Privacy Policy

Last updated November 4, 2026

This Privacy Policy explains how Zaniah Labs (“we”, “us”) handles information in connection with the CutesyCal mobile app, its widgets and watch app, and cutesycal.com (together, the “Service”). By creating an account or using the Service you agree to the practices described here. If you do not agree, please do not use the Service.

1. Who is responsible

Zaniah Labs is the controller of personal information processed through the Service. You can reach us at [email protected].

2. Information we collect

Information you give us

• Account information. When you sign in with Apple or Google we receive an identifier, your name and your email address (or an Apple private-relay address) as made available by that provider. We do not receive your Apple or Google password.
• Journal content. Meals, drinks and water you log by typing, voice, barcode or photo, together with times, portions and any corrections you make to an estimate.
• Profile and preferences. Things you choose to enter, such as diet style, foods to avoid, units, a calorie target, goal type, weight and target weight, your chosen Wednesday tone, and display settings such as ED-safe mode. All of these are optional unless the Service says otherwise.
• Messages to us. Anything you send to our support address.

Information created through your use

• Estimates, confidence labels, daily scores, streaks, moods, recaps, in-app currency (“yarn”) and cosmetic items.
• Sync state, so your device and your account stay consistent.

Information collected automatically

• Device and app data. App version, operating system, device model, language, time zone and a push-notification token if you allow notifications.
• Diagnostics and usage. Crash reports, performance data and, where enabled, product analytics about which features are used. We configure these tools to remove or mask the content of your journal.
• Server logs. Our servers record technical data such as IP address, request time and error details for security and reliability.

Purchase information

Subscriptions are sold and billed by Apple. We, and our subscription-management provider RevenueCat, receive your subscription status, plan, renewal and trial dates and a transaction identifier. We never receive your payment card number.

3. Health and wellness information

Food, calorie, weight and similar entries can reveal information about your health. We treat this information as sensitive. We process it only to provide the Service to you, on the basis of your explicit consent, which you give by creating an account and choosing to enter it. You can withdraw consent at any time by deleting your account (see section 8). The Service is a wellness and journaling tool; it is not a medical device and does not diagnose, treat or prevent any condition.

4. How we use information

• to provide, operate, sync and secure the Service, and to produce the estimates you ask for;
• to create your daily scores, recaps, widgets and the reactions of Wednesday;
• to process subscriptions and restore purchases;
• to send the reminder notification you turn on (we send at most one reminder a day);
• to respond to you and provide support;
• to maintain and improve the Service and its estimates, including by using corrections in aggregated and anonymized form;
• to detect, prevent and investigate fraud, abuse and security incidents; and
• to comply with law and enforce our terms.

5. AI-generated estimates

To turn what you log into an estimate, we send the text, voice transcript, image or barcode data you submit to artificial-intelligence and food-data providers acting on our behalf. Those providers include OpenRouter and the model providers it routes to, and public food databases such as Open Food Facts and the USDA FoodData Central, which receive only food names or barcodes. We send this information only to produce your estimate. We do not authorize these providers to use it for their own advertising. Each provider handles information under its own terms and policies. Estimates are generated automatically and may be wrong; see our Terms.

You give your explicit consent to this processing when you accept our Terms in the app. You can withdraw it at any time in the app under Me, then Privacy & data. Photo, text and voice estimates then stop working; barcode logging and re-logging past meals continue.

Photos. By default, a meal photo is processed to produce an estimate and then deleted from our systems. If you opt in to keep photos for your Album, we store them in private cloud storage linked to your account until you delete them or turn the setting off, which deletes the stored photos.

6. Who we share information with

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share it only as follows:

• Service providers who process information for us under contract: cloud hosting and storage (including Cloudflare), AI and food-data providers (section 5), subscription management (RevenueCat), push delivery (Apple Push Notification service and the Expo push service), and crash and analytics tools.
• Apple and Google, to authenticate you and, for Apple, to process payments and subscriptions. Their own privacy policies apply to what they collect.
• Legal and safety. Where we believe in good faith that disclosure is required by law or legal process, or is needed to protect the rights, safety or property of users, us or others.
• Business transfers. In connection with a merger, financing, acquisition or sale of assets, subject to this policy continuing to protect your information.
• With your direction. For example, if you export your data or share a recap card, the content goes where you send it.

We may also share information that has been aggregated or de-identified so that it cannot reasonably be used to identify you.

7. Where information is stored and transferred

Your journal is stored on your device and synced to our servers, which may be located outside your country, including outside the United Arab Emirates, the European Economic Area and the United Kingdom. When we transfer personal information across borders we rely on appropriate safeguards where the law requires them, such as contractual protections with our providers.

8. Retention and deletion

We keep your information while your account is active and for as long as needed to provide the Service. You can delete your account in the app (Me, then Privacy & data). Deleting removes your account, journal entries, stored photos and corrections from our active systems. Remaining copies in routine backups are overwritten on a rolling basis, and we may retain limited information that we are required or permitted to keep, for example records of purchases, security and fraud-prevention logs, and information needed to resolve disputes or comply with law. De-identified or aggregated information that no longer identifies you may be kept.

9. Your choices and rights

• Access and export. Export your journal from inside the app at any time.
• Correction. Edit your entries, profile and any estimate in the app.
• Deletion. Delete your account from inside the app.
• Hide calorie figures. Turn on ED-safe mode.
• Notifications. Change or turn off reminders in the app or in iOS Settings.
• Photos. Choose whether meal photos are kept.

Depending on where you live, you may also have the right to request access to, correction, deletion, portability or restriction of your personal information, to object to certain processing, to withdraw consent, and to lodge a complaint with your local data-protection authority. This includes rights under the EU and UK GDPR, California law and the UAE Federal Decree-Law No. 45 of 2021 on personal data protection, to the extent they apply. To exercise a right that you cannot exercise in the app, write to [email protected]. We may need to verify your identity first, and we may decline a request where the law allows. We will not discriminate against you for exercising your rights.

Legal bases (EEA and UK). We process information to perform our contract with you, on the basis of your consent for health-related information, for our legitimate interests in securing and improving the Service (balanced against your rights), and to meet legal obligations.

10. Security

We use reasonable technical and organizational measures to protect information, including encryption in transit and access controls. No system is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your device and sign-in accounts secure.

11. Children

The Service is not directed to children and you must be at least 13 years old to use it. Where the law of your country sets a higher age for consenting to the processing of personal or health information (up to 16 in parts of the EEA and the UK), you may use the Service only if you have reached that age or have the permission of a parent or guardian. We do not knowingly collect personal information from anyone under 13. If you believe a child has given us information, contact us and we will delete it.

12. Google user data

If you sign in with Google, we use the basic profile information Google provides only to create and operate your account. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

13. Changes to this policy

We may update this policy from time to time. If we make a material change we will tell you in the app or by other appropriate means before it takes effect where the law requires. The “Last updated” date above shows the current version. Continuing to use the Service after an update means you accept it.

14. Contact

Zaniah Labs
[email protected]