Privacy Policy

Effective date: 5 September 2026 · Last updated: 9 September 2026
Support: [email protected]
Website: https://calscan.relaxlio.com

# Privacy Policy

Product: Cal Scan (“CalScan”, “the App”, “the Service”)

Website: https://calscan.relaxlio.com

Privacy / support contact: [email protected]

Effective date: 5 September 2026

Last updated: 9 September 2026

Publication checklist (fill before going live)

- Insert Operator legal entity name, registered address, and (if required) Data Protection Officer / EU-UK representative.

- Confirm live URL: `https://calscan.relaxlio.com/privacy` (linked from the App).

- Before enabling Adjust / Firebase / advertising SDKs, update Sections 4, 6, and 8 with the exact SDK names and purposes, and complete App Store / Play Data Safety & Privacy Nutrition Labels to match this Policy.

- Have counsel review health-data, AI-processing, and international-transfer sections for your launch markets.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you use Cal Scan. It should be read together with our Terms of Use.

1. Who we are

The Operator of Cal Scan (“we”, “us”, “our”) provides the App and related websites/services. For privacy requests, contact [email protected].

If we appoint an EU/UK representative or Data Protection Officer, their contact details will be listed on https://calscan.relaxlio.com/privacy.

2. Scope

This Policy applies to:

• the Cal Scan mobile applications (iOS and Android);
• related backend APIs operated for the App;
• the product website pages that publish legal documents and product information.

It does not apply to third-party websites, stores, or services that we do not control (including Apple, Google, Open Food Facts, or AI model providers acting as independent controllers where applicable).

3. Personal information we collect

We collect information in three ways: (a) you provide it; (b) the App collects it automatically; (c) we receive it from service providers / partners needed to run the Service.

3.1 Account and identity

Depending on how you use the App, this may include:

• anonymous / device-linked session identifiers;
• email address and authentication credentials (for email registration, login, or password reset);
• identifiers associated with Sign in with Apple or Google Sign-In (e.g. subject ID, email if shared);
• membership / entitlement status linked to your account or device session.

3.2 Profile, questionnaire, and health-related inputs you choose to provide

Cal Scan is a lifestyle nutrition-tracking product. To generate plans and goals, you may provide information such as:

• sex / gender preference for planning, birth year (age), height, weight, target weight;
• activity level, workout frequency, goal type (lose / maintain / gain), weekly pace;
• diet style and dietary restrictions / preferences;
• optional lifestyle answers collected during onboarding.

This information can be considered health-related or sensitive under some laws. We process it only to provide the features you request (plans, goals, logging, trends) and as otherwise described in this Policy.

3.3 Food, diary, water, exercise, and progress data

• meal photos or images you capture or select for recognition;
• recognised or manually entered food names, portions, calories, and macros;
• barcode values and matched product records;
• favourites and “add again” history;
• water logs, cup preferences, reminder settings;
• exercise logs (type, duration, estimated burn, etc.);
• weight logs and related history;
• daily / weekly aggregates shown in Home, Diary, and Progress.

3.4 Device, app, and technical data

• device model, OS version, app version, language / locale, time zone;
• device or installation identifiers used for anonymous login, fraud prevention, install attribution, and quota enforcement (we design these to avoid unnecessary advertising identifiers where not needed);
• network diagnostics (e.g. request success/failure), crash logs, and performance data;
• push notification tokens if you enable notifications;
• remote configuration flags (e.g. whether a retention offer is shown).

3.5 Purchase and subscription data

We do not receive your full payment card number. Apple or Google process payments. We may receive:

• product identifiers, purchase / restore tokens or receipts (as provided by the stores);
• subscription status, expiry, and verification results from our subscription backend.

3.6 Support communications

If you email support, we process the content of your message and related contact details to respond.

3.7 Information we do not intentionally collect

We do not require government ID numbers, precise continuous GPS tracking, contacts, or microphone audio for core features. Do not submit special-category data beyond what the product asks for unless necessary for support.

4. How we use personal information

We use personal information to:

We do not sell your meal photos or personal diary contents as a standalone product dataset.

5. Legal bases (EEA / UK / similar regions)

Where the GDPR / UK GDPR applies, we rely on:

• Contract — processing needed to provide the App features you request (logging, sync, recognition, subscriptions entitlement checks);
• Legitimate interests — security, fraud prevention, product analytics in a privacy-respecting form, service improvement, and defending legal claims, balanced against your rights;
• Consent — where required for certain notifications, optional analytics/advertising SDKs, or sensitive-data processing under local law; you may withdraw consent without affecting prior lawful processing;
• Legal obligation — where we must retain or disclose information to comply with law.

6. Analytics, attribution, and advertising technologies

We may use first-party events and, when enabled for a release, third-party measurement tools (for example install attribution and product analytics SDKs such as Adjust and/or Firebase Analytics or equivalents) to understand:

• onboarding completion and paywall interactions;
• feature usage (scan, barcode, water, exercise, progress);
• subscription funnel performance;
• stability and engagement metrics.

These tools may process device identifiers, IP address (often truncated or processed by the vendor), and event parameters. Exact SDK list for a given build will be reflected in:

• this Policy (updated when tools go live);
• Apple App Privacy details / Privacy Nutrition Labels;
• Google Play Data safety form.

We do not use your meal photo contents for interest-based third-party advertising.

If we later enable advertising or remarketing, we will update this Policy and obtain any consents required by law / platform rules (including ATT on iOS where applicable).

7. AI processing of meal images

When you use camera or gallery recognition (or related re-analysis):

1. The image and necessary technical metadata are transmitted to our servers (`calscan` business API).
2. Our servers call an AI model provider (currently planned: Google Gemini family models via our configured API gateway) to generate candidate foods / nutrition estimates.
3. Results are returned to the App for you to review, edit, and save.
4. We design the flow so that failed or cancelled recognition generally does not consume free daily quota; successful usable results may.

AI providers process data as our processors / subprocessors under our instructions, except where a provider’s own terms state otherwise for abuse monitoring or legal compliance. Do not upload images you are not comfortable sending to cloud AI services.

We retain recognition-related records as needed to provide history, support quotas, security, and debugging, subject to Section 10.

8. How we share information

We share personal information only as needed for the purposes above:

We require processors to protect data and use it only for instructed purposes, where contractually required.

Open Food Facts: barcode / product lookups may query or use data derived from Open Food Facts or similar open databases. Queries may include the barcode or search terms you submit.

9. International transfers

We may process and store information in countries other than where you live (including where our servers, AI providers, or subprocessors operate). Where required, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms, and take steps to ensure an adequate level of protection.

10. Retention

We retain personal information only as long as needed for the purposes described, including:

• Active account / guest session data — while you use the Service and for a reasonable period afterward to allow restore, support, and dispute handling;
• Subscription / purchase verification records — as needed for entitlement, accounting, and fraud prevention;
• Security logs — for a limited period appropriate to security investigations;
• Support emails — as needed to resolve your request and maintain business records.

When you delete guest data or delete your account through in-app controls (where available), we delete or anonymise associated server-side personal data within a reasonable period, except information we must keep for legal, security, or accounting reasons, or that is stored solely on your device until you clear it.

Uninstalling the App does not automatically delete server-side account data and does not cancel store subscriptions.

11. Security

We implement technical and organisational measures appropriate to the risk, such as HTTPS/TLS in transit, access controls, and least-privilege practices for production systems. No method of transmission or storage is 100% secure. Please use a strong unique password for email accounts and keep your device OS updated.

Secrets such as AI API keys are kept on the server side and are not embedded in the mobile client for model calls.

12. Your rights and choices

Depending on your location, you may have rights to:

• access a copy of your personal information;
• correct inaccurate information;
• delete information;
• restrict or object to certain processing;
• data portability;
• withdraw consent;
• lodge a complaint with a supervisory authority.

In-app controls (where available): edit profile/goals; manage reminders; delete guest data; delete account; restore purchases; sign out.

Email requests: [email protected] — we may need to verify your identity before fulfilling a request.

Permissions: revoke camera, photos, or notifications in system settings.

Marketing: Cal Scan’s core emails are transactional (verification / reset). If we send promotional emails later, we will provide unsubscribe mechanisms.

California (CCPA/CPRA) and similar US state laws: We do not “sell” personal information for money. If we engage in “sharing” for cross-context behavioural advertising, we will disclose that and honour opt-out rights as required. You may request know / delete / correct rights via [email protected]. We will not discriminate against you for exercising privacy rights.

13. Children

The App is intended for users 13+ (or older where required). We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information, contact us and we will take appropriate steps to delete it.

Parents/guardians of teens should supervise use of nutrition-tracking tools.

14. Automated decision-making

Cal Scan uses automated processing to estimate nutrition and generate suggested calorie/macro plans. These outputs are assistive estimates you can edit; they are not used to make legal or similarly significant decisions about you (such as credit, employment, or insurance eligibility).

15. Third-party links and stores

Links to App Store, Google Play, Open Food Facts, or other sites are governed by those parties’ policies. Review them before use.

16. Changes to this Policy

We may update this Policy from time to time. We will revise the “Last updated” date and post the new version at https://calscan.relaxlio.com/privacy. Material changes will be highlighted by reasonable means (e.g. in-app notice). Continued use after the effective date means you acknowledge the updated Policy, except where additional consent is required by law.

17. Contact

Privacy requests & support: [email protected]

Website: https://calscan.relaxlio.com

Terms of Use: https://calscan.relaxlio.com/terms

Appendix A — Data categories summary (for store forms)

Use this as a checklist when completing Apple / Google declarations (adjust to the exact build):

Appendix B — Subprocessors (illustrative; update before launch)