Privacy Notice

The person or organization operating this CoCal deployment is responsible for the personal information described here (the “Operator”). For a privacy request, contact the Operator through the official channel from which you received access to this deployment.

• Account data: your sign-in email address, name, profile image, account identifier, sign-in time, and an essential session cookie.
• Meal and diary data: meal photos, dates, meal type, notes, captions, identified foods, portions, calories, macros, edits, and sharing choices.
• Optional wellness data: calorie and macro targets, birthday, height, weight, sex used by the target equation, activity level, goal, and activity names, duration, timestamps, and active calories you enter.
• Profile and social data: handle, display name, avatar, bio, visibility, followers, follows, likes, and comments.
• Device and service data: local app preferences, synchronization state, request timing, error details, and basic security logs.

Depending on where you live, meal, body, target, and activity information may be treated as sensitive or health-related information.

• authenticate your account and keep different users’ diaries separate;
• analyze meal photos, produce editable estimates, and answer adjustment requests;
• save and synchronize your food and activity diary, settings, photos, and profile across devices;
• show content to followers or the public only when you select that visibility;
• operate social actions such as follows, likes, and comments;
• protect the service, diagnose failures, prevent abuse, and control provider costs; and
• evaluate and improve estimate quality, including by recording the before-and-after values of manual corrections. Those correction records do not include the meal photo.

CoCal processes ordinary account and service information as needed to provide the service you requested under the Terms of Use, for legitimate interests such as security and reliability where those interests do not override your rights, and to meet legal obligations.

Where law requires explicit permission for wellness or health-related information, CoCal relies on the separate consent you give on the agreement screen. You may withdraw that consent by stopping use and asking the Operator to delete the associated account data. Withdrawal does not make earlier lawful processing unlawful.

To generate an estimate, CoCal sends the optimized meal image and any note you add to one or more AI service providers. These providers process the input to return an estimate to CoCal for your review and storage.

Other providers may process information only to perform their roles:

• an authentication provider supplies sign-in and basic account identity;
• cloud hosting and file-storage providers run the service and may store optimized photos;
• a managed database provider stores synchronized account, diary, and social records; and
• in development or device-only mode, some diary information and photos stay in your browser or on the local device.

These providers may process data in other countries under their own service and privacy terms. CoCal does not use automated estimates to make legal, employment, credit, insurance, or similarly significant decisions about you.

Profiles and meals begin private. CoCal discloses profile or meal information to followers or the public only when your visibility settings allow it. Public posts, captions, profile details, likes, and comments can be copied by people who see them.

Stored meal and avatar images may use private blob access or a long, unguessable public image URL, depending on how this deployment’s storage is configured. Avoid including faces, documents, or other sensitive details in a meal photo.

Information may also be disclosed when reasonably necessary to comply with law, respond to valid legal process, protect users or the service, investigate abuse, or complete a business transfer with appropriate safeguards.

CoCal uses an essential, HTTP-only cookie to keep you signed in. The browser may also store your device-side diary, photo outbox, synchronization state, theme, and temporary drafts. Blocking essential storage can prevent the app from working.

Account, profile, settings, diary, social, and acceptance records are kept while needed to provide CoCal and maintain a reliable synchronized log. Deleting a meal or activity removes it from the active diary, and deleting a meal schedules any stored photo for deletion; limited tombstone, cache, backup, security, or correction records may remain for synchronization, reliability, fraud prevention, dispute resolution, or legal duties.

Provider-side copies follow the applicable provider’s retention rules. The Operator should not retain personal information longer than needed for the purposes above.

• edit or delete diary entries in the app;
• choose private, followers, or public visibility for supported content;
• change your display name, avatar, bio, follow policy, and optional wellness profile;
• sign out, clear browser storage, or disconnect CoCal from your sign-in provider; and
• ask the Operator for access, correction, deletion, restriction, portability, an objection, or consent withdrawal where applicable law gives you that right.

The Operator may need to verify your account before fulfilling a request. You may also have the right to complain to the privacy or data-protection authority where you live.

CoCal uses access controls, authenticated routes, scoped database queries, and transport encryption where supported. No internet service can guarantee perfect security. If a breach creates a legal notification duty, the Operator will provide the required notices.

CoCal is for adults aged 18 and over and is not intentionally directed to children. If the Operator learns that a child’s information was collected, it should be deleted.

Material changes to this notice receive a new effective date and may require a new acknowledgment or consent. Questions and privacy requests should be sent to the Operator through the official channel from which you received access.