Privacy Policy

OULABI MIR TR. operates CaloReps. This policy describes the personal information handled by our mobile fitness and nutrition application and related services.

Your privacy rights depend on the laws that apply where you live. This policy describes our practices; it does not limit rights provided by those laws.

OULABI MIR TR., Sharjah, United Arab Emirates, is responsible for the personal information processed to operate CaloReps.

Contact: info@caloreps.com. Website: https://caloreps.com.

Account information: username, email address, account identifier and password hash. We do not store your password as plain text.

Health and fitness information you enter: age, gender, body measurements, weight, injuries, fitness assessments, exercise performance, goals, equipment, training preferences and workout history.

Nutrition information: meals, food searches, calorie and nutrient targets, food logs and any meal photos you choose to analyze.

Social information: friend relationships and requests, challenge participation and titles, and leaderboard rankings associated with your username.

Purchase information: subscription products, transaction or purchase identifiers, payment status and entitlement history received from Apple or Google. We do not receive payment-card details.

Service logs: requested API routes, request time and duration, status and errors, account identifiers when signed in, IP address and user-agent information. AI-operation logs may include the account identifier, model, duration, token usage, estimated cost and errors.

Support information you send to us, and aggregate reports made available by the app stores.

Body measurements, injury information and other health-related details may receive additional protection under applicable law. We use these details to provide your requested fitness and nutrition features.

Before saving the initial assessment, the updated app explains this processing and asks for your agreement. Before an AI workout or meal-photo analysis, it separately identifies the recipients and asks permission to share the relevant information.

You can decline an AI request and use other available features. To withdraw consent for stored health information or request deletion, use account deletion in Profile or contact info@caloreps.com. Withdrawal does not undo processing already performed.

We use account information to authenticate you, protect your account and provide support.

We use the information you enter to calculate nutrition targets, track progress, provide workout features and display your chosen social interactions.

When you permit AI workout generation, relevant profile, assessment, injury, goal and workout information is sent to OpenAI to generate the requested program. When you permit meal-photo analysis, the selected photo is sent to OpenAI for nutrition estimates and to Cloudinary for image storage.

We verify subscriptions directly with Apple or Google and manage access through the CaloReps backend.

We use operational logs to diagnose errors, monitor performance, prevent abuse and operate the service. Password-reset emails and store purchase communications support your account and purchases.

Where GDPR or UK GDPR applies, processing necessary to provide your requested account and service features relies on contractual necessity; security and operational diagnostics rely on legitimate interests subject to your rights; and required records may be processed to meet legal obligations.

Where consent is required, including explicit consent for health information, we ask for it. Contact info@caloreps.com with questions about the applicable basis or to exercise your rights.

CaloReps does not sell personal information or use it for third-party advertising.

Service providers include our backend hosting infrastructure, OpenAI for requested AI features, Cloudinary for uploaded meal images, and Apple or Google for distribution and purchase processing. Cloudflare provides network and exercise-media delivery. Providers process information under their applicable service and privacy terms.

OpenAI: https://openai.com/policies/privacy-policy. Cloudinary: https://cloudinary.com/privacy. Cloudflare: https://www.cloudflare.com/privacypolicy/.

Other users may see your username, ranking and information you share through friend and challenge features. Meal photos are not a public social feed, but uploaded images may be accessible to someone who has their delivery URL; do not upload private documents or sensitive images unrelated to your meal.

We may disclose information when legally required or necessary to protect users and the service. If the business is transferred, we will provide any notice and choices required by applicable law.

Account and related fitness, nutrition and social records are kept to provide the service while your account exists. Deleting an account removes its associated records from the active CaloReps database according to the account-deletion process.

Operational logs, backups, purchase records and records required for legal or security purposes may have separate retention periods. Images already uploaded to Cloudinary require separate removal; contact info@caloreps.com for an image-deletion request.

Information sent to service providers is also subject to their retention rules. Disabling response storage for an AI request does not guarantee that the provider retains no data. Contact us for questions about a specific record or deletion request.

CaloReps uses HTTPS for service connections, bcrypt password hashing, authenticated access tokens and authorization checks for account data. We restrict administrative access to service operations.

No online service can guarantee absolute security. Contact info@caloreps.com if you suspect unauthorized access or a security problem.

10.1 Rights Under GDPR / UK GDPR (EEA & UK Users)

Right of Access (Art. 15): obtain confirmation of and a copy of your personal data;

Right to Rectification (Art. 16): correct inaccurate or incomplete data;

Right to Erasure (Art. 17): request deletion of your data ("right to be forgotten") subject to legal exceptions;

Right to Restriction of Processing (Art. 18): limit how we use your data in certain circumstances;

Right to Data Portability (Art. 20): receive your data in a structured, machine-readable format;

Right to Object (Art. 21): object to processing based on legitimate interests or for direct marketing;

Right to Withdraw Consent: withdraw consent at any time without affecting lawfulness of prior processing;

Right to Lodge a Complaint: file a complaint with your national supervisory authority (e.g., ICO in the UK, relevant DPA in your EU country).

10.2 Rights Under CCPA / CPRA (California Residents)

Right to Know: know what personal information we collect, use, disclose, and sell (we do not sell);

Right to Delete: request deletion of your personal information (subject to legal exceptions);

Right to Correct: correct inaccurate personal information;

Right to Opt-Out of Sale: we do not sell personal information;

Right to Limit Use of Sensitive Personal Information: limit our use of sensitive data to necessary purposes;

Right to Non-Discrimination: we will not discriminate against you for exercising your privacy rights.

10.3 Rights Under PIPEDA (Canadian Users)

Right to access personal information we hold about you;

Right to correct inaccurate information;

Right to withdraw consent (subject to legal and contractual restrictions);

Right to file a complaint with the Office of the Privacy Commissioner of Canada.

10.4 How to Exercise Your Rights

Submit your request by emailing info@caloreps.com with the subject line "Privacy Rights Request". Include your registered email address and specify your request. We will verify your identity before processing.

Response timelines: 30 days (GDPR/UK GDPR) | 45 days (CCPA, extendable to 90 days with notice) | 30 days (PIPEDA).

Our infrastructure and service providers may process information outside your country, including in the United States. Applicable privacy laws can require safeguards for international transfers. Contact info@caloreps.com for information about the safeguards relevant to your data.

CaloReps is intended for people aged 13 and over. Children under 13 must not create an account or provide personal information through the App. We do not knowingly collect personal information from children under 13.

Users aged 13 to 17 should review this policy with a parent or legal guardian and must have their permission to use CaloReps. Where local law requires additional parental consent or a higher minimum age, those requirements also apply.

If you believe a child under 13 has provided personal information to CaloReps, contact info@caloreps.com. We will investigate, stop further collection from the child, and take appropriate steps to delete that information, subject to applicable legal requirements. We may need to verify a requester's authority before disclosing account information.

The mobile app uses local storage for authentication tokens, preferences and cached app state. Its current implementation does not integrate advertising identifiers or third-party advertising/attribution SDKs.

Opening our website or a provider website in your browser is subject to that website's cookies and privacy practices.

The app displays account, workout and subscription status within the app. Apple or Google may send purchase and subscription notifications under their own settings. CaloReps sends requested account-recovery communications.

The app's progress charts use your fitness and nutrition records. Server diagnostics record service activity and errors as described above. These logs may be associated with your account; they are not all anonymous. CaloReps does not display third-party advertising.

We will update this page and its effective date when our practices change. For material changes, we will provide additional notice and obtain fresh consent when required by applicable law. A policy update does not replace consent where consent is required.

If you believe your privacy rights have not been respected, you have the right to lodge a complaint with your relevant supervisory authority:

EU residents: your national Data Protection Authority (find yours at edpb.europa.eu);

UK residents: Information Commissioner's Office (ICO) — ico.org.uk;

Canadian residents: Office of the Privacy Commissioner — priv.gc.ca;

California residents: California Privacy Protection Agency — cppa.ca.gov.

Email: info@caloreps.com

Website: https://caloreps.com

For all privacy-related questions, data subject requests, or concerns, contact us at the email address above. We are committed to resolving all legitimate privacy inquiries promptly and transparently.