Privacy Policy

1. Introduction

This Privacy Policy describes how Dima Labs Inc ("Operator", "we", "us") collects, uses, stores, and protects personal information when you use the Caloroo service (the "Service"). By using the Service you agree to the practices described here. Connecting another app requires your separate approval; using Caloroo or accepting this Policy does not authorize an MCP connection.

2. Data Controller

The Operator is Dima Labs Inc, a corporation incorporated in the Province of Ontario, Canada. We are committed to handling personal data in accordance with applicable Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA).

3. Information We Collect

• Account data. Email address, password hash, and optional display name provided to register and sign in.
• Food and nutrition logs. Entries you create, including items, portions, timestamps, photos, and notes.
• Profile and health data. Optional goals, body metrics (such as weight and body measurements), dietary preferences, check-ins, and group membership you choose to enter.
• Photos. Progress photos and avatars you upload, and nutrition-label photos you scan.
• Payment data. If you buy a paid plan, payment is handled by our payment provider. We never receive or store your full card details.
• Notification token. A push notification token, if you enable notifications.
• Connected-app data. When you connect an app through Model Context Protocol (MCP), we store its identity, your approved permissions, authorization and expiry dates, and credentials needed to maintain the connection. We also store metadata about write operations, including the app, operation, time, outcome, and affected record identifiers, and encrypted results used to handle retries without duplicating changes.
• Technical data. IP address, browser and device information, access logs, and error diagnostics collected through standard server logs.

4. How We Use Your Information

• Provide and operate the Service and display your logs back to you.
• Authenticate users and secure accounts.
• Enable connections you approve, respond to authorized app requests, and record changes made through those connections.
• Process payments for any paid features.
• Send notifications related to your account or the Service.
• Diagnose issues, prevent abuse, and analyze usage to improve the Service.
• Comply with legal obligations.

We do not sell your personal data. We do not use your food logs for advertising. We do not use your personal health data to build advertising or marketing profiles, and we do not share it with advertisers.

5. Data Storage and Security

Personal data is primarily stored on servers located in data centers in Toronto, Canada. Photos and other content you upload are kept in S3-compatible object storage. We apply technical and organizational measures including encryption in transit, access controls, regular backups, monitoring, and malware protection. No system is perfectly secure, but we work to protect your data using industry-standard practices. Some of the providers described below may process limited data outside Canada; see International Data Transfers.

6. Data Retention

• Account deletion immediately ends access to your account and is irreversible. Deletion of remaining stored data and copies is subject to the retention periods below. Residual copies in encrypted backups are purged within approximately 30 days.
• Food logs and ordinary account activity history are retained for the lifetime of your account. Account deletion removes the associated database records; residual copies are subject to the retention periods in this section.
• MCP authorization records are retained until the authorization expires, 30 days after approval, then removed along with associated credential records by scheduled cleanup. Individual credentials may expire sooner. Disconnecting an app revokes access but does not immediately delete those records. MCP write-activity metadata expires after 365 days, including activity from disconnected apps. Encrypted retry results and associated retry records expire after 24 hours. Expired records are removed by scheduled daily cleanup, so physical deletion may occur after expiry. Account deletion removes these account-linked database records; the backup provisions above apply.
• Server and access logs are retained for up to 12 months.
• Third-party analytics data is retained according to the policies of the relevant providers.
• Records needed to meet legal obligations, resolve disputes, or prevent fraud may be retained only for as long as necessary for those purposes, with access restricted accordingly. Payment providers may retain transaction records under their own legal obligations.

7. Account Deletion

You can permanently delete your account from app settings. This removes your account and associated database records and cannot be undone. It does not mean that every stored copy, uploaded file, or provider record is erased immediately; the retention provisions above apply. Contact [email protected] for help with deletion of remaining uploaded files or provider-held data. Request any copy of your data you need before deleting your account. Account deletion cancels linked Polar web and RevenueCat-managed Google Play subscription renewals before removing the account. If cancellation fails, your account is kept so you can retry or contact support. Apple subscriptions require separate cancellation through Apple. See the Terms of Service for billing and refund details.

8. Third-Party Services

Your personal health data, including your weight, body measurements, food and nutrition logs, goals, check-ins, and progress photos, is never sold. We do not share it for advertising or marketing. We share it with contracted providers to operate the Service and with recipients or independent apps you authorize, as described below.

Sharing your health data with other people or independent apps is always initiated by you and requires your consent. No health data is shared with those recipients unless you authorize it. This includes groups, share links, and apps or AI assistants connected through MCP. Sharing is entirely opt-in. You control what, if anything, each group member or share link can see, and you can revoke access at any time. Revoking access prevents future access through the Service but cannot recall screenshots, downloads, or copies already obtained by recipients.

To operate the Service we use a small set of providers that process data strictly on our behalf, under contract, and are not permitted to use it for their own purposes: infrastructure and object storage hosting (your photos and content), payment processing (Polar; we never receive your full card details), transactional email (Resend), error diagnostics (Sentry), product analytics (PostHog, which receives your account identifier and usage and technical events only, never your food logs or health data), and push notification delivery.

Nutrition-label scanning. When you scan a nutrition label, the label image (product packaging, not your personal health information) is sent to a vision provider (OpenAI or Google) solely to read the nutrition values. These providers are contractually barred from using the image to train their models or for any purpose other than returning the result to us. The food log created from the scan is stored in our systems and may be shared through sharing settings or connected apps you authorize.

Connected apps and AI assistants (MCP)

MCP lets you connect an independent app, such as an AI assistant, to Caloroo. This is optional and always user-initiated. Starting a connection does not share your health data: you must first sign in to Caloroo and explicitly approve access on the consent screen for the identified app. We do not give an MCP app access to your health data without your consent or beyond the permissions you approve. Personal account access is limited to your own account and the permissions granted; connecting does not give the app access to other members' private data through your group memberships.

• Account access: your account ID, name, email, and connection status.
• Nutrition access: food searches, logged and planned food entries, meals, nutrition targets and goals, and nutrition history, balances, and analysis.
• Wellness access: weight, body measurements, and steps, and estimates derived from relevant profile and weight data when combined with nutrition access. This permission has a separate checkbox that is unchecked by default. You must explicitly select it to share this data; approving the other permissions does not enable wellness access.
• Write access: recording and planning food, editing food entries, and creating meals, manual foods, and recipes. Data submitted by the app is stored as part of the Service.

Authorized data is sent to the connected app to fulfill its requests and may include sensitive health information. These independent apps are not acting as our contracted processors merely because you connect them. Their own terms, privacy policies, and your settings govern how they use and retain received data, including any use for model training and processing outside Canada. Review those policies before connecting. The restrictions described above for our nutrition-label scanning providers do not apply to an independent AI assistant you choose to connect, even if it is offered by the same company.

If you approve persistent access, the app can stay connected for up to 30 days without a new sign-in. During that time, it can request data within the permissions you approved without asking for consent for each request. You can disconnect it at any time in Settings → Connected apps and review its recorded write activity there. Disconnecting stops future access through that connection; it does not undo changes already made. Disconnecting or deleting your Caloroo account cannot delete data already received by the app, including copies in conversations or its backups. Manage those copies or request their deletion directly from that provider.

We do not track you across other companies' apps or websites. We may also disclose data where required by law.

9. Cookies and Tracking

Essential cookies enable authentication and core functionality of the Service. Analytics cookies, where used, help us understand aggregate usage. You can control cookies through your browser settings, though doing so may affect functionality.

10. Your Rights

Subject to applicable law, you have the right to access, correct, or delete your personal data, to object to or restrict certain processing, to withdraw consent, and to lodge a complaint with a supervisory authority. You can access, correct, and delete your personal data directly within the Service, including deleting your entire account. To request a full copy of your data, contact us.

11. International Data Transfers

Our third-party providers may process data outside Canada. By using the Service you acknowledge that your data may be transferred to and processed in countries other than your country of residence, subject to safeguards required by applicable law. Independent apps you authorize may also process received data in other countries under their own policies, as explained in section 8.

12. Children's Privacy

The Service is designed for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe a minor has provided us with personal data, contact us so we can remove it.

13. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by updating the "Last updated" date above. Continued use of the Service after changes means you accept the revised Policy. Where required, we will notify you and obtain consent for material changes to data use or disclosure. Continued use does not replace your explicit approval of a connected app.

14. Contact Us

Questions or requests regarding this Policy? [email protected]