Privacy Policy
42apps LLC ("we", "us", or "our") operates the CalZen mobile application and website (calzen.ai). This Privacy Policy explains how we collect, use, share, and protect your personal data when you use CalZen (the "App" and "Website"). It applies to users worldwide, including those protected by the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
1. Data Controller
The data controller responsible for your personal data is:
- 42apps LLC
- 49 building, Mamyr-4, 050039 Almaty, Kazakhstan
- Email: calzen@42apps.io
2. Information We Collect
2.1 Information You Provide
- Health and nutrition data: age, gender, height, weight, body fat percentage, calorie and macro goals, food diary entries, water intake, weight log
- Medication and GLP-1 tracking data: if you use the medication tracker, the information you choose to enter, such as medication name and formulation, dose and unit, your prescribed schedule, planned and actual dose dates and times, injection sites, dose history and statuses, changes to your recorded regimen, and notes
- Related tracking data: if you use the available related features, symptom and well-being entries, medication supply information (such as quantities and expiry dates), and reminder settings. Entries and estimates derived from them are health-related information
- Food photos: images you take or upload for AI calorie analysis
- Support requests: email address and message content when you contact us
2.2 Information Collected Automatically
- Device data: device model, operating system version, app version, language, time zone
- Usage data: features used, screens viewed, session duration, and interaction events, including interactions with GLP-1 tracking features
- Analytics identifiers: pseudonymous app, device, and user identifiers used to associate events across sessions. An identifier may also be used by our subscription service to associate app usage with subscription status. These identifiers do not themselves contain your name, but they can link activity to the same user or device and are not fully anonymous
2.3 Information from Third-Party Integrations
- Apple Health / Health Connect: steps, active calories burned (only with your explicit permission; we read but do not write to these services)
- Subscription data: purchase status, subscription plan, expiration date (via Apphud; we do not receive payment card details)
2.4 Website Data (calzen.ai)
- Analytics: Google Analytics processes page views, referral source, device type, approximate location (country/city level), and cookie or device identifiers
- Cookies: we use essential cookies and analytics cookies. See Section 10 below
- Calculator inputs: data entered into our online calculators is processed locally in your browser and is never sent to our servers
3. Legal Basis for Processing (GDPR)
We process your personal data based on the following legal grounds:
| Purpose | Legal Basis |
|---|---|
| Providing the App and its features | Contract performance (Art. 6(1)(b)) |
| Processing food photos via AI | Contract performance (Art. 6(1)(b)) |
| Sending push notifications | Consent (Art. 6(1)(a)) |
| Analytics and product improvement | Legitimate interest (Art. 6(1)(f)); consent where required (Art. 6(1)(a)) |
| Reading Apple Health / Health Connect | Explicit consent (Art. 6(1)(a)) |
| Processing subscription payments | Contract performance (Art. 6(1)(b)) |
| Responding to support requests | Legitimate interest (Art. 6(1)(f)) |
Health-related information: where GDPR applies, processing data concerning health also requires an applicable condition under Article 9, in addition to a legal basis under Article 6. Where explicit consent is required, we must obtain it before the relevant processing (Art. 9(2)(a)). Acceptance of the Terms of Use alone does not replace that consent. You may withdraw consent by contacting us at calzen@42apps.io and revoke Apple Health / Health Connect permissions through your device settings. Withdrawing consent may affect features that depend on the relevant processing.
4. How We Use Your Information
- Provide AI-powered food recognition and calorie/macro tracking
- Calculate personalized nutrition goals and health scores
- Provide medication and GLP-1 tracking features: record your prescribed regimen and dose history, display informational charts and estimates, track well-being and medication supply, and provide reminders you configure. These features do not prescribe medication or select your treatment
- Sync activity data from Apple Health or Health Connect
- Process and manage your subscription
- Send push notifications (reminders, progress updates) — only with your consent
- Analyze usage patterns to improve the App, using pseudonymous events and aggregated reports
- Respond to support requests
- Comply with legal obligations
5. AI Processing (OpenAI API)
When you scan a food photo, the image and any accompanying text description are sent to OpenAI's API for analysis. OpenAI processes this data solely to return nutrition results and does not use it to train their models (per OpenAI's API data usage policy). We do not send your name, email, or any identifying information to OpenAI — only the food image and description.
6. Data Sharing
We do not sell your personal data. We share data only with the following categories of service providers, solely for the purposes described in this policy:
| Provider | Purpose | Data Shared |
|---|---|---|
| OpenAI | Food photo AI analysis | Food images, text descriptions |
| Apphud | Subscription management | Purchase events, subscription status |
| Firebase (Google) | Analytics, crash reporting | Usage events, app and device identifiers, technical diagnostics and crash logs |
| Mixpanel | Product analytics | Pseudonymous user ID, app and device context, feature interactions (including GLP-1 tracking interactions), and related event properties |
| Amplitude (where used) | Product analytics | Usage events and pseudonymous app or device identifiers |
| AppsFlyer | Attribution analytics | Install source, attribution events and device identifiers |
| Google Analytics | Website analytics | Page views, referral information, device context and cookie or device identifiers (website only) |
Mixpanel and GLP-1 analytics: we use product analytics to understand feature usage and improve the App. CalZen uses pseudonymous app and user identifiers for product analytics. These identifiers do not themselves contain your name or email address, but can link activity across sessions and may be associated with your Apphud subscription identifier. GLP-1 analytics events do not include medication names, dose amounts, specific injection sites, exact dose dates and times, symptom ratings, or free-text health notes. They may include feature actions and limited properties, such as whether a dose has been recorded, a schedule category, or how many check-in fields were completed. These events can still indicate use of a health-related feature and are treated as potentially health-related information. Aggregated reports do not make the underlying user-level events fully anonymous.
All service providers are contractually obligated to process data only on our behalf and in accordance with this policy.
7. International Data Transfers
Your data may be transferred to and processed in countries outside your country of residence, including the United States (OpenAI, Firebase, Mixpanel, Amplitude where used, AppsFlyer). These transfers are necessary for providing the App's functionality. Where required by GDPR, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or the service provider's adequacy certification, to ensure appropriate safeguards.
8. Data Retention
- Nutrition data: stored locally on your device. Deleted when you uninstall the App
- Medication and GLP-1 entries on iOS: medication records, regimen history, well-being entries, and supply records are stored in the App's local database. You can remove these records using the App's deletion controls. Device or computer backups, if enabled, are managed separately through the relevant operating system or backup service
- Food photos: processed in real-time by OpenAI and not stored on our servers after analysis is complete
- Analytics data: retained only for as long as reasonably necessary for the purposes described above, subject to the retention settings and deletion processes of the relevant provider. Retention may differ between product analytics and website analytics; deleting the App does not automatically delete events already sent to analytics providers
- Support correspondence: retained for up to 12 months after resolution
- Subscription records: retained as required by tax and accounting regulations (typically 3–7 years)
9. Your Rights
9.1 Rights Under GDPR (EU/EEA/UK Users)
You have the following rights regarding your personal data:
- Access — request a copy of the personal data we hold about you
- Rectification — request correction of inaccurate or incomplete data
- Erasure ("Right to be Forgotten") — request deletion of your personal data
- Restriction — request that we limit processing of your data
- Data portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interest
- Withdraw consent — withdraw consent at any time (for consent-based processing)
- Lodge a complaint — file a complaint with your local data protection authority
9.2 Rights Under CCPA (California Residents)
California residents have the right to:
- Know — request disclosure of the categories and specific pieces of personal information we collected
- Delete — request deletion of your personal information
- Opt-out of sale — we do not sell personal information, so this right does not apply
- Non-discrimination — we will not discriminate against you for exercising your rights
9.3 How to Exercise Your Rights
To exercise any of these rights, contact us at calzen@42apps.io. We will respond within 30 days (GDPR) or 45 days (CCPA). We may ask you to verify your identity before processing your request.
You can delete medication and related tracking records using the App's deletion controls, or remove the App's locally stored data by uninstalling it. This does not automatically delete operating-system backups, records in Apple Health / Health Connect, subscription records, or analytics already held by our service providers. To request deletion of data held by us or our processors, contact us using the email above; a pseudonymous app or subscription identifier may help us locate the relevant records.
10. Cookies
Our website (calzen.ai) uses the following cookies:
- Essential cookies: remember your cookie consent preference
- Analytics cookies (Google Analytics): help us understand how visitors use the website. These cookies associate website interactions with browser or device identifiers. You can opt out by declining cookies via the consent banner or by installing the Google Analytics Opt-out Browser Add-on
The App does not use cookies.
11. Security
We implement industry-standard security measures to protect your data, including encrypted data transmission (TLS/HTTPS), secure cloud infrastructure, and access controls. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.
12. Children's Privacy
CalZen is not intended for children under 16 (or under 13 in jurisdictions where that is the applicable age). We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at calzen@42apps.io.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last Updated" date. For significant changes, we may also notify you via push notification or email. We encourage you to review this page periodically.
14. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, contact us:
- Email: calzen@42apps.io
- Mail: 42apps LLC, 49 building, Mamyr-4, 050039 Almaty, Kazakhstan