🔥 Privacy Policy

Last Updated: February 21, 2025
Effective Date: February 21, 2025

Privacy at a Glance

✅ Guest mode: All data stays on your device — never uploaded
✅ No data selling: We never sell your personal data to third parties
✅ AI processing: Food photos/text analyzed in real-time only, not stored by AI
✅ You're in control: Delete your data or account anytime from the app
✅ Encryption: All transmitted data encrypted with TLS

1. Introduction

Welcome to CalBuddy ("we," "us," or "our"). CalBuddy is an AI-powered calorie tracking application that lets you log meals using photos or text, track your macros and weight, and optionally share your daily progress with a buddy via a shared home screen widget.

This Privacy Policy explains how we collect, use, store, and protect your information when you use our mobile application and related services. By using CalBuddy, you agree to the practices described in this policy.

2. Information We Collect

2.1 Account Information

When you create an account (optional — guest mode is available), we collect:

Email address (for email sign-up, or retrieved from Apple/Google)
Display name (you choose this)
A unique buddy code (randomly generated, 8 characters)
Authentication tokens (managed by Supabase)

2.2 Health & Fitness Data

To calculate your personalized calorie goal during onboarding, we collect:

Biological sex, height, and current weight
Age
Activity level (sedentary → very active)
Fitness goal (lose weight, maintain, gain muscle)
Target weight
Workout frequency

We also collect weight log entries if you use the weight tracking feature.

2.3 Food Log Data

Each time you log a meal, we store:

Meal name and description
Estimated calories, protein, carbohydrates, and fat (grams)
Timestamp of the log entry
Log type (photo analysis, text description, barcode scan)

Note on food photos: When you analyze a food photo, the image is sent to Google Gemini API for real-time analysis. The image is not stored permanently in our database — only the resulting nutrition data is saved.

2.4 Buddy System Data

If you use the buddy feature:

Your buddy code and your buddy's code
Buddy relationship status (pending / accepted)
Your daily calorie summary is shared with your buddy (and vice versa)

2.5 Usage & Technical Data

Daily streak counts
App preferences (calorie goal setting, display name)
Onboarding completion status
Device type and operating system (collected by Supabase for authentication)

3. How We Use Your Information

Purpose	Data Used
Provide calorie tracking and AI food analysis	Food photos/text, food log data
Calculate your personalized calorie goal	Onboarding health data
Enable buddy system and shared widget	Buddy codes, daily summaries
Authenticate and secure your account	Email, authentication tokens
Display progress and streaks	Food log timestamps, streak count
Sync data across devices	All account data (signed-in users only)

4. AI Processing — Google Gemini

When you use the AI food analysis feature (photo, text, or label scan), your input is sent to Google Gemini API for processing. This means:

Your food photo or description is transmitted to Google's servers for analysis
Google processes the data according to their Privacy Policy and Data Processing Addendum
CalBuddy does not store your food photos permanently — only the resulting nutrition estimates are saved
Google Gemini does not use your food data to train their models (per Google Cloud API terms)

5. Data Storage

5.1 Guest Mode (Offline / Local)

If you use CalBuddy without an account, all data is stored exclusively on your device using AsyncStorage. Nothing is uploaded to our servers.

5.2 Authenticated Mode (Cloud Sync)

When you sign up or sign in, your data is synced to Supabase, our cloud database provider. Supabase stores data in secure, encrypted databases. Your data is protected by row-level security policies that ensure only you (and your buddy, for summaries) can access it.

Supabase's Privacy Policy: supabase.com/privacy

5.3 iOS Widget

The home screen widget stores a JSON snapshot of your and your buddy's daily calorie summary in iOS App Group storage. This data is local to your device and updated by the app.

6. Data Sharing

6.1 With Your Buddy

If you add a buddy, your daily calorie total and goal are visible to your buddy (and vice versa). No detailed food log names or individual entries are shared — only the summary numbers.

6.2 Third-Party Service Providers

We share data with the following providers only as necessary to operate the service:

Supabase — database, authentication, and edge functions
Google Gemini API — AI food analysis (food photos/text only, not stored)
Apple / Google — authentication when using Apple Sign-In or Google OAuth
Open Food Facts — public barcode database (no personal data sent, only barcode numbers)

6.3 No Sale of Personal Data

We do not sell, rent, or trade your personal data to any third party for marketing or advertising purposes.

6.4 Legal Requirements

We may disclose your information if required to do so by law, court order, or government authority, or if we believe disclosure is necessary to protect the rights, property, or safety of CalBuddy, our users, or others.

7. Data Security

We implement the following security measures:

Encryption in transit: All data transmitted between the app and our servers uses TLS encryption
Encryption at rest: Data stored in Supabase is encrypted at rest
Row-level security: Database policies ensure users can only access their own data
Secure authentication: Passwords are never stored in plain text; Apple and Google auth tokens are handled by the respective platforms
Secure storage: Authentication tokens on your device are stored in encrypted secure storage

8. Data Retention

Active accounts: Data is retained as long as your account is active
After account deletion: All personal data is permanently deleted within 24 hours
Guest mode: Data is stored locally on your device until you delete it or uninstall the app
AI analysis data: Food photos sent to Gemini are not retained — only the resulting nutrition data is stored in your food log

9. Your Rights & Choices

9.1 Access & Portability

You can view all your food logs and data directly within the app. If you need an export of your data, contact us at bora.nikolai.mindwise@gmail.com.

9.2 Correction

You can edit your display name, calorie goal, and individual food log entries directly within the app.

9.3 Deletion

You have two options:

Delete My Food Data: Profile → Delete My Food Data — removes all health and meal data, keeps your account active
Delete Account: Profile → Delete Account — permanently deletes your account and all data

See the Data Deletion Guide and Account Deletion Guide for step-by-step instructions.

9.4 GDPR Rights (EU Users)

If you are located in the European Economic Area, you have the following rights under GDPR:

Right of access — request a copy of your personal data
Right to rectification — correct inaccurate data
Right to erasure — request deletion of your data ("right to be forgotten")
Right to restrict processing — limit how we use your data
Right to data portability — receive your data in a portable format
Right to object — object to processing based on legitimate interests

Our legal basis for processing your data is the performance of a contract (providing you with the CalBuddy service) and your consent (where applicable).

9.5 CCPA Rights (California Users)

If you are a California resident, you have the right to:

Know what personal information we collect, use, and disclose
Delete your personal information
Opt out of the sale of personal information (we do not sell your data)
Non-discrimination for exercising your privacy rights

10. Children's Privacy

CalBuddy is not directed at children under the age of 13 (or 16 in the EU). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately and we will delete it.

11. Third-Party Links

CalBuddy may contain links to third-party services (such as the App Store or Open Food Facts). These third parties have their own privacy policies, and we are not responsible for their practices. We encourage you to review their policies.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by updating the "Last Updated" date at the top of this policy. Your continued use of CalBuddy after changes constitutes your acceptance of the updated policy.

13. Contact Us

Data Controller: CalBuddy

Email: bora.nikolai.mindwise@gmail.com

Location: Bulgaria

For privacy inquiries, data access requests, or deletion requests, please email us with the subject line "Privacy Request" and include your registered email address. We will respond within 30 days.