Privacy Policy

This policy explains what Cal Val Analyzer does with your information when you use Cal Val Analyzer — the website, the installable app and everything behind your sign-in. It applies to you whether you signed up with an email address and password or with Google.

For data-protection purposes Cal Val Analyzer is the controller of your information, and can be reached at privacy@calvalanalyzer.com or at [Registered address].

Only what the app needs to calculate your numbers and show you your own history. There is no hidden collection beyond the four groups below.

Account details

Your name, email address and mobile number, and — if you signed up with a password — a scrypt hash of that password. We never store the password itself and cannot recover it. If you sign in with Google, Google tells us your name and email address and nothing else; we never see your Google password.

Body and health information

The figures your plan is calculated from: age, sex, height, current weight, target weight, body fat percentage, any tape measurements you enter (waist, chest, hip, bicep, thigh, neck), your activity level, your goal, the pace you chose, whether you eat vegetarian, eggetarian or non-vegetarian, whether you train at home or in a gym, and your preferred units. If you ask us to build a meal plan we also keep the cuisine you prefer, how many meals a day you want, and any foods you told us to avoid — which may include allergies and intolerances, and is health information like the rest. If you ask for a workout plan we also keep your training experience, how many days a week you train, preferred session length, the equipment you have at home, and any injuries or limitations you tell us about, which is health information too.

Most of this is health data, which the law treats as a special category deserving extra protection. We collect it only because you chose to enter it, use it only to produce your plan and your progress views, and never use it for advertising. Body fat and the tape measurements are optional — the app works without them.

What you log

Every food entry you save: the name of the dish, the serving, the quantity, its calories and macros, which meal it belonged to and when you logged it. Also which workout days you marked complete, the plan generated for you, and how far through setup you got.

Technical information

A session cookie so you stay signed in, and the ordinary server logs that any website keeps — IP address, browser, and which pages errored. We also keep a record of each request the app makes to the AI on your behalf — what was sent, what came back, and what it cost — so we can monitor spend and fix bad answers. Meal photos are never part of that record. We do not run advertising trackers, analytics profiling or third-party marketing pixels.

When you log a meal from a photo, the picture is resized on your own device first — your phone's full-resolution original never leaves it. The smaller copy is sent to our server, forwarded to Google's Gemini model to be read, and used to fill in the food entry.

We do not store your meal photos. The image is held in memory for the few seconds the analysis takes and then discarded. What persists is the food entry it produced — the dish name and the numbers — which you can delete from your log at any time.

• To give you the service you asked for — calculating your calorie and macro targets, generating your diet and workout plans, keeping your food log and showing your progress. Without this data there is no product.
• To keep your account secure — verifying your sign-in, signing your session cookie so it cannot be tampered with, and investigating abuse.
• To fix what breaks — error logs tell us a screen failed so we can repair it.
• To contact you about your account if something needs your attention.

Where the GDPR or India's Digital Personal Data Protection Act, 2023 applies to you, our bases are: performing our contract with you for the account and the plan; your explicit consent for the health information you choose to enter, which you can withdraw at any time by deleting it or closing your account; and our legitimate interest in keeping the service secure and working.

Cal Val Analyzer uses Google's Gemini API to estimate nutrition for food you describe or photograph, and to draft your daily plan. That means some of your information is sent to Google to be processed.

Your identity is not part of it. When we ask the model for a plan, we send only what the plan needs — age, sex, height, weight, body fat, measurements, activity level, goal, pace, target weight, how you eat, your cuisine and meal-count preferences, any foods you asked us to avoid, and for a workout plan your experience level, training days, session length, home equipment and any injuries you noted. Your name, email address and mobile number are deliberately left out. When you log food, we send the text you typed or the resized photo, and nothing else about you.

Google processes this as our service provider under its API terms. We do not send your data to any other AI provider.

We do not sell your data, and we do not share it for advertising. It goes to exactly three kinds of recipient:

• Google — for the Gemini API described above, and for Google Sign-In if that is how you signed up.
• Our infrastructure providers — the database and hosting services that store and serve the app. They hold the data on our instructions and may not use it for anything of their own.
• Authorities or advisers — only where the law genuinely requires it, or to establish or defend a legal claim.

If the service is ever sold or merged, your information may transfer with it. You would be told before that happened, and the new owner would be bound by this policy until you were given the chance to agree to a different one.

We set only what the app needs to function:

• A session cookie that records which account is signed in. It is HTTP-only, so page scripts cannot read it, and cryptographically signed, so it cannot be edited to impersonate someone else. It lasts up to 30 days, and signing out clears it.
• A Google sign-in cookie, set by Auth.js, if you signed in with Google.
• An on-device cache. If you install the app, a service worker stores the page shell and icons on your device so it opens offline. That cache lives on your device only and is cleared when you uninstall the app or clear your browser data.

There are no advertising or cross-site tracking cookies, which is why the app shows you no cookie banner asking to set them.

Your account, profile and food log stay until you ask us to delete them — the point of a progress chart is that it goes back further than last week. Meal photos are never stored at all. Error logs are kept only as long as they are useful for diagnosing the problem.

When you ask us to delete your account, we remove your profile and your logged entries from our live database. Encrypted backups may retain a copy for a short period before they roll over.

You can:

• See and correct your information — your profile screen shows what we hold about your body and lets you change any of it. Your food log shows every entry, and you can delete individual entries yourself.
• Get a copy of your data in a portable format.
• Delete your account and everything attached to it.
• Withdraw your consent to our holding your health information, by deleting it or closing your account.
• Object or complain — to us first, and to your local data-protection authority if we have not put it right.

Export and account deletion are not yet buttons in the app. Email privacy@calvalanalyzer.com from the address on your account and we will action it within 30 days. We will not charge you for it, and we will not ask why.

• Passwords are stored only as scrypt hashes with a per-account random salt.
• Session cookies are HTTP-only, signed, and marked secure in production, so they travel only over HTTPS.
• Every request that touches your data re-checks the session on the server and resolves which account it belongs to — the browser never gets to name the account it is reading.
• Traffic to the app and to Google's API is encrypted in transit.

No system is perfect. If a breach ever affects your data, we will tell you and the relevant regulator as quickly as the law requires.

Our hosting, database and AI providers operate globally, so your information may be processed in a country other than your own — including the United States. Where the law requires a safeguard for that transfer, we rely on the standard contractual clauses or another approved mechanism in our agreements with those providers.

Cal Val Analyzer is not for anyone under 16. Calorie targets and deficits are not appropriate for a growing body without professional supervision, so we do not knowingly collect anything from a child. If you believe a child has created an account, write to privacy@calvalanalyzer.com and we will delete it.

If we change how we handle your information, we will update this page and move the date at the top. For anything that materially affects you — a new category of data, or a new recipient — we will tell you in the app or by email before it takes effect, and ask again for your consent where the law requires it.

Privacy questions and data requests: privacy@calvalanalyzer.com

Anything else: support@calvalanalyzer.com

Cal Val Analyzer, [Registered address]

Our Terms of Service cover the rules for using the app itself.