CalPal Privacy Policy

1. Introduction

MOUNTAIN LLC ("we," "us," or "our") operates the CalPal AI mobile application, the websites www.aicalpal.com and www.calpalai.app, its related services, and any associated platforms (collectively, the "Service"). This Privacy Policy describes how we collect, use, store, share, and protect your information, and the rights available to you under applicable data protection laws worldwide.

By downloading, installing, accessing, or using our Service, you confirm that you have read and understood this Privacy Policy. Where processing is based on consent under applicable law, we obtain that consent through the mechanisms described in this Policy and within the Service.

This Service is strictly for users aged 18 and older. We do not knowingly collect personal information from individuals under this age. If you do not agree with this Policy, please do not use our Service.

Important: CalPal is an informational tool. Nutritional data in the Service is derived in part from third-party and open-source food databases, and AI-generated outputs are estimates; both may be inaccurate. This Policy governs data handling only — please review our Terms of Use for disclaimers, limitations of liability, and other conditions governing your use of the Service.

2. Information We Collect

We collect various types of information to provide, maintain, secure, and improve the Service. The categories of information we collect include:

• a) Account and Profile Information

  This is information you provide when you create an account, which is necessary for the Service to work. This includes:

  • Identifiers: Name, email address, username, and password (stored in hashed/encrypted form).
  • Demographics: Date of birth and sex (gender).
  • Profile Customization: Profile image or photo, and general location information (e.g., country/zip code).
• b) Health, Food, and Activity Data (Sensitive Data)

  This is information you voluntarily provide through your use of the Service's features. This includes:

  • Body Metrics: Height, weight, BMI, and body measurements.
  • Goals & Lifestyle: Fitness level, activity goals (e.g., weekly habits), and lifestyle information (e.g., sleeping data).
  • Dietary Diary: Food, drink, and medications you consume (including as submitted via voice logging), calorie counts, dietary restrictions, and information from grocery integrations.
  • Medical Information: Information related to any physiological conditions you choose to share.
  • Visual & Reflective Data: Progress photos you may choose to provide and other information you submit in notes (e.g., observations and reflections).
  • AI-Processed Data: Images, text, and voice inputs you submit for nutritional analysis. These are processed to provide estimated nutritional information and may be retained to improve our AI models.
  • AI Assistant Conversations: The content of your conversations with the in-app AI Assistant (which helps you log diary entries and use the Service), including any health, dietary, or personal information you choose to include in those conversations. Conversation content is processed by our third-party AI provider (Google, via its Gemini models) to generate responses and perform logging actions, and may be retained as described in Section 7.
  • Recipe Data: Recipes you view, save, create, log, or publish, and associated preferences and interactions.
  • Synced Device & Health-Platform Data: With your permission, step counts, activity data, and calorie-burn estimates from your device and connected health and fitness platforms (e.g., Apple HealthKit, Google Fit / Health Connect, Strava, Garmin, and other wearable integrations).
  • Generated Insights: Estimated daily calorie targets, macronutrient breakdowns, energy-balance calculations, and other analytics generated by our Service based on your data.

  Health, Food, and Activity Data may constitute sensitive personal information (or a "special category" of personal data) where it indicates or allows someone to infer a health condition. Where applicable law requires explicit consent to process such data, we rely on the explicit consent you provide when you submit it and enable the relevant features; you may withdraw that consent at any time as described in Section 9.

• c) Communication Data

  When you communicate with us, we collect records of those interactions. This includes:

  • Information you provide when you contact us for customer support, provide feedback, or respond to surveys or questionnaires.
  • The content of your communications with us, including emails, in-app messages, and social media interactions.
• d) Technical and Usage Data (Automatically Collected)
  • Device Information: Operating system, hardware model, device type, unique device identifiers (e.g., IDFA or Android Ad ID), IP address, network connection type, and battery level.
  • Diagnostics & Service Logs: Crash reports, error and performance data, and server-side logs generated when your device communicates with our infrastructure (e.g., API request logs including IP address and timestamps). We may additionally collect aggregate feature-usage information to understand app performance; we do not use third-party behavioral-advertising analytics.
  • Cookies & Local Storage (Strictly Necessary Only): Our website uses only strictly necessary, first-party cookies and browser local storage — for authentication/session management and to remember basic interface preferences (e.g., language or layout settings). We do not use advertising cookies, third-party analytics cookies, tracking pixels, or cross-site tracking technologies on our website. If we ever introduce non-essential cookies or trackers, we will update this Policy and, where required by law (e.g., in the EEA/UK), request your consent first.
• e) Purchase and Subscription Data

  When you purchase a Subscription, we and our subscription-management processor (RevenueCat) process purchase and transaction data, including product identifiers, purchase and renewal dates, transaction/receipt identifiers issued by the Apple App Store or Google Play Store, subscription status, and pricing/currency information. We do not collect or store your full payment card details — payments are processed by the Apple App Store, Google Play Store, or their respective payment infrastructure.

• f) Third-Party Data (With Your Consent)
  • Integrated Services: If you connect third-party services (e.g., Apple HealthKit, Google Fit / Health Connect, Strava, Garmin, or other wearable and fitness platforms), we collect data from those services according to your permissions, including step counts, activity, and calorie-burn estimates. Data obtained from Apple HealthKit or Google Fit / Health Connect is used solely to provide Service functionality and is handled in accordance with the applicable platform policies (including Apple's HealthKit guidelines and Google's Health Connect / Fit data policies), which restrict the use of such data for advertising and other non-service purposes.
  • Public Content You Choose to Share: If you publish content through public-facing features (such as Community Recipes or a public profile), that content — together with your username, profile photo, and other profile attribution you make public — is visible to anyone, including non-users, and may be indexed by search engines and copied by third parties outside our control. Health and diary data is never made public unless you affirmatively publish it.
  • Social Media: If you link your account with social media platforms, we may collect profile data as authorized by you through that platform.

3. How We Use Your Information & Our Legal Bases

We use your information for the following purposes, based on the legal grounds specified:

• To Provide Core Service Functionality (Legal Basis: Performance of a Contract; Explicit Consent for sensitive Health Data):
  • Create and manage your user account and profile, including displaying your profile photo.
  • Calculate personalized health metrics (e.g., BMR, calorie targets) which require data like age, height, and weight.
  • Enable logging of workouts, nutrition, mood, sleep, and notes.
  • Analyze food images, text, and voice inputs to provide nutritional estimates.
  • Operate the AI Assistant, including processing your conversation content to generate responses and create or modify diary entries at your direction.
  • Provide, personalize, and log Recipes and their estimated nutritional information.
  • Sync and display step, activity, and calorie-burn data from your device and connected health platforms, and incorporate it into your daily calculations.
  • Deliver curated content and insights based on your data.
  • Manage subscriptions, entitlements, and purchases (via RevenueCat and the applicable app store).
• To Improve and Develop the Service (Legal Basis: Legitimate Interests; Consent for Sensitive Data where required):
  • Analyze usage patterns to enhance user experience and optimize features.
  • Train and validate our AI models, primarily using anonymized and aggregated data, to improve accuracy and service capabilities. We will seek your explicit consent where required by applicable law before using sensitive data for materially new purposes.
  • Conduct research and development for new features.
• To Communicate with You (Legal Basis: Performance of a Contract; Legitimate Interests; Consent):
  • Send essential service-related communications (e.g., account verification, security alerts, policy updates).
  • Respond to your support inquiries, feedback, and other communications.
  • Send marketing communications about our products, from which you can opt out at any time.
• For Security, Legal Compliance and Protection (Legal Basis: Legal Obligation; Legitimate Interests):
  • Verify you meet the minimum age requirement (18+) using your date of birth.
  • Detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Use; protect our rights, property, and user safety; establish, exercise, or defend legal claims.
  • Comply with legal obligations and respond to lawful requests from public authorities.

No Sale of Personal Data: We do not sell your personal data for money. We do not "share" personal data for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA), and we do not process personal data for targeted advertising as defined under other U.S. state privacy laws. If this ever changes, we will update this Policy and provide required opt-out mechanisms first.

Automated Processing: The Service uses automated processing (including AI models) to generate nutritional estimates and insights. These outputs are informational only and do not produce legal or similarly significant effects concerning you. Where applicable law grants you rights regarding automated decision-making, you may exercise them as described in Section 9.

4. Data Sharing & Third-Party Disclosures

We share information only under limited circumstances with appropriate safeguards:

• a) Service Providers (Processors)

  We engage third-party companies to perform services on our behalf under contracts that require them to protect your data and restrict them from using it for their own purposes. Our principal providers include:

  • Cloud Hosting, APIs & Infrastructure: Google (Google Cloud Platform, including hosting and API infrastructure).
  • Database & Data Storage: Supabase (managed database, authentication, and storage infrastructure).
  • Subscription & Purchase Processing: RevenueCat (subscription lifecycle and entitlement management), together with the Apple App Store and Google Play Store.
  • AI Vendors: Third-party AI providers, including Google (Gemini models), for meal-scanning image recognition, nutritional analysis, and powering the AI Assistant. Inputs you submit to AI features (images, text, voice, and AI Assistant conversations) are transmitted to and processed by these providers to generate outputs.
  • Analytics Providers: Tools for analyzing usage data to understand app performance and stability.
  • Customer Support & Communication Tools: Platforms for managing user inquiries and sending communications.

  We may update or replace providers from time to time; where required by law, we maintain data processing agreements (including Standard Contractual Clauses where applicable) with each provider.

• b) Disclosures at Your Direction (Connected Apps & Third-Party AI Assistants)

  The Service allows you to authorize third-party applications and AI assistants — including clients compatible with the Model Context Protocol ("MCP"), such as Claude — to connect to your CalPal account through an OAuth-based consent flow. If you authorize such a connection:

  • We disclose to the connected client the identity information covered by the scopes you approve on the consent screen (e.g., email address and profile information), and the client may access your CalPal account data (including Health, Food, and Activity Data) on your behalf using your access token.
  • These disclosures are made at your direction and do not constitute a "sale" or "sharing" of personal data under the CCPA/CPRA or similar laws.
  • Once received by the connected client, your data is governed by that third party's privacy policy and terms — not this Policy. We encourage you to review them before connecting.
  • You may revoke a connection at any time in your account settings; revocation stops future access but does not retrieve data the client already received.
• c) Legal & Safety Disclosures

  We may disclose your information if required by law, regulation, legal process, or enforceable governmental request, or if we believe in good faith that disclosure is necessary to protect our rights and property, our users' or the public's safety, to enforce our Terms of Use, or to detect, prevent, or address fraud or security issues.

• d) Business Transfers

  In the event of a merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of our assets, your information may be transferred as part of the transaction. We will provide notice where required and ensure the continued protection of your data under this Policy or a successor policy.

• e) Anonymized or Aggregated Data

  We may share anonymized or aggregated data that cannot reasonably be used to identify you for purposes like research, analytics, AI model improvement, or industry reports.

5. Referral Program Data Processing

When you participate in CalPal's referral or influencer program, we process additional personal data to manage the program and process payments. This section describes how we handle referral program-specific data:

• a) Referral Program Data Collected

  When you generate and share your referral link, we collect and process:

  • Your unique referral code and associated referral link
  • Records of each referred user (identifying information of people you refer)
  • Conversion data (whether referred users downloaded, signed up, and completed their first tracking week)
  • Purchase data (subscription purchase amounts, dates, and cancellations)
  • Referral source (which platform or method your link was shared on)
  • Referral metrics (total referrals, successful conversions, cancellations, chargebacks)
  • Commission calculations and payment amounts earned
• b) Influencer Program Data

  If you are approved as an influencer (10,000+ followers), we additionally process:

  • Your social media handles, follower counts, and audience demographics
  • Verification records (screenshots, account authenticity checks)
  • Account status history and engagement metrics
  • Your bank account or payment processor details (Stripe Connect or PayPal) for commission payouts
  • Tax documentation (W-9, W-8BEN, or local tax ID for income reporting and 1099-NEC generation for US-based influencers earning >$600/year)
  • Content audit records (monitoring for FTC compliance and brand alignment)
  • Payment history and payout records
• c) Legal Basis & Purpose

  We process referral program data based on the following legal grounds:

  • Performance of a Contract: Processing necessary to manage your participation in the referral program and pay your earned commissions
  • Legal Obligation: Processing tax documentation (W-9/W-8BEN) and maintaining records for tax compliance and 1099-NEC reporting (up to 7 years in the US)
  • Legitimate Interests: Fraud prevention, program integrity monitoring, ensuring compliance with referral program terms, detecting bot activity or fake referrals
  • Consent: For marketing communications about referral program updates and opportunities (you may withdraw consent at any time)
• d) Data Retention for Referral Program
  • Active Participants: Referral data is retained for the duration of your participation in the program and for 12 months after account deletion or program withdrawal
  • Tax & Compliance Records: Retained for 6–7 years to comply with tax obligations and financial audit requirements
  • Chargeback & Dispute Records: Retained for as long as necessary to detect fraud patterns and defend legal claims, consistent with applicable limitation periods
  • Commission & Payment Records: Retained for 7 years for tax, accounting, and audit purposes
• e) Data Sharing for Referral Program

  We share referral program data with:

  • Payment Processors (Stripe Connect, PayPal): To process commission payments and verify payment information
  • Tax Service Providers: To generate Form 1099-NEC for eligible US-based influencers
  • Fraud Prevention Services: Third-party tools to detect bot activity, fake referrals, and suspicious patterns
  • App Store Partners (Apple App Store, Google Play Store): To verify referral conversions from app download events
  • Legal Authorities: If required by law or to enforce our Referral Program Terms
• f) International Data Transfers for Referral Data

  Referral data may be transferred to jurisdictions where we and our payment processors and service providers operate. We rely on Standard Contractual Clauses (SCCs), adequacy decisions, or equivalent safeguards to ensure lawful transfers.

• g) Data Subject Rights for Referral Data

  You have the same rights regarding referral program data as described in Section 9, including access, rectification, erasure (subject to tax and legal retention obligations), portability, and withdrawal of consent. To exercise these rights, contact privacy@calpalai.app. Note that deletion of referral program data may impact your ability to receive pending or future commission payouts.

• h) Tax Compliance & Reporting
  • For US-based influencers: If you earn $600 or more in commission fees during a calendar year, we are required by US tax law to issue a Form 1099-NEC. To comply, we will collect your full legal name, Tax Identification Number (TIN), address, and other information required by the IRS. This information is processed for tax reporting purposes and retained for 6 years.
  • For international influencers: We may be required to collect tax identification information (such as Tax ID numbers) or W-8BEN forms to comply with international tax treaties and withholding requirements.

6. International Data Transfers

The Service is available worldwide, and your personal data may be processed in countries other than your country of residence, including the United States and other countries where our infrastructure providers (Google, Supabase, RevenueCat, Apple, Google Play) operate. These countries may have data protection laws that differ from those of your jurisdiction.

Where we transfer personal data out of the EEA, UK, Switzerland, or other jurisdictions with transfer restrictions, we ensure such transfers are lawful and protected by appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, adequacy decisions, certification frameworks (such as the EU-U.S. Data Privacy Framework where a provider is certified), or other legally recognized mechanisms. You may request more information about the safeguards applied to your data by contacting privacy@calpalai.app.

7. Data Ownership, Retention & Your Data

• a) Ownership of Your Data
  • Your Identifiable Personal Data: You retain all rights and ownership of your identifiable personal data. You grant us a non-exclusive license to use, store, process, and display your identifiable personal data for the purposes of operating, providing, securing, and improving the Service as outlined in this Privacy Policy and our Terms of Use.
  • Derived Data & AI Models: We own all anonymized, aggregated, or de-identified data, including our AI models, algorithms, and insights derived from user-generated content (like food entries, notes, images) and other data. This data, once stripped of personal identifiers such that it can no longer reasonably be linked to you, is no longer personal data and may be used for any legitimate business purpose, including product development, research, and analytics, and may be retained indefinitely. We commit to maintaining such data in de-identified form and not attempting to re-identify it, except as permitted by law to test the effectiveness of de-identification.
• b) Data Retention
  • Active Accounts: Personal data associated with your active account is retained until you request account deletion.
  • Account Deletion: Deletion follows the process in our Terms of Use (30-day pending-deletion grace period). After deletion becomes permanent, we delete or irreversibly anonymize your personal data, except as noted below.
  • Inactive Accounts: For accounts that remain inactive for a period exceeding 24 months, we may anonymize or delete associated personal data.
  • Legal Requirements & Audits: Certain data, such as transaction records, may be retained for up to 7 years or as required by applicable law for tax, fraud prevention, or auditing purposes, even after account deletion.
  • Backups: Encrypted backups of data may be retained for up to 90 days for disaster recovery purposes, after which they are securely overwritten or deleted.
  • AI Assistant Conversations: Conversation history is retained while your account is active to provide continuity and improve the feature, and is deleted or anonymized upon account deletion, subject to the backup and legal-retention periods above.
  • AI Training Data: Data used for AI model training, once anonymized or de-identified, may be retained indefinitely to ensure continuous model improvement and validation.

8. Data Security

We implement appropriate technical and organizational safeguards designed to protect your personal data from unauthorized access, use, alteration, and disclosure. These measures include:

• Encryption: Encryption of sensitive data at rest and in transit (TLS).
• Access Controls: Strict, role-based access controls limiting who can access personal and sensitive data, following the principle of least privilege.
• Infrastructure Security: Reliance on enterprise-grade infrastructure providers (Google Cloud, Supabase) that maintain independent security certifications and controls.
• Backup and Recovery: Appropriate backup and recovery procedures to prevent data loss.
• Incident Response: A data breach protocol for managing and responding to security incidents, including notification to affected users and supervisory authorities where required by applicable law (e.g., within 72 hours under the GDPR where feasible and required).

NO METHOD OF TRANSMISSION OVER THE INTERNET OR METHOD OF ELECTRONIC STORAGE IS 100% SECURE. WHILE WE IMPLEMENT SAFEGUARDS APPROPRIATE TO THE RISK, WE CANNOT AND DO NOT GUARANTEE ABSOLUTE SECURITY, AND, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, WE DISCLAIM LIABILITY FOR UNAUTHORIZED ACCESS, USE, OR DISCLOSURE OF DATA THAT OCCURS DESPITE SUCH SAFEGUARDS, INCLUDING INCIDENTS AFFECTING OUR THIRD-PARTY PROVIDERS. You are responsible for maintaining the security of your account credentials.

9. Your Rights (Global)

Depending on your jurisdiction, you may have some or all of the following rights regarding your personal data:

• Right to Access / Know: Request confirmation of processing and a copy of your personal data.
• Right to Portability: Receive your data in a structured, commonly used, machine-readable format and/or have it transmitted to another controller.
• Right to Rectification / Correction: Request correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten") / Deletion: Request deletion of your account and personal data, subject to legal retention obligations or other lawful grounds for retention (e.g., legal holds, financial records). The account-deletion process is described in our Terms of Use.
• Right to Object: Object to processing based on legitimate interests, and to direct marketing (absolute right).
• Right to Restriction: Request that we limit the way we use your personal data.
• Right to Withdraw Consent: Where processing is based on consent (including explicit consent for health data), withdraw it at any time without affecting the lawfulness of prior processing. Withdrawal may limit or disable Service features that depend on that data.
• Rights Related to Automated Decision-Making/Profiling: Request human intervention, express your point of view, and contest automated decisions where applicable law provides such rights.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• Right to Lodge a Complaint: Lodge a complaint with your data protection supervisory authority (e.g., your national authority in the EU/EEA, the ICO in the UK, or your state Attorney General in the U.S.).

How to Exercise Your Rights: Contact us at privacy@calpalai.app. We will verify your identity before fulfilling requests and respond free of charge within 30 days (or one month under the GDPR), extendable where permitted by law for complex requests. Where permitted, you may use an authorized agent to submit requests on your behalf. If we deny your request, you may appeal by replying to our decision, and we will respond as required by applicable law.

Jurisdiction-Specific Provisions

• EEA / UK / Switzerland (GDPR / UK GDPR): MOUNTAIN LLC is the controller of your personal data. Our legal bases are described in Sections 3 and 5. Special-category (health) data is processed on the basis of your explicit consent (Art. 9(2)(a) GDPR). You have all rights listed above and the right to complain to your supervisory authority.
• United States (CCPA/CPRA and other state laws): We do not sell personal information and do not share it for cross-context behavioral advertising. Categories of personal information collected, purposes, and disclosures are described in Sections 2–5. California residents may exercise rights to know, delete, correct, and limit use of sensitive personal information via privacy@calpalai.app. Residents of Virginia, Colorado, Connecticut, Utah, Texas, and other states with comprehensive privacy laws have comparable rights, including the right to appeal a refusal.
• Brazil (LGPD): You may additionally request information about public and private entities with which we have shared your data, and information about the possibility of denying consent and its consequences.
• Canada (PIPEDA and provincial laws): We collect, use, and disclose personal information with consent or as otherwise permitted by law. You may withdraw consent subject to legal or contractual restrictions and reasonable notice.
• Australia (Privacy Act 1988): You may request access to and correction of your personal information and complain to the Office of the Australian Information Commissioner (OAIC) if dissatisfied with our response.
• Japan (APPI): We handle personal information in accordance with the Act on the Protection of Personal Information, including obtaining consent where required for the provision of personal data to third parties and for cross-border transfers, and honoring requests for disclosure, correction, and cessation of use.
• South Korea (PIPA): We process personal information in accordance with the Personal Information Protection Act, including consent requirements for the collection of sensitive information and overseas transfers.
• South Africa (POPIA): We process personal information in accordance with the Protection of Personal Information Act; you may object to processing, request correction or deletion, and complain to the Information Regulator.
• India (DPDP Act): We process digital personal data in accordance with the Digital Personal Data Protection Act, 2023, including consent-based processing and your rights to access, correction, erasure, and grievance redressal.
• Other Jurisdictions (including elsewhere in Asia, Africa, Latin America, and the Middle East): Where the data protection law of your country grants you additional rights or imposes additional requirements, we honor them to the extent required by that law.

10. Cookies, Tracking & Do Not Track

Our website uses only strictly necessary, first-party cookies and local storage as described in Section 2(d) — for signing you in, keeping your session active, and remembering basic interface preferences. Because we do not use advertising, analytics, or cross-site tracking cookies, no cookie-consent banner is required, and there is no tracking to opt out of. You can clear cookies and local storage through your browser settings; doing so may sign you out or impair Service functionality. Some browsers transmit "Do Not Track" or Global Privacy Control (GPC) signals; as we do not sell or share personal data or engage in cross-site tracking, our treatment of your data is the same whether or not such signals are present.

11. Age Restriction & Children

Our Service is designed for and intended for use only by individuals who are 18 years of age or older.

• Strict Policy: No exceptions are made to the 18+ age restriction.
• Proactive Measures: We implement age gates at the sign-up process and ensure our marketing is not targeted at children.
• Child Data Discovery: If we become aware that we have collected personal data from anyone under the age of 18, we will take immediate steps to delete such information and terminate the associated account. Please contact us at privacy@calpalai.app if you believe we may have collected information from a minor.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated Policy with a revised "Last Updated" date and, for material changes, notify you via the Service or email and, where required by applicable law, obtain your consent. Your continued use of the Service after the effective date of an updated Policy constitutes acknowledgment of the update to the extent permitted by law.

13. Governing Law & Disputes

This Privacy Policy is an integral part of our Terms of Use. The governing law and dispute resolution procedures for any disputes arising from or related to your use of the Service, including those concerning your privacy, are set forth in our Terms of Use, Sections 17 (Dispute Resolution & Arbitration) and 18 (Governing Law & Jurisdiction). Nothing in this Section limits any non-waivable rights you have under the data protection law of your jurisdiction, including the right to lodge a complaint with a supervisory authority.

14. Contact Us

• Data Controller: MOUNTAIN LLC
• Privacy inquiries & rights requests: privacy@calpalai.app
• Legal notices: legal@calpalai.app