Privacy Policy

Effective date: November 7, 2026

CalorieCodex is a local-first nutrition tracker. This policy explains what information the app may collect, how it is used, and your choices.

Information the app stores

The app stores data you enter, including foods, recipes, meal logs, custom measures, daily targets, and preferences. This information is saved locally on your device.

Optional accounts and partner sharing

An email account is optional. If you sign in, our sharing service stores your email address, hashed sign-in challenges and sessions, partner connection, invitations, and the foods, recipes, templates, or meal content you choose to share. Sign-in requests use your installation identifier and IP address for abuse prevention. Amazon SES delivers sign-in codes and sharing notifications using the MacroCodex sender address.

• Partner items include their required food and recipe ingredients, serving definitions, and nutrition metadata. Recipients see your email address as sender attribution.
• Only items you mark for sharing or explicitly send are uploaded. Your complete diary, daily targets, AI conversations, private notes, and diagnostic evidence are not included in a sharing bundle.
• Partner sharing follows updates to the owner's master item. Each recipient chooses their own portions; personal logs and ingredient changes do not update that master.
• One-off shares become independent private copies after acceptance. Turning off sharing or disconnecting removes live library access after the next successful sync; offline devices may retain cached items until they reconnect. Past logs and explicit private copies remain.
• Session credentials use platform secure storage. Account-scoped shared caches and pending uploads use local SQLite storage. Signing out clears shared access and unsent sharing changes on that device.
• You can delete your sharing account in Settings → Partner & sharing. This removes the server account, connections, shared masters and account-bound shares. It does not erase another person's saved private copies or personal logs, or your local personal nutrition records.

Photos and files

If you add a photo for a custom measure or use AI quick log, the app may access your camera or photo library. If you export or import data, the app will use files you choose.

AI quick log and CalorieCodex Agent

If you choose to use AI quick log features, CalorieCodex sends only the content you select for analysis, such as photos, typed descriptions, or voice transcripts, to the AI provider you configure.

• AI quick log is optional and stays off unless you configure an AI provider.
• Your selected provider and model are stored locally on your device. Existing API-key providers keep their keys in app preferences; OpenAI Codex ChatGPT OAuth access and refresh credentials are stored only in platform secure storage.
• If you connect OpenAI Codex, the app uses OpenAI's device authorization flow. OpenAI receives the authorization requests and selected AI content, and controls which Codex models are available to your ChatGPT account. The app does not receive or store your ChatGPT password.
• Photos, text, and transcripts are sent only to the provider and endpoint you configure when you start an AI analysis or send an Agent message.
• Agent voice input uses Android speech recognition by default. Android may process recognition on-device or through the recognition service configured on your phone. If you explicitly select Gemini Audio or OpenAI transcription, the temporary microphone recording is uploaded directly to that provider, deleted from the device after the request, and—where supported—deleted from the provider's temporary file service after transcription.
• AI nutrition estimates can be wrong, so you should review and edit them before logging.
• The Agent derives relevant eating patterns locally from confirmed, non-deleted meal logs. When a pattern matches your message, only the matching meal context—along with relevant targets, saved foods, recipes, and measures—is sent to the configured provider so it can answer and prepare accurate changes.
• When Gemini is selected and current external evidence is needed, the Agent may ask Gemini to use Google Search or retrieve a URL. Returned source links are stored with the local conversation and nutrition audit.
• When OpenAI Codex is selected and its web-search tool is enabled, the Agent sends a search query to OpenAI only after you explicitly ask it to search, browse, or look something up online. Returned source links are stored with the local conversation and nutrition audit.
• Agent conversations, execution events, and attachments are stored in a separate local database. Deleting a conversation permanently deletes its events and attachments from that database.
• The Agent stores an alias, preference, or city/country memory only after you explicitly approve it. Precise location is not retained as Agent memory.
• Proposed changes to meals or your saved library are shown for confirmation before the app applies them.

How the data is used

• To show your saved foods, recipes, and meal history.
• To calculate calories and macros from the data you enter.
• To estimate calories and macros from photos or text when you explicitly use AI quick log.
• To let you back up, restore, or reset your local app data.

Data sharing

CalorieCodex does not sell your personal information. Your data stays on your device unless you choose to export it, email support, open an external link, send selected content to your configured AI provider for a quick-log analysis, or enable the optional sharing features described above.

Third-party services

The app may open third-party apps or services when you tap links such as email or the Google Play listing. Those services are governed by their own privacy policies.

Health Connect on Android

On supported Android devices, CalorieCodex can optionally write your completed daily nutrition totals to Health Connect if you choose to enable Health Connect sync in the app.

• The app requests android.permission.health.WRITE_NUTRITION only if you turn on Health Connect sync or start a Health Connect sync yourself.
• If enabled, the app writes only your completed daily calorie and macro totals: calories, protein, carbs, fat, and fiber.
• The app does not require Health Connect access to use CalorieCodex. You can leave Health Connect disabled and continue using the app normally.
• You can manage or revoke Health Connect access from CalorieCodex settings or from Health Connect system settings.

Children's privacy

CalorieCodex is not intended for children under 13, and it does not knowingly collect personal information from children.

Third-party attribution

OpenAI Codex device authorization support incorporates code and design from dsh-codex-connect (Apache-2.0) and the OAuth portions of pi-ai (MIT). These components are used only for authentication interoperability; Codex credentials remain in platform secure storage.

Contact

Questions? Email [email protected].