Privacy Policy
42apps LLC ("we", "us", or "our") operates the CalZen mobile application and website at calzen.ai. This Policy explains what information is processed for nutrition and GLP-1 tracking, AI food analysis, weekly meal plans, purchases, analytics, and support. The information we process depends on the features you use, your app version, your platform, and where you make a purchase.
1. Data Controller
42apps LLC is the controller responsible for the processing described in this Policy.
Address: 49 building, Mamyr-4, 050039 Almaty, Kazakhstan
Email: hello@calzen.ai
2. Information We Process
2.1 Information you provide
- Nutrition and body information: age, gender, height, weight and weight history, body measurements, body fat percentage where entered, activity level, nutrition goals, food diary entries, water intake, and dietary preferences.
- Medication and GLP-1 records: medication name and formulation, dose and unit, the medication schedule you enter and any changes to that schedule, planned and actual dose dates and times, dose status, injection sites, and notes.
- Related health records: symptom and well-being entries, medication supply quantities and expiry dates, reminder settings, and estimates derived from your records.
- Food analysis content: photos, food descriptions, ingredient information, and other text you submit for analysis or correction.
- Contact information: an email address you provide for purchase access, recovery, communications, or support; messages and attachments you send to us.
2.2 Weekly meal-plan information
When you use the iOS weekly meal-plan feature, we process your questionnaire answers: dietary style; restrictions such as halal, kosher, no alcohol, or lactose-free; allergens; disliked and excluded ingredients; preferred and avoided cuisines; cooking skill; available kitchen equipment; selected meals; preparation-time preference; priorities such as speed, variety, simplicity, taste, and budget; and your chosen start date.
We also use your calorie, protein, fat, carbohydrate, and fiber goals, language, region, and preferred units. Your region comes from your device's regional settings, not GPS location. We process the resulting menu, recipes, generated images, nutrition estimates, shopping list, menu identifier, generation status, and records linking your purchase to the plan so we can deliver or restore it.
The iOS menu request does not include your name, email address, age, gender, body weight, medication journal, or individual Apple Health activity records. CalZen may use information stored on your device to calculate your nutrition targets. If activity-based adjustment is enabled and sufficient history is available, the target sent for generation may incorporate an estimate derived from active-energy history. A derived target is still health-related information.
Allergy and medication information may concern your health. Dietary choices may also reveal sensitive preferences, including religious beliefs. Selecting a restriction does not require you to state your religion or explain why you selected it.
2.3 Technical information and usage
Depending on the service, we and our providers process app and operating-system versions, device model, language, time zone, IP address, approximate location inferred from the network, diagnostics, and interactions with features. Requests to the menu service also include app version and platform. We also use network information to protect the Services and limit abusive requests.
Analytics uses pseudonymous app, device, and user identifiers. These identifiers can connect events across sessions and may be associated with an Apphud purchase or subscription identifier. They do not themselves contain your name, but the related records are not fully anonymous. Section 6 explains the event properties processed for GLP-1 and meal-plan analytics.
2.4 Apple Health and Health Connect
Health integrations are optional and controlled by your device permissions and the settings available in your app version. On iOS, supported exchanges may include reading steps, workouts, active energy, weight, height, and waist measurements, and writing selected nutrition, water, body measurements, and calculated BMI to Apple Health. The exact data types and directions depend on what you enable. Health Connect data access on Android follows the permissions presented on that platform; the data types and features available on Android may differ.
You can change permissions in your device's health settings and the available CalZen settings. Revoking access stops the corresponding future exchange but does not automatically delete records already held in CalZen or the health service. As explained in Section 2.2, the menu feature sends calculated nutrition targets to our servers, even though the underlying activity records stay on your device.
2.5 Subscriptions and one-time purchases
We process purchase status, product and plan identifiers, billing period and expiry where applicable, transaction identifiers, purchase dates, and refund or revocation status available to us. On iOS, a signed Apple transaction is sent to the menu service to verify a one-time purchase and associate it with its menu, or to restore a previously purchased plan. Apphud also processes purchase events and entitlement information. We do not receive full payment-card details for App Store or Google Play purchases. A website checkout provider handles the billing information you submit under its own privacy terms.
2.6 Website information
Website analytics may process page views, referral information, device context, approximate location, and browser or cookie identifiers. Calculator inputs on calzen.ai are processed in your browser rather than submitted to our calculation servers. If you separately submit information through a purchase or support flow, that information is processed for that flow. See Section 10 for cookies and consent choices.
3. Purposes and Legal Bases
If the GDPR applies to your information, our legal basis depends on why we process it:
| Purpose | Legal basis |
|---|---|
| Provide requested tracking, food analysis, and meal-plan generation, delivery, archive, and recovery | Performance of a contract, Article 6(1)(b) |
| Verify and administer subscriptions, one-time purchases, and purchase support | Performance of a contract, Article 6(1)(b); legal obligation where applicable, Article 6(1)(c) |
| Optional health integrations, notifications, or other processing requiring permission | Consent, Article 6(1)(a), where consent is the applicable basis |
| Product analytics and attribution | Legitimate interests, Article 6(1)(f), only where appropriate; consent, Article 6(1)(a), where required |
| Protect the Services, investigate failures and abuse, and respond to support | Legitimate interests, Article 6(1)(f); performance of a contract where necessary for purchase support |
| Required accounting, legal compliance, and handling legal claims | Legal obligation, Article 6(1)(c), or legitimate interests, Article 6(1)(f), as applicable |
Sensitive information. Processing data concerning health, or information that reveals religious beliefs, requires an applicable condition under Article 9 in addition to a basis under Article 6. Where explicit consent is required, it must be requested before the relevant processing, including disclosure to an AI provider. Acceptance of the Terms, a purchase, an operating-system health permission, or a general analytics permission does not by itself replace a separate consent required for a different purpose.
You can withdraw consent by contacting hello@calzen.ai and revoke health permissions through your device settings. Withdrawal applies to future processing and does not affect processing that was lawful before withdrawal. Features that require the information may no longer work without it. You may continue to use features that do not depend on the withdrawn permission.
4. How We Use Information
We use the information described above to provide tracking and calculations; analyze food; prepare menus, recipes, translations, and images; deliver and recover paid content; record your medication regimen without selecting treatment; provide configured reminders; operate enabled health integrations; administer purchases; communicate about access and support; understand feature use; secure the Services; and comply with legal obligations. Analytics, attribution, and optional communications have the separate purposes and recipients described below. You do not have to agree to unrelated marketing to make a purchase.
Where we send optional product news or offers using an email you provide, you can unsubscribe using the instructions in the message or by contacting us. Any consent required for that purpose must be obtained separately. Opting out of marketing does not stop necessary purchase, access, security, or support messages.
5. AI Processing
5.1 Food analysis
Food images, descriptions, and ingredient information you submit for AI analysis are transmitted through CalZen's service infrastructure to OpenAI's API to generate nutrition estimates. Do not include information about another person or unnecessary personal details in images or free text.
5.2 Weekly meal plans
The profile described in Section 2.2 is sent to CalZen's menu service. The service uses the relevant goals, dietary style, restrictions, allergens and excluded foods, cuisine preferences, cooking conditions, and language to request menu composition, recipes, checks, or translations from OpenAI. Generated dish descriptions are also used to request illustrative food images. CalZen uses your signed purchase transaction to verify payment. We do not include it in requests to OpenAI for meal-plan generation. Medication journal entries are not included in this menu-generation profile.
5.3 Provider processing and permission
OpenAI processes the content sent through its API under the applicable API terms and data controls. API content is not used to train OpenAI models by default. OpenAI may retain some content in security logs or to operate API features, depending on its settings and legal obligations. See OpenAI's API data controls. CalZen's own storage is described in Section 8.
Use of a feature that sends personal data to an external AI provider requires the relevant disclosure and permission before the transfer. Where sensitive data is involved, the additional conditions in Section 3 also apply. You may decline to use online AI generation; it cannot produce a personalized result without processing the information needed for that request.
6. Recipients, Analytics, and Advertising Measurement
The services used depend on your platform, app version, region, and purchase channel. The table below explains who receives information and why. Not every provider receives all of the information listed in this Policy.
| Recipient | Purpose | Information involved |
|---|---|---|
| CalZen hosting and infrastructure providers | Operate APIs, generation, storage, recovery, and backups | Request content, menu profiles and results, purchase-verification information, network information, and operational records needed for the feature |
| OpenAI | Food analysis; menu, recipe, translation, and image generation or checking | Food content and the relevant meal-planning inputs described in Section 5 |
| Apple and Google | Store billing, transaction verification, and optional health integration | Purchase information and the health data types you authorize, according to the service used |
| Apphud | Purchase and subscription management, entitlement and attribution | App/user identifiers, purchase events and status, and an email address if you provide one for access or recovery |
| Paddle, where identified at checkout | Website billing as merchant of record | Checkout and billing information, transaction and subscription records |
| Firebase (Google) | App configuration, diagnostics, crash reporting, and supported measurement | App/device identifiers, technical context, diagnostics, and relevant usage or conversion events |
| Mixpanel | Product analytics | Pseudonymous user ID, app/device context, feature interactions, and event properties described below |
| Amplitude and AppsFlyer, where used | Product analytics or attribution in the applicable platform/version | Usage or attribution events and pseudonymous app/device identifiers |
| Meta and TikTok, where enabled | Advertising attribution and conversion measurement | App/device or advertising identifiers where permitted and registration, checkout, or purchase events; Meta may also receive a hashed email for matching where you provide an email |
| Google Analytics | Website measurement | Page views, referral information, device context, and browser/cookie identifiers |
GLP-1 analytics. Mixpanel events can indicate interactions with the medication feature and limited properties such as whether a dose has been recorded, a schedule category, or the number of completed check-in fields. These events do not include medication names, dose amounts, specific injection sites, exact dose dates/times, symptom ratings, or free-text health notes. Nevertheless, feature events associated with a persistent ID may reveal use of a health-related service and are potentially health-related information.
Meal-plan analytics. Events include questionnaire progress, dietary style, selected restrictions, preferred and avoided cuisines, cooking skill, meal slots, time preference, start choice, counts of allergens or excluded foods, menu IDs, generation outcomes, and purchase interactions. Allergen names and individual excluded-ingredient lists are not included in the questionnaire-completion event. Limited or counted properties can still reveal sensitive preferences, and linking them to a persistent ID does not make them anonymous. The legal conditions in Section 3 apply to sensitive analytics as well as to the core feature.
Email and matching. Where you supply an email in an access or recovery flow, the iOS App can attach it to Apphud and pass it to Meta's matching functionality. The iOS App does not send your email address directly to Mixpanel or TikTok through these events. A hashed email or linked identifier is pseudonymous information, not necessarily anonymous information.
Processors acting for CalZen are subject to applicable processing instructions and contractual safeguards. Stores, health platforms, payment merchants, and some measurement providers may also act under their own legal responsibilities and privacy terms. We may disclose information where required by law, to protect legal rights or security, or in connection with a corporate transaction, subject to applicable safeguards.
We do not sell personal data for monetary payment. Advertising measurement or disclosure of identifiers may qualify as "sharing", targeted advertising, or a "sale" under certain privacy laws even without monetary payment. Section 9 explains how to exercise any applicable opt-out rights.
7. International Transfers
CalZen is operated by a company in Kazakhstan, and information may be processed in other countries where our infrastructure and providers operate, including the United States. Where GDPR restricts a transfer, the transfer requires an applicable safeguard, such as European Commission Standard Contractual Clauses or an applicable adequacy decision. You can ask us for more information about the safeguards that apply to a particular transfer.
8. Storage and Retention
- Local tracking records: the iOS medication journal, regimen history, well-being, and supply entries are stored in the App's local database. Nutrition records, questionnaire preferences, and menu copies are also kept locally as needed for the features. Available deletion controls remove the corresponding records; removing the App removes its local container. Operating-system or computer backups and records in health platforms are managed separately.
- Menu profiles on the server: for completed or failed requests, we remove the original set of meal-planning answers during scheduled cleanup once the request is more than 14 days old. We may keep those answers longer while a request is still pending. This 14-day schedule applies to that set of server records. Menu results, local copies, purchase records, and backups have the separate retention periods described below.
- Purchased menus and purchase association: menu results, recipes, images, generation records, and the association with a verified purchase are retained to deliver, troubleshoot, archive, and restore the purchased result. They are not automatically deleted when the seven-day planning period ends. Purchased plans remain in the archive until deleted; there is no fixed automatic expiration date. We also retain a digital fingerprint of the original answers to verify that a retry belongs to the same purchase, even after those answers are removed from the original server record. Contact us to request deletion; a menu can itself reveal dietary preferences even after the original profile is removed.
- Server backups: the menu service keeps a rotating set of up to 14 daily database backups. Data removed from the active database may remain in those backups until they rotate out. This rotation is separate from the 14-day profile cleanup. Local preferences and copies may have different retention from the server copy.
- AI request content: food-analysis and generation content is processed through CalZen and the AI provider for the requested operation. Your saved meal history and generated plans are stored separately from the requests used to create them. The provider may retain content for security or API operation as described in Section 5; processing a request does not mean that every recipient immediately deletes the information.
- Analytics and attribution: retention follows the purpose, provider settings, and applicable deletion requirements. Deleting the App does not automatically delete previously transmitted events. Contact us to locate and request deletion of identifiable records.
- Purchase and accounting records: retained as required for billing, verification, accounting, tax, and legal obligations, typically 3–7 years where those obligations apply. This does not mean that the complete health questionnaire must be retained for that period.
- Support: correspondence is retained for up to 12 months after resolution, unless further retention is needed for an ongoing dispute or legal obligation.
9. Your Choices and Rights
9.1 GDPR and similar rights
Depending on applicable law, you may request access, correction, erasure, restriction, portability, or objection to processing, withdraw consent, and complain to your data protection authority. These rights are subject to their legal conditions. We respond within the applicable deadline, generally one month for GDPR requests, with any permitted extension explained to you.
9.2 US state privacy rights
Where applicable, including under California law, you may request information about collection and disclosure, access or a copy, correction, deletion, and opt-out of sale, sharing, or targeted advertising. You may also have rights concerning sensitive information and an authorized agent. We will not discriminate against you for exercising a privacy right. California requests are generally addressed within 45 days, subject to any permitted extension. Use the contact below to submit an opt-out or other request; available device tracking and website cookie settings also control the corresponding future collection.
9.3 How to request deletion or withdraw permission
Contact hello@calzen.ai. An app/user identifier, menu identifier, or purchase reference may help us locate your records. We may request proportionate identity verification. Do not send full card details or unnecessary medical records. We will explain any information we must retain and the reason.
Local deletion, uninstalling, and turning off a health integration do not automatically remove server menus, provider analytics, payment records, platform health records, or backups. You can request deletion of server menu information by email. Deleting a purchased plan and the records linking it to your purchase may prevent us from restoring it later; required payment records may still be retained. Deletion of information does not itself cancel billing or create a refund; see the Refund Policy.
10. Cookies and Tracking Choices
The website uses storage to remember consent choices and may use Google Analytics cookies or similar browser identifiers for measurement. Use the consent controls displayed on the relevant website pages and your browser settings to manage this collection. You can also use the Google Analytics Opt-out Browser Add-on. Mobile SDKs can use app and device identifiers without using browser cookies; relevant device tracking permissions and applicable consent requirements still apply.
11. Security
We use measures such as encrypted transmission, access controls, and restricted operational access to protect information. No electronic system is completely secure. Protect your device and purchase account and avoid including unnecessary personal information in photos, text, and support attachments.
12. Children's Privacy
CalZen is not intended for children under 16, or under 13 in jurisdictions where that is the applicable minimum age. We do not knowingly collect personal data from children below the applicable age. If we learn that such information has been provided, we will take steps to delete it as required. Contact hello@calzen.ai if you believe this has happened. Meeting the minimum age requirement does not mean that a particular diet or medication is safe or appropriate for a minor.
13. Changes to This Policy
We will publish changes with an updated revision date and notify you of material changes through an appropriate channel. Where a new category, purpose, or disclosure requires additional permission, the updated text alone does not replace that permission.
14. Contact
42apps LLC
49 building, Mamyr-4, 050039 Almaty, Kazakhstan
Email: hello@calzen.ai