Privacy Policy

Calibr8 Nutrition is a service of CALIBRATE Ltd (КАЛИБРЕЙТ ЕООД), UIC 208715859, with its registered seat in Shumen, Bulgaria. CALIBRATE Ltd is the data controller responsible for your personal information. We provide evidence-based adaptive nutrition tracking through our web application.

Contact: support@calibr8nutrition.com

Account Information: Email address, name, and authentication credentials when you create an account.

Profile Data: Age, gender, height, and activity level to calculate your nutritional needs.

Health & Body Data: Weight, body fat percentage, and body measurements you choose to log. This is classified as special category data under GDPR and requires your explicit consent.

Nutrition Logs: Food intake, meal timing, and calorie/macro tracking data you record.

Voice Clips (optional): If you use voice logging or Talk to Octava, a short recording of your speech is turned into text: a meal, a weigh-in or a question. We never store the recording; see AI-Powered Features below for details.

Usage and Device Data: How you use our website and the app (the pages you open, the features you use, the site or link that brought you to us), your device type, operating system and browser, technical data about your connection, and the approximate location (country and city) our hosting provider derives from your IP address. We keep this in our own database and use it to measure, improve and protect the service.

Connected Assistants: When you ask an AI assistant you connected to log or look something up, we receive only what that request needs, such as foods and amounts, a recipe, or a weight or measurement. We never receive your conversation with the assistant. We keep a record of its requests and of the entries it adds, to secure the connection and to show you under Connected apps what it did. The record of an entry is deleted with the entry, and the request records lose their link to you when you delete your account.

Security Records: To keep the service secure and prevent misuse, we keep a short record of which foods from our catalogue your account looked up, in the app or through an assistant you connected. We delete it after 35 days.

Certain data you provide (weight, body fat, body measurements, and health-related dietary preferences) is classified as "special category data" under GDPR Article 9.

We only process this health-related data with your explicit consent, which you provide during account creation.

You can withdraw this consent at any time in your profile, under Privacy & Consent, or by contacting us. The app cannot work without it, so it will ask you for it again.

This data is used solely to provide personalized nutrition recommendations and track your progress. The one exception is an AI assistant you connect yourself, which receives the data you approve on the connection screen (see Who We Share Data With).

Service Delivery: Calculate personalized calorie and macro targets, generate meal recommendations, and track your progress toward goals.

Account Management: Authenticate your identity, manage your subscription, and communicate important service updates.

Service Improvement: Analyze how the website and the app are used, to improve them.

Support: Respond to your questions and provide customer assistance.

We do not use your data for automated decision-making that produces legal or similarly significant effects.

Consent (GDPR Article 6(1)(a)): For processing your health data, body measurements, and sending optional marketing communications.

Contract Performance (GDPR Article 6(1)(b)): For providing the nutrition tracking service you signed up for.

Legitimate Interests (GDPR Article 6(1)(f)): For service improvement, security monitoring, fraud prevention, and analytics and performance measurement, where these interests do not override your rights. You can object to this at any time (see Your Rights).

For special category health data, we rely on explicit consent under GDPR Article 9(2)(a).

We never sell your personal data. Period.

Service Providers: We share limited data with trusted providers who help us operate the service: Supabase (database hosting, EU region), Vercel (web hosting and analytics), Stripe (payment processing), Resend (transactional email delivery, plus the text of the messages you send to support or in a bug report), Google Analytics 4 (anonymized usage analytics on our website only, not in the iPhone app), and Sentry (error monitoring).

Error Monitoring: Sentry monitors our servers for errors on the basis of our Legitimate Interest under GDPR Article 6(1)(f), and this does not depend on your cookie choice. On our website, the browser-based part of Sentry only turns on after you give consent in the cookie banner.

Payment and Subscription Processors: If you subscribe inside the Calibr8 app for iPhone, Apple processes the payment and RevenueCat processes the subscription record. In-App Purchases below sets out what each one receives.

AI Providers: The coaching, voice, meal-description, label-reading and share-card features send data to AI service providers that act as our processors. AI-Powered Features below sets out what each kind of provider receives, and we tell you which providers we use whenever you ask.

All service providers are bound by data processing agreements and can only use your data to provide services to us.

Apps You Connect Yourself: If you connect an AI assistant such as Claude or ChatGPT to your account, we send it the data you approve on the connection screen, each time it asks: your food diary, including your meal templates, recipes and your own foods; your daily calorie and macro totals, your targets and what is left to eat today; your goal, diet type and the allergens you listed (meal suggestions follow them), your units, language, meals per day and training days per week; your weight and body measurements, including how they are changing; and your latest weekly check-in: when it took place and, if it changed your calorie target, the target before and after. It also receives the foods from our catalogue that it looks up for you, with their calories and macros. It does not receive the reasons for a change or our estimates of your energy expenditure or body composition; those stay in the app. If you allow logging, on that screen or later under Connected apps, the assistant can add meals, recipes, weigh-ins, body measurements and caliper readings for you, save new recipes, and correct or remove what it added within 24 hours; it cannot change anything you logged or edited yourself. Its provider is not our service provider and handles this data under its own privacy policy. You can switch logging off, delete everything the assistant added or disconnect it at any time under Connected apps in your profile, and withdrawing your health data consent disconnects it too. Access stops at once; data it has already received stays with its provider.

Legal Requirements: We may disclose data if required by law, court order, or to protect our legal rights.

Your data is primarily stored in the European Union (Supabase EU region).

Some service providers may process data in the United States. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

By using our service, you acknowledge these transfers necessary to provide the service.

Active Accounts: We retain your data for as long as your account remains active and you use our services.

Deleted Accounts: When you delete your account, we remove your personal data within 30 days. Some anonymized, aggregated data may be retained for analytics.

Withdrawn Consent: If you withdraw your health data consent, we delete your health and nutrition data within 30 days, unless you give it again before then.

Legal Requirements: We may retain certain data longer if required by law (e.g., financial records for tax purposes).

Backups: Deleted data stays in our database backups for up to 7 days. Uploaded files, such as photos, are deleted together with your account.

Access: Request a copy of the personal data we hold about you.

Rectification: Correct any inaccurate or incomplete data.

Erasure: Request deletion of your data ("right to be forgotten").

Data Portability: Receive your data in a structured, machine-readable format.

Withdraw Consent: Revoke consent for health data processing at any time.

Object: Object at any time to processing based on our legitimate interests, including analytics.

Restriction: Request limited processing in certain circumstances.

To exercise these rights, contact us at support@calibr8nutrition.com. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority.

For privacy inquiries, data requests, or concerns:

Email: support@calibr8nutrition.com

Security reports: security@calibr8nutrition.com

Coach chat: Our in-app AI coach runs on a large language model from an AI provider in the United States. So that it can answer you in context, we send your message together with a summary of your data: your first name, what you told us about yourself and your goal, your logs (food, workouts, weight, body fat, body measurements and eating episodes), your calorie and macro targets, your weekly check-ins, and our calculations from them. This includes health data.

The legal basis for sending health data to our AI providers is your explicit consent under GDPR Article 9(2)(a), which you give when you create your account. Without an active consent record, these features do not run.

Knowledge search: Before the coach answers, the text of your question goes to a search provider, which finds the passages of our nutrition knowledge base that match it. That provider receives your question, not your name, email or profile.

Automated insights: Your daily and weekly insights are written on a schedule by the AI model that runs the coach. That request carries your targets, the foods you logged, your weight trend, your training days and your check-ins; the weekly one also carries your body fat estimate and your replies to earlier insights. Your name and email are not included.

Voice logging and Talk to Octava: Your short voice clip is sent to a speech-to-text provider to turn it into text. We use two such providers, the second as an automatic fallback, so one clip may be sent to both if the first does not answer. Along with the audio we send your app language, but not your name or email. We never store the recording. When you log food by voice from your diary, you review the text before anything is saved. In Talk to Octava we save a meal or a weigh-in you say at once and show it to you with Undo (when we are not sure, we ask first), and the coach answers your questions.

Meal descriptions: When you describe a meal, in writing or by voice, the description is sent to an AI language model provider to be resolved into foods and quantities. Only the text of the description is sent.

Label photos: When you photograph a nutrition label, the photo is sent to the AI model that runs the coach, to read the printed values. No account, profile or health data travels with it. A photo you attach to a food you submit is stored in our media storage for as long as that food entry exists.

Meal share cards: The photo you choose to share is sent to an image-processing provider to remove its background. No account or health data is included in this request.

Training and retention at the providers: The provider of the coach's model is contractually barred from training its models on what we send it, and the provider that resolves meal descriptions does not use what we send through its API for training by default. Providers may hold content briefly for abuse monitoring and service reliability before discarding it.

All of these providers process data in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses in each provider's data processing agreement; some of them are also certified under the EU-US Data Privacy Framework.

Withdrawing consent: When you withdraw your health data consent (see Health Data Notice), we stop sending your data to these providers. Anything sent before then cannot be recalled.

Which providers we use: ask us at support@calibr8nutrition.com and we will tell you which provider handles each of these features.

AI assistants you connect: When you connect an assistant such as Claude or ChatGPT, it receives health data at your instruction. That rests on the same explicit consent under GDPR Article 9(2)(a), together with your approval of that specific app on the connection screen. The assistant's provider acts under your own agreement with it, not as our provider, even when it is a company we also work with. What it keeps, and whether it may train on it, follows your terms with that provider; the training, retention and transfer statements above cover only what we send to our own providers.

Vercel Web Analytics and Vercel Speed Insights run on our website and in the Calibr8 app for iPhone. They set no cookies, are not used for advertising and give us only aggregated statistics: pages opened, referring sites, countries, devices, browsers and loading speed.

We also count visits to our website ourselves, without cookies and without storing anything on your device: which pages are opened, which buttons are pressed and how fast the site loads. We keep these records in our own database and use them only to measure and improve the website.

In both cases, the legal basis is our Legitimate Interest under GDPR Article 6(1)(f) in measuring and improving the service. You can object at any time by emailing support@calibr8nutrition.com.

If you subscribe on our website, Stripe processes the payment. If you subscribe inside the Calibr8 app for iPhone, Apple processes the payment. Your card details never reach us and we never store them.

RevenueCat is our subscription processor for purchases made in the iPhone app. It receives our internal identifier for your account (the app user id), the purchase and subscription status, the product identifier, the Apple transaction identifiers, and the App Store storefront country linked to your Apple Account.

We keep your subscription status and the Apple original transaction id in your profile so that restoring purchases and moving a subscription to another device or account keeps working.

The legal basis for this processing is Contract Performance under GDPR Article 6(1)(b).

Managing or cancelling an App Store subscription, and requesting a refund for one, is done through Apple, not through Calibr8. Terms of Service sets out how.

This policy is for people in the United States. It explains how Calibr8 collects, uses and shares consumer health data under Washington's My Health My Data Act, Nevada's consumer health data law (SB 370) and Connecticut's Data Privacy Act.

Open as a separate page →