← Back to Calbook

Privacy Policy

Effective 12 September 2026

Calbook is a calorie and workout diary made by Cortexlumora Private Limited, a company registered in India (“Cortexlumora”, “we”, “us”). This policy explains what we collect when you use the Calbook app, why we collect it, who else touches it, and what you can ask us to do with it.

We do not run ads, we do not use third-party analytics or advertising SDKs, we do not track you across other apps or websites, and we do not sell or rent your data to anyone.

1. Information we collect

Account information

You can use Calbook without an account: the app creates an anonymous guest account on first launch, and that diary stays on your device and in our systems without any identifying details attached to it.

If you sign in, you do so with Sign in with Apple, Google, or an email address and password. Sign-in and account management are handled for us by Google Firebase Authentication, which stores your email address, your display name if the provider supplies one, and authentication details such as sign-in tokens and the times you signed in. We never see or store your password.

The entries you log

Everything you record in the diary is stored against your account so the app can show it back to you:

• Food entries — what you ate and the calories, carbohydrate, protein and fat worked out for it, including any corrections you make.
• Exercise entries — the activity and the calories burned.
• Weight entries — the weights you log and any target weight you set.
• Water entries — the amounts you log.
• The text of your messages — the sentences you type to log something or to ask a question about your own numbers.
• Favourites and edits — meals you save to reuse, and adjustments you make to an entry.

Photos

If you attach a photo — a plate of food, a bathroom scale display, a treadmill or watch screen — the image is uploaded to Google Firebase Cloud Storage and sent to OpenAI so that a model can read what is in it and turn it into diary entries. Photos stay attached to the entry they created until you delete the entry or your account. Please do not attach photos containing anything you would not want processed this way.

Profile details

To estimate a daily calorie budget the app asks for your weight, height, age and sex. These are used for that calculation and to show your progress; they are not used for anything else.

Technical information

Our servers keep ordinary operational records — such as the time of a request, an error code, or an IP address — for keeping the service running and secure. We do not build advertising or behavioural profiles from them.

2. Groups, and what other people can see

Calbook has an optional feature called Groups, for tracking alongside friends, family or a nutrition professional. It is off unless you choose to create or join a group, and you are never added to one without entering a group code yourself.

Joining a group makes some of your diary visible to the other people in it. This is the point of the feature, but it is worth being exact about what it means:

• Your daily calorie total is shared with the group, for the leaderboard, for every day you log while you are a member.
• Every meal you log is shared automatically while you are in a group — its description, its calories and macros, and the photo you attached to it, if any. There is no per-meal choice: if you are in a group, your meals go to it.
• Your display name is shown to the other members.

What is not shared: your weight entries, your water, your profile details, your email address, your goals, and anything you logged before you joined.

Anyone holding a group's code can join it, so only share a code with people you intend to see this. You can leave a group at any time, which stops any further sharing; what you already published to it is removed when you leave or when you delete your account.

Photographs shared to a group are given an unguessable link so that the other members' devices can display them. Anyone who is given that link can open the image, so treat a group photo as something that has left your control.

If you see something in a group you should not have to, you can report it and block the person who posted it, both from the post itself. A report reaches us with the post, who posted it and who reported it; we review every one and act on the ones that break our Terms. Blocking is private — the person is not told, it hides everything they post from you, and you can undo it in Settings.

3. Why we use it

• To run the diary — to save your entries and show your day, your macro rings, your weight trend, your weekly summary and your PDF reports.
• To turn what you write or photograph into numbers — the text and images you submit are analysed so they can become calories, macros, calories burned, water or weight.
• To answer questions from your own data — when you ask something like “how much protein have I had today?”, we read your entries to answer it.
• To estimate your calorie budget — from the profile details you provide.
• To keep your account secure and to identify you when you sign in.
• To support you — if you email us, to answer your message.
• To fix and improve the app — diagnosing errors and problems reported to us.

We rely on the necessity of processing your data to provide the service you asked for, on your consent where you choose to attach a photo or provide profile details, and on our legitimate interest in keeping the service working and secure.

4. Who else processes your data

We use a small number of service providers. They act on our instructions and may only use your data to provide their service to us.

• Google (Firebase) — accounts and sign-in (Firebase Authentication), storage of your entries, profile and groups (Cloud Firestore), storage of the photos you attach (Cloud Storage), and the servers that analyse what you submit (Cloud Functions).
• OpenAI — analysis of the text and photos you submit, so they can become diary entries or answers. OpenAI processes this as our API provider.
• RevenueCat — management of subscriptions, which receives an app-specific identifier and your subscription status. Your payment details go to Apple or Google, never to us or to RevenueCat.

These providers may store or process data outside India, including in the United States. We may also disclose data if the law requires it, to enforce our Terms, or to protect the rights and safety of our users or of Cortexlumora. Beyond this, we do not share your data, and we never sell it.

5. How long we keep it

Your entries, photos and profile details are kept for as long as your account exists, because the app is a diary and its value is in the history.

You can delete your account from inside the app, under Settings. Deletion is immediate and permanent: your diary, weights, water, photos, profile and sign-in are removed, along with everything you published to any group and your membership of it. There is no recovery period, and we cannot undo it for you afterwards.

Deleting your account does not cancel a subscription. Subscriptions are billed by Apple or Google against your store account, not by us, so you need to cancel one through the store. Reports filed about content in a group are kept after the reporter's or the reported person's account is deleted, because a record of why we acted has to outlast the account it concerned. Operational logs are kept for a short period and then discarded.

6. Your rights and choices

• Access — you can ask for a copy of the data we hold about you. You can also export a PDF report for any date range from inside the app at any time.
• Correction — you can edit or delete individual entries and adjust macros yourself in the app.
• Deletion — you can delete your account and everything in it from Settings inside the app, without asking us. You can also email us to ask.
• Objection and withdrawal of consent — you can stop attaching photos at any time, leave any group to stop sharing with it, and stop using the app and ask us to delete your data.
• Blocking — you can block anyone in a group so that nothing they post reaches you, and unblock them again, from Settings.

To exercise any of these, email cortexlumora@gmail.com from the address on your account. We will respond within a reasonable time and in any event as required by applicable law.

7. Security

Data is transmitted over encrypted connections and stored with reputable providers. Access to production systems is limited to people who need it. No system is perfectly secure, so we cannot guarantee absolute security, but we take reasonable steps to protect your information.

8. Children

Calbook is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has given us personal data, email us and we will delete it.

9. Changes to this policy

If we change this policy we will update the effective date at the top of this page and, where the change is significant, tell you in the app or by email. Continuing to use Calbook after a change means you accept the updated policy.

10. Contact

Cortexlumora Private Limited, India.
Email: cortexlumora@gmail.com