Privacy Policy

What We Collect

• Account info: Email, alias (display name), hashed password.
• Health data: Food logs, calorie entries, exercise logs, weight logs, daily budgets.
• Messages: Comments exchanged between paired users.
• Photos: Sent to a third-party AI provider for calorie analysis. See "AI Data Handling" below.
• Usage data: Login timestamps, session tokens.

How We Use It

• To provide calorie tracking and accountability features.
• To generate AI-powered progress insights and coaching suggestions.
• To calculate penalties and budget adjustments between paired users.
• To send notifications you've opted into.
• We do NOT sell your data. We do NOT serve ads.

AI Data Handling

CaloPair uses AI in the following ways:

• Food photo analysis: When you upload a food photo, the image is sent to our AI provider for calorie estimation. Photos are transmitted via encrypted connection and are not stored by us after processing.
• Progress insights: Periodically, we send aggregated, de-identified health data (calorie totals, weight trends, food descriptions, exercise entries) to our AI provider to generate coaching suggestions. No personally identifiable information (your name, email, alias, or account details) is included in these AI requests.
• What is NOT sent to AI providers: Your email address, real name, alias, password, payment information, messages to your partner, or any data that could identify you personally.
• AI provider data usage: We use Anthropic's API, which does not use customer inputs or outputs for training. See Anthropic's privacy policy for their data handling practices.

Third-Party Services

• Anthropic (Claude AI): Processes food photos and generates progress insights. Does not train on your data.
• Amazon Web Services: Hosts the application and database. Data stored in US regions.
• Stripe: Processes payments. We do not store your credit card details.

Data Retention

Your data is retained for as long as your account is active. Upon account deletion, all personal data is permanently removed within 30 days. AI-generated insights are deleted along with your account data.

Your Rights

• Request a copy of your data.
• Request deletion of your account and all associated data.
• Opt out of notifications at any time.
• Opt out of AI progress insights (contact support).

Security

Passwords are hashed with bcrypt. Sessions use httpOnly cookies. Database connections are encrypted with TLS. All AI provider communications use encrypted HTTPS connections. We follow industry-standard security practices.

Children

CaloPair is not intended for users under 18. We do not knowingly collect data from minors.

Changes

We may update this Privacy Policy at any time. Continued use after changes constitutes acceptance.

Contact

For privacy concerns: support@scripturasoftware.com