Privacy Policy

Effective September 25, 2026

Calzentra ("Calzentra", "we", "us") is a personal nutrition and fitness tracker, operated by an individual based in India. This policy explains what data we collect, why, and what rights you have over it — under the EU/UK General Data Protection Regulation (GDPR) where it applies, since some of what we collect (your weight, body measurements, workouts, water, sleep and food logs) is health data, a "special category" of personal data under GDPR Article 9; and under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), under which we act as the Data Fiduciary and you are the Data Principal for the personal data you provide us.

1. What we collect

  • Account data — name, email address, and either a hashed password or a Google account identifier (if you sign in with Google).
  • Health & fitness data — body weight, waist circumference, body-fat percentage, workouts (type such as walking, running, cycling, strength, yoga or a sport, plus duration, distance or steps), water intake, sleep (hours and an optional quality rating), and any weight, step or water goals you set. This is "special category" health data under GDPR Article 9.
  • Nutrition data — food and meal entries, diet plans, and personal recipes. If you log a meal by typed description or photo, that text or image is sent to an AI provider (see "Who we share data with" below) to be parsed into structured food items, then discarded once parsed — we don't keep the raw photo or transcript after the entry is created.
  • Voice notes — if you log by voice, the recording is sent to an AI provider (see below) to be transcribed and turned into entries. A voice note can contain food as well as health data you mention, such as a workout, water, sleep or your body weight; it's used only to fill in the entries you review before saving. The recording and its transcript are discarded once parsed — only the entries you save are stored.
  • Preferences — timezone, unit system (metric/imperial), theme, and your dashboard layout.
  • Support requests — anything you send us through the in-app Support section.
  • Technical data — a session cookie that keeps you signed in. We don't use analytics or advertising trackers.

2. Why we process it, and our lawful basis

Under GDPR, every use below is backed by one of these lawful bases. Under the DPDP Act, the same processing is backed by your consent (for health and nutrition data) or is necessary for the specified purpose of providing the service you signed up for (account data and preferences) — both are recognised grounds for processing under the Act.

  • Your explicit consent (Article 9(2)(a)) — for your health and nutrition data specifically, since it's special category data. We only start processing it once you tick the box on the consent screen shown right after you create an account (or, if we ever change what we collect it for, the next time you log in), and you can withdraw consent at any time by deleting your account (Settings → Danger zone), which erases this data permanently.
  • Performance of a contract (Article 6(1)(b)) — for account data (name, email, login credentials) and preferences, which we need simply to run the account you signed up for.
  • Legitimate interests (Article 6(1)(f)) — for technical data like the session cookie and basic request logs, needed to keep the service secure and functioning, and for support-ticket data, needed to respond to what you send us.

We never sell your data, and we don't use your health or nutrition data for advertising or profiling.

3. Who we share data with

We use a small number of processors to run the service. None of them receive your health/nutrition data for their own purposes — only to perform the specific task below on our behalf:

  • DeepSeek — parses typed meal descriptions into structured food items.
  • OpenRouter / Google Gemini — parses meal photos into structured food items when you log food by photo, and transcribes voice notes into food, workout, water, sleep and weight entries when you log by voice.
  • USDA FoodData Central and Open Food Facts — public nutrition databases we query by food name to fetch verified macro/micronutrient data; we don't send them any of your personal information.
  • Google — if you choose to sign in or link your account with Google OAuth.
  • Our email provider — sends transactional email only (e.g. password reset links), never marketing.
  • Our hosting and database providers — store the application and its data.

Some of these processors are based in, or process data in, the United States. Where that happens, we rely on their standard contractual clauses (SCCs) or equivalent safeguards for transferring data out of the EU/UK.

4. How long we keep it

We keep your data for as long as your account is active. If you delete your account (Settings → Danger zone), your profile, weight/measurement/workout history, nutrition logs, recipes and diet plans are permanently deleted immediately — this can't be undone. Support tickets and records needed to demonstrate legal compliance (e.g. proof of consent) may be retained for a limited period afterward where we have a legitimate or legal reason to do so.

5. Your rights

Under GDPR, you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data (most of it you can edit directly in the app).
  • Erase your data — self-service via Settings → Danger zone → Delete account, which removes everything immediately.
  • Restrict or object to certain processing.
  • Receive a copy of your data in a portable format.
  • Withdraw consent at any time (see "Your rights" above — withdrawing consent to health-data processing means deleting your account, since that data only exists to power the tracking features you consented to).
  • Lodge a complaint with your local data protection authority.

To exercise any right that isn't self-service in the app, contact us using the details below.

6. Your rights under India's DPDP Act

If you're in India, the DPDP Act separately gives you the right to:

  • Access a summary of the personal data we hold about you and how it's processed.
  • Correct, complete, or update your personal data — most of it you can edit directly in the app.
  • Erase your data — self-service via Settings → Danger zone → Delete account, which removes everything immediately, once it's no longer needed for the purpose it was collected for or for us to meet a legal obligation.
  • Withdraw consent at any time, as easily as you gave it (see Section 2 above).
  • Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity, by writing to us at the contact below.
  • Register a grievance with us first, and if it isn't resolved to your satisfaction, with the Data Protection Board of India.

Grievance Officer — for any complaint or grievance under the DPDP Act, contact Saurabh Nimkande at support@calzentra.com. We aim to acknowledge grievances within a reasonable time and resolve them promptly.

7. Security

Passwords are hashed (never stored in plain text), sessions are authenticated with an httpOnly cookie, and access to the database is restricted to the application itself.

8. Children

Calzentra isn't directed at, or knowingly used by, anyone under 16.

9. Changes to this policy

If we make a substantive change to what we collect or why, we'll update the effective date above and, where the change affects the basis you originally consented to, ask existing users to re-consent.

10. Contact

Questions about this policy or your data can be sent through the in-app Support section, or by email at support@calzentra.com.