Privacy Policy
Effective: July 22, 2026 / Last updated: August 18, 2026
1. Information we collect
The App collects: (1) account information — email address and authentication provider (Apple / Google) identifiers; (2) logged data — meals, calories/nutrients, weight, water, goals, and streaks; (3) meal photos — stored on your device (see Section 4); (4) purchase information — your paid plan status; payment details such as card numbers are processed by Apple and never reach us; (5) advertising identifier — only if you allow tracking (ATT); (6) usage data — such as AI feature usage counts.
2. How we use it
We use this information to (1) sync and restore your logs, (2) generate AI nutrition estimates and meal/weekly suggestions, (3) provide paid plans and manage purchase status, (4) serve ads, and (5) prevent abuse.
3. Third-party services
The App sends data, to the extent necessary, to the following types of services: - Cloud database & authentication platform: stores your logs and account information - Third-party AI service providers (AI analysis): receive meal photos, dish names, and aggregate log values when you use AI features. Contact details such as your name or email are never sent. Processing may occur on servers located abroad (including the US and China), and each provider's privacy policy applies - Purchase management platform: receives a user identifier and purchase information to manage your plan status - Google AdMob (ads): advertising identifier when ATT is allowed; otherwise non-personalized ads are shown.
4. Meal photos
Meal photos are stored on your device by default. They are sent to our server only when you run AI analysis and are not retained on our servers after analysis. Third-party AI providers may process or retain them for a limited period for purposes such as abuse prevention.
5. Retention & deletion
Server data is kept while your account exists. "Delete account" in Settings > Account permanently deletes your account and all server-side logs (unrecoverable). On-device data is removed by deleting the App. Product data contributed to the shared barcode database remains in anonymized form.
6. Sharing
We do not share personal information with third parties without your consent, except as required by law. We never sell your personal information.
7. Security
Communication is encrypted, and server data is protected by per-user access control (Row Level Security). API keys for external services are kept server-side only and never stored on your device.
8. Children
The App is not intended for children under 13. If we learn that we have collected personal information from a child under 13, we will delete it promptly.
9. Your rights
You may request access to, correction of, or deletion of your personal information via the contact below. If you live in a region with additional privacy rights (such as the EU, UK, or California under GDPR / CCPA), you may exercise those rights the same way.
10. Changes
Changes to this policy will be announced in the App.
11. Contact
Questions about your data: support@caroot.app