1. Introduction
Welcome to DeficitFlex ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (collectively, the "Service"). By using the Service, you agree to the collection and use of information in accordance with this policy.
GDPR Compliance: We fully support all main aspects of GDPR compliance. We notify you when we store data and ask for your explicit consent. We only store data when you provide explicit consent. You can export all your stored data, download it for your own use, and permanently delete your account and all associated data at any time through the Account settings page.
2. Information We Collect
Consent-Based Data Collection: We only collect and store your personal information when you provide explicit consent. When you sign in with Google OAuth, we notify you about what data will be collected and stored, and we only proceed with data storage after you explicitly consent. You can withdraw your consent at any time by deleting your account.
2.1 Account Information
When you create an account or sign in using Google OAuth, we collect (with your explicit consent):
- Authentication Data: Google ID, email address, name, and profile picture from your Google account
- Demographics: Age, gender, height, and weight (voluntarily provided)
- Preferences: App settings and user preferences
2.2 Lifestyle and Nutrition Data
To provide accurate calorie tracking and lifestyle insights, we collect:
- Food Logs: Meal descriptions, ingredients, and calorie information
- Physical Activity: Exercise and sports activities, calories burned, step counts
- Body Metrics: Weight measurements and tracking history
- Sleep Data: Bedtime, wake time, sleep duration, resting heart rate, sleep stages (light, deep, REM), sleep efficiency, and sleep quality metrics
2.3 Usage and Technical Data
We automatically collect certain information when you use our Service:
- Device Information: Device type, operating system, unique device identifiers
- Usage Data: App features accessed, interaction patterns, session duration
- Log Data: IP address, browser type, access times, error logs
- Performance Data: App crashes, loading times, and performance metrics (via Sentry)
2.4 AI-Generated Content
When you use our AI-powered calorie estimation feature:
- Meal Descriptions: Text descriptions or images of meals you submit for calorie estimation
- AI Responses: Calorie estimates and nutritional breakdowns generated by our AI service
3. How We Use Your Information
We use the collected information for the following purposes:
3.1 Service Provision
- Provide and maintain the Service
- Process your food logs and calculate calorie balance
- Generate personalized lifestyle and nutrition insights
- Sync your data across devices when you sign in
- Provide AI-powered calorie estimation services
3.2 Personalization
- Customize your experience based on your demographics and preferences
- Calculate your Basal Metabolic Rate (BMR) using the Mifflin-St Jeor formula
- Provide activity-based calorie recommendations
- Tailor sleep quality analysis to your profile
3.3 Service Improvement
- Analyze usage patterns to improve app functionality
- Develop new features and services
- Monitor and fix technical issues
- Enhance security and prevent fraud
3.4 Communication
- Send service-related notifications and updates
- Respond to your inquiries and provide customer support
- Notify you about important changes to our Service or policies
3.5 Legal Compliance
- Comply with applicable laws, regulations, and legal processes
- Respond to lawful requests from public authorities
- Enforce our Terms of Service
- Protect our rights, privacy, safety, and property
4. Data Sharing and Disclosure
We do not sell your personal information. We may share your information in the following circumstances:
4.1 Service Providers
We share information with trusted third-party service providers who assist in operating our Service:
- Google Cloud Platform: Hosting and infrastructure services
- Google Vertex AI: AI-powered calorie estimation services (your meal descriptions are sent to generate estimates)
- Cloudflare: Content delivery, security, and performance optimization
- Sentry: Error tracking and performance monitoring
All service providers are contractually bound to protect your information and use it only for specified purposes.
4.2 Google OAuth
When you sign in with Google:
- We receive your Google profile information (name, email, picture) to create your account
- Google's use of information is governed by their Privacy Policy
- You can revoke access through your Google account settings
4.3 Legal Requirements
We may disclose your information if required by law or in response to:
- Valid requests by public authorities (e.g., court orders, subpoenas)
- Legal processes or government investigations
- Protection of our rights, privacy, safety, or property
- Prevention of fraud or security threats
5. Data Storage and Security
Your data is stored on secure servers hosted by Google Cloud Platform. Data is encrypted in transit using HTTPS/TLS and at rest using industry-standard encryption. We implement appropriate technical and organizational measures to protect your information, including secure authentication, user ID isolation, and regular security assessments.
Important: While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. You acknowledge that we cannot guarantee absolute security and you use the Service at your own risk.
6. Your Rights and Choices
Depending on your location, you may have certain rights regarding your personal information. We fully support GDPR rights:
- Right of Access (Article 15): View and access all your personal information through the Account settings page
- Right to Rectification (Article 16): Update and correct your information through your account settings
- Right to Erasure / "Right to be Forgotten" (Article 17): Permanently delete your account and all associated data at any time through the Account settings page. This action is irreversible and will remove all your data including profile, diary entries, preferences, and settings.
- Right to Data Portability (Article 20): Export all your stored data in a portable JSON format and download it for your own use through the Account settings page. The export includes your profile, diary entries, preferences, and reminder settings.
- Right to Restrict Processing (Article 18): Stop all data processing by deleting your account
- Right to Object (Article 21): Object to processing by deleting your account or adjusting app permissions
- Right to Withdraw Consent (Article 7): Withdraw your consent at any time by deleting your account
- Opt-Out: Opt out of marketing communications and adjust app permissions
- Anonymous Usage: Use the Service without creating an account (data stored locally)
How to Exercise Your Rights: All GDPR rights can be exercised through the "Account" page accessible from the user menu dropdown. You can export your data or delete your account at any time. No additional verification is required beyond your authenticated session.
7. Age Restrictions
Our Service is not intended for individuals under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal information from individuals under 18. If we become aware that we have collected information from an individual under 18, we will take steps to delete it promptly.
Other intended-use limits: The Service is not intended for use during pregnancy or breastfeeding, by people with a current or past eating disorder, or by people whose medical condition or treatment requires an individually supervised diet or weight-management plan. Please do not submit medical history to establish eligibility. These limits do not remove existing users' rights to access, export or delete their data. See our Terms of Service for the health disclaimer.
8. International Data Transfers
Our Service is hosted on Google Cloud Platform, which may process data in various global locations. Your information may be transferred to and processed in countries other than your country of residence. We implement appropriate safeguards to protect your information during international transfers.
9. California Privacy Rights (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know, delete, and opt-out of the sale of personal information. We do not sell personal information. To exercise your California privacy rights, please contact us using the information provided below.
10. European Privacy Rights (GDPR)
If you are located in the European Economic Area (EEA) or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR). We fully comply with GDPR requirements:
- Explicit Consent: We notify you when we store data and only store data when you provide explicit consent. You can withdraw consent at any time.
- Data Export: You can export all your stored data in a portable format and download it for your own use through the Account settings page.
- Account Deletion: You can permanently delete your account and all associated data at any time through the Account settings page. This action is irreversible.
- Transparency: We clearly explain what data we collect, how we use it, and who we share it with in this Privacy Policy.
- Data Minimization: We only collect data that is necessary for providing the Service.
- Security: We implement appropriate technical and organizational measures to protect your data.
Our legal basis for processing includes consent, contract performance, legitimate interests, and legal obligations. All GDPR rights can be exercised through the Account page accessible from the user menu dropdown.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes through the app, email, or other communication methods. The "Last Updated" date at the top reflects the most recent changes. Your continued use of the Service after changes constitutes acceptance of the updated policy.
12. Third-Party Links and Services
Our Service integrates with third-party services including Google OAuth, Google Vertex AI, and Sentry. We are not responsible for the privacy practices of third parties. Your interactions with third parties are governed by their terms and policies.
13. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
DeficitFlex
Email: [email protected]
Website: https://deficitflex.app