Privacy policy

CaloriesCount ("we", "us") is a website for adults 18+ that helps you track food, weight and, if you choose, ketones, blood glucose and blood pressure. This policy explains what we collect, why, who helps us run the service and what you can do with your data.

The controller of your personal data is SUUX INC, 390 Flagstaff Ln, Hoffman Estates, IL 60169, USA. Contact: support@calories-count.me.

From Google or Telegram when you sign in. From Google: your name, email address, profile picture and Google account ID. From Telegram: your name, username, profile picture and Telegram ID. We use them only to create your account and sign you in. We do not get your password and do not post anything on your behalf.

What you enter yourself. Sex, date of birth, height, weight, activity level, your goal and diet, food diary, progress photos, reminders, friends, contacts and folders, and, only if you turn them on in your profile, ketone, blood glucose and blood pressure readings.

Technical data. IP address, browser and device type, language, time of requests and error reports. Push notification subscription if you allow notifications.

We do not use advertising or analytics trackers and do not sell or rent your data.

When you sign in with Google, CaloriesCount asks Google only for the basic scopes openid, email and profile. From them we receive your Google account ID, name, email address and profile picture.

• How we use it: only to create your account, sign you in, link it with Telegram sign-in if you choose to, and show your name and picture in the app. We do not send you email.
• How we store it: in our database on our servers (see «Where data is stored»), encrypted in transit.
• Sharing: we do not sell Google user data, do not share it with third parties, and do not use it for advertising. Our hosting providers process it only to run the service.
• Deleting: you can delete your account at any time in your profile; the Google data is erased with it. You can also remove CaloriesCount's access at https://myaccount.google.com/permissions.

CaloriesCount's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Weight, food and readings are health data, a special category of personal data. We process them only with your explicit consent, which you give at first sign-in, and only to calculate your targets, show your progress and send the reminders you set up. You can withdraw consent at any time by turning the health modes off or deleting your account.

• To provide the service (performance of our agreement with you): your account, calculations, diary, progress, reminders, friends and sharing.
• With your explicit consent: health data, as described above.
• Legitimate interests: security, preventing abuse, fixing errors, keeping a tamper-proof log of changes.
• Legal obligations: answering lawful requests from authorities.

• You. Everything in your account.
• Friends. Only what you allow in your sharing settings. You can change or revoke it at any time.
• Our team. Support staff see account data when needed to help you. Access to health data is limited to administrators, and every view is recorded in an audit log.
• Service providers that process data for us under contract:
  • Railway (hosting of the application and database, USA);
  • Cloudflare (network protection, encryption in transit, storage of encrypted files and backups);
  • Google and Telegram (sign-in only);
  • browser push services (Google, Mozilla, Apple) to deliver notifications you enabled; they receive only the notification text;
  • Open Food Facts (food search); it receives only your search term or barcode, never your account data.

Our servers are in the United States. Encrypted files and backups are stored in Cloudflare R2. Transfers outside your country are protected by the providers' standard contractual clauses. Data is encrypted in transit (HTTPS); progress photos and attachments are additionally encrypted with a key unique to your account.

• Account data: while you have an account. After you ask to delete it, there are 30 days to change your mind; then the account and its data are erased and the encryption key of your files is destroyed.
• Backups: kept 30 days, encrypted, then removed automatically.
• Change log: a tamper-proof record of changes, kept while the service runs. The content of each record is encrypted with your account key, so it becomes unreadable once your account is erased.
• Server request logs (with IP address): kept up to 30 days to protect accounts and investigate abuse.
• Entries older than three months become read-only in the app, but they remain yours and are included in your export.

You can, at any time:

• download all your data (Profile → Download my data);
• correct your data in the app;
• delete your account (Profile → Delete account);
• withdraw consent for health data;
• object to processing or ask us to restrict it;
• ask us what we hold about you: write to support@calories-count.me.

We answer within one month. You can also complain to your data protection authority.

We use only cookies needed for the site to work: your sign-in session (cc_at, cc_rt), your language (NEXT_LOCALE) and a short-lived cookie when you link two sign-in methods (cc_merge). No advertising or analytics cookies, so we do not ask for cookie consent.

CaloriesCount is only for people aged 18 and over. If we learn that an account belongs to someone younger, we delete it.

When we change this policy we publish a new version here with its date. If the change matters, you will be asked to accept it at your next sign-in.

Privacy questions and requests: support@calories-count.me.