Privacy Policy

This is an English translation provided for convenience. The Lithuanian version is the legally binding original; in case of any discrepancy, the Lithuanian text prevails.

1. Who we are

LazyCal is a calorie and nutrition tracking service available at lazycal.lt. "LazyCal" is a brand and service operated by LAZYFIT, MB. This privacy policy explains how LAZYFIT, MB collects, uses and protects information about you when you use our service.

By using LazyCal you confirm that you have read and agree to this privacy policy. If you do not agree, please do not use the service.

Data controller — LAZYFIT, MB, legal entity code 306635319, registered address Gelvonų g. 5-51, LT-07140 Vilnius, Lithuania, email info@lazycal.lt. "LazyCal" is a brand and service operated by LAZYFIT, MB.

2. What data we collect

We only collect data you enter yourself or that is necessary for the service to function. Full list below.

Account data

• Email address — for registration, sign-in and communication.
• Password — stored only as a secure cryptographic hash (never in plain text); handled by our authentication provider, Supabase.
• Name — shown in your profile (optional).
• Profile photo — if you upload one, it is stored in your account (our database) so it appears on all your devices. You can change or remove it at any time.
• Marketing consent — whether you agreed to receive emails (unchecked by default; you can withdraw consent at any time).

Health and body data (sensitive category)

This data falls under the special categories in GDPR Art. 9. We process it only on the basis of your explicit consent (by entering it, you consent to us storing it so we can provide the service):

• Weight, height, age, sex, activity level, goal (lose/maintain/gain weight).
• Calorie and macronutrient (protein, carbs, fat) targets.
• Weight history over time.
• Body measurements (e.g. waist, chest, hips, etc.), if you track them.
• Water intake and step/activity logs, if you enter them.

Nutrition data

• Logged meals and foods, their quantities, calories and macronutrients; daily entries and history.
• Foods and recipes you create, favorited foods.
• Product prices you enter and shopping basket lists (if you use these features).
• Food photos and barcodes — processed for recognition (see section 4 on AI); photos themselves are not stored long-term.

Technical and usage data

• IP address — only for error diagnostics, rate limiting and abuse protection.
• Browser/device type, event logs (e.g. "app opened", "search used") and error reports — so we can see what works and what to fix.
• Bug reports you submit (if any), with technical context.
• Push notification token — only if you enable reminders.

Data we do NOT collect

• Payment card data — we do not process or store it.
• Precise GPS coordinates.
• Contact lists or data from other apps.

3. How we use your data

We use your data only for the following purposes:

• Providing the service — showing nutrition logs, calculating calories, providing recommendations.
• Account management — authentication, password recovery.
• Notifications — a reminder system you request (you can opt out at any time).
• Service improvement — analyzing bug reports, improving functionality.
• Security — detecting abuse and protecting accounts.

We do not use your data for advertising or behavioral profiling for profit.

4. Artificial intelligence (AI)

Some features use artificial intelligence. We want you to know exactly what is sent and where:

• Food recognition from photos. When you photograph food, the photo is sent to Google (Gemini API) to recognize the product and estimate calories. The photo is processed for recognition and is not stored long-term in our systems.
• AI coach. To generate weekly advice we send Google (Gemini API) only numbers (e.g. average calories, target, streak, weight/measurement change). We do not send your name, email or meal names.

Google processes this data as our service provider for the purpose of recognition/generating a response. AI estimates are approximate and do not constitute medical advice. These features are opt-in — if you do not photograph food or use the coach, this data is not sent to AI.

5. Sharing with third parties

We do not sell or rent your personal data. Data may only be shared with the following service providers (data processors) acting on our instructions:

• Supabase (database and authentication) — stores your account, nutrition, health and body data. GDPR-compliant.
• Google (Gemini API) — for AI processing: food photo recognition and AI coach advice (see section 4).
• Resend (email delivery) — for transactional and (if you consented) marketing emails.
• Vercel (hosting service).
• Google Sign-In — only if you choose to sign in with Google (see section 7).

All service providers are obligated to use data only to provide our service and to comply with GDPR requirements.

Exception: we may disclose data if required by applicable law or binding orders from law enforcement authorities.

6. Data storage and protection

• Data is stored while you use the service, and for 30 days after account deletion.
• Data in transit is encrypted (TLS/HTTPS).
• Passwords are never stored in plain text — a secure hash is used.
• Access to the database is restricted and monitored.

7. Signing in with Google

If you choose to sign in with Google, we only receive:

• Your first and last name (shown in your profile).
• Email address (used to identify your account).
• Profile photo (optional).

We do not have access to your Google emails, contacts, calendar or other Google service data.

8. Cookies and local storage

• Authentication cookies — necessary for sign-in and maintaining your session.
• Local storage (localStorage) — settings and profile are stored on your device.

We do not use third-party tracking cookies, advertising pixels, or analytics tools that collect your data across other websites.

9. Children's privacy

LazyCal is not intended for individuals under 16 years of age. We do not knowingly collect data from children. If you believe a child has created an account, please notify us and we will delete it.

10. Your rights under GDPR

As an EU resident, you have the following rights:

• Right of access — you can request a copy of all data we hold about you.
• Right to rectification — you can request correction of inaccurate data.
• Right to erasure ("right to be forgotten") — you can request deletion of your account and data.
• Right to restrict processing — you can request that we temporarily stop processing your data.
• Right to data portability — you can request your data in a machine-readable format (available directly in-app: Settings → Account → Export data).
• Right to object — you can object to data processing for direct marketing purposes.

To exercise any of these rights, write to: info@lazycal.lt. We will respond within 30 days.

You also have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt), or your local EU data protection authority.

11. Changes to this policy

We will notify you of material changes to this privacy policy by email or in-app notification at least 14 days before they take effect. Continued use of the service after changes take effect constitutes acceptance of the new policy.

12. Contact