Privacy Policy

Information we collect

Information you provide

• Account information. If you create an optional account, Supabase Auth processes your email address and password for authentication and stores password hashes, account identifiers, email-confirmation status, and session information. It supports signing in, signing out, email confirmation, and password recovery.
• Meal information. When you request an AI calorie estimate, the meal description you enter is transmitted to our service and the service providers that support the estimation feature. Please do not include names or other identifying information in meal descriptions.
• Communications. If you contact us, we receive the information you choose to provide, such as your email address and the contents of your message.

Device and cloud diaries

Accounts are optional. When you are signed out, your diary is stored in that browser's local storage. When you are signed in, your cloud diary is stored in Supabase and associated with your account. These are separate diaries; guest entries are not automatically uploaded or merged into an account. AI estimation sends your submitted meal description to our service and its providers in either mode.

Diary entries include food names, calorie values, diary dates, and protein, carbohydrate, and fat estimates when available. Cloud records also include account and entry identifiers and timestamps, allowing you to access your cloud diary on other devices when signed in. Signing out returns you to the separate guest diary in that browser.

Information collected automatically

When you use the Services, our hosting and infrastructure providers may process standard technical information such as your IP address, browser and device type, requested pages, referring page, approximate location derived from IP address, timestamps, and diagnostic or security logs.

The CalorieLite marketing website uses Cloudflare Web Analytics to understand aggregate website traffic and performance. Cloudflare states that this service does not collect or use visitors' personal data. You can read more in Cloudflare's Web Analytics documentation.

The tracker uses Vercel Web Analytics to understand aggregate traffic and usage. According to Vercel, this analytics service does not use third-party cookies, does not associate analytics with an individual or IP address, and discards its visitor-identification hash after 24 hours. You can read more in Vercel's Web Analytics privacy documentation.

AI estimates and Google Gemini

When you request an estimate, your meal description passes through the tracker server to the Google Gemini API for calorie and nutrient estimates, whether or not you are signed in. We do not intentionally add your account email, password, or complete diary to the prompt. Anything you type in the description is included, so do not enter personal, sensitive, or confidential information.

CalorieLite currently uses Gemini's unpaid tier. Under Google's terms for unpaid services, Google uses submitted content and generated responses to provide, improve, and develop its products, services, and machine-learning technologies. Human reviewers may read and process this content. Google's processing is governed by its Gemini API terms and Privacy Policy.

The original free-text prompt is not stored as a separate diary field. The returned food name and nutrition values can be saved in your diary. This does not mean that prompts or responses are never retained by Google or in technical logs.

Account emails

We use Resend to deliver account-confirmation and password-recovery emails. Resend processes the recipient's email address, message content, and delivery information to provide this service. These are transactional messages; creating an account does not subscribe you to a newsletter.

Speech input

If you use speech-to-text, your browser or device platform may process your audio through its own speech-recognition service. CalorieLite receives the resulting text so it can prepare your meal description. The platform provider's privacy policy governs its processing of the audio.

How we use information

We use information to:

• provide calorie and nutrient estimates and other features you request;
• manage optional accounts, synchronize cloud diaries, and send account emails;
• operate, maintain, troubleshoot, and secure the Services;
• understand aggregate usage and improve the Services;
• respond to questions and privacy requests; and
• comply with law and protect our rights, users, and the public.

How we share information

We may disclose information:

• to providers supporting the Services, including SiteGround for website hosting, Vercel for tracker hosting and analytics, Cloudflare for website analytics, Supabase for authentication and cloud diaries, Resend for account emails, and Google Gemini for AI estimates;
• when reasonably necessary to comply with law, legal process, or a valid government request, or to protect rights, safety, and security;
• in connection with a merger, acquisition, financing, reorganization, or sale of all or part of CalorieLite; or
• with your direction or consent.

Providers may also process information for purposes described in their applicable terms and privacy policies, including Google's uses explained in the AI section above.

We do not sell personal information or share it for cross-context behavioral advertising, and we do not use third-party advertising trackers.

Cookies and local storage

As of the date above, CalorieLite does not use non-essential advertising cookies. The tracker uses browser local storage for guest diaries and authentication/session cookies for signed-in users. Hosting providers may use strictly necessary technologies to deliver and protect the Services. Clearing browser data can remove your sign-in session. For the effects on each diary, see Your data and account deletion below.

Data retention

Guest diary entries remain in that browser until you delete them in the app or clear the tracker's site data. Cloud diary entries remain associated with your account until they are deleted, your cloud diary is cleared, or your account is deleted. We retain communications and technical logs as reasonably necessary to operate and secure the Services, comply with legal obligations, resolve disputes, and enforce agreements. Provider retention varies with the information and service involved and is subject to the provider's applicable terms and policies, including Google's processing described above.

Account deletion removes the account and associated cloud diary from the active application database. It does not necessarily remove copies immediately from backups, technical or security logs, communications, or third-party provider systems. Those records remain subject to the applicable retention practices and legal obligations.

Health and sensitive information

Food and calorie information may be sensitive to you. CalorieLite is a general wellness tool and is not designed to receive medical records or protected health information on behalf of a HIPAA-covered healthcare provider. Do not submit medical diagnoses, treatment information, or other sensitive personal information in a meal description.

Your data and account deletion

You can delete individual food entries directly in the tracker.

There is currently no self-service account-deletion button. Requests are handled manually. To request deletion of your account and associated cloud diary, email admin@calorielite.app. Please indicate whether you want your entire account deleted or only your cloud diary cleared. We may ask you to confirm ownership of the account before processing your request. Do not send us your password.

If you use CalorieLite without signing in, your diary is stored in that browser. You can remove it by clearing the tracker's site data in your browser settings. Repeat this on each browser or device where you have stored a guest diary.

Deleting your account does not remove a separate guest diary stored in your browser. Clearing browser data or signing out does not delete your account or cloud diary. Signing out also does not delete your guest diary.

Other privacy rights

Depending on where you live, you may also have rights to request access to, correction of, deletion of, or a copy of personal information we hold about you; to object to or restrict certain processing; or to withdraw consent where processing is based on consent. You may also have the right to appeal a response or complain to your local data-protection authority.

Use the email address above for other privacy requests as well. There is currently no self-service data-export feature. We may need to verify privacy requests, and we will not discriminate against you for exercising an applicable privacy right.

Legal bases for processing

Where the law requires a legal basis, we process information as necessary to provide features you request, for our legitimate interests in operating, securing, and improving the Services, to comply with legal obligations, and with consent where required. You may object to processing based on legitimate interests by contacting us.

International data transfers

CalorieLite and its providers may process information in the United States and other countries. Where required, we rely on legally recognized safeguards for transfers of personal information.

Children's privacy

CalorieLite is intended for adults aged 18 and over. The Services are not directed to anyone under 18. If you believe someone under 18 has provided personal information, contact us at admin@calorielite.app so we can take appropriate action.

Security

We use reasonable administrative and technical measures designed to protect information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Third-party links

The Services may link to websites or services we do not control. Their privacy practices are governed by their own policies, not this Privacy Policy.

Changes to this policy

We may update this Privacy Policy as CalorieLite changes. We will post the revised policy here and change the "Last updated" date. If changes are material, we will provide additional notice when required by law.