Privacy Policy

1.Who We Are

1.1This Privacy Policy explains how CalQuant (the "Service") collects, uses, and protects your personal data.

1.2The Service is operated by:

1.2.1Operator / data controller: Harry Dransfield trading as "CalQuant"

1.2.2Legal form: Sole trader established in England

1.2.3Website / app domain: https://calquant.app/

1.2.4Business postal address: Chapel Recording Studios, South Thoresby, Lincolnshire, LN13 0AS, United Kingdom

1.2.5Contact email for privacy matters: support@calquant.app

1.3For the purposes of UK data protection law (UK GDPR and Data Protection Act 2018) and, where applicable, the EU GDPR, CalQuant is the "data controller" for personal data processed through the website and any related apps (including future iOS/Android apps). This means we decide how and why your personal data is processed.

1.4Our users are primarily in the UK, but we may also have users in the EU and US.

2.What This Policy Covers

2.1This Privacy Policy describes: What personal data we collect when you use CalQuant; how and why we use your personal data; the legal bases we rely on (especially under UK/EU data protection laws); how we use cookies and similar technologies (including Firebase Analytics / Google Analytics and any future advertising tags); who we share your data with and why; how long we keep your data; how we protect your data; your rights, particularly if you are in the UK or EU.

2.2This Policy applies to: The CalQuant website (https://calquant.app/); and any future iOS/Android apps or related interfaces that we operate.

2.3It does not apply to third-party websites or services that we do not control, even if we link to them from our Service.

3.The Data We Collect

3.1We only collect personal data that we need to provide and improve the Service. This section explains what we collect and when.

3.2Registration and Account Data

3.2.1Email and password registration: If you register with your email and a password, we collect: Full name or display name; email address; password (stored only as an encrypted/hashed value by Firebase Authentication - we never see your raw password).

3.2.2Google sign-in: If you create an account or log in using Google sign-in, we receive: Full name (as provided by Google); email address; Google-issued identifiers needed for authentication; user profile photo (this is available in the database but is not displayed or otherwise used within the CalQuant interface).

3.2.3In both cases (email/password and Google sign-in): Your account data is linked to a Firebase UID (a unique identifier issued by Firebase). Passwords are not stored in plain text and are handled securely by Firebase Authentication. The same types of account and log-in data are associated with your user profile.

3.2.4Date of birth, sex, and health-data consent at account completion: We ask for your full date of birth and sex when you complete account creation, including where a new account is created using Google sign-in. We use your date of birth to confirm that you are eligible to create an account, to block under-18 account creation, and to pre-fill your age in calculator fields when you are logged in. We use your sex to pre-fill calculator fields that require sex-specific equations. Your date of birth and sex are stored in your account profile.

3.2.5Explicit health-data consent record: Because account-based saved results and calculator defaults involve health-related profile, body measurement, body composition, activity, nutrition-profile, and calculation data, we ask you to tick an explicit consent box before account completion. We store a consent record linked to your Firebase UID, including whether consent was granted, when it was granted, and the consent/privacy version shown at the time.

3.2.6Calculator defaults in account settings: If you use account settings to save calculator defaults, we may store your preferred unit system, sex, date of birth, and height in your account profile. We use these values to pre-fill relevant calculator fields and, where appropriate, lock account-derived fields so your saved account profile remains the source of truth.

3.3Saved Calculation Data (for Logged-in Users)

Important: Only data from logged-in users is stored in our database. Any inputs or calculations you make while not logged in are not sent to our database and are not stored as personal records. Account-based saved results and account profile defaults require your explicit consent to the storage and processing of health-related data for those account features.

3.3.1Body and profile inputs: When a logged-in user saves or syncs a calculation, we store the body and profile inputs needed to recreate that result, including: Units; sex / gender selection used by the calculator; age; height; weight; body-fat percentage if provided; whether body-fat percentage was provided; and the saved result name and timestamp.

3.3.2Activity and nutrition-profile inputs: We store the activity-category values and nutrition-profile selections you enter as part of a saved calculation. This may include daily or weekly sleep, sedentary, light, moderate, and vigorous activity breakdowns, and your Thermic Effect of Food (TEF) or nutrition-profile setting. These values are stored to recreate and display your saved calculation result; they are not analytics about how you navigate or use the app interface.

3.3.3Derived outputs and saved-result display data: We may store or regenerate calculation outputs, summaries, chart data, and related display information where needed to show your saved results and help you visualise activity and body trends for your own self-tracking purposes.

3.3.4Preferences linked to saved calculations: We may store preferences such as your selected BMR method or display choices for saved calculations, so the Service can restore your chosen view.

3.4Technical and Usage Data (Analytics / Cookies)

3.4.1When you use the Service, we use tools such as Firebase Analytics / Google Analytics with Google Consent Mode. By default, Analytics and Marketing consent are set to denied. Google Analytics may load in consent-denied mode before you make a cookie choice or where you decline Analytics cookies. In that state, optional Analytics and Marketing cookies remain denied, but Google may receive limited cookieless measurement signals for aggregate measurement and modelling.

3.4.2If you consent to Analytics cookies, Firebase Analytics / Google Analytics may collect technical and usage information via cookies and similar technologies. This may include: IP address (which may be truncated or anonymised, depending on configuration); device type, browser type, and operating system; referrer URLs (where you came from before visiting CalQuant); pages viewed, time spent on each page, and click paths; approximate location (for example, city or region); online identifiers (such as cookies, Google Analytics IDs, and other unique identifiers). This data helps us understand how the Service is used and improve performance. We may also maintain anonymous first-party aggregate counts of basic page views and selected product events, without storing user identifiers, calculator inputs, or saved-result content in those counts.

3.4.2.1If we introduce Google Ads or similar advertising tags in the future, those tools will only be used where they are enabled in the Service and you have given any consent required by law. Our current application code sets Google ad storage, ad user data, and ad personalisation to denied by default and does not actively initialise Google Ads tags.

3.4.3For UK/EU users, non-essential cookies (including analytics and advertising cookies) are only used with your consent, as described in Section 6 below and in our Cookie Policy.

4.Data We Do Not Collect or Intentionally Process

4.1No food logs / detailed calorie-intake entries (at this stage): CalQuant currently does not collect detailed food logs or per-meal calorie-intake entries.

4.2No storage of non-logged-in user inputs: Inputs you make when using the Service without being logged in are not sent to our database as personal records and are not stored in a way that identifies you.

4.3Health-related data is limited to what you choose to provide: We do not intentionally collect special category data (such as health data) beyond the date of birth, sex, height, activity, body measurement, body composition, nutrition-profile, and saved calculation data that you choose to input, save, or store in your account profile. To the extent that such data is considered health-related, it is provided by you for self-tracking purposes only and is used to provide the Service features you choose. For account-based storage of health-related data, we ask for explicit consent before account completion.

5.How We Use Your Data (Purposes)

5.1We use your personal data for the following purposes:

5.1.1To create and manage your account: Setting up your user account; managing log-in credentials and authentication (including via Google sign-in).

5.1.2To provide the core Service: Running calculators; storing and displaying your saved calculations, activity inputs, body measurements, body-composition inputs, account profile defaults, and saved results where you use account features; calculating and displaying summaries, trends, and progress visualisations; remembering your preferences and settings (including unit preference, sex, height, and TEF selection where saved).

5.1.3To operate, maintain, and improve the Service: Monitoring usage (for example, which features are used most); understanding and improving performance and user experience; fixing bugs and troubleshooting.

5.1.4To run analytics: Using Google Analytics and similar tools to understand how users interact with CalQuant; generating aggregated statistics and usage reports.

5.1.5To run and measure advertising where enabled: If we introduce Google Ads or similar advertising tools, we may use them to run campaigns, measure ad performance and conversions, and, where you have consented, use remarketing or retargeting features.

5.1.6To communicate with you: Responding to your enquiries or support requests sent to support@calquant.app; providing important service-related notices (for example, material changes to this Policy or to the Terms of Service).

5.1.7To prevent fraud and ensure security: Detecting and preventing abuse, misuse, or security incidents; protecting the Service and its users.

5.1.8To comply with legal obligations and enforce our rights: Meeting our legal and regulatory responsibilities; enforcing the Terms of Service and other agreements; handling disputes and legal claims.

5.2Marketing communications: At present, CalQuant does not send regular marketing emails or newsletters. If we introduce such communications in the future, we will obtain your consent where required and provide you with clear options to opt in or opt out.

6.Legal Bases for Processing (UK/EU Users)

6.1If you are in the UK or EU, data protection laws require us to explain our legal bases for processing your personal data. The main processing activities are:

6.1.1Account creation, authentication, and account management: We use account data such as name or display name, email address, Firebase UID, date of birth, authentication provider details, email verification status, and authentication credentials to create, secure, and manage your account, confirm age eligibility, and pre-fill account-based calculator fields. Legal basis: Performance of a contract and, for security controls, our legitimate interests in operating a secure Service.

6.1.2Providing saved calculations, account defaults, and self-tracking features: We use saved calculation inputs, activity data, body measurements, body-composition data, date of birth, sex, height, TEF / nutrition-profile selections, saved result names, timestamps, and saved preferences to provide the core Service, restore saved results, pre-fill account-based calculator fields, calculate outputs, and display charts, summaries, and trends. Legal basis under Article 6: Performance of a contract for providing the account features you request. Where this data is health-related special category data under UK/EU law, we rely on your explicit consent under Article 9(2)(a), recorded through the health-data consent checkbox shown during account completion. If you do not provide or withdraw consent for this health-related processing, we cannot provide account-based saved calculation, profile default, and self-tracking features that require stored health-related data. You may still use the calculators without an account where those inputs are not stored as personal records in our database.

6.1.3Operating, maintaining, and improving the Service: We use account, technical, and usage information to troubleshoot, fix bugs, understand feature performance, maintain service reliability, and improve user experience. Legal basis: Our legitimate interests in running and improving the Service. Where analytics cookies or similar technologies are used, we obtain consent where required by cookie/ePrivacy rules.

6.1.4Analytics: We use Firebase Analytics / Google Analytics with Google Consent Mode. Optional Analytics cookies and full Analytics event tracking are used where you consent to Analytics cookies or similar technologies. Where Analytics consent is denied or has not yet been given, Google Analytics may operate in consent-denied mode and send limited cookieless measurement signals without setting or reading Analytics cookies. Legal basis: Consent for non-essential cookies and similar technologies; legitimate interests in understanding and improving the Service for subsequent use of aggregated or non-identifying analytics outputs and, where applicable, limited cookieless measurement signals.

6.1.5Security, fraud prevention, and abuse prevention: We use account, authentication, device, technical, and operational data to detect and prevent abuse, misuse, automated attacks, fraud, and security incidents. Legal basis: Legitimate interests in protecting the Service, our users, and our systems; and legal obligation where security or regulatory duties require processing.

6.1.6Support and service communications: We use your email address, account details, and the content of support communications to respond to enquiries, provide support, and send important service-related notices. Legal basis: Performance of a contract where support relates to your use of the Service; legitimate interests in responding to enquiries and maintaining records; and legal obligation where we must keep or provide certain information.

6.1.7Legal compliance and enforcement: We use relevant account, usage, support, and transaction-related information to comply with legal obligations, enforce our Terms, handle disputes, respond to lawful requests, and protect our rights. Legal basis: Legal obligation and legitimate interests in protecting our legal rights and the rights of others.

6.1.8Advertising and marketing where introduced: At present, CalQuant does not send regular marketing emails and the current application code does not actively initialise Google Ads tags. If we introduce marketing emails, Google Ads, remarketing, or similar advertising tools in the future, we will obtain consent where required and update our notices as needed. Legal basis: Consent where required; otherwise legitimate interests for limited non-personalised or contextual advertising where lawful and appropriate.

6.1.9You may withdraw consent at any time. For cookie and analytics consent, you can change your cookie preferences in our cookie banner or preference centre, adjust your browser settings, or delete cookies. For explicit consent to account-based health-related data processing, the current in-Service withdrawal route is to delete your account in account settings, or contact us at support@calquant.app if you need help. Because stored health-related data is required for account-based saved results, profile defaults, and related account features to work, withdrawing this consent by deleting your account means those account features will stop and your account-based personal records will be deleted or anonymised in accordance with Section 10. Withdrawing consent does not affect the lawfulness of processing that took place before you withdrew it.

7.Cookies and Similar Technologies (including Analytics and Future Advertising Tags)

7.1How We Use Cookies: CalQuant uses cookies and similar technologies (such as local storage and pixels) for the following purposes: Essential / strictly necessary cookies: To keep you logged in; to provide security and prevent fraud; to enable basic site features and functionality. Analytics cookies (Firebase Analytics / Google Analytics): To understand how users interact with the Service (e.g. which pages are viewed, how long users stay, and which features are used); to help us improve usability and performance. Advertising and remarketing cookies: The current application code does not actively initialise Google Ads tags, but if these are introduced they will be used only where enabled and with any consent required by law.

7.2Consent for UK/EU Users: If you are in the UK or EU: Non-essential cookies (including analytics and advertising cookies) are only used with your consent. You can provide or withhold consent via our cookie banner or cookie preference manager when you first visit the site and at any time afterwards. You can change your preferences or withdraw consent at any time. Please see our separate Cookie Policy for more detail: Cookie Policy URL: https://calquant.app/cookie-policy

7.3Managing Cookies: You can also manage cookies in your browser settings. Most browsers allow you to: Block all cookies; block cookies from specific sites; delete cookies when you close your browser. If you block or delete cookies, some features of the Service may not work properly.

7.4Google’s Tools and Your Choices: Google provides tools and settings to give you more control over how your data is used, including the Google Analytics opt-out browser add-on and Google Ads settings and controls for personalised ads. We encourage you to review Google’s own privacy and cookie information for more details about how Google processes data. CalQuant uses Firebase Analytics with Google Consent Mode. Optional Analytics cookies and full Analytics event tracking are gated behind the Analytics cookie setting, and the current application code does not actively initialise Google Ads tags.

8.How We Share Your Data

8.1We do not sell your personal data.

8.2We may share your personal data with the following categories of recipients, but only as necessary and subject to appropriate safeguards:

8.2.1Service Providers / Data Processors: We use third-party service providers to help us operate the Service. These include, for example: Firebase / Google Cloud – for hosting, authentication, database storage, security, and analytics; and other operational partners – for email delivery, error monitoring, logging, and similar services, where used. If we introduce Google Ads or similar advertising tools, we will update our notices as needed. These providers act as data processors on our behalf where they process personal data only as instructed by us and subject to contractual obligations to protect your data.

8.2.2Google as Independent Controller: For some services, such as Google Analytics and any future Google Ads integrations, Google may also act as a separate, independent data controller for its own purposes (for example, to improve its own services). In those cases: Google’s own privacy policies apply to its independent use of data. We encourage you to review Google’s privacy documentation for more detail on how Google handles your data.

8.2.3Google Cloud / Firebase location: Our Firebase-backed server functions are deployed in Google Cloud region europe-west2 (London, United Kingdom). Account and saved-result data is stored and processed using Firebase / Google Cloud infrastructure for this Service, including Google infrastructure in the London region where configured for these backend services.

8.2.4Legal and Safety Reasons: We may disclose your personal data where required by law or where we reasonably believe it is necessary to: Comply with a legal obligation or respond to lawful requests from public authorities; protect the rights, property, or safety of CalQuant, our users, or others; enforce our Terms of Service or other agreements or policies.

9.International Data Transfers

9.1Our main infrastructure and service providers may be located outside the UK and the European Economic Area (EEA). This includes where: Google (including Firebase, Google Cloud, Google Analytics, and any future Google Ads integrations) hosts or processes data on servers in other countries (such as the US or other regions); other service providers maintain infrastructure in multiple jurisdictions.

9.1.1Current backend region: Our backend Cloud Functions are deployed in Google Cloud region europe-west2 (London, United Kingdom), and account and saved-result data is stored and processed using Firebase / Google Cloud infrastructure for this Service, including Google infrastructure in the London region where configured for these backend services. Google and other providers may still use global infrastructure, support, security, analytics, or operational systems, which is why international transfer safeguards may still be relevant.

9.2Where personal data is transferred outside the UK or EEA, we will ensure that appropriate measures are in place to protect your data, such as: Standard Contractual Clauses (SCCs) approved by the European Commission and/or UK authorities; other lawful transfer mechanisms that may become available under data protection laws. These safeguards are designed to ensure that your personal data remains protected in line with UK/EU data protection standards, even when processed in countries that may have different data protection laws.

10.How Long We Keep Your Data (Data Retention)

10.1We keep personal data only for as long as necessary for the purposes described in this Policy, including to provide the Service and to comply with legal obligations. Below is a more detailed explanation.

10.2General Rule: We keep your personal data for as long as you have an active account and we need the data to provide the Service.

10.3Account & Profile Data (Name, Email, UID, Authentication Information, Date of Birth, Sex, Height, Preferences, and Consent Records): Retained while your account is active. If you delete your account, including where deletion is used to withdraw explicit consent for account-based health-related data processing, we will delete or anonymise your personal data from active systems within 90 days of your deletion request, unless we need to keep certain data longer to comply with legal obligations or resolve disputes. If you create an account and do not verify your email address, we may delete that unverified account after 7 days as part of our scheduled account-cleanup process (typically within up to 14 days from registration, depending on cleanup timing).

10.4Saved Calculations, Activity Inputs, Body Measurements, and Body-Composition Data: Retained while your account is active, so you can see your saved results, history, profile defaults, and trends. After account deletion, we will delete or anonymise your saved calculations, activity inputs, body measurements, body-composition data, and related account-based health data within 90 days. We may retain aggregated or anonymised data that no longer identifies individual users indefinitely for analytics, research, and service improvement.

10.5Inactive Accounts: If you do not log in to or otherwise use your account for 3 years, we may treat your account as inactive. We may then delete or anonymise your associated personal data within 90 days after that 3-year period, subject to any legal obligations to retain data longer. Inactive-account cleanup is normally evaluated during a scheduled monthly cycle.

10.6Backups: Personal data may continue to exist in encrypted backup copies after it is removed from active systems. Backup data will be automatically overwritten and removed in the course of normal backup cycles and will not be retained for more than 12 months after the original data is removed from active systems.

10.7Support Emails and Logs: Emails sent to support@calquant.app, and related support or error logs, may be kept for up to 3 years from the date of the last relevant communication or log entry, unless a longer period is required for legal, accounting, or security reasons.

10.8Explanation and Exceptions: We may keep some information for a longer period where necessary to: Comply with legal or regulatory obligations; resolve disputes or enforce agreements; protect our rights and the rights of our users. Once data is truly anonymised so that it can no longer be linked to an identified or identifiable individual, we may keep it without a specific time limit.

11.How We Keep Your Data Secure

11.1We take reasonable technical and organisational measures to protect your personal data. These include: Using Firebase and Google Cloud infrastructure, which is designed with industry-standard security practices; using encryption in transit (HTTPS/TLS) when data is sent between your device and our servers; relying on Firebase Authentication for secure password handling, which uses hashing and encryption technologies; limiting access to personal data to those personnel and providers who need it to operate the Service and who are bound by confidentiality obligations.

11.2However, no online service can guarantee absolute security. While we cannot eliminate all risks, we aim to reduce them as much as reasonably possible.

11.3If you believe that your account or interaction with us is no longer secure (for example, if you suspect a compromise of your password), please contact us immediately at support@calquant.app.

12.Your Rights (UK/EU Users)

12.1If you are in the UK or EU, you have certain rights in relation to your personal data under the UK GDPR/EU GDPR. These include: Right of access - you can ask for confirmation of whether we process your personal data and request a copy of that data. Right to rectification - you can ask us to correct or update inaccurate or incomplete personal data. Right to erasure ("right to be forgotten") - you can ask us to delete your personal data in certain circumstances (for example, where it is no longer needed for the purposes for which it was collected, or where you withdraw consent and there is no other legal basis). Right to restriction of processing - you can ask us to restrict the processing of your personal data in certain situations (for example, while we investigate an accuracy issue). Right to data portability - you can ask us to provide your personal data in a structured, commonly used and machine-readable format and to transmit that data to another controller where technically feasible. Right to object - you can object to our processing of your personal data where we rely on legitimate interests, including profiling based on those interests. You can also object at any time to processing of your data for direct marketing (including profiling for marketing purposes). Right to withdraw consent - where we rely on your consent (for example, for certain cookies, health-related data processing, or future marketing communications), you can withdraw that consent at any time. This will not affect the lawfulness of processing carried out before you withdrew consent.

12.2How to Exercise Your Rights: To exercise any of these rights, please contact us at: Email: support@calquant.app. To help us respond, please: Provide enough information to identify your account (for example, the email address you used to register). Explain which right you wish to exercise and what you are requesting. We may need to request additional information to verify your identity before fulfilling your request, to protect your privacy and security.

12.3Complaints to a Supervisory Authority: If you are not satisfied with how we handle your personal data, you also have the right to lodge a complaint with a data protection authority. In the UK, you can contact the Information Commissioner’s Office (ICO) at https://ico.org.uk/make-a-complaint/ or by calling 0303 123 1113. In the EU, you can contact your local supervisory authority in the country where you live, work, or believe a breach has occurred. We would, however, appreciate the chance to deal with your concerns before you approach a regulator, so please consider contacting us first.

13.Children and Minors

13.1The Service is intended for users aged 18 and over.

13.2We do not knowingly collect personal data from anyone under 18.

13.3If we learn that we have collected personal data from a person under 18, we will take reasonable steps to delete that data and, where appropriate, close the account.

13.4If you believe that a child under 18 has provided personal data to us, please contact us at support@calquant.app.

14.Third-Party Links

14.1The Service may contain links to third-party websites or services that we do not operate or control.

14.2We are not responsible for the privacy practices or content of these third parties.

14.3When you follow a link to a third-party site or service, the collection and use of your data is governed by that third party’s own privacy policy and terms.

14.4We encourage you to review the privacy policies of any third-party websites or services you visit or use.

15.Changes to This Privacy Policy

15.1We may update this Privacy Policy from time to time, for example to reflect: Changes to the Service; changes in applicable laws or regulatory guidance; changes in our data processing practices.

15.2When we make changes: We will update the "Last updated" date at the top of this Privacy Policy. For significant changes, we may provide additional notice, such as via email or an in-Service notification.

15.3We encourage you to review this Privacy Policy periodically to stay informed about how we handle your personal data.

16.How to Contact Us

16.2We will do our best to respond to your request or query in a timely and appropriate manner.