1. Introduction
CalX ("we", "our", "the Application") is a mobile nutrition and fitness application developed and published by CalX. Protecting your personal data is our absolute priority.
This Privacy Policy describes the data we collect, why we collect it, how we use it, and the rights you have regarding your data, in accordance with the General Data Protection Regulation (GDPR — EU 2016/679) and the Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada.
By using CalX, you agree to the practices described in this policy.
2. Data controller
CalX
Website : www.calx.be
Contact : contact@calx.be
3. Data collected
We collect the following categories of data, only to the extent necessary for the operation and improvement of our services:
🔐 Identification data
Email address, username, profile picture (optional), unique Google identifier (when connecting via Google Sign-In).
📊 Biometric and health data
Body weight (current and historical), height, age, sex, calculated body mass index (BMI), weight goals (loss, maintenance, bulking), daily caloric target, declared physical activity level.
🍽️ Nutritional data
Meal photos (taken via camera), AI analysis results (estimated calories, protein, carbs, fat), meal history, scanned barcodes and associated product data (via OpenFoodFacts).
🏃 Exercise data
Exercise type, duration, estimated calories burned, GPS data (location during exercise), pedometer data (step counting), distance traveled.
💬 Social data
Messages exchanged with the AI Coach, Squad (group) participation, reactions to other users' posts, activity score, notifications.
📸 Progress photos
Before/after photos voluntarily uploaded by the user for visual tracking of their body transformation.
⚙️ Technical data
Device type, operating system, preferred language, timezone, Firebase identifiers.
4. Camera usage
CalX accesses your phone's camera exclusively for the following features:
- Meal photo scan: taking a photo of your plate for automatic nutritional analysis by Google Gemini AI.
- Barcode scan: reading food product barcodes to retrieve nutritional information.
- Progress photos: taking photos of your body transformation (voluntary use).
- Profile picture: personalizing your account.
No photo is taken without your knowledge. Camera access requires your explicit permission via your device settings and can only be activated at your initiative.
5. Use of artificial intelligence
CalX uses Google Gemini (Pro and Flash) artificial intelligence models for:
- Image-based nutritional analysis: visual identification of foods and estimation of macronutrients from photos.
- Voice-based nutritional analysis: natural language understanding to identify orally described foods.
- Personal AI coach: personalized nutritional and fitness advice based on your profile, goals, meals, and exercises.
- PDF menu generation: creation of personalized meal plans.
Important: The results provided by AI are estimates and not exact measurements. They do not constitute medical or professional dietary advice under any circumstances. Consult a healthcare professional for any specific medical needs.
Photos sent to Google Gemini are processed in real time and are not stored by Google beyond the processing of the request, in accordance with Google Cloud's customer data policy.
Consent: these features only activate after your explicit agreement, requested in the app before any data is sent to the AI service. The consent prompt states which data is transmitted (meal and ingredient photos; profile — age, sex, height, weight, goals, dietary preferences, allergies; meals, coach messages and activity summary) and to whom (Google Gemini, through CalX's secure servers). You can withdraw your consent at any time from the app's Profile screen; AI features are then disabled while the rest of the app keeps working normally.
6. Legal basis for processing
We process your data on the following legal bases (Article 6 of the GDPR):
- Consent (Art. 6.1.a): for biometric and health data, camera access, GPS geolocation, and progress photos.
- Contract performance (Art. 6.1.b): for providing CalX services (meal analysis, nutritional tracking, AI coaching).
- Legitimate interest (Art. 6.1.f): for improving our services, aggregated and anonymized usage analytics, and platform security.
7. Data sharing and transfers
Your personal data is never sold to third parties. It may be shared with:
- Google Cloud / Firebase: hosting and infrastructure (servers located in the EU and the United States). Transfer to the United States is governed by the EU-US Data Privacy Framework.
- Google Gemini AI: processing nutritional analysis and coaching requests. Data is processed in accordance with Google Cloud terms.
- OpenFoodFacts: consulting the nutritional database (no personal data is transmitted, only the scanned barcode).
- Resend (email delivery): when you ask for a menu or recipe to be emailed to you, your address and the generated document pass through Resend, our email delivery provider, solely to deliver that email.
8. Data retention
We retain your personal data for as long as your account is active. Upon account deletion:
- Your deletion request triggers a 30-day grace period during which you can cancel it (banner in the app + link in the email). After this period, all your personal data (profile, meals, exercises, photos, messages, subscription, etc.) is permanently deleted within an additional 24 hours.
- Aggregated and anonymized data for statistical purposes may be retained indefinitely (this data no longer allows your identification).
- AI Coach conversations are deleted with the account.
- For technical reasons (security backups), some residual data may persist for up to 30 days after deletion, but is not accessible to any user or our team outside of an emergency restoration procedure.
9. Your rights
Under the GDPR and PIPEDA, you have the following rights:
🔍 Right of access
Obtain a copy of your personal data.
✏️ Right to rectification
Correct inaccurate or incomplete data.
🗑️ Right to erasure
Request deletion of your data.
📦 Right to portability
Receive your data in a structured format.
⛔ Right to object
Object to the processing of your data.
⏸️ Right to restriction
Temporarily restrict processing.
To exercise your rights, contact us at contact@calx.be. We will respond within a maximum of 30 days.
You also have the right to lodge a complaint with a competent supervisory authority (in Belgium: the Data Protection Authority — www.autoriteprotectiondonnees.be).
10. Data security
We implement appropriate technical and organizational measures to protect your data:
- Data encryption in transit (TLS/SSL) and at rest.
- Secure authentication via Firebase Authentication (email/password, Google Sign-In).
- Firestore security rules limiting each user's data access to their own account.
- Hosting on Google Cloud infrastructure, certified ISO 27001, SOC 2, and SOC 3.
11. Children's data
CalX is not intended for children under 16 years of age. We do not knowingly collect personal data from minors under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at contact@calx.be.
11 bis. Rights of California residents (CCPA / CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you additional rights regarding your personal data:
- Right to know what categories of data we collect about you and for what purpose.
- Right to access a specific copy of the personal data we hold.
- Right to request deletion of your data (equivalent to the GDPR right to erasure).
- Right to correct inaccurate personal data.
- Right to opt out of the sale or sharing of your data. We do NOT SELL OR SHARE your personal data for cross-context advertising purposes — so there is nothing to opt out of.
- Right to non-discrimination if you exercise your CCPA rights (we will not degrade your service).
To exercise your CCPA rights, send your request to contact@calx.be with "CCPA Request" in the subject line. We will respond within 45 days as required by California law. You may also designate an authorized agent to submit the request on your behalf (proof of authorization required).
12. Changes to this policy
We reserve the right to modify this Privacy Policy at any time. Any significant changes will be notified via an in-app notification or by email. The last update date is shown at the top of this page.
Continued use of CalX after the publication of changes constitutes your acceptance of the updated policy.
13. Contact
For any questions regarding this Privacy Policy or the protection of your personal data, contact us: