Privacy policy

1. Who we are

Calolean (calolean.com) is an AI-powered health assistant for nutrition tracking, food scanning, exercise guidance and workout form analysis. It is operated as an independent product from India.

For anything in this policy — including access, correction and deletion requests — contact contact@calolean.com. That address is also our grievance contact for the purposes of India's Digital Personal Data Protection Act.

2. What we collect

Account data

Your email address and display name, handled by Firebase Authentication. Sign-in is by email and password, an email sign-in link, or Google. If you use Google sign-in we receive your email address, name and profile picture from Google — we never receive your Google password.

Health and fitness data you enter

Food logs, calorie and macro goals, height, weight, date of birth, activity level, workout logs, water intake, step counts you type in, and form-analysis scores. This is stored in your own document space in Firebase Firestore and is readable only by your account.

Usage data

A rolling count of AI requests, used to enforce the fair-use limits described on the pricing page. Standard web analytics events via Google Analytics 4 — pages viewed, approximate region, device type. We do not send your email address or any health data to Analytics.

Technical data

IP address, browser and device information, and timestamps, as produced by ordinary web request logging on Google Cloud. This is used for security, abuse prevention and debugging.

3. Photographs and video — the important part

Food photographs.A photo you scan is compressed on your device and sent to Google's Gemini model on Vertex AI for the sole purpose of identifying the food and estimating its nutrition. We do not store the image, we do not attach it to your account, and it is not used to train any model. What is saved to your log is the resulting text and numbers.

Workout video. Video recorded for form analysis never leaves your device. Pose detection runs locally in your browser. What is transmitted for scoring is an anonymised numerical summary of joint angles — no frames, no image data, nothing from which you could be identified or the footage reconstructed.

4. AI processing

Food analysis, chat responses, workout parsing, plan generation and form scoring are produced by Google Gemini models running on Google Cloud Vertex AI. Your prompt, the relevant portion of your own logs, and — for a scan — the photograph, are sent to that service to generate a response.

AI output is an estimate and a suggestion. It is not medical advice, not a diagnosis and not a treatment plan. Consult a qualified professional about any medical or dietary condition.

5. Advertising, cookies and consent

Free accounts see clearly labelled Sponsoredcards served by Google AdSense. These, and Google's advertising partners, may set cookies or read device identifiers to serve, measure and personalise advertising, and to limit how often you see the same advert.

What is never used for ad targeting:your chat messages, your photographs, your food logs, your weight, your goals or any other health information. Advertising context comes only from a short, hand-maintained whitelist of generic food and fitness categories such as “high protein” or “whey protein”. This is an architectural boundary in the code, not a preference setting.

Consent.Visitors in the EEA, the UK and Switzerland are shown a consent message from Google's certified consent management platform (Funding Choices) before any advertising or analytics cookie is set, and can refuse personalised advertising. You can change that choice at any time through the same banner. Elsewhere, you can control or block cookies through your browser settings.

Google's own explanation of how it uses data from sites that use its services is at policies.google.com/technologies/partner-sites, and advertising settings can be managed at adssettings.google.com.

Cookies and similar technologies we use

6. Affiliate links

Some product suggestions are Amazon affiliate links, marked with an external-link icon. If you buy through one we may earn a commission at no additional cost to you. Following such a link takes you to Amazon, whose own privacy policy then applies. Affiliate products are chosen from the same generic keyword whitelist described above.

7. Who else processes your data

We do not sell personal data and we do not share it with data brokers. Data is processed on our behalf by:

Nutrition data in our own database is derived from USDA FoodData Central. We may also disclose data where the law requires it, or to protect our rights or the safety of users.

8. Where your data is held

Application data is hosted on Google Cloud infrastructure in the Mumbai (asia-south1) region. Some processing — AI inference, analytics and advertising — may take place on Google infrastructure outside India under Google's own safeguards for international transfers.

9. How long we keep it

Your account data and logs are retained while your account exists. Deleting your account removes your stored logs and profile. Aggregated, non-identifying analytics may persist. Ordinary server logs are retained for a short period for security and debugging.

10. Your rights and controls

Two of these are buttons in the app rather than requests you have to make:

• Export — Profile → Export Data gives you a CSV of everything you have logged, immediately.
• Deletion — Profile → Delete Account removes your data. There is no waiting period.
• Correction — every log, goal and profile field is editable in the app.
• Advertising choices— through the consent banner, your browser, or Google's ad settings.

Depending on where you live — under the GDPR, the UK GDPR, the CCPA/CPRA or India's DPDP Act — you may also have rights of access, rectification, erasure, restriction, objection, portability, and the right to complain to a supervisory authority. Email contact@calolean.com and we will respond within the period the applicable law allows.

11. Security

Data is encrypted in transit with TLS and at rest by Google Cloud. Firestore security rules restrict every document to the account that owns it. Server-side secrets are held in Google Secret Manager rather than in configuration files. No system is perfectly secure, but these are the controls in place.

12. Children

Caloleanis not intended for children under 13, and we do not knowingly collect data from them. Calorie restriction in particular is not appropriate for children without medical supervision. If you believe a child has created an account, write to us and we will remove it. Users under 18 should have a parent or guardian's involvement.

13. Changes to this policy

If this policy changes materially, the date at the top changes and — for anything that affects how your data is used — we will tell you in the app before the change takes effect. Continuing to use Calolean after that means you accept the updated policy.

14. Contact

Questions, requests or complaints: contact@calolean.com. See also our terms of service.