Privacy Policy

1. Who we are

calibrEAT is operated by PallettAi (“we”, “us”). For UK GDPR we are the controller for the limited personal data described in sections 3, 5 and 6. For the app’s on-device health logs we are not the controller — you are. That data never reaches our servers.

Contact: support@calibreat.co.uk · Website: https://calibreat.co.uk. If you write to us, we will use your message only to answer you.

Who we are: calibrEAT is operated by PallettAi. Contact: support@calibreat.co.uk. Card payment is taken by a Merchant of Record named on the checkout page and on your receipt. We do not publish a company number on this site.

2. Scope

This policy covers:

• Website — calibreat.co.uk and subpages (index.html, license.html, download.html, and these legal pages), hosted as a static site on GitHub Pages.
• App — calibrEAT for Android (APK sideload; build in progress) and iOS (App Store later) — currently in pre-launch. App features: food diary, barcode scan, water & weight tracking, True Burn Learning, goals & insights.
• License service — the activation API (Cloudflare Worker + Durable Object) that verifies your email and binds your lifetime code to a device; and the Merchant of Record checkout that sells the code and emails it.

It does not cover Open Food Facts, Apple, Google or your email provider — they have their own policies.

3. Website data — the minimum

We set no cookies and run no analytics. The site is plain HTML/CSS/JS with one Google Fonts stylesheet (Inter + Sora). If Google Fonts fails, the site falls back to system fonts.

We do not use fingerprinting, advertising pixels or cross-site tracking.

4. App data — what stays on your device

The app is offline-first and local-only. Everything you log is written to a local SQLite database (via expo-sqlite on device) and to AsyncStorage for the license. There is no calibrEAT account and no sync. In-app tools (BMI today; more later) read that on-device profile and weigh-in history to calculate useful numbers. Those calculations stay on the phone — calibrEAT never collects or stores them.

Data that stays on the device and is never sent to us unless you email us:

• Profile & goals: sex, birth date, height, weight, activity level, calorie/macro targets, start weight — used on the device to compute BMR/TDEE (Mifflin-St Jeor), daily needs, and in-app tools such as the BMI calculator. This is health-related special-category data under UK GDPR Art. 9 — we choose not to collect it at all; it remains on your device and is included only if you export CSV/JSON yourself.
• Logs: food entries (meal, name snapshot, quantity, kcal/macros), water (ml per day), weigh-ins (kg), derived daily totals. Stored locally per day_key YYYY-MM-DD.
• License cache: normalized code, activatedAt, plan label, customer email (as returned by the license API) — stored locally so the app works offline after activation.
• Install ID: a random UUID generated once per install and stored locally — sent only to the activation API (see §5) so one code = one active device per email.

What this means: deleting the app deletes this data (subject to OS backup behaviour). Uninstalling without an export is permanent. We cannot “recover your logs” — we never had them.

5. Activation data we do receive

To enforce “one code, one email, one active device” we must verify ownership outside the device. The three-step gate is the only personal data flow from the app to our servers:

1. POST /v1/request-verification { email } — we generate a 6-digit OTP, store only hash(email|otp), and send the code via Resend (no-reply@calibreat.co.uk). OTP: 10-minute expiry, single-use, 5-attempt lockout, 30 s resend cooldown.
2. POST /v1/verify-email { email, otp } — if valid we store the lower-cased verified email against the install. No password is ever set.
3. POST /v1/activate { code, email, installId } (and later /v1/validate, /v1/deactivate) — we store hashed license codes (SHA-256) bound to the buyer email and the installId. A different email with the same code is rejected; a second device is rejected until the first deactivates or support clears the slot. Refunds/chargebacks → the code is revoked and the app re-locks on next validation.

What we store server-side: lower-cased email, hashed code, installId, activatedAt, plan, and whether revoked. We never store your food, water or weight logs. License codes are hashed — a database leak leaks nothing activatable.

Processors: Cloudflare Workers + Durable Objects (hosting the API + SQLite DO store) and Resend (email delivery). See §9.

6. Purchase — Merchant of Record is the seller

The lifetime code is sold on a hosted checkout operated by a Merchant of Record named on the payment page. The MoR is the seller of record: it takes payment, handles VAT/sales tax, sends the receipt and emails your permanent activation code instantly, and handles chargebacks. The MoR’s privacy policy and terms apply to the checkout and payment. We receive only what the MoR webhooks to our license API — typically event, customer_email, license_key — to register or revoke the code. We never see full card numbers.

7. Food database lookups

Barcode scan and food search query Open Food Facts directly from the app over HTTPS. Those queries (barcode numbers, search terms) plus your IP go to that provider per their policies — not to us. Results are cached locally on your device. Using these features requires an internet connection; your private logs are still local.

8. Legal bases (UK GDPR Art. 6 & 9)

9. Sharing & processors

We do not sell your data and we share it only where needed to run the product:

• Merchant of Record — payment, tax, receipt & license-key email. The MoR acts as independent controller for the sale (and as seller of record). Its policy applies at checkout.
• Resend (email) — sends OTPs and (if you email us) may transit support replies. DPA in place via their terms.
• Cloudflare, Inc. — Workers & Durable Objects host the license API; may process requests in the US/EEA per Cloudflare Privacy Policy.
• GitHub, Inc. — hosts the static website (Pages).
• Open Food Facts — only the queries you choose to make from the app.

We will also share if the law requires it, or to protect our rights.

10. Retention

• OTPs: deleted after use or after 10 minutes, and after lockout windows expire. Resend logs per their retention.
• License bindings (hashed code + email + installId + status): kept for the life of the license so we can re-validate, let you move devices, and honour revocation. If you ask us to delete your email, we anonymise the binding (the code stays hashed for fraud prevention).
• Support emails: kept until your question is resolved, then up to 12 months for warranty/support records, then deleted.
• On-device logs: you control this — delete the app or clear data to erase everything locally.

11. Your rights

Under UK GDPR you have the right to access, correction, erasure, restriction, objection, and data portability, and to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk (helpline 0303 123 1113). Because most app data is only on your device, the way to exercise portability/erasure for logs is via the app’s export and delete functions. For server-side data (email + hashed license), email support@calibreat.co.uk — we will respond within one month.

12. Security

License codes are stored hashed (SHA-256) with constant-time comparisons; OTP records are keyed by hash(email|otp) so the store reveals neither. Webhooks and admin endpoints require secrets (x-webhook-secret / Authorization: Bearer). Cloudflare provides HTTPS, global edge and isolation per Worker. No system is perfect — a decompiled APK can still be patched, which is why the server is the gate: without a valid server check, no store-derived unlock works offline in release builds (release builds fail closed).

13. Children

calibrEAT is not directed at children under 13. If you are under 18, please have a parent or guardian review these terms before you buy or activate.

14. International transfers

The license API and email delivery may process data outside the UK (e.g. Cloudflare/Resend infrastructure in the US/EU). Where we transfer UK personal data abroad we rely on the UK’s adequacy regulations or the provider’s Standard Contractual Clauses / IDTA as appropriate.

15. Changes to this policy

We will post any changes here and update the “Last updated” date. If the changes are material we will highlight them on calibreat.co.uk and, where appropriate, in the app. The version at the time you purchased or activated remains available on request.

16. Contact & complaints

Questions or requests (access, deletion, portability): support@calibreat.co.uk. Complaints not resolved with us: you may complain to the ICO (ico.org.uk/make-a-complaint) or to an ADR provider. You also have the right to bring a claim before the courts of England and Wales.

This policy describes how calibrEAT actually works: on-device logs, hashed server licence data, Merchant of Record checkout, and no cookies. The MoR’s own privacy policy also applies to payment. Questions: support@calibreat.co.uk.