Privacy Policy

1. Who we are

CalsFlow (“CalsFlow”, “we”, “us”) is a nutrition and body-progress tracking app. This policy explains what we do with your personal data when you use the CalsFlow mobile app or calsflow.com.

The data controller is Rehan Shakir, an individual developer based in Lahore, Pakistan. You can reach us at contact@calsflow.com.

2. What we collect

We only collect data you give us or that the app produces as you use it. We do not buy data about you, and we do not track you across other apps or websites.

We do not collect your precise location, contacts, calendar, browsing history, or advertising identifiers. The CalsFlow app contains no advertising SDKs and no third-party analytics SDKs.

The calsflow.com website (not the app) uses Google Analytics to understand how many people visit and which pages they view, so we can improve the site. This uses cookies and collects a truncated IP address plus standard device and browser information; Google Analytics 4 does not record full IP addresses. We do not use it for advertising. You can opt out with Google’s opt-out browser add-on or by blocking cookies in your browser.

3. What never leaves your device

The app asks for camera and photo-library permission only so you can capture or pick these images. If you delete the app, photos it saved privately are removed with it; photos you chose to also save to your gallery stay in your gallery under your control.

Your theme choice, reminder settings and the picks you make on the share sheet are also stored locally on your device.

4. How we use your data

• To create and maintain your account and keep you signed in.
• To estimate the calories and macros in the meals you describe, and to calculate your personalised daily targets.
• To show your daily totals, streak, calendar, weight trend, BMI and measurement history.
• To send the reminders you switch on (these are scheduled on your device).
• To keep the service secure, debug problems and prevent abuse.
• To email you a waitlist invite, if you asked for one.

We do not use your data to build advertising profiles, and we do not make automated decisions that produce legal or similarly significant effects about you.

5. AI processing

To turn “2 boiled eggs, 1 roti and chicken karahi” into numbers, CalsFlow sends your meal description to the Anthropic Claude API, together with a small amount of context: your diet type, whether you prefer halal food, and your country.

When you ask CalsFlow to calculate your targets, we send your profile — age, gender, height, weight, target weight, goal, activity level, training days, average steps, food preferences and allergies.

Anthropic processes this data as our service provider in order to return the estimate. If AI estimation is unavailable, CalsFlow falls back to a local formula (Mifflin-St Jeor) or lets you enter the numbers yourself. See Anthropic’s privacy policy.

6. Health Connect (Android)

If you choose to connect Health Connect, CalsFlow reads four things for the current day: steps, active calories burned, sleep duration and resting heart rate.

We do not use Health Connect data for advertising, and we do not sell it. You can disconnect at any time from CalsFlow’s Profile screen, or revoke access in Health Connect (Settings → Security and privacy → Health Connect → App permissions). Revoking access stops all reads immediately; because we never stored the data, there is nothing on our side to delete.

7. Who we share data with

We do not sell your personal data, and we never have. We share it only with the service providers that let CalsFlow run:

We may also disclose data if we are legally required to, or to protect the rights and safety of our users. If CalsFlow is ever involved in a merger or acquisition, we will tell you before your data becomes subject to a different policy.

When you use Share progress, you decide what to include and which app to send it to. That content leaves your device through your own share sheet and is then governed by whichever app you sent it to.

8. Legal basis (UK/EU)

If UK or EU data protection law applies to you, we rely on:

• Performance of a contract — to provide the account and features you asked for.
• Consent — for optional things you switch on, such as Health Connect, camera and photo access, notifications, and joining the waitlist. You can withdraw consent at any time.
• Legitimate interests — to keep the service secure and working, balanced against your rights.

Health and body data are a special category of personal data. We process them on the basis of your explicit consent, given when you enter them or connect Health Connect.

9. How long we keep it

• Account and logged data — for as long as your account exists. Delete your account and it goes with it.
• Waitlist emails — until you ask to be removed, or until early access ends and the list is no longer needed.
• Server logs — a short period for security and debugging, then discarded.
• On-device photos and settings — until you delete them in the app or uninstall it.

10. Your rights

Depending on where you live, you have the right to:

• Access the personal data we hold about you, and get a copy of it.
• Correct anything inaccurate — most of it you can edit directly in the app.
• Delete your account and your data.
• Object to or restrict certain processing.
• Withdraw consent you previously gave.
• Complain to your data protection authority.

To exercise any of these, email contact@calsflow.com. We will respond within 30 days. We will never charge you or make the service worse because you exercised a right.

11. Deleting your account

We will confirm your request and permanently delete your account, profile, meal logs, weight history and body measurements within 30 days. Some data may persist in encrypted backups for a short period afterwards before being overwritten.

Photos stored on your device are not part of this request, because we never had them — delete them in the app or uninstall CalsFlow to remove them.

To be removed from the waitlist only, email us and we will delete your address without touching anything else.

12. Security

Passwords are hashed with bcrypt and never stored in readable form — we cannot see your password. Traffic between the app and our servers is encrypted in transit with HTTPS. Access to production data is limited to those who need it to operate the service.

No system is perfectly secure. If we ever become aware of a breach affecting your personal data, we will notify you and the relevant regulator as required by law.

13. Children’s privacy

CalsFlow is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child has given us personal data, email contact@calsflow.com and we will delete it.

CalsFlow provides nutrition estimates, not medical advice. If you have a medical condition or an eating disorder, please speak to a doctor or dietitian before changing how you eat.

14. International transfers

Our providers may process your data in countries other than yours, including the United States. Where required, transfers are covered by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

15. Changes to this policy

If we change this policy we will update the date at the top of this page. For changes that materially affect how we handle your data, we will tell you in the app or by email before they take effect.