Privacy Policy

Last updated: October 21, 2026

1. Introduction

CaloGoal ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how your personal information is collected, used, and disclosed by CaloGoal.

2. Data Controller

The data controller responsible for your personal data is:

INNOVA GLOBAL DEVELOPMENT S.R.L.
Strada Basarabilor, nr. 11
Sector 5, București, 050334
România
CUI: 54283488
Reg. Com.: J2026018036002
Email: privacy@calogoal.com

3. Information We Collect

We collect information you provide directly to us, such as when you create or modify your account, request customer support, or otherwise communicate with us.

Account Information: Name, email address, password.
Health Data: Height, weight, body fat percentage, age, gender, activity level, dietary preferences, and food intake history.
Usage Data: Food logs, calorie intake, macro/micronutrient data, weight history, and app interaction patterns.
Product Usage Events: When you are signed in, we record which parts of the app you use — for example signing up, finishing setup, the days you open the app, reaching a daily limit, seeing or tapping an upgrade offer, and starting, completing or restoring a purchase — together with your account, your plan and your platform (web, Android or iOS). These records never contain food, health or weight values. We keep them ourselves, do not share them with third parties, and delete them after 13 months or when you delete your account.
Images: Food photos you upload for AI-powered nutrition analysis.
Activity Data (via Health Connect): If you connect Android Health Connect, steps, active calories burned, and exercise sessions. See Section 7.
Payment Information: We do not store your card or other financial data. Purchases made in the Android app are processed by Google Play (Google Play Billing), and we receive your subscription status through RevenueCat. Purchases made on our website are processed by Lemon Squeezy as Merchant of Record. See Section 9.

4. Legal Basis for Processing

We process your personal data on the following legal bases:

Performance of a contract: To provide and maintain the Service, process subscriptions, and deliver features you have paid for.
Your consent: For health data (special category data under GDPR Article 9), which you agree to when you set up your profile, and for analytics cookies on our website, which you choose in the cookie banner. You may withdraw consent at any time by contacting us at privacy@calogoal.com, by changing your choice in the cookie consent settings (for analytics cookies), or by deleting your account.
Performance of a contract (AI features): Sending your food photos, meal text and the inputs for coaching features to our AI provider (Section 8) is necessary to provide the analysis and coaching you request from the Service. We do not rely on consent for this processing.
Legitimate interests: To improve our Service (including the product usage events described in Section 3), prevent fraud, and ensure network security. You can object to this processing at any time (Section 12).
Legal obligation: To comply with applicable laws, regulations, and legal processes.

5. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our Service.
Calculate personalized nutritional targets (calories/macros).
Generate AI-powered food analysis, nutrition reports, and weight forecasts.
Process transactions and send related information, including confirmations and invoices.
Send you technical notices, updates, security alerts, and support and administrative messages.
Monitor and analyze trends, usage, and activities in connection with our Service.

6. Health Data (Special Category Data)

Health-related data — including body metrics, food logs, calorie intake, macro/micronutrient data, and dietary preferences — is classified as special category data under GDPR Article 9. We process this data on the basis of your explicit consent, which you provide when you set up your profile. You may withdraw this consent at any time by deleting your account (which erases your health data from our systems, subject to Section 11) or by contacting us at privacy@calogoal.com.

HIPAA Disclaimer: CaloGoal is not a HIPAA-covered entity. We do not provide medical advice, diagnosis, or treatment. The Service is for informational and self-tracking purposes only.

7. Health Connect Data

If you connect Android Health Connect, CaloGoal reads the following data types to power your activity dashboard:

Steps: Used to display your daily step count in the activity widget.
Active Calories Burned: Used to display calories burned and to compute your daily calorie balance against food logged.
Exercise Sessions: Used to display your individual workout sessions in the activity timeline.

This access is read-only — CaloGoal never writes data back to Health Connect. This data is shown only to you, the account owner, and is never shared with third parties or used for advertising or marketing. You can disconnect Health Connect or revoke individual permissions at any time in Android Settings > Apps > Health Connect > App permissions > CaloGoal. Revoking access stops the activity sync and changes nothing else about your account. Deleting your CaloGoal account, as described in Section 11, also permanently erases any Health Connect data we have stored (it lives in the user_exercises table, linked to your account).

CaloGoal's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.

8. AI and Photo Processing

Certain features of CaloGoal use artificial intelligence services provided by Google Gemini to analyze food photos and meal descriptions, generate nutritional estimates, and produce coaching insights. Our legal basis for this is the performance of our contract with you: it is how we provide the features you ask for. The information sent to Google Gemini is:

We ask for your permission before anything is sent to Google Gemini. You can withdraw it at any time in Profile > Security with the "AI meal analysis (Google Gemini)" switch; after that nothing more is sent, and you can still log food manually or by barcode.
Food photos you upload and the meal text you type or dictate.
For coaching features: your weight trend, calorie targets and your answers to goal questions.
The data is transmitted to Google Gemini's API for processing.
We do not upload facial images, biometric identifiers, or medical records to AI services.
AI-generated analysis is an estimate and should not be treated as exact nutritional data.
Google processes this data under its own privacy terms and security standards.

9. Data Sharing and Processors

We do not sell your personal data. We share your information only with the service providers listed below, solely so they can perform services on our behalf.

Our Processors:

Google Gemini API (Google LLC): AI analysis of food photos and meal text, and coaching insights (see Section 8). Google Privacy Policy.
Google Play Billing (Google LLC): Processes payments for purchases made in the Android app. Google Privacy Policy.
RevenueCat: Manages and reports your subscription status for Android app purchases. RevenueCat Privacy Policy.
Lemon Squeezy: Merchant of Record for purchases made on our website; processes your payment details and billing information. Lemon Squeezy Privacy Policy.
Google Sign-In (Google LLC): Optional sign-in with your Google account. Google Privacy Policy.
Firebase Cloud Messaging (Google LLC): Delivers push notifications to your device. Google Privacy Policy.
Brevo: Sends our transactional and notification emails (for example account, security and reminder emails). Brevo Privacy Policy.
Sentry: Error and crash monitoring and performance diagnostics for the website and the Android app (error details, device model, operating-system and app version). We configure it not to collect request contents, form entries or session recordings. Sentry Privacy Policy.
Google ML Kit (Google LLC): A barcode-scanning library included in the Android app for an upcoming barcode feature. It runs on your device; when it is used, Google receives basic device and app information, a per-installation identifier and performance metrics for diagnostics. ML Kit data disclosure.
Google Analytics 4 (Google LLC): Website analytics, used only after you accept analytics cookies in the cookie banner. Google Privacy Policy.
Google Health Connect (Android): An on-device source of steps, active calories and workouts. CaloGoal reads this data only with your permission and never writes to it (see Section 7). Google Privacy Policy.
Jina Reader (Jina AI): If a restaurant-menu link you paste cannot be fetched directly, the link is sent to Jina Reader to retrieve the page text. No account or health data is sent. Jina AI Legal.
Open Food Facts and USDA FoodData Central: Public food databases that we query to look up nutrition data. Food names or barcodes are looked up there; no personal data is sent. Open Food Facts Privacy Policy. Open Food Facts product data is used under the Open Database License (ODbL).
Hosting & Infrastructure: We use industry-standard cloud providers to host our application and database securely.

10. International Data Transfers

We are based in Romania (European Union). Some of our service providers, including our AI processing partners, are located in the United States. When we transfer your personal data outside the European Economic Area (EEA), we do so using appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission, to ensure your data receives an adequate level of protection.

11. Data Retention & Deletion

We retain your personal information for as long as your account is active or as needed to provide you the Service.

Your Rights (Right to be Forgotten): You have the right to request the deletion of your account and all associated data at any time via your Profile settings. Upon deletion, all your logs, personal measurements, and account details are permanently removed from our database.

Records retained after deletion: A small amount of data is kept with the link to your account removed, as described on our Account & Data Deletion page: anonymised AI usage cost records, consent records (reduced to the type of consent, dates and a one-way hash of your email address), email delivery logs (the recipient email address and subject line of emails we sent, kept for delivery troubleshooting), and anonymised meal-text extraction logs from our AI food pipeline.

Android subscriptions: Deleting your account does not cancel a subscription you bought through Google Play. Cancel it in Google Play first.

12. Your Data Protection Rights

Under applicable data protection laws, including the GDPR, you have the following rights:

Right to Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data.
Right to Restrict Processing: Request limitation on how we use your data.
Right to Data Portability: Request transfer of your data to another service.
Right to Object: Object to processing based on legitimate interests or direct marketing.
Right to Withdraw Consent: Withdraw consent at any time for processing based on consent, by emailing privacy@calogoal.com, changing your cookie consent settings, or deleting your account.
Right to Lodge a Complaint: You may lodge a complaint with a supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro. You may also contact the authority in the EU/EEA country where you live or work.

To exercise any of these rights, please contact us at privacy@calogoal.com. We will respond within 30 days.

13. Cookies and Tracking

We use cookies and similar tracking technologies to track the activity on our Service and hold certain information.

Essential Cookies: Required for the operation of the Service (e.g., keeping you logged in).
Analytics Cookies: Help us understand how our Service is being used.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service. You may manage your cookie preferences at any time via the cookie consent banner.

14. Security

The security of your data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

15. Children's Privacy

Our Service is intended for users who are 18 years of age or older (or the age of legal majority in your jurisdiction). We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us immediately at privacy@calogoal.com and we will take steps to delete such information.

16. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have certain rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

The right to know what personal information we collect, use, disclose, and sell.
The right to delete your personal information.
The right to opt-out of the sale or sharing of your personal information.
The right to non-discrimination for exercising your privacy rights.

We do not sell your personal information. To exercise your California privacy rights, contact us at privacy@calogoal.com.

17. Changes to This Policy

We may update our Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top of this policy. For significant changes, we may also notify you via email or in-app notification.

18. Contact Us

If you have any questions about this Privacy Policy, please contact us at privacy@calogoal.com.