CalMaster Privacy Policy

Last updated: April 24, 2026

This Privacy Policy explains what information we collect when you use CalMaster, how we use it, and the choices you have. By using the app you agree to the practices described here.

1. Information we collect

Account information. When you sign up we collect your email address and display name. Authentication is handled by Supabase Auth.

Profile information. To compute your daily calorie goal we collect height, weight, age, gender, and activity preferences. You provide these during onboarding.

Usage data. Food logs (name, calories, macronutrients, timestamp), exercise logs (type, duration, calories), and your preferred language and notification settings.

AI analysis content. When you use AI food photo analysis or AI exercise video analysis, the photo or video is sent to our backend and to Anthropic's Claude API for inference. These are processed transiently to return a result and are not retained long-term by us beyond the analysis result (calories, detected exercise, etc.).

Apple HealthKit data (iOS, optional). If you grant permission, we read step count and active energy from HealthKit to display daily activity. HealthKit data stays on your device and is only read when the app is open. We do not transmit raw HealthKit data to our servers; only aggregated numbers are used to display your dashboard.

Subscription status. RevenueCat manages subscription entitlement and provides us with the active/expired status. We do not receive credit card or payment details.

Device and technical data. Basic device information (OS, app version, language) via Expo to diagnose crashes and compatibility issues.

2. How we use information

• To provide the core app functionality (logging, summaries, trends).
• To run AI analyses you explicitly request (photo/video).
• To send local notifications you enable (meal reminders, evening recap).
• To manage your subscription and restore purchases.
• To diagnose errors and improve stability.

We do not sell your personal information, do not use it for advertising, and do not share it with third parties for their own marketing.

3. Third-party services

We rely on the following processors. Each receives only the minimum data needed for its role:

• Supabase — authentication, database, and edge functions. Stores your account, profile, logs, and notification preferences.
• Anthropic (Claude API) — runs AI inference on the food photos, exercise videos, and text summaries you request. See Anthropic's privacy policy.
• RevenueCat — subscription management and entitlement. Receives a RevenueCat-scoped user identifier and subscription status from Apple. See RevenueCat's privacy policy.
• Apple (App Store & HealthKit) — payments, subscriptions, and (optionally) health data read with your permission.

4. Data retention

We keep your account and logs for as long as your account is active. If you delete your account, we remove your profile, food/exercise logs, and linked identifiers from our database within 30 days. Backups are purged on our regular rotation (up to 90 days). Apple may retain purchase records independently.

5. Your rights

• Access — request a copy of your data by emailing manuelrodriguez8958@gmail.com.
• Correction — edit your profile and logs directly in the app.
• Deletion — delete your account from Profile → Delete account, or email us.
• Withdraw HealthKit consent — revoke access anytime in iOS Settings → Privacy & Security → Health → CalMaster.

6. HealthKit-specific disclosures

Data received through Apple HealthKit:

• is never sold or shared with advertisers;
• is never used for marketing;
• is not transmitted to our servers — it is read locally on your device for display;
• is only accessed with your explicit permission granted through the iOS HealthKit prompt.

7. Children

CalMaster is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided information to us, please contact manuelrodriguez8958@gmail.com and we will delete it.

8. Security

We use industry-standard practices to protect your data in transit (HTTPS/TLS) and at rest. No system is perfectly secure; if we become aware of a breach affecting your information we will notify you as required by applicable law.

9. International transfers

Our processors (Supabase, Anthropic, RevenueCat) may store and process data in the United States and other countries. By using the Service you consent to such transfers where permitted by applicable law.

10. Changes to this policy

We may update this policy as the Service evolves. Material changes will be notified through the app or by email before taking effect.

11. Contact

For privacy questions or data requests email manuelrodriguez8958@gmail.com.

CalMaster 隐私政策（中文摘要）

本摘要仅供参考，正式政策以上文英文版为准。

• 我们收集的信息：邮箱与昵称、身高体重年龄性别等资料、饮食/运动记录、设备信息；你授权后读取 HealthKit 的步数与消耗卡路里。
• AI 图片/视频分析：你提交的内容会发送到我们后端与 Anthropic Claude API 进行分析，处理完即丢弃。
• 第三方服务：Supabase（存储与认证）、Anthropic（AI 推理）、RevenueCat（订阅管理）、Apple（支付与 HealthKit）。我们不出售你的数据，不做广告追踪。
• HealthKit 数据仅在设备本地读取，不传输到我们的服务器，不会用于广告或营销。
• 数据删除：App 内「Profile → Delete account」可永久删除账户，或发邮件至 manuelrodriguez8958@gmail.com。
• 13 岁以下儿童不得使用本服务。
• 有隐私问题请邮件至 manuelrodriguez8958@gmail.com。