Privacy Policy

1. Introduction

CarriFit ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application. By using CarriFit, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

Account Information

When you create an account, we collect your email address, display name, and password (encrypted). You may optionally provide your date of birth, gender, height, and weight to personalize your experience.

Health & Fitness Data

• Food logs (meals, calories, macronutrients)
• Weight measurements and body metrics
• Daily goals and progress data
• Streak and achievement data
• Restaurant visits and menu selections

AI-Processed Data

• Photos you upload for food recognition are sent to OpenAI's GPT-4o Vision API for analysis. Photos are processed in real-time and are NOT stored on our servers or by OpenAI after processing.
• Nutrition label photos are processed using GPT-4o Vision for OCR and data extraction.
• Voice recordings for food logging are sent to OpenAI's Whisper API for transcription. Recordings are processed immediately and deleted.
• Nutri AI conversations are processed using GPT-4 to provide personalized nutrition advice.

Location Data

If you use the restaurant map feature, we collect your location to show nearby restaurants (only when the feature is in use) and restaurant visits you choose to log. Location data is processed through Mapbox services.

Device & Usage Data

• Device type, operating system, and app version
• Usage patterns (features used, session duration)
• Crash reports and performance data
• IP address (for security and fraud prevention)

3. How We Use Your Information

Provide Services

• Calculate and track your nutrition and fitness goals
• Power AI-based food recognition, voice logging, and barcode scanning
• Provide personalized nutrition advice through Nutri AI
• Show nearby restaurants and their menu nutritional information
• Generate personalized insights and recommendations
• Maintain streaks, achievements, and gamification features

Improve Our App

• Analyze usage patterns to improve features
• Fix bugs and optimize performance
• Develop new features based on user needs

Ensure Security

• Prevent fraud and unauthorized access
• Enforce our Terms of Service
• Comply with legal obligations

4. Health Platform Integration

Apple HealthKit (iOS)

If you choose to connect Apple Health, we may read and/or write: active energy burned, steps count, weight measurements, and workouts.

Health Connect (Android)

If you choose to connect Health Connect, we may read and/or write: steps and distance, active calories, weight records, and exercise sessions.

5. Data Storage & Security

Encryption

• All data transmitted between your device and our servers uses TLS 1.3 encryption
• Passwords are hashed using industry-standard bcrypt algorithm
• Sensitive data is encrypted at rest

Secure Infrastructure

• Data is stored on Supabase (PostgreSQL) with Row Level Security (RLS)
• Each user can only access their own data
• Regular security audits and penetration testing
• Servers located in secure, SOC 2 compliant data centers

Data Retention

• Active account data is retained while your account exists
• Deleted accounts are permanently removed within 30 days
• Anonymized analytics data may be retained for product improvement

6. Third-Party Services

We use the following third-party services:

• OpenAI - GPT-4o Vision API for food photo recognition, Whisper API for voice transcription, GPT-4 for Nutri AI
• Stripe - Secure payment processing for Premium subscriptions
• Supabase - Secure PostgreSQL database hosting and user authentication
• Mapbox - Restaurant map and location services
• USDA FoodData Central - Nutritional information for ingredients
• Open Food Facts - Barcode product information

7. Your Rights & Choices

Access Your Data

View all data we have about you in the app. Request a complete data export (available to Premium users, or by contacting support).

Correct Your Data

Update your profile information at any time. Edit or delete food logs and other entries.

Delete Your Data

Delete individual entries at any time. Request complete account deletion (Settings → Account → Delete Account). Upon deletion, all your data is permanently removed within 30 days.

Opt Out

• Disconnect health integrations at any time
• Disable location services for the restaurant map
• Disable AI features and use manual logging only

For EU/UK residents (GDPR) and California residents (CCPA), you have additional rights including data portability and the right to object to processing. Contact us to exercise these rights.

8. Children's Privacy

CarriFit is not intended for children under 13 years of age (or 16 in the EU/UK). We do not knowingly collect personal information from children under these ages. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@carrifit.app.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. When we transfer data internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission and encryption of data in transit and at rest.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy in the app, sending you an email notification (for significant changes), or displaying an in-app notice. Your continued use of CarriFit after changes become effective constitutes acceptance of the revised policy.