MythCal Meticulous Labs

Your diary. Your privacy.

Privacy policy.

What MythCal collects, how your data is used and stored, who can access it, and how to ask for it to be deleted.

Last updated Meticulous Labs · MythCal

This private release: no advertising, no tracking, and your data is never sold. Photo estimates use Google's Gemini (see Photo AI), and Meticulous Labs does not make owner-managed backups.

01Who we are

MythCal is a calorie, activity and water diary operated by Meticulous Labs, responsible for the account and diary data described here. This policy covers the private release of the MythCal phone app, PC/web app and this privacy page.

For privacy questions, access requests or deletion requests, email hello@mythcal.com.

02Data we collect

  • Account information: your email address, display name, account ID, approval status and account/sign-in timestamps. Firebase Authentication processes your password, keeps your login session, and sends the emails that confirm your address or let you choose a new password. Accounts made before sign-in moved to email may still use an older username until an email is added.
  • Sign-up and invitations: when you sign up, your request to join (your name, email, time zone and any note you write for the owner) and how many invitation codes you have tried. When you join, how you got in: the owner let you in, or the code you used and the member (or owner) it came from. Members who invite people also have the codes they made, when, and who joined with each.
  • Profile and goals: information you enter, such as age, height, weight, sex used by the calorie formula, body-fat percentage, activity level, calorie and water goals, timezone and preferred units. Measurement fields can be skipped by choosing a manual calorie goal.
  • Diary and saved foods: food, activity and water entries; dates, meal categories, calories, quantities, units, optional macros and notes; custom foods, favourites, meals and recipe ingredients; and creation, update and deletion status. From these the app keeps each day's totals for your trends, and whether you met your goals each day, which streaks and badges are counted from.
  • Weigh-ins: the weight you record for a day (one a day: the latest replaces an earlier one) and when it was recorded, kept as your weight history. Your goal weight and pace are part of your profile. Scale display settings stay on your device.
  • Technical and support information: Firebase and hosting providers receive request information, such as IP addresses and app/browser information, to deliver and secure the service. If you email us, we receive your email address and the information in your message. This page's host receives the requests needed to serve it.
  • Problem reports: if you use Report a problem in the app, what you write, with your account ID, the app's version, the kind of phone or browser, the app's theme and when you sent it. Nothing else is attached.

The current app has no advertising or third-party analytics integration. It does not request GPS location, contacts, microphone access or Health Connect data, and it does not automatically monitor your activity.

03How we use and share data

We use data to sign you in, maintain your diary, calculate your chosen goals and summaries, synchronise devices and answer support and deletion requests.

  • Google Firebase: Firebase Authentication handles accounts and login; Cloud Firestore stores profiles, diary entries, weigh-ins and saved foods. Google processes this information to provide and secure those services.
  • Photo estimates: MythCal's server on Cloudflare Workers passes your photo, any amount you typed and your note to Google's Gemini API for an estimate, as described under Photo AI.
  • Barcodes: when you scan or type a food’s barcode, the app sends only that number to Open Food Facts, a non-profit open food database, to look the product up. Like any website, it receives your device’s IP address with the request. The camera picture used for scanning stays on your device and is not saved. Searching plain foods uses a list from the US Department of Agriculture kept in the app: what you search for is not sent anywhere.
  • Meticulous Labs administrators: authorised administrators can access stored profiles and diaries for account management, support and deletion, and see sign-up requests in order to let people in or turn them down. Other app members cannot browse your account.
  • The member who invited you: if you join with a member's code, they see the name you signed up with and when you joined. Nothing else about your account.
  • Recipients you choose: exporting or sharing a diary CSV gives its contents to the app, service or person you select.
  • Legal requests: information may be disclosed where required by law or necessary to investigate abuse or protect users, limited to what is needed.

We do not sell your personal or health data or use it for advertising.

04Photo AI

Status: switched on. Nothing is sent unless you choose to estimate a photo. The provider is Google (Gemini API).

What is sent: when you choose Estimate, the app sends the photo (resized on your device), any amount you typed (in grams or millilitres) and any note you typed to MythCal's server on Cloudflare Workers. The server checks that you are signed in to an approved account and that usage limits allow it. It removes camera details and location from the photo, then sends the photo, amount and note to Google's Gemini API, which works out the estimate.

What MythCal keeps: none of the photo, the note or the estimate. The photo exists only in the server's memory while your request is handled; it is not written to storage or logs. Only the foods you choose to add go into your diary. To control cost and misuse, the server keeps your account ID with counts of the estimates you used today and this month, and a record of each request for 48 hours: its ID, a one-way fingerprint of what was sent, whether it worked and what it cost. These records contain no photo, note or estimate and expire automatically.

What Google keeps: Google processes the photo, amount and note under its Gemini API terms. For paid use of the API, Google states that it does not use them to improve its products, but logs them for a limited period (currently 55 days) to detect misuse. Cloudflare and Google may process this information outside your country.

Accuracy: an estimate is a guess from a photo and can be wrong, especially for oils, sauces and fillings that can't be seen. Check and edit each food before you add it.

Who can use it: approved accounts, which are given to adults only, as Google's terms require. Guests can't use it. Taking a photo requires camera permission; the original stays in your photo library, and temporary copies on your device may remain until cleared.

05Storage and security

Account data is stored in Firebase. The phone keeps a local copy and pending changes for offline use, and the PC/web app keeps the same in your browser's storage. If you use MythCal as a guest, without an account, your diary stays on your phone and is never sent to us. Firebase connections are encrypted in transit, and access rules restrict ordinary members to their own records. Administrators have privileged access. This is not end-to-end encryption.

Phone files use the app's private storage. MythCal does not separately encrypt local files, so protect your device and browser account. Signing out removes the downloaded phone copy, but drafts and pending changes you choose to keep can remain. Clear the app's storage or browser data to remove those local copies.

Google processes Firebase Authentication data in the United States. Other processing locations depend on the service and provider, and may be outside your country. See Firebase's privacy and security information, including its data-protection terms.

06How long data is kept

Your plan sets how long diary entries are kept: 15 days on Free and 30 days on Plus. Once a day the app removes older days for good. Before it does, it keeps each day's totals for your trends (up to 90 days) and whether you met your goals that day (for streaks and badges). If Plus ends, the extra days are kept for 7 more days first. Weigh-ins are kept as your weight history until you delete them in the app or ask for deletion.

Account details, profile settings, goals, custom foods, favourites, saved meals and recipes are separate from diary history and remain until you remove them or request deletion. Support correspondence is kept for handling your request and any necessary legal obligations. A problem report is deleted once the problem has been dealt with.

A sign-up request is kept while it waits and, once you are let in, as the record of how you joined; a turned-down request is kept until you delete it in the app or ask us to. Sign-ins that never confirmed their email may be removed once they are a week old. Used invitation codes are kept, so members can see who joined with their codes; unused ones stop working after 12 hours.

Deleting an entry inside the app moves it into Recently deleted for 24 hours so you can restore it; after that, the app removes it for good.

Owner backups: None for this version. Meticulous Labs does not make owner-managed backups or retain owner backup copies of permanently deleted records. Permanent deletion removes records from our active storage rather than keeping them available for restoration. Google's service retention and copies held on devices or in exports are separate, as described here.

Google's separate service retention applies after we request deletion: Firebase documents authentication IP logs being kept for a few weeks, and remaining authentication data being removed from live and backup systems within 180 days of account deletion. See Firebase's retention information.

07Request account or data deletion

You can request deletion without opening the app:

  1. Email hello@mythcal.com with the subject MythCal account deletion.
  2. Include the email you sign in with (or your old MythCal username) and say whether you want your entire account or particular records deleted. Do not send your password.
  3. We may ask for reasonable confirmation that the account belongs to you, then process the request and confirm the outcome, including any necessary retention.

Until you are let in, you can delete your own sign-up (its request and its login) from the app. Account deletion covers the login account, profile, diary, weigh-ins, saved foods, meals, recipes, problem reports and your sign-up request; invitation codes you made that nobody used are removed, and a code you joined with keeps only that someone joined, not who. Disabling an account is not deletion. Device copies and CSV exports already held by you or recipients may remain; clear them separately, including on devices that have been offline.

08Your choices and privacy requests

You can edit your entries and profile, export diary records as CSV, skip optional measurements and control camera permission in device settings.

Contact us to request access, correction, deletion or other rights available under your local privacy law, including restrictions, objections or withdrawal of consent where applicable. You may also raise a concern with your local data-protection authority. Withdrawing permission or consent may prevent the related feature from working.

09Age and children's information

MythCal's first release is intended for people aged 13 and over. It is not intended for children under 13, and we do not knowingly collect their personal information.

Contact us if you believe a child under 13 has an account, so we can investigate and arrange removal. Any additional protections required for teenage users still apply.

Photo estimates are only for people aged 18 and over.

10Changes to this policy

We will update this page and its date when our data practices change. Material changes will be brought to users' attention, and any consent required for a new use will be obtained before that use begins.

This page uses no analytics scripts, tracking cookies or forms. Its print button works on your device without sending your diary or policy-reading activity to us.