CalBuddy — Privacy Policy

1. Who We Are (Data Controller)

The Service is operated by Otto Apps Yazılım Uygulama Bilgi Teknoloji Reklamcılık Danışmanlık Sanayi ve Ticaret A.Ş. ("we", "us", "CalBuddy"), Istanbul, Turkey.

• Privacy / data-protection contact: info@calbuddy.app
• Registered address: [registered address — to be completed]
• EU / UK representative: [appoint an Art. 27 GDPR representative if targeting EU/UK users — to be completed]

For residents of the EEA, UK, and Switzerland, we act as the data controller for the personal data described below.

2. Data We Collect

2.1 Onboarding & Quiz Data (web funnel)

When you complete the CalBuddy quiz/onboarding, we collect the answers you provide, which may include:

• Email address (captured before we show your personalized result).
• Sex, age, height, current weight.
• Goal weight and desired pace.
• Current and desired physique selections (body-image choices).
• Activity level and lifestyle answers (schedule, habits, past blockers, motivation).
• Preferred language and, where you proceed, your messaging channel (e.g. WhatsApp / Apple Messages / Telegram handle or number).

2.2 Account & Registration Data

• Sign-in identifiers: Apple Sign-In identifier (with optional email / display name), email address (magic-link or email sign-in), and/or your messaging-platform identifier used to link your chat to your account.
• Device UUID, optional display name, preferred language.

2.3 Messaging-Channel Data

The AI coach is delivered through third-party messaging platforms. Depending on the channel you choose, we collect and process:

• WhatsApp (primary): your phone number and WhatsApp profile identifier, used to route messages and to send a one-time passcode (OTP) that verifies you and links your chat to your account.
• Telegram: your Telegram user ID and, if set, username, used to route messages and verify you via the CalBuddy bot.
• Apple Messages (as it rolls out): the identifier Apple provides for Business messaging.
• For every channel: the content of your messages to and from the coach (text, food photos, voice notes, barcodes) and basic delivery metadata (timestamps, message/delivery status).

These platforms are operated by Meta (WhatsApp), Telegram, and Apple. Your use of them is also governed by that platform's own privacy policy and terms, over which we have no control. On WhatsApp we send/receive messages via the WhatsApp Business Platform.

2.4 Health, Food & Activity Data (special-category data)

This is health data and is treated as a special category:

• Logged foods, meals, portions, calories, and macronutrients.
• Barcode-scanned products.
• Food photos you send, and voice notes you send (which are transcribed to text so the coach can respond).
• Profile data: age, sex, height, weight, activity level, dietary preferences and restrictions.
• Goals, targets, and computed values (TDEE, BMI, calorie/macro targets, projected trajectory).
• Progress records: weight history, body measurements, water intake.
• The content of your conversations with the AI coach, and the AI-generated plans, recipes, charts, and recommendations produced for you.

2.5 Payment Data

• Subscription status, plan, trial state, transaction identifiers, and billing country.
• We do not store full card numbers. Card and payment details are handled directly by our payment processors.

2.6 Device, Technical & Usage Data

• IP address, device model, OS, app/version, browser type.
• Approximate geolocation (country / city, derived from IP).
• Product usage events, feature interactions, and funnel/quiz analytics.
• Cookies and similar technologies on the website and funnel.

3. How We Use Your Data

• Provide the Service: run the AI coach, compute your plan and targets, log food/water/weight, and deliver responses over your chosen messaging channel.
• Personalization: remember stable facts and preferences from your conversations to give continuity and better coaching over time.
• Payments & subscriptions: process purchases, trials, renewals, and refunds.
• Service improvement & analytics: understand usage, fix defects, evaluate quality, and improve the coach.
• Communications: send you your plan, service and transactional messages, trial/renewal reminders, and — where permitted — product updates.
• Security & fraud prevention; and legal compliance.

4. Legal Bases (GDPR / UK GDPR) & Health-Data Consent

Where GDPR/UK GDPR applies, we rely on:

• Consent — for processing your health data, for marketing communications, and for non-essential cookies/tracking. You give explicit consent via the checkbox(es) in the funnel/app, and you can withdraw it at any time.
• Contract — to provide the Service and manage your subscription.
• Legitimate interests — for security, fraud prevention, and basic service analytics (balanced against your rights).
• Legal obligation — for tax, accounting, and lawful requests.

Because CalBuddy processes special-category health data, we ask for your explicit, separate consent before collecting it and only process it to deliver the coaching you requested.

5. Third Parties We Share Data With

We share the minimum data necessary with the following categories of processors/partners. Each processes data under contract on our behalf (or, for payment/messaging platforms, under their own terms).

We do not sell your personal data.

6. Automated Processing & Personalization

The AI coach and our personalization layer (MemoryOS) automatically analyze your inputs to tailor plans, targets, and messages. This does not produce legal or similarly significant effects about you. All calorie/macro/target numbers are computed by deterministic formulas, not invented by the AI; AI outputs are estimates and may be inaccurate. You can contact us to review or object to this personalization.

7. International Data Transfers

We are based in Turkey and use processors located in the United States, EU, and other countries. Where we transfer personal data out of the EEA/UK, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (and the UK Addendum) or an adequacy decision. A copy of the safeguards is available on request.

8. Cookies & Tracking (website & funnel)

Our website and onboarding funnel use cookies and similar technologies for essential functionality, analytics (PostHog), and advertising/measurement (Meta Pixel). Non-essential cookies load only after you consent via our cookie banner, where required. You can manage preferences through the banner and your browser settings.

9. Data Retention

• We keep personal data only as long as needed for the purposes above.
• If you delete your account, we anonymize or delete your personal data within 90 days, except records we must keep for legal, tax, or fraud-prevention reasons.
• Voice notes and photos are retained only as needed to process and log them, then deleted or de-identified per the above.

10. Your Rights

Depending on your location (GDPR/UK GDPR, CCPA/CPRA, and similar laws), you may have the right to:

• access, rectify, erase, and restrict processing of your data;
• data portability;
• object to processing and withdraw consent at any time;
• opt out of "sale"/"sharing" and targeted advertising (we do not sell data); and
• lodge a complaint with your data-protection authority.

To exercise any right, email info@calbuddy.app. We respond within 30 days. We will not discriminate against you for exercising your rights.

US health-privacy notice

For US residents, we handle consumer health data in line with applicable laws, including the FTC Health Breach Notification Rule and the Washington My Health My Data Act (and comparable state laws). We obtain consent before collecting consumer health data and before sharing it with third parties as those laws require.

11. Children

The Service is not directed to children under 16. We do not knowingly collect data from children under 16 (or the minimum age of digital consent in your country). If you believe a child has provided us data, contact us and we will delete it.

12. Security

We use TLS/SSL encryption in transit, access controls, row-level security on our database, and regular security reviews. No method is 100% secure. If a breach affecting your data occurs, we will notify you and the relevant authority as required by law (within 72 hours where GDPR applies).

13. Changes to This Policy

We may update this Policy. Material changes will be communicated via in-app notification, email, or a website banner. Continued use after the effective date means you accept the updated Policy.

13. Company Information

This website and its Services are operated by the following entities: