Privacy policy

NakedCalorie is operated by Lucalvry LLC, a Wyoming limited liability company with its registered address at 30 N Gould St, STE R, Sheridan, WY 82801, USA ("we", "us", "our"). We are the controller of the personal data described in this policy.

For privacy questions or to exercise your rights, contact privacy@nakedcalorie.app.

This policy applies to the NakedCalorie website, web app, and mobile app (collectively, the "Service"). It does not apply to third-party sites or services we link to; those are governed by their own policies.

Information you provide.

• Account: email address, password (stored as a salted hash), and authentication provider identifiers if you sign in with Google or Apple.
• Profile: name or handle, date of birth, sex, height, weight, activity level, goals, dietary preferences, and region.
• Health & fitness data (special-category / sensitive): foods logged, meals, macros, calorie intake, body measurements, progress photos, workouts, and any notes you add.
• Recipes, meal plans, grocery lists, and photos you upload.
• Payment metadata: subscription status and receipts. Card details are held by Stripe or the app store; we never see them.
• Support communications you send us.

Information collected automatically.

• Device and technical data: device model, operating system, app version, language, and crash / diagnostic events used to keep the app reliable.
• Approximate location derived from your IP address (city / country level) for security, fraud prevention, and to select the right regional content.
• Cookies and similar technologies used for essential functionality and, where you consent, product analytics. See our cookie policy.

Information from third parties.

• OAuth providers (Google, Apple) share a limited profile with us when you sign in with them.
• Connected apps you choose to enable (for example Apple Health or Google Fit) share the specific data types you authorise.

• Provide the Service: log storage, sync across devices, ingredient scoring, meal planning, coaching insights, and account management.
• Safety and integrity: prevent fraud, abuse, and security incidents.
• Communications: send transactional emails (receipts, password resets, security alerts) and, if you opt in, product updates.
• Product improvement: measure feature performance and fix bugs using aggregated or de-identified data.
• Legal and regulatory compliance.

Where GDPR or UK GDPR applies, we rely on the following legal bases under Article 6:

• Contract (Art. 6(1)(b)) — to deliver the Service you signed up for.
• Legitimate interests (Art. 6(1)(f)) — to keep the Service secure, prevent fraud, and improve reliability. You can object at any time.
• Consent (Art. 6(1)(a)) — for optional analytics cookies and marketing emails.
• Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, and other laws.

For health and fitness data (special-category data under Article 9), we rely on your explicit consent (Art. 9(2)(a)), given when you sign up and start logging. You can withdraw consent at any time by deleting your account; withdrawal does not affect the lawfulness of processing before withdrawal.

We share personal data only in these situations:

• Subprocessors that host, secure, and operate the Service on our behalf (listed below), under written data-processing terms.
• Legal requests when we are legally required to disclose data, and only to the extent required.
• Business transfers: if Lucalvry LLC is involved in a merger, acquisition, or asset sale, personal data may transfer, subject to this policy.
• Aggregated / de-identified data that cannot reasonably be used to identify you.

We do not sell your personal data and do not share it for cross-context behavioural advertising.

We are established in the United States and some of our subprocessors are also based in the US. When personal data of individuals in the EEA, UK, or Switzerland is transferred outside those regions, we rely on appropriate safeguards including the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum (IDTA), and — where applicable — the EU–US Data Privacy Framework.

• Account and logs: kept for the life of your account.
• After deletion: purged from active systems within 30 days; encrypted backups roll off within 90 days.
• Billing records: retained for up to 7 years to meet tax and accounting obligations.
• Consent log: 24 months.
• Diagnostic and security logs: up to 12 months.

We encrypt data in transit (TLS) and at rest, use role-based access controls, and log administrative access. We restrict production access to a small number of engineers on a need-to-know basis. No system is perfectly secure; if a breach affects your data, we will notify you and the relevant supervisory authority within the timelines required by law.

EEA / UK / Switzerland. You have the right to:

• Access a copy of your personal data.
• Have inaccurate data corrected.
• Have your data erased.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time.
• Lodge a complaint with your local supervisory authority.

California (CCPA / CPRA). You have the right to know what personal information we hold about you, to delete it, to correct it, to opt out of sale or sharing (we do neither), to limit the use of sensitive personal information, and to non-discrimination for exercising your rights. You may designate an authorised agent to submit requests. California residents may also request information under the "Shine the Light" law.

Other US states. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other states with comprehensive privacy laws have similar rights of access, correction, deletion, and opt-out.

How to exercise your rights. Use Settings → Data export and Settings → Delete account in the app, or email privacy@nakedcalorie.app. We respond within the timelines required by applicable law (generally 30 days, extendable where permitted).

NakedCalorie is not directed to children. You must be at least 16 to use the Service in the EEA and UK, and at least 13 elsewhere. We do not knowingly collect personal information from children below these ages. If you believe a child has provided us data, contact privacy@nakedcalorie.app and we will delete it. Consistent with COPPA, we do not knowingly collect personal information from children under 13 in the United States.

We use a small number of essential cookies and local-storage keys required for the app to function (for example, your session and your consent choices). With your consent in applicable regions, we may also enable anonymous product analytics. You can review and change your choices any time from the consent banner or from Settings → Privacy.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

We may update this policy from time to time. When we make material changes, we will update the "Effective" date at the top and, where required, notify you in-app or by email.

Controller. Lucalvry LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA. Email: privacy@nakedcalorie.app.

EU / UK representative. Where we offer the Service to individuals in the EEA or UK on a scale requiring an Article 27 representative, we will appoint one and disclose their contact details here before doing so.