BareCal Privacy Policy

Effective October 17, 2026 · Applies to the BareCal app for Android, version 0.5 and later, and to barecal.app.

1. Who we are

BareCal is a calorie and macro tracker made and run by one independent developer based in Ontario, Canada ("BareCal", "we", "us"). BareCal decides how the app handles personal information and is responsible for it.

Our Privacy Officer is the person accountable for privacy at BareCal and handles all privacy questions, requests and complaints:

Privacy Officer, BareCal
Email: support@barecal.app

Email is the only way to reach us; we don't take requests by mail. If you want to know the name of the person who serves as Privacy Officer, email us and we'll tell you.

2. Where BareCal is offered

BareCal is offered on Google Play in Canada and the United States, and is intended for people who live there. It is not offered or directed to people in the European Union, the European Economic Area, the United Kingdom or Switzerland.

3. Data stored on your phone

Everything you enter or create in BareCal is saved in the app's private storage on your device:

• Food and drink logs (including calories, protein, carbs, fat, and fiber, sugar and sodium where known), recipes, custom foods, corrections you make to food data, saved meals and planned meals
• Body weight, water intake, days you marked "Not tracking today", and your calorie, macro, water, nutrient and target-weight goals, with a history of goal changes
• Optional profile details used to estimate a starting goal: sex, age, height, goal, activity level and pace
• If you use BareCal Plus features: diet phases, training and rest day targets, and your weekly check-in history
• Estimates the app calculates from your data, such as your estimated daily calorie burn and suggested targets (see section 8)
• Weigh-ins read from Health Connect, if you connect it (see section 6)
• Settings: units, theme, app icon, reminders, widget style, and whether you have BareCal Plus
• A random installation ID, created by the app and not linked to your name, email or device identifiers. It's used only as described in section 4.

Reports and exports you create (CSV or PDF) are made on your phone and saved or shared only where you choose. Reminders are scheduled on your phone; there is no notification server.

4. Data that leaves your phone

Some features need to send information to other services. Each one is listed here. Except for food lookups, they only happen if you use that feature. Like any internet request, each one also reveals your IP address and basic technical details (such as the app version) to the service it goes to.

Google and Open Food Facts handle information they receive under their own privacy policies: Google, Firebase, Open Food Facts.

5. Cloud save with Continue with Google (optional)

You can use BareCal without an account. If you choose Continue with Google:

• Sign-in: Google confirms who you are and gives the app your name, email address and Google account ID. These are stored by Firebase Authentication, together with your user ID, sign-in times and, for security and abuse prevention, IP addresses.
• What's saved to your account: a copy of the data listed in section 3 (your logs, foods, recipes, meals, weight, water, goals, profile details, plans, check-ins and settings), plus the phone model, app version and time of the last save. Sample data from test builds is never saved.
• Where: Google Cloud Firestore, operated by Google as our service provider (a "processor"), under Google's Firebase data processing terms. It is encrypted in transit and at rest. Google processes it in the United States and other countries (see section 15).
• Who can see it: the database's security rules let each signed-in account read and write only its own copy. As the operator of the Firebase project, BareCal's Privacy Officer could technically open the database through Google's console. We don't, except to carry out a request from you (such as deleting your account) or where the law requires it.
• Why: only so that a reinstall or a new phone gets your data back when you sign in. It isn't analyzed, used for advertising, sold or shared.

Signing out stops saving but keeps the copy in your account so you can sign in again later. To delete it, use Profile → Your data → Delete all data while signed in, or ask us at barecal.app/delete-account.

6. Health Connect (optional)

If you connect BareCal to Health Connect, you choose which data types to allow, one at a time:

• Read: steps, exercise sessions and body weight recorded by your watch, scale or other apps. Steps and workouts are only shown in BareCal (Today, Activity and Trends). Weigh-ins from a smart scale fill days that have no weight logged, and from then on they're part of your weight log like any other weigh-in.
• Write (only if you turn on sharing): your meals and their nutrition, water and weight, so other apps you choose can use them.

Calories burned from your watch are never read or added to your budget. Data read from Health Connect is used only to provide these features. It is never used for advertising, never sold or transferred to data brokers or other third parties, and never used to decide on credit, insurance, employment or lending. No person reads it unless you ask us to (for example, by sending it in a support request), for security, or where the law requires. Our use of Health Connect data follows the Health Connect permissions policy, including its Limited Use requirements.

Steps and workouts are not saved anywhere outside your phone. If you also use cloud save, imported weigh-ins are included in the copy saved to your account (section 5), like weigh-ins you type in. You can remove access at any time in Health Connect settings or in BareCal (Profile → Watch & scale → Disconnect everything).

7. How we use data, and your consent

We use your information only:

• to log your food and show calories, macros, nutrients, weight, water and activity
• to estimate your daily calorie burn and, if you use them, suggest weekly targets (section 8)
• to look up foods by barcode or name, and to share foods or corrections when you ask
• to save and restore your data with your Google account, if you sign in
• to provide BareCal Plus features you've purchased
• to answer your feedback, fix bugs and keep the app secure

Information about your body, food intake and activity is sensitive health information. We ask for your consent before collecting it and before each optional feature that sends it off your phone. Cloud save, Health Connect, and sharing with Open Food Facts or the BareCal community are off until you turn them on. Android backup follows your phone's own backup setting.

You can withdraw consent at any time: delete the data, disconnect Health Connect, turn off sharing, sign out or delete your account copy, or uninstall the app. Withdrawing doesn't undo what was done before. If you withdraw, the features that depend on that data stop working. We will ask for your consent again before using your information for any new purpose.

8. Estimates the app calculates

BareCal uses your weight, food logs and profile details to estimate your daily calorie burn and to suggest targets. These calculations run on your phone. They are always on when you log food and weight; you can't turn them off separately, but you can ignore them, and they are deleted with the rest of your data. They are suggestions only: your goal never changes unless you choose to apply one. No decision with legal or similarly significant effects is made about you by automated means.

9. What BareCal never does

• No advertising, no advertising IDs, no ad networks
• No analytics, tracking or profiling tools from third parties
• No selling, renting or trading of personal information, including health data, and no "sharing" for targeted advertising as defined under US state privacy laws
• No location access
• No use of your data to train AI models

Do Not Track. BareCal does not track you across other apps or websites, so it does not change its behavior in response to "Do Not Track" signals or similar mechanisms, including Global Privacy Control. There is nothing for them to turn off.

Third-party tracking. No third party is allowed to collect personally identifiable information about your online activities over time or across different apps or websites when you use BareCal.

10. Retention and deletion

• On your phone: kept until you delete it. Profile → Your data → Delete all data permanently removes everything BareCal stores on the phone. Uninstalling the app also removes it.
• Copy saved to your account: kept until you delete it. Delete all data (while signed in) deletes the saved copy and your sign-in record. You can also request deletion at barecal.app/delete-account, without the app. We complete requests within 30 days. Google may keep encrypted backups of its systems for a limited time under its own data processing terms before they are overwritten.
• Android backups: kept in your Google account under Google's backup rules. You can turn backup off or delete backups in your phone's settings or in Google Drive (Storage → Backups).
• Community submissions: approved foods stay in the shared list (they contain no information about you). Submissions that aren't approved are deleted within 12 months.
• Feedback and crash emails: kept only as long as needed to answer and follow up, and deleted within 24 months, or sooner if you ask.
• Purchase records: Google keeps these under its own policies. Order details Google shares with us are kept only as long as needed for support, refunds and legal requirements such as tax records.
• Open Food Facts contributions are public and managed by Open Food Facts.

When information is no longer needed, we delete it or make it anonymous.

11. Your rights

Wherever you live in Canada or the US, you can ask to:

• know what personal information we hold about you, how it's used and who received it, including a list of the third parties that received it
• get a copy, in a structured, commonly used format
• correct it
• delete it
• withdraw your consent

Data on your phone: you have direct control. View and edit it in the app, export it (Profile → Your data → Export as CSV), and delete it (Profile → Your data → Delete all data).

Anything else (your saved account copy, feedback emails, order details): email support@barecal.app, or use barecal.app/delete-account for deletion. You don't need a BareCal account to make a request, and requests are free. We may need to confirm the request comes from you, for example by asking you to email from the address you sign in with.

Response times: we reply in writing within 30 days. Where a US state law gives 45 days (such as consumer health data laws or Connecticut's privacy law), we reply within 45 days. If we need more time, we'll tell you within those 45 days and may extend once by another 45 days. If we refuse a request, in whole or in part, we'll tell you why, which law we rely on, and how you can appeal or complain.

Appeals (US): if we decline a request, reply with "Appeal" in the subject. We'll answer the appeal in writing within 45 days. If you're not satisfied, you can contact your state Attorney General.

We won't treat you differently for using any of these rights.

12. How we handle personal information, and complaints

BareCal is run by one person, the Privacy Officer, who is the only person with access to the Firebase project, the community review sheet and the support inbox, and who approved this policy. We collect only what each feature needs, keep it only for the periods in section 10, and assess a new service for privacy before it receives any of your information. We review this policy at least once a year.

Complaints: please email support@barecal.app first, with "Complaint" in the subject. We'll acknowledge it, look into it, and give you a written answer within 30 days. If we got something wrong, we'll fix it and tell you how. If you're not satisfied, you can contact:

• the Office of the Privacy Commissioner of Canada
• the Commission d'accès à l'information du Québec if you live in Quebec
• your provincial privacy commissioner, or your US state Attorney General

13. Security

• Data on your phone is kept in the app's private storage, which other apps can't read. Protect your phone with a screen lock.
• Every network request the app makes uses an encrypted HTTPS connection.
• The copy saved to your account is encrypted in transit and at rest by Google, and security rules limit each account to its own data.
• Access to BareCal's Firebase project and community sheet is limited to the Privacy Officer.
• Payments are handled by Google Play; card details never pass through BareCal.

No method of storage or transmission is perfectly secure. If your Google account were compromised, someone could see the copy of your food and weight history saved there, so we recommend 2-step verification on your Google account.

14. Breaches

If a security breach affects your personal information and creates a real risk of significant harm, we will notify you and the authorities the law requires, such as the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, and the US Federal Trade Commission under its Health Breach Notification Rule. We'll notify you without unreasonable delay, and for breaches covered by the FTC rule within 60 days of discovering them. The notice will say what happened, what information was involved, what we've done, what you can do, and how to reach us. We keep a record of every incident, even small ones, for at least 5 years.

15. Where data is processed

BareCal is based in Canada, where feedback emails and other information we receive directly are handled. Google, including Firebase, processes data in the United States and other countries where it operates. Open Food Facts is based in France. When you use a feature that contacts one of them, your information may be processed outside your province or country, where local laws may differ and courts, law enforcement or national security authorities there may be able to access it. Before using these services, we assessed the protection they give personal information, including information of Québec residents. We rely on Google's Firebase data processing terms as our written agreement with Google.

16. Children

BareCal is intended for people aged 16 and older and is not directed to children. We do not knowingly collect personal information from children under 16, including children under 13. The app won't accept an age under 16 during setup. If you believe a child has entered information in the app or saved data to an account, contact us and we will delete it.

17. Not medical advice

BareCal provides estimates for general wellness. It is not a medical device and does not diagnose, treat, cure, or prevent any medical condition. Talk to a doctor or registered dietitian before making significant changes to your diet, especially if you are pregnant, have a medical condition or have a history of disordered eating.

18. Consumer health data (US)

If you live in Washington, Nevada, Connecticut or another US state with a consumer health data law, our separate Consumer Health Data Privacy Policy describes the health data BareCal handles, where it comes from, why it's used, who receives it and how to use your rights.

19. Changes to this policy

If this policy changes, the new version will be posted here with a new effective date. Significant changes will also be shown in the app before they apply. If a change would use your information in a new way, we'll ask for your consent first.

20. Contact

Privacy Officer, BareCal
Email: support@barecal.app