Privacy Policy for Cal Counter

Effective August 9, 2026 · Version 1 · All Metabola policies

This Privacy Policy explains how Metabola LLC ("we," "us," or "our") collects, uses, and protects your information when you use Cal Counter, our mobile application for photo-based calorie and macro tracking. It covers the Cal Counter app only; other Metabola apps have their own policies, and the metabola.io website is covered by our Website Privacy Notice. We are committed to transparency and safeguarding your privacy.

Much of what Cal Counter handles is health data, and Washington and Nevada law give it particular protections. Our Consumer Health Data Privacy Policy describes how we treat that data in more detail, including the consents we ask for and the rights you have over it. We apply those practices to every Cal Counter user, wherever you live.

1. Information We Collect

We collect all of the following from one source: you, directly, when you enter it or take a photo in the app. We do not buy data about you, and we do not collect it from data brokers, public sources, or other services.

• Account Information: your email address, and either a password you choose or an identifier from Apple or Google if you use Sign in with Apple or Sign in with Google. We also store the name you ask us to call you, and your subscription tier.
• Body and Profile Data: your date of birth, biological sex, height, weight (including a dated history of your weight entries), and your self-described activity level. You provide these during onboarding and can edit them later.
• Goals: your fitness goal and your daily calorie and macronutrient targets, whether the app calculated them or you set them yourself.
• Meals and User Content: the food photos you take or select in the app; the food names, portion descriptions, calorie estimates, and macronutrient estimates for each meal, whether our AI produced them or you entered or adjusted them; the date and time each meal was logged; your saved and favorite meals; and the calorie goal that was in effect when each meal was logged.
• Usage and Device Information: product analytics events recording that something happened in the app (for example, that a scan completed), how many scans you have used, your push notification token, your notification preferences, and crash and error diagnostics.

We do not collect your location — the app never requests location permission — and we do not connect to Apple Health, Google Fit, or any other external health record.

2. How We Use Your Information

We use the information we collect strictly to provide, maintain, and improve the Cal Counter app. Specifically, we use it to:

• Create and manage your account.
• Analyze your food photos to provide estimated nutritional data (calories and macronutrients).
• Calculate your calorie and macronutrient targets from the body characteristics and goals you provide.
• Track your progress against your established goals and show your trends over time.
• Send you the notifications you have enabled.
• Keep the app working — diagnosing crashes and errors, and measuring in aggregate how features are used so we can improve them.
• Provide customer support and respond to your inquiries.

We do not use your information for advertising, and we do not sell it.

3. Third-Party Data Processing

We rely on trusted service providers to ensure the app functions securely and effectively. They handle your data only on our behalf, under contract, and only according to our instructions. We do not sell your personal data, and none of these providers is permitted to use it for their own purposes.

• Supabase: our database, private file storage, and user authentication. Your account data, profile, and meal history are stored via their infrastructure.
• Railway: hosting for our backend application. Your data passes through Railway in transit and may appear briefly in short-lived operational logs.
• Google (Gemini), Anthropic (Claude), and OpenAI: analysis of the food photos you submit, solely to return nutritional estimates to you. Which of these analyzes any given photo depends on your subscription tier and on operational factors such as availability and fallback, and we may change that routing at any time, so you should assume any one of them may process a photo you submit. We use all three on terms that do not permit them to train models on what we send or to use it independently; our Google account is on the paid Gemini API tier, where submitted data is not used to improve Google's products. They may retain a submitted photo briefly for security and abuse monitoring under their own retention terms, then delete it on their own schedule. They do not receive your name, email address, or account history.
• Sentry: crash and error reporting. Fields describing your body, your goals, or what you ate are redacted on your device before a report is sent.
• RevenueCat: subscription and purchase management. It receives an account identifier only.
• Expo push service: delivery of push notifications. It receives a device token only.

Your food photos are stored privately, never in a public bucket. They are sent to the AI services directly from our backend as image data, so those services never reach into our storage themselves, and your photos are never exposed at a public or permanent web address. Any link the app uses to display one of your photos expires within one hour.

4. Other Ways We May Disclose Information

Apart from the service providers described above, we may disclose your information only in the following circumstances:

• Legal Requirements: If required to do so by law or in response to valid legal process (such as a subpoena, court order, or government request), or where we believe disclosure is necessary to protect the rights, safety, or property of Metabola LLC, our users, or others.
• Business Transfers: If Metabola LLC or the Cal Counter app is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

5. The metabola.io Website

This policy covers the Cal Counter app. Anything you do on our website — including joining the launch waitlist — is covered separately by our Website Privacy Notice.

6. Data Retention and Account Deletion

While your account is active, we keep your data for the life of the account — your meal history and long-term trends are the service itself, so we do not expire them. We do not delete dormant accounts: if you stop using Cal Counter, your data stays until you delete it or ask us to.

You can permanently delete your account and all associated data directly within the Cal Counter app settings at any time. Deletion immediately removes your authentication record, which cascades through our database to remove your profile, meals, saved meals, weight history, goals, notification preferences, and push tokens, and it deletes your food photos from storage. A follow-up cleanup process sweeps for anything the first pass did not remove. Your analytics events are unlinked from your identity and remain only as anonymous rows that can no longer be associated with you. Our backups are encrypted and taken daily on a rolling seven-day window, so residual copies in backups are purged within seven days.

Aggregate statistics that can no longer be linked to you or any individual may be retained indefinitely.

7. Your Privacy Rights

Depending on where you live, you may have rights under applicable law to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. You can exercise most of these directly in the app (including full account deletion), or by contacting us at support@metabola.io. We will not discriminate against you for exercising any of these rights. If your request concerns health data, our Consumer Health Data Privacy Policy describes the specific rights available to you, our response times, and how to appeal a decision.

8. Security

We implement reasonable and standard security measures, including those provided by Supabase, to protect your personal information from unauthorized access, alteration, or disclosure. However, no electronic transmission or storage method is 100% secure.

9. Children's Privacy

Cal Counter is not intended for individuals under the age of 13 (or the applicable age of consent in your region). We do not knowingly collect personal information from children. If we discover that a child has provided us with personal information, we will delete it immediately.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you through the app or via the email address associated with your account.

11. Contact Us

If you have any questions or concerns about this Privacy Policy or your data, please contact us at: support@metabola.io