Privacy Policy

Introduction

This Privacy Policy explains how Carb Cycling ("we", "us", or "our") collects, uses, stores, and protects your personal information when you use our website, applications, and related services (collectively, the "Service"). By using the Service, you consent to the practices described in this policy.

Information We Collect

Information You Provide

• Account Information — Email address, display name, and password (hashed) when you register an account.
• Profile Data — Optional information you choose to add, such as body weight, dietary goals, and preferences used to generate carb cycling plans.
• Diet & Meal Data — Meal plans, food selections, and nutrition tracking data you create or import through the Service.
• User-Generated Content — Comments, reviews, shared meal plans, and other content you post in community features.
• Payment Information — Billing details processed by our third-party payment providers (Stripe, PayPal, Creem). We do not store full payment card numbers on our servers.
• Communications — Messages you send to our support team or feedback you provide.

Information Collected Automatically

• Usage Data — Pages visited, features used, actions taken, timestamps, and interaction patterns within the Service.
• Device & Technical Data — Device type, operating system, browser type, IP address, and language preference.
• Cookies & Similar Technologies — We use cookies to maintain sessions, remember preferences, and analyze usage. You can control cookies through your browser settings.

Information from Third Parties

• OAuth Providers — If you sign in via Google or GitHub, we receive your email address and basic profile information from those providers, in accordance with your settings on those platforms.

How We Use Your Information

We use your information to:

• Provide the Service — Create and manage your account, generate carb cycling plans, track nutrition, and enable meal planning features.
• Personalization — Customize meal plans and recommendations based on your profile, goals, and dietary preferences.
• AI Features — Process your inputs through AI models to generate diet suggestions, meal analysis, and related content. Your data may be sent to third-party AI service providers for processing; we do not allow these providers to use your data to train their models.
• Community Features — Display your shared meal plans, comments, and interactions to other users as part of the community functionality.
• Payments & Subscriptions — Process transactions, manage subscriptions, and administer credit balances.
• Communication — Send service-related notices, security alerts, and respond to support requests.
• Improvement & Analytics — Analyze usage patterns to improve features, performance, and user experience.
• Security & Fraud Prevention — Detect, prevent, and address abuse, fraud, and security issues.

Legal Bases for Processing

We process your personal data based on:

• Contract — Processing necessary to provide the Service you signed up for.
• Legitimate Interest — Improving the Service, analytics, fraud prevention, and marketing.
• Consent — Where you have given explicit consent, such as for optional cookies or marketing communications.
• Legal Obligation — Where processing is required by applicable law.

Data Sharing & Disclosure

We do not sell your personal information. We may share data in the following circumstances:

• Service Providers — Third parties that help us operate the Service (hosting, payment processing, email delivery, AI processing, analytics), bound by confidentiality and data processing agreements.
• Community Visibility — Content you choose to share (meal plans, comments, profile name) is visible to other users of the Service.
• Legal Requirements — When required by law, regulation, legal process, or enforceable governmental request.
• Protection of Rights — To protect the rights, property, or safety of Carb Cycling, our users, or the public.
• Business Transfers — In connection with a merger, acquisition, or sale of assets, with notice to affected users.

AI & Third-Party Processing

When you use AI-powered features, your inputs (such as meal descriptions, dietary goals, and food selections) are transmitted to third-party AI providers for processing. These providers:

• Process data solely to generate responses for you.
• Do not use your data to train or improve their AI models.
• Are bound by data processing agreements that restrict data use.

AI-generated content is provided for informational purposes only and does not constitute medical, nutritional, or health advice. Always consult a qualified healthcare professional before making dietary changes.

Data Retention

• Account Data — Retained while your account is active. Deleted within 30 days of account closure.
• Meal Plans & Diet Data — Retained while your account is active or until you delete it.
• Usage & Analytics Data — Retained for up to 24 months in aggregated/anonymized form.
• Payment Records — Retained as required by applicable tax and financial regulations.

Data Security

We implement industry-standard security measures including:

• Encryption of data in transit (TLS/SSL) and at rest.
• Access controls and authentication for internal systems.
• Regular security reviews and updates.

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access — Request a copy of the personal data we hold about you.
• Correction — Request correction of inaccurate or incomplete data.
• Deletion — Request deletion of your personal data.
• Portability — Request your data in a structured, machine-readable format.
• Restriction — Request that we limit how we process your data.
• Objection — Object to processing based on legitimate interest or for direct marketing.
• Withdraw Consent — Where processing is based on consent, withdraw it at any time.

To exercise these rights, contact us at the email address provided on our website. We will respond within 30 days.

Children's Privacy

The Service is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

International Data Transfers

Your data may be processed in countries other than your own. When we transfer data internationally, we implement appropriate safeguards such as standard contractual clauses to protect your information in accordance with applicable data protection laws.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "updated_at" date at the top of this page and, where appropriate, sending a notice through the Service. Your continued use of the Service after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at the email address provided on our website.