Privacy Policy

This Privacy Policy ("Policy") describes how Caloura ("Caloura", "we", "us", or "our") — operated by Harix Global Solutions Pvt. Ltd. — collects, uses, discloses, and protects your personal information when you use the Caloura mobile application (the "App"). Caloura is a nutrition and fitness tracking app that lets you log meals, scan food via camera or barcode, estimate nutrition with AI, track water intake, set goals, and earn progress badges.

Caloura is operated from India. We process personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, the SPDI Rules, 2011, and our obligations under the Google Play User Data Policy. By creating an account and using Caloura, you agree to the practices described in this Policy. If you do not agree, please do not use the App.

1. Summary

• We collect information you provide during sign-up and onboarding (name, email, date of birth, gender, height, weight, goals) and data you create while using the App (meals, food photos, water logs, badges).
• We use Google Sign-In for authentication. We do not store your password.
• Meal photos you choose to analyze are sent to AI providers (OpenAI, Google Gemini, Groq) solely to identify food and estimate nutrition.
• We do not sell your personal data.
• The App uses rewarded ads via Google AdMob — certain features require you to watch a short ad to gain free access. AdMob may use your advertising ID and limited device data to serve relevant ads. You can opt out of personalised ads in your Android device settings at any time, but you will still need to watch an ad to access rewarded features.
• AI Disclaimer: Nutrition estimates generated by AI are approximate and may be inaccurate. We are not responsible for any decisions you make based on AI-generated results — see Section 7 for full details.
• You can delete your account and all associated data at any time from within the App.
• Caloura is intended for users aged 18 and above.

2. Personal Information We Collect

Some data described below — including health and fitness data such as weight, dietary habits, calorie intake, and meal images — is sensitive personal data or information under the SPDI Rules and personal data under the DPDP Act. We collect it only because it is necessary to deliver the App's core features, and we do so with your consent.

2.1 Information you provide directly

Account and profile (collected during onboarding):

• Email address, full name, and profile photo (from your Google account)
• Date of birth and gender
• Height and weight
• Dietary preference (e.g., none, vegetarian, vegan)
• Activity / workout level
• Fitness goals, goal weight, and target pace

Health and fitness data you create in the App:

• Meal logs (meal name, type, calories, protein, carbs, fats, serving size, healthiness score)
• Food photos you capture or upload for AI analysis
• Food barcodes you scan
• Water intake logs
• Daily nutrition goals and overrides
• Water reminder preferences (times and quiet hours)
• Progress and gamification data (streaks, meal counts, goals hit, badges earned)
• Feature requests or feedback you choose to submit

Referral information:

• Your unique referral code, who referred you (if applicable), and your referral count

Billing information:

• Caloura is currently free to use. We do not collect payment card details, billing addresses, or financial information of any kind. If a paid tier is introduced in the future, this section will be updated before any billing data is collected.

2.2 Information collected automatically

• Authentication tokens: Secure session tokens from our authentication provider, stored encrypted on your device using the Android Keystore.
• App activity counters: Limited local counters (app opens, meals logged) used only to decide when to show the in-app review prompt — never sent to our servers.
• Advertising identifier (GAID): Google AdMob may collect your device advertising identifier, device model, OS version, IP address, and ad interaction data to serve and measure ads. See Section 6 for full details.
• Crash and diagnostic data: If a crash occurs, limited technical error information is sent to Sentry (our crash-reporting provider), configured to exclude your IP address and personal identifiers.

2.3 Information we do NOT collect

• Your password (authentication is handled entirely by Google Sign-In)
• Precise or approximate GPS location
• Google Fit, contacts, messages, or call logs
• Payment or financial information (app is free)

3. Device Permissions We Request

Permissions are requested only when needed. You can deny or revoke them at any time in your device settings. Some features may not work without the related permission.

4. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Personalise your experience and calculate recommended calorie and macronutrient goals
• Identify foods and estimate nutrition from photos and barcodes using AI
• Track your meals, water intake, goals, streaks, and badges
• Send reminders and notifications you have enabled
• Operate the referral program
• Display in-app advertisements via Google AdMob to keep the App free
• Diagnose crashes, fix bugs, and improve the App's reliability and performance
• Respond to your support requests and feedback
• Maintain the security of the App and prevent fraud or misuse
• Comply with our legal obligations under applicable Indian law

We process your data based on your consent (given when you create an account and use the relevant features), to perform our contract with you, and for our legitimate interests in keeping the App secure and functional.

5. How We Share Your Information

We do not sell your personal information. We share data only with the categories of recipients described below, and only as necessary to operate the App:

• Our Service Providers. We share your personal information with third parties that provide technical, infrastructure, and support services on our behalf. This includes backend hosting and database services, cloud storage, AI food-recognition services, barcode lookup, crash reporting, and authentication services. These providers may only use your data to perform services for us and are bound by their own privacy and security obligations.
• Our Advertising Partners. We share limited device and usage information (such as your advertising identifier and device model) with our advertising partner, Google AdMob, to serve in-app advertisements and measure their performance. We do not share your health or fitness data with any advertising partner. See Section 6 for full details and opt-out instructions.
• Our Analytics Providers. We may share limited technical and usage data with analytics providers (such as our crash-reporting service) to help us understand App performance, diagnose bugs, and improve reliability.
• Law Enforcement and Regulatory Authorities. We may disclose your personal information to comply with applicable legal and regulatory obligations or to respond to valid requests from law enforcement authorities to the extent required by applicable Indian law.
• Other Parties. We may disclose your information to other parties as necessary or appropriate to: (i) comply with applicable law; (ii) protect the rights and safety of our users or the public; (iii) prevent, detect, or investigate fraud, unauthorized access, or misuse of the App; or (iv) enforce our Terms of Service.

International transfers: Some of our service providers operate servers outside India. Where data is transferred internationally, we rely on appropriate safeguards as required by applicable Indian law.

6. Advertising and Google AdMob

Caloura is free and supported by in-app advertising via Google AdMob (Google LLC). Certain features of the App require you to watch a rewarded ad to gain access — this is how we keep the App free for everyone. This section explains what AdMob collects and what choices you have.

How ads work in Caloura

Caloura uses rewarded ads — you choose to watch a short ad in exchange for free access to a feature. Watching the ad is required to use those features; there is no way to skip or bypass it. You are not charged any money at any point.

What AdMob may collect

• Your device's Google Advertising ID (GAID) — a resettable identifier for serving and measuring ads
• Device information (model, OS version, screen size, language)
• IP address (used to infer approximate region for ad relevance)
• Ad interaction data (impressions, clicks, view times, completion)
• App usage context (which screen an ad is shown on)

We do not pass your health or fitness data (meal logs, weight, calorie intake, etc.) to AdMob. Google's use of this data is governed by the Google Privacy Policy.

Personalised vs. non-personalised ads

AdMob may serve personalised ads based on your advertising ID and inferred interests. You can opt out at any time — you will still need to watch an ad to access rewarded features, but it will be non-personalised:

• Android 12+: Settings → Google → Ads → Delete advertising ID
• Earlier Android: Settings → Google → Ads → Opt out of Ads Personalisation

Non-personalised ads use contextual signals (e.g., the current screen) but do not use your advertising ID to build a cross-app interest profile. Opting out does not remove the ad requirement — it only affects whether ads are personalised to you.

Children and ads

Caloura is for users aged 18 and above only. We do not configure AdMob to serve child-directed ads. If we learn a user is under 18, we will remove their account and ensure no ads are served to them.

7. AI-Generated Content — Important Disclaimer

8. Data Storage and Security

• Your account, profile, and fitness data are stored in our Supabase (PostgreSQL) database, protected by Row-Level Security so each user can access only their own data.
• Meal photos are stored privately in Amazon S3 under a per-user path.
• Authentication tokens are stored encrypted on your device using the Android Keystore.
• All data is transmitted over encrypted (HTTPS/TLS) connections.
• Sensitive server credentials (AI keys, storage keys) are never embedded in the App and are kept in secured server-side configuration.

While we take reasonable technical and organisational measures to protect your information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Data Retention

We retain your personal and fitness data for as long as your account is active. When you delete your account, we delete your profile, meal logs, food photos, water logs, nutrition goals, reminder preferences, and feedback.

For fraud and abuse prevention, we may retain a minimal audit record (email address and name only) after deletion. This data is not used for marketing and is held only as long as necessary for the stated purpose.

10. Your Rights and Choices

Under the Digital Personal Data Protection Act, 2023, you have the following rights as a Data Principal:

• Right to access: Obtain a summary of the personal data we process about you and the parties with whom it has been shared.
• Right to correction and updation: Request correction of inaccurate or incomplete data. You can edit most profile information directly in the App.
• Right to erasure: Request deletion of your personal data when it is no longer needed for the purpose collected. You can delete your account at any time from Profile → Delete account in the App.
• Right to grievance redressal: Raise a complaint with our Grievance Officer (see Section 13).
• Right to nominate: Nominate another individual to exercise your rights in the event of your death or incapacity.
• Right to withdraw consent: Withdraw consent at any time by emailing us. Withdrawal does not affect the lawfulness of prior processing and may limit your ability to use parts of the App.

To exercise any right, email us at privacy@calourai.com. We will respond within the timelines required by applicable Indian law.

Ad personalisation: You can opt out of personalised ads from Google AdMob at any time via your device settings (see Section 6 for instructions).

11. Age Requirement and Children's Privacy

Caloura is intended for users aged 18 and above. Under the DPDP Act, 2023, anyone under 18 is a "child", and we cannot process a child's personal data without verifiable parental consent. Because Caloura processes health-related data and derives personalised nutrition recommendations, we do not consider the App suitable for anyone under 18.

• We do not knowingly collect personal data from individuals under 18.
• We do not track, profile, or target children with personalised content or ads.
• We will promptly delete any data found to have been collected from a child without verifiable parental consent.

If you are a parent or guardian and believe your child has provided data to Caloura, contact us at privacy@calourai.com. We will verify the request and delete the data.

12. Health Disclaimer

13. Changes to This Privacy Policy

We may update this Policy from time to time. When we make material changes, we will update the "Effective Date" above and, where appropriate, notify you in the App. Your continued use of Caloura after changes take effect constitutes acceptance of the updated Policy.

14. Grievance Officer and Contact

In accordance with the Information Technology Act, 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, the details of our Grievance Officer are:

You may contact the Grievance Officer to:

• Exercise your rights under the DPDP Act
• Raise concerns or complaints about how your personal data is processed
• Report content or activity that violates this Policy or the law

For general questions, write to:

15. Governing Law and Jurisdiction

This Policy is governed by the laws of India. Any dispute arising from this Policy shall be subject to the exclusive jurisdiction of the competent courts at Bhavnagar, Gujarat, India.

If you are dissatisfied with our response to a grievance, you may also approach the Data Protection Board of India once it is operational, in accordance with the DPDP Act, 2023.

This Policy is intended to meet the disclosure requirements of the Google Play User Data Policy, the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and the SPDI Rules, 2011. It does not constitute legal advice; consider having it reviewed by a legal professional in India.