Privacy Policy

1. Who we are

calibrEAT is operated by PallettAi (“we”, “us”). For the limited data described in sections 3 and 5 we are the controller under UK GDPR. For the logs you keep in the app we are not: those stay on your device and never reach us.

Contact: support@calibreat.co.uk · Website: https://calibreat.co.uk. If you write to us, we use your message only to answer it.

2. Scope

This policy covers:

• Website: calibreat.co.uk and its pages, hosted as a static site on GitHub Pages.
• App | calibrEAT for Android and for iPhone and iPad. Features include the food diary, barcode scanning, nutrition-label photo scanning, recipe import by URL, water and weight tracking, workouts, fasting, reminders, and CSV/JSON export.

It does not cover Open Food Facts, Google, Apple or your email provider. They have their own policies.

3. Website data

We set no cookies and the site has no contact form and no accounts. The only thing the website stores in your browser is your light or dark theme choice (calibreat-theme in localStorage), which is never sent to us. Pages load one Google Fonts stylesheet (Inter Tight, IBM Plex Mono, Sora). If that fails, the site falls back to system fonts.

The site may use Cloudflare Web Analytics for cookieless, aggregated page-view counts. It collects no personal profiles and sets no cookies. It only runs once it is configured for the site, and it never sees anything you do inside the app.

We do not use fingerprinting, advertising pixels or cross-site tracking.

4. App data stays on your device

The app is local-only. There is no calibrEAT account and no sync. Everything you log is written to a SQLite database on your phone, plus a small amount of settings data in local storage. The in-app calculators (BMI, BMR/TDEE, workout burn estimates, fasting timer, trends) work from that on-device data, and the results stay on the phone.

• Profile and goals: sex, birth date, height, weight, activity level, calorie and macro targets. Used on the device to compute your needs. This is health-related data under UK GDPR Article 9. It is never sent to us.
• Logs: food entries, water, weigh-ins, workout sessions, fasting sessions, saved meals and routines, stored by day.
• Reminders: reminder schedules are handled by the phone’s own notification system.

Uninstalling the app deletes this data, subject to your phone’s own backup settings. Export it first with the app’s CSV/JSON export if you want a copy. We cannot recover logs that were only ever on your device.

5. Network requests the app makes

The app talks to the network only in these cases:

• Barcode scan and packaged-product search query Open Food Facts (openfoodfacts.org) over HTTPS. The request contains the barcode or search terms, plus your IP address, and goes to that provider under its own policy. It does not come to us. Name search checks the bundled UK food dataset (CoFID) on your device first, so it works offline; packaged-product results come from Open Food Facts when you are online.
• Recipe import fetches only the public recipe page URL you paste in, directly from that site. The parsed recipe is stored on your device. We never see the URL or the recipe.
• Links to calibreat.co.uk from the share features open in your browser only when you tap them.

The app contains no advertising SDKs, analytics SDKs, crash reporters or account services. Nothing about your logs is sent to us.

6. Device permissions

• Camera: reads food barcodes and photographs nutrition labels. Label text is recognised on the phone using an on-device text recogniser. Photos are not uploaded to us or anyone else.
• Health Connect (optional, Android): read-only access to steps, active calories burned and exercise sessions, used to estimate activity burn in the app. You can decline or revoke it at any time. The data stays on the device.
• Notifications: local reminders you choose to enable.

7. Legal bases (UK GDPR Art. 6)

8. Sharing and processors

We do not sell your data and we do not send your logs to any server we run. We share data only where needed to run the website or answer you:

• GitHub, Inc. hosts the static website.
• Google LLC serves the website’s fonts.
• Open Food Facts receives only the barcode and search queries you make from the app.

We will also share data if the law requires it, or to protect our rights.

9. Retention

• Support emails: kept only as long as needed to answer you and keep a record of the reply.
• On-device data: you control it. Clear the app’s data or uninstall the app to erase it.

10. Your rights

Under UK GDPR you have the rights to access, correction, erasure, restriction, objection and data portability, and to complain to the Information Commissioner’s Office (ICO) at ico.org.uk. Because your app data is held only on your device, you exercise those rights for it directly in the app, through export and uninstall. For anything we hold, email support@calibreat.co.uk and we will respond within one month.

11. Security

The website is served over HTTPS. Your app data is protected by your phone’s own storage and lock-screen security. We cannot see it, so we cannot leak it. No system is perfect, though, so keep your phone’s software up to date.

12. Children

calibrEAT is not directed at children under 13, and we do not knowingly collect data from them.

13. Changes to this policy

We will post changes here and update the “Last updated” date. If a change is material we will say so on calibreat.co.uk and, where appropriate, in the app.

14. Contact and complaints

Questions or requests: support@calibreat.co.uk. Complaints not resolved with us: you can complain to the ICO at ico.org.uk/make-a-complaint.