CalBuddy — Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how the company identified in Section 14 (the "Company", "we", "us" or "our") processes personal data when you use CalBuddy (the "Service").

This Privacy Policy explains how personal data is collected, used, shared, and protected when you use the CalBuddy: AI Assistant mobile application, the website calbuddy.app, our web onboarding funnel, and the AI coaching service delivered over messaging channels (WhatsApp today; Telegram and Apple Messages as additional channels) — together, the "Service".

By using the Service you agree to this Policy. If you do not agree, do not use the Service.

2. Personal Data We Collect

2.1 Onboarding & Quiz Data (Web Funnel)

When you complete the CalBuddy quiz/onboarding, we collect the answers you provide, which may include:

• Email address (captured before we show your personalized result).
• Sex, age, height, current weight.
• Goal weight and desired pace.
• Current and desired physique selections (body-image choices).
• Activity level and lifestyle answers (schedule, habits, past blockers, motivation).
• Preferred language and, where you proceed, your messaging channel (e.g. WhatsApp / Apple Messages / Telegram handle or number).

2.2 Account & Registration Data

• Sign-in identifiers: Apple Sign-In identifier (with optional email / display name), email address (magic-link or email sign-in), and/or your messaging-platform identifier used to link your chat to your account.
• Device UUID, optional display name, preferred language.

2.3 Messaging-Channel Data

The AI coach is delivered through third-party messaging platforms. Depending on the channel you choose, we collect and process:

• WhatsApp (primary): your phone number and WhatsApp profile identifier, used to route messages and to send a one-time passcode (OTP) that verifies you and links your chat to your account.
• Telegram: your Telegram user ID and, if set, username, used to route messages and verify you via the CalBuddy bot.
• Apple Messages (as it rolls out): the identifier Apple provides for Business messaging.
• For every channel: the content of your messages to and from the coach (text, food photos, voice notes, barcodes) and basic delivery metadata (timestamps, message/delivery status).

These platforms are operated by Meta (WhatsApp), Telegram, and Apple. Your use of them is also governed by that platform's own privacy policy and terms, over which we have no control. On WhatsApp we send/receive messages via the WhatsApp Business Platform.

2.4 Health, Food & Activity Data (Special-Category Data)

This is health data and is treated as a special category:

• Logged foods, meals, portions, calories, and macronutrients.
• Barcode-scanned products.
• Food photos you send, and voice notes you send (which are transcribed to text so the coach can respond).
• Profile data: age, sex, height, weight, activity level, dietary preferences and restrictions.
• Goals, targets, and computed values (TDEE, BMI, calorie/macro targets, projected trajectory).
• Progress records: weight history, body measurements, water intake.
• The content of your conversations with the AI coach, and the AI-generated plans, recipes, charts, and recommendations produced for you.

2.5 Payment Data

• Subscription status, plan, trial state, transaction identifiers, and billing country.
• We do not store full card numbers. Card and payment details are handled directly by our payment processors.

2.6 Device, Technical & Usage Data

• IP address, device model, OS, app/version, browser type.
• Approximate geolocation (country / city, derived from IP).
• Product usage events, feature interactions, and funnel/quiz analytics.
• Cookies and similar technologies on the website and funnel.

3. How We Use Personal Data

• Provide the Service: run the AI coach, compute your plan and targets, log food/water/weight, and deliver responses over your chosen messaging channel.
• Personalization: remember stable facts and preferences from your conversations to give continuity and better coaching over time.
• Payments & subscriptions: process purchases, trials, renewals, and refunds.
• Service improvement & analytics: understand usage, fix defects, evaluate quality, and improve the coach.
• Communications: send you your plan, service and transactional messages, trial/renewal reminders, and — where permitted — product updates.
• Security & fraud prevention; and legal compliance.

3.1 Automated Processing & Personalization

The AI coach and our personalization layer (MemoryOS) automatically analyze your inputs to tailor plans, targets, and messages. This does not produce legal or similarly significant effects about you. All calorie/macro/target numbers are computed by deterministic formulas, not invented by the AI; AI outputs are estimates and may be inaccurate. You can contact us to review or object to this personalization.

4. Legal Bases

Where GDPR/UK GDPR applies, we rely on:

• Consent — for processing your health data, for marketing communications, and for non-essential cookies/tracking. You give explicit consent via the checkbox(es) in the funnel/app, and you can withdraw it at any time.
• Contract — to provide the Service and manage your subscription.
• Legitimate interests — for security, fraud prevention, and basic service analytics (balanced against your rights).
• Legal obligation — for tax, accounting, and lawful requests.

Because CalBuddy processes special-category health data, we ask for your explicit, separate consent before collecting it and only process it to deliver the coaching you requested.

5. Sharing and Recipients

We share the minimum data necessary with the following categories of processors/partners. Each processes data under contract on our behalf (or, for payment/messaging platforms, under their own terms).

• Authorised Reseller (Alvin AI Studio LLC, as shown on your receipt): merchant of record for website purchases. Receives only the data needed for payment, receipts, taxes, refunds, chargebacks and fraud prevention, and acts as an independent controller for those purposes only.

We do not sell your personal data for money. Our use of advertising and measurement partners may count as "sharing" under some US state laws — see Section 9.

6. International Transfers

We are based in Turkey and use processors located in the United States, EU, and other countries. Where we transfer personal data out of the EEA/UK, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (and the UK Addendum) or an adequacy decision. A copy of the safeguards is available on request.

7. Retention

• We keep personal data only as long as needed for the purposes above.
• If you delete your account, we anonymize or delete your personal data within 90 days, except records we must keep for legal, tax, or fraud-prevention reasons.
• Voice notes and photos are retained only as needed to process and log them, then deleted or de-identified per the above.

8. Security

We use TLS/SSL encryption in transit, access controls, row-level security on our database, and regular security reviews. No method is 100% secure. If a breach affecting your data occurs, we will notify you and the relevant authority as required by law (within 72 hours where GDPR applies).

9. Your Rights and Choices

Depending on your location (GDPR/UK GDPR, CCPA/CPRA, and similar laws), you may have the right to:

• access, rectify, erase, and restrict processing of your data;
• data portability;
• object to processing and withdraw consent at any time;
• opt out of "sale"/"sharing" and targeted advertising — we do not sell data for money, but our use of advertising partners such as the Meta Pixel may count as "sharing"; opt out on our Do Not Sell or Share page or with a Global Privacy Control (GPC) signal, which we honor automatically; and
• lodge a complaint with your data-protection authority.

To exercise any right, email support@calbuddy.app. We respond within 30 days. We will not discriminate against you for exercising your rights.

10. Regional Information

10.1 United States — Health-Privacy Notice

For US residents, we handle consumer health data in line with applicable laws, including the FTC Health Breach Notification Rule and the Washington My Health My Data Act (and comparable state laws). We obtain consent before collecting consumer health data and before sharing it with third parties as those laws require.

11. Children

The Service is not directed to children under 16. We do not knowingly collect data from children under 16 (or the minimum age of digital consent in your country). If you believe a child has provided us data, contact us and we will delete it.

12. Cookies and Tracking

Our website and onboarding funnel use cookies and similar technologies for essential functionality, analytics (PostHog), and advertising/measurement (Meta Pixel). In the EU/EEA, the UK, Switzerland, Türkiye, Canada and California, non-essential cookies load only after you accept them in our cookie banner (CookieScript). Elsewhere you can opt out of advertising cookies on our Do Not Sell or Share page or with a Global Privacy Control (GPC) signal. You can manage preferences through the banner and your browser settings.

13. Changes to This Policy

We may update this Policy. Material changes will be communicated via in-app notification, email, or a website banner. Continued use after the effective date means you accept the updated Policy.

14. Controller and Contact

The controller of the personal data described in this Policy is Otto Apps Yazılım Uygulama Bilgi Teknolojileri Reklamcılık Danışmanlık Sanayi ve Ticaret Anonim Şirketi, a company incorporated in Türkiye, İçerenköy Mah. Topçu İbrahim Sk. Quick Tower Sit. No: 8-10D, Ataşehir / İstanbul, Türkiye.

For privacy questions or to exercise your rights: support@calbuddy.app.