Privacy policy

Personal information that we collect

Personal information means information that, alone or combined with other information, may be used to identify you. It includes, for example, name, username, email address, mailing address, and phone number. When you use our Services, we may collect the following about you.

Information you provide to us

We collect personal information you voluntarily provide—for example, account details, language or regional preferences, or information you submit when participating in surveys, promotions, or events (such as contact information). You are responsible for ensuring the information you provide is accurate and up to date.

Hearty app data

When you use features of Hearty, we may collect information such as measurement or session history within the app (for example, heart-related readings you choose to save or sync), logs and metadata related to app performance, session or usage duration, and purchase or subscription history where applicable.

Camera and on-device processing: Hearty may use your device's camera for heart-related measurement similar in nature to apps like Cardiac Link. Frames used for measurement are processed on your device to provide core functionality. We do not upload photos or video from the camera for that purpose to our servers unless we clearly disclose otherwise in the app or in an updated version of this Policy.

CalPal app data

When you use CalPal, we may collect information linked to an anonymous Firebase user identifier (UID), including meal logs and calorie or macro entries you create, meal photos you choose to scan, typed meal descriptions, health and fitness details you enter (such as weight, height, age, and nutrition goals), session and usage duration, crash data, and App Store or Google Play subscription status. CalPal does not collect data for tracking and does not use data for third-party advertising.

AI-powered food recognition: When you scan a meal, a food image or text description may be sent to a third-party AI model (currently Google Gemini) to identify ingredients and estimate nutritional content. These images are processed by the AI provider and are not stored on our servers beyond what is required to return a result. We do not use your food images to train No Bad Ideas models. See our sources page for details on the AI models and nutrition databases we use.

Nutrition data: Calorie and macronutrient values are sourced from public databases (USDA FoodData Central, Open Food Facts). We do not sell your meal logs or health data to third parties.

Activity and usage data

While you access or use the Services, we or our providers may automatically collect information about how you interact with the Services. This may include your Internet Protocol (“IP”) address, device identifier, MAC address, operating system, browser type, language preferences, referring and exit pages, crash data, approximate location derived from IP or device settings, purchasing activity, and other data regarding your use of the Services.

CalPal does not collect advertising identifiers and does not use ad networks or App Tracking Transparency. Product interaction and crash data in CalPal are used to operate and improve the app, not for tracking you across other companies’ apps or websites.

App Privacy labels (CalPal)

The following categories are collected in CalPal and linked to your anonymous Firebase UID. They are not collected for tracking and are not used for third-party advertising:

• Photos: meal scans you choose to submit for food recognition.
• Health & Fitness: weight, height, age, meals, and goals you enter.
• Purchases: CalPal Premium subscription status.
• Product Interaction / Crash Data: how you use the app and diagnostic crash reports.
• Other User Content: typed meal descriptions.

How we use your personal information

We use personal information for purposes including:

• To provide our Services: Operate Hearty and CalPal and fulfill your requests, including processing transactions, delivering features, syncing data across devices when you use an account (if offered), and providing customer support.
• To personalize your experience: For example, use language or region to show appropriate content or time zone, and use device characteristics to improve display and compatibility.
• Service-related communications: Send notices about your account, transactions, and material changes to our policies. You may not be able to opt out of all such communications where they are necessary to operate the Services.
• Analytics and internal purposes: Measure usage, improve quality, conduct internal auditing, and evaluate how the app and related campaigns perform.
• Security: Verify identity, detect fraud, protect users and systems, maintain backups, and safeguard the integrity of the Services.
• Research and development: Improve existing Services and develop new ones, using reasonable safeguards and access controls where appropriate.
• Marketing: Promote our Services and, where permitted, send information about products, events, or studies that may interest you (subject to your choices and applicable law).
• Legal and regulatory compliance: Meet tax, accounting, and other obligations, and manage risk as required by applicable law.

How we share your personal information

Third-party service providers

We may engage vendors to perform functions on our behalf, such as processing payments (including through Apple App Store or Google Play where you purchase through those platforms), hosting or storing data, security services, and market research. We seek contractual commitments that they use appropriate safeguards when handling personal information.

For CalPal, we use the following processors and data sources:

• Firebase (Google): Authentication, Analytics, Crashlytics, Cloud Functions, Firestore, and App Check.
• RevenueCat: subscription status and in-app purchase entitlements.
• OneSignal: push notifications you choose to receive.
• Google Gemini: meal photo or text recognition, as described above.
• USDA FoodData Central and Open Food Facts: public nutrition reference data.

Legal obligations and safety

We may disclose personal information if it is reasonably necessary to:

• Comply with a valid legal process (for example, subpoenas, warrants, or court orders);
• Comply with valid requests or investigations by public authorities;
• Comply with applicable laws or regulations;
• Enforce our policies, agreements, and terms in litigation, disputes, or otherwise;
• Protect our legitimate interests, including legal interests;
• Protect the security or integrity of the Services; or protect the rights, property, or safety of you, other users, our team, collaborators, partners, or others.

We may, where permitted, give you advance notice if we are required to disclose personal information to law enforcement, public authorities, or other governmental entities, unless we are prohibited from doing so.

Cookies and similar technologies (“tracking technologies”)

What are cookies and tracking technologies?

Cookies are small data files, often letters and numbers, placed on your device by a server. We and companies we work with may use cookies and similar technologies—including pixel tags, web beacons, mobile analytics features, and mobile identifiers (collectively, “tracking technologies”)—to keep you signed in, remember preferences and settings, analyze how the Services are used, measure performance, and help keep the Services secure. Some technologies are strictly necessary to offer the Services; other uses give us insight into how we can improve the Services. CalPal does not use advertising identifiers or ad-network tracking.

How to manage tracking technologies

On our websites and in Hearty, we may use third-party technologies that automatically collect information and may recognize your device. We encourage you to read those providers’ policies for details on how they use data they collect. CalPal analytics and crash reporting (Firebase) are used to operate and improve CalPal only; they are not used to track you across other companies’ apps or websites, and CalPal data is not used for third-party advertising.

Through your browser or mobile settings: You can enable, disable, or delete many tracking technologies via your browser or device settings (often under “Help,” “Tools,” or “Privacy”). If you turn off tracking technologies, secure or personalized parts of the Services may not work fully—for example, saved preferences, referral links, or sign-in state on web properties.

Marketing

We may use your personal information to send you messages about new products or services, events, or other information that may interest you, by email or other methods you agree to. If you do not wish to receive such messages, change your account settings (where available) or use the “unsubscribe” link in email communications. You cannot opt out of all transactional communications about your account or the Services without missing important information. CalPal does not sell personal information and does not use CalPal data for third-party advertising.

Security

We take the security of personal information seriously. We adopt practices common in our industry to help protect your personal information from unauthorized access, disclosure, use, alteration, and loss or corruption. We take reasonable measures to keep information accurate and up to date where we control it.

Because of how the internet works, no system is perfectly secure. Malicious actors and factors outside our control can still pose risks. You help protect your information by keeping passwords and device access private and taking sensible precautions so others cannot access your account.

Retention

In general, we keep your information for as long as needed to fulfill the purposes described in this Policy or to meet applicable law. We try to delete personal information when you ask us to or when we no longer need it for why we collected it, except we may keep it where necessary to establish or defend legal claims, for audit, or for fraud or crime prevention. We will not delete personal information that also relates to another person unless that person agrees to deletion at the same time, where applicable.

Account information: We retain information tied to your account while your account stays active or as needed to provide the Services you request.

Information from tracking technologies: We generally keep this as long as needed for usage analytics and similar purposes, and for legal claims, audit, or fraud or crime prevention where applicable.

Marketing data: Contact details you give us for marketing (such as name, email, or phone) are kept until you unsubscribe from marketing messages. If you unsubscribe, we add you to a do-not-contact list where appropriate to honor your choice.

Deleting your CalPal account

In CalPal, go to Settings → Account → Delete account. This removes on-device meals, your profile, and the anonymous Firebase identity associated with the app on that device.

Deleting your CalPal account does not cancel an App Store or Google Play subscription. To stop future charges, cancel CalPal Premium in iOS Settings → Apple ID → Subscriptions or in Google Play → Payments & subscriptions, depending on where you subscribed.

For residual deletion or access requests after you use in-app deletion, contact us at privacy@404badideas.com.

Children

Our Services are not intended for anyone under sixteen (16). CalPal blocks profile ages under 16. We do not knowingly collect personal information directly from children under 16 without parental consent. If you are under 16, do not provide us with information of any kind. We encourage parents and guardians to spend time with their children online and understand the apps and sites they use.

If you believe we may have received information from a child under 16 by mistake, contact us immediately at privacy@404badideas.com.

Do not track

Some browsers—such as Firefox, Safari, and others—can send “Do Not Track” (“DNT”) signals. Because uniform standards for DNT are not widely adopted, we do not currently process or respond to DNT signals on our Services.

Your California privacy rights

If you live in California, you can ask us for a list of third parties with whom we have shared your personal information for marketing purposes, where applicable. California law also lets residents request a notice that identifies categories of personal information we share with partners and/or third parties for marketing, with contact information for those parties where required. To make a request, email us at the address below with “My California Privacy Rights” in the subject line and include your name, relevant account information, and proof of California residence as needed so we can verify and respond.

Special notice for individuals in the European Economic Area, United Kingdom, and Switzerland

This section applies only if you are located in the European Economic Area, the United Kingdom, or Switzerland (the “Designated Countries”) when we collect your data. We may ask which country you are in, or rely on your IP address to infer location. If you mask or hide your location so that you do not appear to be in the Designated Countries, we may not be able to apply this section to you. If any part of this section conflicts with other parts of this Policy, this section controls for people in the Designated Countries.

Individual rights

Where applicable law gives you the rights below, we provide them as described. We may limit individual rights requests when: (a) denial of access is required or allowed by law; (b) granting access would harm someone else’s privacy; (c) we need to protect our rights and property; or (d) the request is frivolous or excessively burdensome. To exercise your rights, contact us using the information at the end of this Policy. We may verify your identity before we act on a request to protect your personal information. When we correct, delete, or restrict processing as you request, we will tell other parties processing that data where we can, unless that is impossible or would require disproportionate effort.

Right of access and portability

You may ask for a copy of the personal information we hold about you without undue delay and free of charge, unless the law lets us charge a fee. In some cases you may ask to receive your information in a structured, commonly used, machine-readable format, and to have us send it to another controller where that is technically feasible.

Right to rectification

You may ask us to correct or update inaccurate or incomplete personal information we hold about you.

Right to erasure

In certain situations, you may have the right to have personal information we hold about you deleted.

Right to restriction

Under certain conditions, you may have the right to restrict how we process your personal information.

Right to object

Where we process your personal information on the legal bases of consent, contract, or legitimate interests, you may object to that processing as allowed by applicable law.

Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects on you, unless an exception applies under applicable law.

Right to lodge complaints

If you believe we have infringed your privacy rights under applicable law or this Policy, contact us first so we can try to resolve your concern. You also have the right to lodge a complaint with a competent supervisory authority in your country of habitual residence, place of work, or place of the alleged infringement.

Contact us

For questions about this Policy or our privacy practices, contact us at privacy@404badideas.com.