Privacy Policy

What FitCal is

FitCal is a mobile application that estimates the nutritional content of a meal from a photograph you take. It also tracks water intake, weight, and logged meals. It is an informational tool only.

What we collect

• Meal photographs you choose to capture
• Nutrition estimates generated from those photographs
• Your account email address, if you choose to create an account (the app works without one)
• Water intake, weight, and meal log entries you record
• App usage events: which screens and features you use, scan timing and errors, and how much you changed an estimate before logging it (counts only, never meal names, nutrition values or photos)
• Feedback you choose to send: your message, an optional reply email, and thumbs up/down ratings of estimates
• Technical data: app version, device identifiers, crash reports, and diagnostic events
• Advertising identifiers and ad interaction events (see Advertising below)

Why this is sensitive information

Dietary and nutrition information linked to an identifiable person can be classified as health data, which privacy law treats as a special category requiring your explicit consent. That is why FitCal asks before processing anything, never processes data before you accept, and gives you an equal option to decline personalized ads.

Legal bases for processing (GDPR)

• Consent (Art. 6(1)(a)) — meal photo analysis and personalized advertising
• Contract (Art. 6(1)(b)) — providing the app's core functionality
• Legitimate interests (Art. 6(1)(f)) — usage analytics, crash diagnostics and security, balanced against your rights. You can object at any time with Settings → Privacy → Share usage analytics.

For special-category processing we rely on your explicit consent under Art. 9(2)(a).

Who processes your data

Our backend runs on Supabase, hosted in the EU (Ireland). Photographs are forwarded to third-party AI providers — Google and OpenRouter — solely to generate estimates. Account data and usage events are stored in Supabase. Crash reports are processed by Sentry. Account emails (sign-up and password codes) are sent through Resend.

International transfers

Some providers process data outside the European Economic Area. Where that occurs, transfers are covered by Standard Contractual Clauses and a transfer impact assessment.

Advertising

FitCal is supported by advertising. We use Google AdMob.

Personalized ads are OFF by default. If you opt in — and separately approve the device-level prompt — our ad partners may use your activity to show more relevant ads. You can turn personalized ads off at any time in Settings → Privacy without losing any core feature. European users are shown a consent platform before any ad request is made.

How long we keep data

Meal photographs and nutrition logs are retained until you delete them or close your account. Our servers do not keep a separate cache of analysis results. App usage events are retained for up to 13 months, feedback for up to 24 months. Crash and diagnostic logs are retained for up to 90 days.

Delete your account and data

In the app: open FitCal → Settings → Privacy → Delete my account and data, then confirm. Your meals, photos, water and weight logs, scan history and account are permanently deleted from our servers right away, and the app's local data is cleared.

Without the app: email us from the address on your account (or, for a guest profile, tell us roughly when you used the app) with the subject “Delete my FitCal account”. We delete the account and all associated data within 30 days and confirm by reply.

Nothing is kept after deletion, except where the law requires us to retain a record.

Your rights

• Withdraw consent for personalized ads — Settings → Privacy
• Turn off usage analytics and crash reports — Settings → Privacy → Share usage analytics
• Delete your account and all associated data — Settings → Privacy, or see how to delete without the app
• Request a copy of the data we hold about you
• Correct inaccurate information
• Object to processing, and restrict it
• Lodge a complaint with your supervisory authority

Children

FitCal is not directed at children under 18, or under the minimum age of digital consent in your jurisdiction. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

Security

Data is encrypted in transit using TLS. Access is authenticated with short-lived tokens. Ad SDKs are initialized only after consent is resolved, and cloud backups of app data are disabled on Android.

Your choices

Declining personalized ads leaves every core feature of FitCal fully available. You may use the app as a guest without creating an account.