LeafCal Legal

Privacy Policy

This Privacy Policy applies to the LeafCal mobile application (Package Name: com.zz.leafcal), together with any associated services, backend infrastructure, and features operated by ZuzuVerse (hereinafter referred to as the "Service Provider", "we", "us", or "our"). This policy explains how we collect, process, store, and protect your data, in compliance with applicable data protection laws including the General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law (KVKK - Law No. 6698).

1. Collected Information: Personal, Physical & Health Data

LeafCal is a calorie, nutrition, and health tracking application. To provide personalized metabolic insights, nutrient tracking, and progress management, the Application processes data provided directly by you when interacting with the app:

Physical & Metabolism Profile: Age, date of birth, gender, current weight, historical weight progress records, height, target weight, body fat percentage (%), and body circumference measurements (waist, neck, hip, and wrist). Used for calculating BMR (Basal Metabolic Rate) and TDEE (Total Daily Energy Expenditure).
Activity & Lifestyle Data: Daily activity level, weekly workout frequency/days, estimated daily step counts, daily sleep duration, and diet model preferences (e.g., Lean Cut, Water Fasting).
Nutrition, Hydration & Text Inputs: Consumed food items, meal timestamps, total calories, macronutrient breakdowns (protein, fats, carbohydrates), micronutrients (sugar, sodium/salt, dietary fiber), daily water intake in milliliters (ml), custom meal notes, and text entries submitted for AI food analysis.
Account & Authentication Data (Optional): Creating an account is voluntary. You may use LeafCal as a Guest (without logging in) or register an optional account (via Email, Google Sign-In, Apple Sign-In, or third-party authentication). If you register an account, we process your email address, display name, authentication provider IDs, and unique user tokens to enable multi-device sync and account recovery.
Account & Device Identifiers: Automatically generated unique User ID (UID), token balance, and invite/referral codes (e.g., KCAL-XXXX-XXXX).

2. Camera, Photo Gallery & Artificial Intelligence (AI) Analysis

LeafCal incorporates AI-assisted meal analysis to simplify nutrition tracking:

Device Permissions: The Application requests access to your device's Camera (android.permission.CAMERA / iOS NSCameraUsageDescription) and Photo Gallery (iOS NSPhotoLibraryUsageDescription) solely to enable you to capture food photos or upload existing images of meals.
Google Gemini AI & Text Processing: When you submit a food photo or text description for analysis, the input data is transmitted securely via encrypted connections (HTTPS) to our backend server and to the Google Gemini AI API service. The image or text is processed exclusively to estimate meal composition, portion size, calories, and macronutrient values. Visual images are not sold to third parties or used for public display without consent.

3. Barcode Scanning & Open Food Facts Search

To provide accurate packaged product lookup:

Barcode Reader: The camera permission is utilized by the mobile_scanner package to scan product barcodes directly on your device.
Open Food Facts Integration: Scanned barcode strings are queried against the open-source product database hosted by Open Food Facts (world.openfoodfacts.org). No personal profile data or health metrics are sent during product database queries.

4. Advertising, Analytics & Tracking Identifiers (AdMob & ATT)

LeafCal offers free features supported by in-app advertising:

Google AdMob (google_mobile_ads): The Application displays rewarded video ads (capped at a maximum of 8 rewarded video ads per day per user) and banner advertisements served through Google AdMob.
App Tracking Transparency (iOS ATT): On iOS devices, personalized ad serving relies on explicit user consent requested via NSUserTrackingUsageDescription. Users can grant or deny permission at any time.
Collected Advertising Data: Google AdMob may collect technical identifiers, IP addresses, mobile Advertising IDs (IDFA on iOS, AAID on Android), and ad interaction telemetry as described in Google's Partner Privacy Policy.

5. In-App Purchases, Tokens & Subscriptions

LeafCal provides premium features, token/coin packages, and monthly unlimited subscriptions via the in_app_purchase framework:

Payment Processing: All financial transactions, credit card data processing, billing, and subscription renewals are managed directly by official app store infrastructure (Apple App Store and Google Play Store).
Financial Data Exclusion: LeafCal does NOT collect, store, transmit, or process your payment card numbers, bank details, or billing addresses. We receive only transaction completion receipts and token entitlement statuses.

6. Data Storage, Backend Sync, Widgets & Infrastructure

LeafCal employs both local storage and cloud synchronization to keep your data accessible across sessions:

Local Storage & Home Screen Widgets: Your profile settings, local food logs, hydration counters, and app preferences are stored locally on your mobile device's encrypted storage. Home Screen Widgets access local cached metrics (such as daily calorie budget and water intake) strictly to render widgets on your device screen without transmitting widget data externally.
Cloud Synchronization & Authentication: Meal history, token balances, subscription entitlements, account credentials, and invite codes are synchronized securely with our backend server (kcal-backend-1.onrender.com) and database / auth services (Supabase Auth & Database, meal_logs database table) over HTTPS/TLS encrypted connections.

7. Overview of Required Device Permissions

The Application may request the following permissions on your mobile device:

Camera (android.permission.CAMERA / NSCameraUsageDescription): Required for capturing food photos for AI calorie analysis and scanning product barcodes.
Photo Library (NSPhotoLibraryUsageDescription): Required for picking meal photos from your device gallery for AI analysis.
Internet Access (android.permission.INTERNET): Required for AI image analysis, barcode queries, server data synchronization, and ad loading.
App Tracking Transparency (NSUserTrackingUsageDescription - iOS): Used to request consent for personalized advertising via AdMob on iOS 14.5+.

8. Your Rights (GDPR / KVKK Compliance)

Depending on your location, under GDPR (EU/EEA) and KVKK (Turkey), you hold specific rights regarding your personal and physical data:

Right of Access & Inspection: You have the right to request confirmation of whether your personal data is processed and receive a copy of your records.
Right to Rectification: You can update or correct incomplete or inaccurate profile, health, or nutrition entries directly within the app or by contacting us.
Right to Erasure ("Right to be Forgotten"): You may request the deletion of your account, cloud meal logs, and personal metrics stored on our servers.
Right to Withdraw Consent: Where processing is based on consent (such as camera usage or iOS ad tracking), you can revoke consent at any time through app settings or device settings.
Right to Data Portability: You may request an export of your user data in a structured, machine-readable format.

To exercise any of these rights, please submit your request to ybingol3463@gmail.com. Requests will be evaluated and fulfilled within 30 days free of charge.

9. Third-Party Service Providers

LeafCal integrates trusted third-party SDKs and service providers to operate its features. Each provider processes data in accordance with their respective privacy policies:

10. Data Retention & "Reset All Data" ("Tüm Verilerimi Sıfırla") Policy

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy:

In-App Data Reset ("Tüm Verilerimi Sıfırla"): Users can purge all tracking data at any time via Settings > "Tüm Verilerimi Sıfırla". Executing this action immediately and permanently deletes meal history, weight logs, hydration records, and physical profile metrics from local storage and backend servers. Jeton balances, referral codes, and app preferences (theme/language) are preserved.
In-App Account Deletion (Store Compliant): Registered users can initiate full account and profile deletion directly within the LeafCal mobile app settings.
Web / Email Deletion Request: You may also request permanent account and data erasure by emailing ybingol3463@gmail.com with the subject "Account Deletion Request". All cloud meal logs (meal_logs), authentication credentials, body metrics, token balances, and profile records will be permanently erased from active backend databases within 30 days.
Guest / Local Data: You can purge local logs instantly by clearing app data or uninstalling LeafCal from your device.
Anonymized Telemetry: Aggregated analytical metrics that do not identify individuals may be retained indefinitely for quality improvement.

11. Protection of Minors (Children's Privacy)

LeafCal is not intended for children under 16 years of age. We do not knowingly collect personal or health metrics from children. If we discover that a child under 16 has submitted personal information without parental consent, we will promptly delete that data from our servers. Parents or guardians who suspect their child has provided data can contact us at ybingol3463@gmail.com.

12. Data Security & Technical Safeguards

We implement industry-standard physical, procedural, and technological security controls including HTTPS/TLS encryption in transit, server firewall protections, strict access permissions, and database key encryption. However, please note that no transmission method over the Internet or electronic storage is 100% impenetrable.

13. International Data Transfers

Your data may be processed on servers located outside your country of residence (such as cloud nodes hosted by Render, Supabase, or Google Cloud). Where data transfers cross international borders, we ensure adequate safeguards are in place, including Standard Contractual Clauses (SCCs) and privacy compliance frameworks mandated by applicable law.

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect app updates or legal requirements. Material changes will be published on this page with an updated effective date. Continued use of LeafCal after modifications indicates acceptance of the updated terms.

This privacy policy is effective as of July 25, 2026.

15. Contact Information

If you have any questions, inquiries, or privacy concerns regarding LeafCal, KVKK, or GDPR compliance, please contact the Service Provider at:

ZuzuVerse / Yusuf Zuzu
Email: ybingol3463@gmail.com
Website: zuzuverseweb