Effective Date: January 25, 2026
Last Updated: June 28, 2026
Welcome to CalyFit ("we," "our," or "us"). We are committed to protecting your privacy. This policy explains how we collect, use, and safeguard your information when you use our mobile application.
Account Data: Google account email, display name, and profile picture (via Google Sign-In / Firebase Authentication). We do not collect passwords — authentication is handled entirely by Google.
Physical Profile: Date of birth, weight, height, gender, and activity level — used to calculate BMI, BMR, and personalized calorie goals.
Nutrition & Food Data: Food intake logs (food name, calories, protein, carbs, fat, meal type, timestamps). Food photos taken for AI recognition (processed in real-time, stored locally on your device only). Barcode scan results for packaged food lookup. Custom recipes, meal plans, and micronutrient data.
Health & Fitness Data: Daily step count, distance, and calories burned (read from your device's hardware step sensor via Health Connect). Heart rate readings, sleep duration and quality, Heart Rate Variability (HRV), blood oxygen saturation (SpO2), and skin temperature (read from your device or connected wearables via Health Connect). Water intake, weight history, fasting times, and body measurements (waist, chest, arms, thighs, neck, hips). Exercise type, duration, and calorie burn data (read from Health Connect). Progress photos (stored locally on your device only).
Device Information: Device model, operating system version, unique device identifiers (device ID, advertising ID), and app usage patterns. Device integrity signals (via Google Play Integrity API) to prevent piracy and abuse.
Subscription & Purchase Data: Subscription status, purchase history, and transaction details (managed via Google Play Billing). Premium status is stored in Firebase Firestore and encrypted local storage.
Data Type
Storage Location
Profile, goals, settings
Encrypted on your device (AES-256)
Food logs, water, steps, weight
Local database on your device
Progress photos, food photos
Local file storage on your device
Account email, name
Firebase (Google servers, US)
Subscription status
Firebase Firestore + local encrypted storage
Heart rate, sleep, HRV, SpO2, skin temperature
Local device only — never uploaded
Step count
Local device only — never uploaded
Device ID
Firebase (for account linking and security)
We use your data solely to provide and improve CalyFit's services:
Personalizing calorie, macro, and step goals based on your profile
AI-powered food recognition from photos (via OpenAI API)
Tracking daily nutrition, steps, water, weight, heart rate, sleep, and fasting
Monitoring health metrics including HRV, SpO2, and skin temperature
Generating meal plans, weight predictions, and health insights
Scheduling smart reminders
Ensuring secure payments and account management
We do NOT use your data for advertising, profiling, or sale to third parties.
OpenAI API: We send food photos (compressed to max 1024px, JPEG quality 60%) and food descriptions to OpenAI's GPT-4o model for nutritional analysis. We do NOT send your name, email, Google account details, or any personally identifiable information. OpenAI returns estimated nutrition data stored locally on your device only. OpenAI may retain API inputs for up to 30 days for safety monitoring per their API policy.
USDA FoodData Central API: We send search queries and an API key. We receive nutritional data (calories, protein, carbs, fat, vitamins, minerals). No personal data is shared with USDA.
Open Food Facts API: We send search queries (food name or barcode number). We receive product name, brand, image URL, nutritional data, and nutriscore grade. No personal data is shared with Open Food Facts.
Firebase Services: Account data is stored using secure, encrypted Firebase infrastructure. Step count, fitness data, food logs, progress photos, and body measurements are stored locally on your device only and are never transmitted to any server.
Service
Purpose
Google Sign-In / Firebase Auth
Account authentication
Firebase Firestore
Premium status & subscription verification
Firebase Remote Config
API key delivery
Firebase Cloud Messaging
Push notifications
Firebase Analytics
App analytics (currently disabled)
Google Play Billing
Subscription management
Google Play Integrity
Device security verification
Health Connect (Google)
Step count, heart rate, sleep, HRV, SpO2, skin temperature, exercise data
OpenAI
AI food recognition
USDA FoodData Central
Nutritional database
Open Food Facts
Product nutritional database
ML Kit / CameraX
Barcode scanning (local)
Picasso
Image loading from Open Food Facts
We do not sell your personal data to any third party.
Encryption: Sensitive data (profile, goals, premium status, fasting state) is encrypted using AES-256-GCM via Android's EncryptedSharedPreferences, backed by Android Keystore. All network requests use HTTPS (TLS encryption).
Device Security: We use Google Play Integrity API to verify the app is running on a genuine, unmodified device. We use Google Play License Verification to verify the app was downloaded from the Play Store.
Breach Protocol: In the unlikely event of a data breach, we will notify affected users within 72 hours.
CalyFit uses Health Connect (by Google) to access your health and fitness data with your explicit permission.
What we read:
Step count and historical daily step data
Heart rate readings
Sleep duration and sleep quality
Heart Rate Variability (HRV)
Blood oxygen saturation (SpO2)
Skin temperature
Exercise type, duration, and calorie burn
What we do NOT read:
Menstrual cycle data
Nutrition data (handled separately via food logging)
Any other Health Connect categories not listed above
Data flow: All health and fitness data is read from Health Connect and stored locally on your device only. No health data is uploaded to any server. You can revoke Health Connect access at any time in your device's Settings.
Access & Correction: Update your profile directly in App Settings
Data Deletion: Request permanent account and data deletion by emailing calyfitapp@gmail.com within 30 days
Step Data: Stored locally only. Uninstalling the app permanently deletes all step data
Health Data: Heart rate, sleep, HRV, SpO2, skin temperature — stored locally only. Uninstalling removes all health data
Photos: Stored locally only. Deleting the app removes all photos
Opt-Out: Disable AI features, notifications, or Health Connect access at any time in app settings
Premium: Cancel through Google Play Store
Active accounts: Data is retained as long as your account is active
Inactive accounts: Accounts inactive for 2+ years may be removed after notice
Deletion requests: Data is permanently deleted within 30 days
Local data: Uninstalling the app permanently deletes all locally stored data
CalyFit is NOT a medical device. All AI-generated estimates, calorie calculations, weight predictions, heart rate readings, sleep analysis, HRV, SpO2, skin temperature data, and nutritional insights are for educational purposes only. They are not a substitute for professional medical advice. Always consult a qualified healthcare professional before making significant changes to your diet, exercise, or health routine.
Your data may be processed on servers in the United States (Firebase, OpenAI). We ensure appropriate safeguards are in place to protect your information according to international standards.
CalyFit is not intended for users under the age of 13. We do not knowingly collect information from children.
California Residents: You have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information.
European Residents: You have the right to access, rectify, erase, restrict processing, and port your personal data.
To exercise any rights: calyfitapp@gmail.com
We may update this policy from time to time. Material changes will be communicated via in-app notification or email.