Privacybeleid

This privacy policy explains how Talorie handles personal data when you use talorie.app. Talorie is the controller for the processing described below. You can contact us at info@talorie.app.

1. Information we collect

• Account information: your name, email address, password hash, email-verification status, Google account identifier if you use Google sign-in, and authentication session data.
• Profile and nutrition information: measurement and language preferences, calorie, macro and micronutrient targets, food diary entries, quantities, dates and meals.
• Content and community activity: products, nutritional values, barcodes, photographs, dishes, ratings, stars, club memberships and sharing preferences.
• Communications: messages or privacy requests you send us and operational emails sent to your account.
• Technical information: information necessary to secure and operate the service, such as request times, IP addresses, device or browser information, error records and security logs.

2. How we receive information

Most information comes directly from you. Product information can also originate from previously imported public food datasets. Talorie does not perform live searches against an external food database. Google supplies the limited profile information needed for Google sign-in. Club members provide their own names, dishes and tracking activity.

3. Why and on what basis we process data

• Provide the service and perform our agreement: create your account, authenticate you, calculate nutrition, save your diary and dishes, convert units, operate clubs and provide requested account emails.
• Legitimate interests: secure Talorie, diagnose failures, prevent fraud and abuse, moderate community product records, and understand service reliability. We balance these interests against your rights.
• Consent: where you actively choose optional sharing or another feature for which consent is required. You can withdraw consent through the relevant setting or by contacting us.
• Legal obligations: retain or disclose information where applicable law requires it and respond to valid legal requests.

4. Food diaries and health-related information

A food diary and nutrition targets can reveal information about health or lifestyle. Talorie uses this information only to provide the features you request. Do not place medical diagnoses or other unnecessary sensitive personal information in product or dish names. Club sharing is off unless enabled in your profile; if enabled, the information described by that setting becomes visible to members of clubs you join.

5. Label scanning and automated processing

When you choose label scanning, the photographs you select are sent to Google Gemini to extract a barcode and nutritional values. Talorie uses the response to pre-fill a product record for your review. Automated extraction can be inaccurate, does not make decisions with legal or similarly significant effects, and should be checked against the package before saving.

Google processes these images and related prompts to provide the Gemini service. Google states that content sent through eligible paid services is not used to improve its products, although limited logging can occur for abuse monitoring and legal compliance. See the Gemini API terms.

6. Google sign-in

If you choose Google sign-in, Talorie receives your Google account identifier, verified email address and name. We use these only to create, connect and access your Talorie account. Talorie does not request access to Google Drive, Gmail, contacts or calendars. Google's own processing is described in the Google privacy policy.

7. Shared products, dishes and clubs

Products you contribute, including their barcode, nutritional information and product image, are placed in Talorie's global food database and may be visible to other users. Your account identity is not displayed with the product. Community ratings help moderate accuracy; a poorly rated record may become visible only to its creator.

Dishes and diary activity are shared with club members only according to your profile sharing settings. Information already seen or copied by another club member cannot necessarily be recalled after you disable sharing or leave a club.

8. Service providers and recipients

• Amazon Web Services: application hosting, networking, database infrastructure and transactional email delivery.
• Google: Google Identity Services for optional sign-in, Gemini for label extraction when requested, and Google Analytics for visit statistics once you have agreed to it.
• Club members and other users: only the community or club information described above.
• Authorities or advisers: where reasonably necessary to comply with law, protect rights, investigate abuse or establish legal claims.

We do not sell personal data and do not use it for third-party behavioural advertising.

9. Cookies and analytics

Talorie stores a small amount of information in your browser to work at all: a sign-in token so you stay signed in, and your language and measurement preferences. These are necessary for the service and are not used to follow you.

For statistics we use Google Analytics 4, which counts visits and tells us which pages are read. It places its own cookies and passes your shortened IP address and browsing behaviour on this site to Google. This happens only after you agree: analytics stays switched off until you accept it in the banner, and declining leaves the site fully usable.

Addresses that carry a secret, such as an invitation or a password-reset link, are shortened before they are reported, so a key never leaves this site. Your food diary, your products and your dishes are never sent to Google Analytics.

You can change your mind at any time by clearing this site's cookies in your browser, after which the question is asked again.

10. International transfers

Some providers may process information outside the European Economic Area. Where required, transfers are protected through an adequacy decision, approved contractual safeguards such as the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism.

11. Retention

Account, profile, diary, dish and club information is generally kept while your account remains active. Authentication, security and transactional-email logs are retained only as long as reasonably necessary for security, troubleshooting and legal obligations. Account recovery and verification tokens expire automatically.

When an account is deleted, personal account data will be deleted or anonymised unless retention is legally required. Product facts contributed to the shared database may remain in anonymised form so the community database continues to work. Backup copies are removed through the ordinary backup cycle.

12. Security

We use technical and organisational safeguards appropriate to the service, including encrypted network connections, restricted infrastructure access, password hashing and isolated production resources. No internet service can guarantee absolute security. Contact us promptly if you believe your account has been compromised.

13. Your privacy rights

Depending on applicable law, you may ask us to:

• provide access to and a copy of your personal data;
• correct inaccurate or incomplete information;
• delete your information;
• restrict or object to processing;
• provide information you supplied in a portable format; or
• withdraw consent without affecting processing that occurred before withdrawal.

Email info@talorie.app to exercise a right. We may request information necessary to verify your identity and normally respond within one month. You may also lodge a complaint with your local data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens.

14. Children

Talorie is not directed to children and you must be at least 18 years old to create an account or use label scanning. If you believe a child has supplied personal data, contact us so we can investigate and remove it where appropriate.

15. Changes to this policy

We may update this policy as Talorie changes. We will publish the revised version here, change the “last updated” date and provide additional notice when a change materially affects your rights or how we use personal data.