Privacy Policy

At CaloBuddy ("we", "us", or "our"), we are committed to protecting your privacy and being fully transparent about how your personal data is collected, processed, and safeguarded. This Privacy Policy explains our practices in compliance with the Malaysian Personal Data Protection Act 2010 (PDPA), as well as global privacy standards such as the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA/CPRA) where applicable.

1. Information We Collect

We collect information you provide directly to us, data generated automatically when you use CaloBuddy, and necessary transaction records:

1.1 Information You Provide Directly

1.2 Information Collected Automatically & Technical Data

1.3 Billing & Virtual Purchases

• Virtual Credits & Purchases: If you purchase in-app credits, packs, or subscriptions, transaction records (e.g., purchase tokens, timestamp, product ID, and credit balance) are logged to fulfill digital goods.
• Payment Security: We do not collect or store your credit card or bank details. All financial transactions are processed securely through platform app stores (such as Google Play Billing or Apple In-App Purchase).

2. Meal Photos, Audio & AI Processing

We take extraordinary care with your media and AI interactions:

1. Local Metadata Stripping (EXIF): When you take or select a meal photo, our mobile app re-encodes the image locally on your device to completely strip all EXIF metadata (including GPS coordinates, device identifiers, and camera settings) prior to upload.
2. AI Nutritional Estimation: Stripped images or audio voice logs are transmitted over an encrypted connection to the Google Gemini API to recognize dishes and estimate nutritional metrics (calories, carbs, protein, fat).
3. Proprietary AI Training & User Opt-Out: To continuously improve dish identification accuracy (including regional foods, portion sizing, and cuisine variations), CaloBuddy may use de-identified, anonymized meal photos and dish labels to train and fine-tune our proprietary machine learning models. We do not sell this data, and we do not use identifiable personal information (such as your name, email, profile details, or biometric data) for training. EXIF metadata is permanently stripped prior to storage. You have full control: you can opt out of contributing data for AI model training at any time in Settings > Preferences > Improve CaloBuddy AI.
4. Encrypted Private Storage: Photos are stored in an encrypted cloud storage bucket protected by database Row-Level Security (RLS). Only your authenticated account can access or view your uploaded images.

3. How We Use Your Information

We use the collected information for the following legitimate purposes:

• Core Functionality: To provide, operate, maintain, and deliver all features of CaloBuddy (calorie tracking, streak counts, virtual pet growth, social challenges).
• Personalization: To tailor calorie budgets, macronutrient breakdowns, and reminders to your specific goals.
• AI Processing: To process meal images, barcodes, and voice descriptions into structured nutritional estimates.
• Account Management & Security: To authenticate users, prevent fraudulent use, enforce usage quotas, and protect against security threats.
• Customer Support: To investigate and resolve customer inquiries, bug reports, and feedback.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.
• Proprietary AI Model Improvement: Anonymized meal photos and verified food labels may be used to train, evaluate, and improve CaloBuddy's proprietary meal recognition models, unless you have opted out in Settings.

4. Third-Party Service Providers (Subprocessors)

We work with trusted third-party service providers who assist us in operating our platform. These providers are bound by strict contractual data protection obligations:

We do not sell, rent, or share your personal data with third-party advertisers or data brokers.

5. Data Retention & Account Deletion

1. Active Accounts: We retain your personal data and meal history for as long as your account remains active.
2. User Deletion Rights: You can delete individual meal logs, photos, or your entire account at any time:
   • In-App Account Deletion: Go to Settings > Account > Delete Account.
   • Email Request: You can also request complete account and data deletion by emailing chris.calobuddy@gmail.com.
   • Direct Web Deletion: You can execute direct automated deletion without the mobile app on our Web Deletion Page.
3. Permanent Purging: When you delete your account, all associated personal data, health metrics, meal logs, and stored photos are permanently purged from our active databases and storage buckets within thirty (30) days, except where retention is required by law.

6. Your Rights (PDPA, GDPR & Global Privacy)

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Right of Access: You may access all personal data stored in your profile and meal logs directly within the app.
• Right to Rectification: You can edit or correct your profile data, weight records, and meal entries at any time.
• Right to Erasure ("Right to be Forgotten"): You have the right to request the permanent deletion of your account and personal data.
• Right to Data Portability: You may request an export of your personal data in a standard machine-readable format by contacting our privacy team.
• Right to Withdraw Consent: You may withdraw consent to data processing at any time by deleting your account or adjusting your device permissions (e.g., camera, microphone, notifications).
• Right to Opt Out of AI Model Training: You can toggle off data contribution for proprietary AI model training at any time directly in the app (Settings > Preferences > Improve CaloBuddy AI).
• Right to Non-Discrimination: We will never deny services, charge different prices, or provide a lower quality of service for exercising your privacy rights.

To exercise any of these rights, please contact us at chris.calobuddy@gmail.com. We will respond to verified requests within the statutory timeframe (typically within 21–30 days).

7. Data Security

We implement robust technical and organizational security measures to protect your data:

• Encryption in Transit: All communications between the CaloBuddy app and backend APIs use HTTPS / TLS 1.3 encryption.
• Encryption at Rest: Database records and photo storage are encrypted at rest using industry-standard AES-256 encryption.
• Row-Level Security (RLS): Database queries are isolated at the database level, ensuring users can only read and write their own data.
• Zero Exposed Secrets: Service role keys and master credentials are never bundled in client mobile builds.

While we take all reasonable precautions to safeguard your data, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Children's Privacy

CaloBuddy is intended for users who are at least 13 years old (or the applicable minimum legal age in your country, e.g., 16 in certain EU jurisdictions). We do not knowingly solicit or collect personal information from children under 13. If you become aware that a child has provided us with personal information without parental consent, please contact us at chris.calobuddy@gmail.com, and we will promptly delete such information.

9. International Data Transfers

Your data may be transferred to and processed on servers located outside of your country of residence (such as cloud infrastructure in the United States or Singapore). Whenever data is transferred internationally, we ensure appropriate safeguards are in place in compliance with applicable data protection laws.

10. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, features, or legal requirements. When we make material updates, we will notify you through the app (such as an in-app notice or banner) and update the "Last Updated" date at the top of this document. We encourage you to review this policy periodically.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out to us at:

• Email: chris.calobuddy@gmail.com
• Operated by: CaloBuddy Team, Malaysia