Privacy Policy

Last updated: March 17, 2026

1. Data Controller

CalorieAI is operated by Ian Carroll ("we", "our", or "us"). We are the data controller responsible for your personal data.

Contact: support@calorieai.us

2. Information We Collect

We collect the following categories of personal data:

Account Information: Email address and authentication credentials
Health & Fitness Data: Weight, height, age, biological sex, activity level, exercise frequency, daily step count, and body composition goals
Food Logs: Text descriptions of food consumed, meal times, calorie estimates, and macronutrient breakdowns (protein, carbohydrates, fat)
Usage Data: App interactions, feature usage, and preferences

3. Legal Basis for Processing

Under the EU General Data Protection Regulation (GDPR), we process your data based on the following legal grounds:

Contractual necessity (Article 6(1)(b)): Processing your account information, health data, and food logs is necessary to provide the CalorieAI service — including calorie tracking, personalized targets, and nutrition insights.
Consent (Article 6(1)(a)): Your food descriptions are sent to third-party AI services (Google Gemini and OpenAI) for nutritional analysis. By creating an account, you consent to this processing. You may withdraw consent at any time by deleting your account.
Legitimate interest (Article 6(1)(f)): We process usage data to maintain app security, prevent abuse, and improve our service.

4. How We Use Your Information

Provide and operate the CalorieAI service
Calculate personalized calorie targets and macronutrient recommendations
Process food descriptions using AI to estimate nutritional content
Generate insights and AI coaching recommendations
Send account-related emails (password resets, support responses)
Ensure the security and integrity of our services

5. Automated Decision-Making and AI Processing

CalorieAI uses artificial intelligence to process your food descriptions and estimate calorie and macronutrient content. Your food text is sent to third-party AI providers (see Section 6) for analysis. These estimates are informational only and do not constitute medical or dietary advice. No decisions with legal or similarly significant effects are made solely through automated processing.

6. Third-Party Services (Sub-Processors)

We share your data with the following service providers, solely to operate CalorieAI:

Provider	Purpose	Data Shared	Location
Supabase	Database and authentication	All account data, food logs, weight history	United States
Google Gemini	AI food description analysis	Food description text only	United States
OpenAI	AI nutrition coaching	Chat messages and relevant nutrition context	United States
RevenueCat	Subscription management	Anonymous user ID, purchase data	United States
Resend	Transactional email delivery	Email address	United States

Neither OpenAI nor Google use data submitted via their APIs to train their models, per their respective API data usage policies. We do not sell, rent, or trade your personal information to any third party.

7. International Data Transfers

Your data is transferred to and processed in the United States, where our service providers operate. For transfers of personal data from the European Economic Area (EEA), we rely on:

Standard Contractual Clauses (SCCs) approved by the European Commission, included in our Data Processing Agreements with each sub-processor
The EU-U.S. Data Privacy Framework, where applicable

8. Data Retention

Account and profile data: Retained while your account is active. Deleted within 30 days of account deletion.
Food logs and weight history: Retained while your account is active. Deleted within 30 days of account deletion.
AI processing data: Food descriptions sent to AI providers are not stored by them beyond the API request. Cached nutritional estimates are retained in our database indefinitely to improve response times.
Transactional emails: Email delivery logs are retained by Resend for up to 30 days.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

Right of access (Article 15): Request a copy of all personal data we hold about you.
Right to rectification (Article 16): Request correction of inaccurate or incomplete data.
Right to erasure (Article 17): Request deletion of your data. You can delete your account at any time from the Settings screen in the app.
Right to restrict processing (Article 18): Request that we limit how we process your data in certain circumstances.
Right to data portability (Article 20): Request your data in a structured, machine-readable format (JSON).
Right to object (Article 21): Object to processing based on legitimate interest.
Right to withdraw consent (Article 7(3)): Withdraw your consent for AI processing at any time by deleting your account.

To exercise any of these rights, contact us at support@calorieai.us. We will respond within 30 days.

10. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority in the EU member state where you reside or work, or where the alleged infringement took place. A list of EU data protection authorities is available at edpb.europa.eu.

11. Account Deletion

You can delete your account at any time from the app's Settings screen. Deleting your account will permanently remove all your personal data, food logs, weight history, and preferences from our servers within 30 days. This action cannot be undone.

12. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS/SSL) and at rest, secure authentication, and regular security reviews. However, no method of transmission over the internet is 100% secure.

13. Children's Privacy

CalorieAI is not intended for users under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will delete it promptly.

14. Data Sharing and Disclosure

Beyond the sub-processors listed in Section 6, we do not share your personal data with any third parties. We may disclose information if required by law, court order, or to protect our legal rights.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the app. Continued use of CalorieAI after changes constitutes acceptance of the updated policy. Previous versions are available upon request.

16. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, contact us at:

Email: support@calorieai.us