Privacy Policy

Overview

RythmCal ("we", "us", or "our") is a calorie, macro, and cycle tracking app developed by Mohamed Shunaan. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

By using RythmCal, you agree to the practices described in this policy. If you do not agree, please discontinue use of the app.

Information we collect

We collect only the information necessary to provide and improve the service:

We do not collect location data, contacts, browsing history, or any data not listed above.

How we use your information

• To provide the service — display your dashboard, calculate macro totals, estimate cycle phases, and personalise your experience.
• To power AI features — meal photos and ingredient lists are sent to Anthropic's API to estimate nutrition. Images are not stored by Anthropic beyond the immediate request.
• To send reminders — if you enable daily reminders, your device push token is used to deliver local or remote notifications.
• To process payments — subscription status is managed via RevenueCat. We do not store card details.
• To send OTP codes — if you sign in with a phone number, your number is sent to Twilio to deliver a one-time verification code.
• To improve the app — anonymised, aggregated usage patterns may inform future feature decisions. No individual-level data is used for this purpose without your consent.

Third-party services

We share data with the following third parties only to the extent necessary to operate the service:

We do not share your data with advertisers, data brokers, or any party not listed above.

Data storage and security

Your data is stored on Supabase's infrastructure, which uses AES-256 encryption at rest and TLS in transit. Access to your data is protected by row-level security — only your account can read or write your records.

Meal photos and avatars are stored in private storage buckets. Access requires a time-limited signed URL generated for your account only.

We take reasonable technical and organisational measures to protect your data, but no system is completely secure. If you discover a vulnerability, please contact us at [email protected].

Data retention

We retain your data for as long as your account is active. When you delete your account:

• All profile data, meal logs, health records, and photos are permanently deleted within 30 days.
• Subscription records may be retained by RevenueCat per their own retention policy.
• Anonymised aggregate statistics (not linked to your account) may be retained indefinitely.

Your rights

Regardless of where you are located, you have the right to:

• Access — request a copy of all data we hold about you.
• Correction — update or correct inaccurate data directly in the app or by contacting us.
• Deletion — delete your account and all associated data from within the app (Settings → Delete Account) or by contacting us.
• Portability — export your meal and weight data as a CSV file from within the app (Plus plan).
• Objection — opt out of any non-essential data processing by contacting us.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

Children's privacy

RythmCal is not directed at children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us immediately and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify you via the app or by email. Continued use of RythmCal after changes take effect constitutes acceptance of the updated policy.

Contact