Privacy Policy

Tiếng Việt · English

This page explains what the DailyCalo app and the dailycalo.vn website collect, why, who it is shared with, how long it is kept and how you control your data.

Summary

• Food logs, weight, InBody values and body photos are health data. We process them only with your consent, never sell them and never use them for advertising.
• No GPS location, contacts or advertising identifiers; no tracking or behavioural analytics.
• AI features (Anthropic, ElevenLabs) run only after you agree in the app; you can withdraw at any time.
• Export your data and delete your account right in the Me tab.
• For people aged 16 and over.

1. Who is responsible

The DailyCalo app and the dailycalo.vn website are developed and operated by DBR (“we”), an independent developer without a separately registered legal entity, who is the controller and processor of your personal data. Contact: hello@dailycalo.vn.

This policy follows Vietnam’s Law on Personal Data Protection No. 91/2025/QH15 and its implementing regulations (Decree 356/2025/ND-CP, which replaced Decree 13/2023/ND-CP), and Apple App Store rules.

2. Data we collect

• Account: email, display name, password (stored hashed by the authentication provider; we cannot read it); 6-digit email codes for sign-up and password reset.
• Energy profile: sex, date of birth, height, activity level, goal (lose, maintain, gain), target weight, calorie and macro targets. Used to compute BMR, TDEE and daily targets.
• Body metrics: weight, body-fat %; InBody values (muscle mass, fat mass, visceral fat, BMR, InBody score) and the InBody printout photo if you take one.
• Body photos: progress photos you take (if you use this feature), stored in a private bucket.
• Nutrition log: foods, meals, portions, kcal, protein, carbs, fat, notes, data source (AI, manual, verified), meal photos; water; supplements; your custom foods and exercises, favourite foods.
• Training and recovery log: exercises, weights, reps, workout clips; sports, duration, intensity; sleep, soreness, HRV, resting heart rate, recovery therapies.
• Chats with David (AI assistant): your messages, replies and the log changes David makes at your request. Photos you send David are used only to answer and are not stored.
• Community and messaging: bio, avatar, posts, photos and clips, likes, comments, friends, block list, 1-to-1 messages (with photos), waves; the gym name you type when checking in (expires automatically; no location stored).
• PT / expert connections: connection requests and status, session bookings, reviews (stars and text); if you apply as a PT or shop: name, title, bio, specialties, services and prices, shop name, phone, address, products.
• PT payments: amount, order ID, MoMo transaction ID, buyer and PT names, order status. We do not store card or wallet details.
• Notifications: your device’s push token and OS, your notification setting; diary reminders are local notifications.
• Abuse reports: the content or person you report and the reason.
• On your device: your session (in the device’s secure keystore), a log cache and settings (theme, haptics, glass effect, AI consent).
• dailycalo.vn website: the email you leave on the early-access list plus a one-way hash of your IP address for spam protection (the IP itself is not stored); a nickname and score if you play the web game. No advertising cookies.

3. Health data and your consent

Weight, body-fat %, InBody values, body photos, sleep, heart rate and food and training logs are sensitive personal data. By creating an account and entering this data you consent to us processing it for the purposes in section 4. You can stop using any feature, delete individual entries, or delete your account to withdraw consent. We never use health data for advertising, never sell it, and share it only with the parties in sections 5 and 7.

4. Purposes

• Create and secure your account and sync it across your devices.
• Compute BMR, TDEE, calorie and macro targets; draw charts and progress statistics.
• Estimate nutrition from meal photos, read InBody printouts and let David answer using your data, when you use those features.
• Run the community, messaging, PT connections, bookings and PT payments.
• Send notifications you have allowed.
• Moderate content, handle abuse reports, keep the service secure, prevent fraud, provide support and meet legal obligations.

5. AI and service providers

Before you first use an AI feature, the app asks whether you agree to send data to a third-party AI. If you decline, AI features do not run; you can withdraw at Me → Withdraw AI consent. When you chat with David you are talking to an AI system, not a person. AI output is an estimate and can be wrong; you can edit it before saving. We do not send your email or account ID to AI providers.

• Anthropic (Claude models): receives meal photos, InBody printout photos and, for David, your messages, attached photos and the log figures needed to answer. Under Anthropic’s commercial terms, API data is not used to train models by default.
• ElevenLabs: receives the text of David’s reply (up to 1,200 characters) to speak it aloud when you turn on voice mode; this text may appear temporarily in our server infrastructure’s technical logs.
• Apple (iOS speech recognition): turns your speech into text in voice mode; audio may be processed by Apple under Apple’s policy.
• Supabase: cloud infrastructure for accounts, database, photos, clips and server functions (servers in Singapore). Every table is locked per account at the database level.
• Resend: sends sign-up and password-reset code emails (receives your email address and the message).
• Expo Push Service and Apple Push Notification service: deliver push notifications (push token, short title and body).
• MoMo: processes PT payments (amount, order ID, order description).
• Cloudflare: runs the dailycalo.vn website, early-access list and web game.
• GitHub (exercise illustrations) and Google Fonts (website fonts): receive your device’s IP address when images or fonts load.

None of these parties may use your data for advertising. Their temporary retention follows their own terms and policies.

6. Public community content

Your display name, avatar and bio form your community profile. Posts, photos, clips and comments are visible to signed-in members; PT reviews (stars, text, display name) are visible to all members; leaderboards show only names and days logged. Avatars can be reached via a public link. Think before posting; you can delete your posts, and block and report others.

7. Sharing with PTs / experts and administrators

PTs / experts you connect with: once you send a request and the PT accepts, the PT gets read-only access to your energy profile, food log and meal photos, water, body metrics and body photos, training log, workout clips, recovery and supplements. PTs cannot see your private chats with David. You can disconnect at any time and access ends immediately; this is enforced on the server, not just hidden in the interface.

DailyCalo administrators: DBR, or a person DBR assigns to the task, may view user data where needed for support you request, content moderation, abuse reports, security, or lawful requests from competent authorities.

8. Transfers outside Vietnam

Servers of Supabase (Singapore), Anthropic, ElevenLabs, Resend, Expo and Cloudflare are outside Vietnam. Data is transferred abroad only to provide the service to you, based on your consent and in line with the rules on cross-border transfer of personal data, including an impact assessment dossier where the law requires one.

9. Retention

We keep data until you delete it or your account. When you delete your account, your sign-in account, profile, logs, photos, clips, David chats, posts, comments, messages, connections and reviews are removed from our systems immediately, and the cache on the device you are using is cleared. Exceptions:

• PT order and payout records are kept for accounting, tax and reconciliation for as long as the law requires; they are unlinked from your account and keep only the display name at the time of the order.
• Abuse reports concerning other people may be kept to protect the community.
• Automatic infrastructure backups (if any) are overwritten on the provider’s cycle.
• Website early-access emails are deleted on request.

10. Your rights

You have the right to be informed; to consent, refuse or withdraw consent; to access and correct your data; to obtain a copy; to request deletion; to request restriction of or object to processing; and to complain, report, sue and claim compensation as provided by law.

• Access and correct: in the app; your energy profile is in the Me tab.
• Get a copy: Me → Export all data (JSON: profile, logs, David chats, posts, comments, messages you sent, friends, connections, orders, reviews) or Export food log (CSV). Exports contain links to photos and clips, not the files; email us if you need the files.
• Delete your account: Me → Delete account (with confirmation). The first-run profile screen has this button too.
• Withdraw AI consent: Me → Withdraw AI consent.
• Notifications: turn off diary reminders in the Me tab, push notifications in the Community card or in iPhone Settings.
• Other requests: email hello@dailycalo.vn. We acknowledge receipt and respond within the statutory time limits; we may need to verify that you own the account.

Withdrawing consent does not affect processing already carried out, but some features may stop working.

11. Security and incidents

Connections are encrypted; access is locked per account at the database level; photos and clips live in private buckets opened only by time-limited links; your session is kept in the device’s secure keystore; AI API keys live only on our servers; payment results are signature-checked. No system is perfectly secure. If a personal-data breach occurs, we notify the competent data protection authority within 72 hours of discovery, remedy it, and inform you where the law requires.

12. Age

DailyCalo is for people aged 16 and over; the app asks for your date of birth during setup and does not let anyone under 16 continue. If you are a parent or guardian and believe your child has given us data, contact us and we will delete it.

13. Health notice

Calories, macros, TDEE and David’s answers are for reference only and are not a diagnosis or medical advice. If you have a medical condition, are pregnant or breastfeeding, or have a history of eating disorders, talk to a doctor before changing your diet or training.

14. Users in the EU, EEA and UK

Where the GDPR / UK GDPR applies, our legal bases are consent and performance of a contract, and explicit consent for health data. You also have the right to data portability and to complain to your local supervisory authority.

15. Changes and contact

When this policy changes we update the date at the top and tell you in the app or by email before material changes take effect. Questions: hello@dailycalo.vn (DBR). You may also complain to Vietnam’s personal data protection authority (Ministry of Public Security).