings
• Food logs are stored locally on your device and under your control

6.2 Data Deletion

To delete your account and data: Please visit our Account Deletion page or email us at ziepakker@gmail.com with your account email address and a request to delete your account. We will process your request within 30 days.

What gets deleted:

• Your Google account link (email, user ID)
• AI request logs associated with your account
• Rate limiting records
• Analytics data (PostHog) if you request it
• Local device data (when you uninstall)

What is NOT deleted:

• Anonymized analytics data (cannot be linked back to you)
• Cached AI responses (automatically expire in 24 hours)

6.3 Opt-Out of Analytics

To disable analytics tracking:

1. Open the App
2. Go to Settings
3. Toggle OFF "Share Analytics Data"
4. Your preference is saved immediately

Effect: We will stop collecting analytics events. Past data remains in PostHog unless you request deletion (contact us at ziepakker@gmail.com).

Re-Enable: You can opt back in anytime in Settings.

6.4 Opt-Out of Personalized Ads

Android:

1. Settings → Google → Ads → Reset advertising ID or Opt out of Ads Personalization

iOS:

1. Settings → Privacy → Tracking → Toggle off "Allow Apps to Request to Track"

6.5 GDPR Rights (EU Users)

If you are in the European Economic Area (EEA), you have the following rights:

• Right to Access: Request a copy of your data
• Right to Rectification: Correct inaccurate data
• Right to Erasure: Delete your data ("right to be forgotten")
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to data processing for direct marketing

To exercise these rights, contact us at: ziepakker@gmail.com

6.6 CCPA Rights (California Users)

California residents have the right to:

• Know what personal information is collected
• Know if personal information is sold or disclosed
• Opt-out of the sale of personal information (we do NOT sell data)
• Request deletion of personal information
• Not be discriminated against for exercising privacy rights

7. Children's Privacy

Age Restriction: Calorie Calculator is NOT intended for children under 13 years old.

We do not knowingly collect personal information from children under 13. If you believe we have collected data from a child under 13, please contact us immediately, and we will delete the information.

COPPA Compliance: We comply with the Children's Online Privacy Protection Act (COPPA).

8. International Data Transfers

Your data may be transferred to and processed in:

• United States (Supabase, Deno Deploy, Google Cloud)
• Other countries where our service providers operate

We ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) for GDPR compliance
• Privacy Shield frameworks (if applicable)

9. Cookies and Tracking Technologies

9.1 Cookies

We do NOT use cookies in the mobile app. However, our web-based authentication flow (Google Sign-In) may use cookies.

9.2 Local Storage

• SQLite Database: Stores food logs and app settings locally
• Shared Preferences: Stores app preferences (e.g., dark mode, units)

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date.

Notification of Changes:

• Material Changes: We will notify you via email or in-app notification
• Minor Changes: Will be posted on this page

Your Continued Use: By continuing to use the App after changes are posted, you accept the updated Privacy Policy.

11. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us:

• Email: ziepakker@gmail.com
• Website: https://calorie-calculator.app
• Privacy Policy URL: https://calorie-calculator.app/privacy-policy