Privacy Policy

1. Data Controller

Responsible for data processing in the CaloriSnap app:

This privacy policy explains what data we collect when you use CaloriSnap, how we use it, and what rights you have.

2. Data We Collect

3. How We Use Your Data

We use your data exclusively for the following purposes:

• App functionality: Calorie calculation, nutritional analysis, progress tracking
• AI-powered image analysis: Automatic detection of foods and nutritional values in your meal photos
• Personalization: Customizing goals and recommendations based on your settings
• Notifications: Meal and water intake reminders (only when enabled)
• Allergen warnings: Warnings about detected allergens based on your intolerances
• Health correlations: Analysis of relationships between nutrition and health data (e.g. blood glucose vs. carbohydrate intake)
• App improvement: Analysis of feedback and error reports to improve the app
• Security: Protection against misuse and ensuring data security

4. Legal Basis (GDPR)

Your data is processed based on the following legal grounds:

• Consent (Art. 6(1)(a) GDPR): For health data, push notifications, and image analysis
• Contract performance (Art. 6(1)(b) GDPR): To provide the agreed app services
• Legitimate interest (Art. 6(1)(f) GDPR): For app improvement and error analysis

5. Data Sharing with Third Parties

We only share your data with the following third-party providers that support us in providing the app:

5.1 Supabase (Backend Infrastructure)

Purpose: Cloud database, authentication, file storage

Location: USA (with EU Standard Contractual Clauses)

Privacy policy: https://supabase.com/privacy

5.2 Google Gemini (Image Analysis & Nutrition Chat)

Purpose: AI-powered analysis of meal photos for food and nutritional value detection, as well as personalized nutrition advice via chat

Provider: Google LLC, USA

Data transferred: Meal photos, chat messages with nutrition questions. No personal identification data.

Data usage: Data is used exclusively to process the request and is not used for AI model training.

Encryption: All data is transmitted encrypted via HTTPS/TLS.

Privacy policy: https://policies.google.com/privacy

5.3 OpenAI (Alternative Image Analysis)

Purpose: Alternative AI-powered analysis of meal photos (optionally selectable in settings)

Provider: OpenAI Inc., USA

Data transferred: Meal photos. No personal identification data.

Data usage: Data is not used for AI model training.

Privacy policy: https://openai.com/privacy

5.4 Firebase Cloud Messaging (Push Notifications)

Purpose: Sending push notifications (only when enabled)

Provider: Google LLC

Privacy policy: https://policies.google.com/privacy

6. App Permissions

CaloriSnap requires the following permissions:

7. Data Storage and Security

7.1 Security Measures

• Encrypted transmission of all data (SSL/TLS)
• Encrypted storage of sensitive data
• Secure authentication with password hashing
• Regular security updates
• Access restrictions based on the need-to-know principle

7.2 Retention Period

• Account data: Until account deletion
• Meal and health data: Until manual deletion or account deletion
• Feedback and support requests: Maximum 3 years
• Logs and technical data: Maximum 90 days

7.3 Storage Location

Your data is primarily stored in the EU. Some third-party providers (e.g., Google, OpenAI) may transfer data to the USA based on EU Standard Contractual Clauses pursuant to Art. 46 GDPR.

8. Your Rights (GDPR)

You have the following rights at any time:

• Right of access (Art. 15 GDPR): You can request information about your stored data
• Right to rectification (Art. 16 GDPR): You can have incorrect data corrected
• Right to erasure (Art. 17 GDPR): You can delete your data at any time

  In the app: Settings → Account → "Delete Account". This will permanently delete all your data.

• Right to data portability (Art. 20 GDPR): You can receive your data in a structured format
• Right to object (Art. 21 GDPR): You can object to data processing
• Right to restriction (Art. 18 GDPR): You can restrict the processing of your data
• Withdrawal of consent: You can withdraw given consents at any time (e.g., push notifications in app settings)

9. Right to Complain

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data.

Competent supervisory authority in Switzerland:
Federal Data Protection and Information Commissioner (FDPIC)
www.edoeb.admin.ch

10. Changes to This Privacy Policy

We reserve the right to update this privacy policy as needed to reflect changes in the law or in the app. We will inform you of significant changes via email or within the app.

11. Contact

For questions about data protection or to exercise your rights, contact us: