Privacy Policy

Last updated: July 06, 2026

This is a good-faith summary of how CarboData collects, uses, and protects your data. It has not been reviewed by a lawyer and is provided for transparency, not as a substitute for formal legal advice.

What we collect

• Account information: email, profile name, encrypted password.
• Profile photo, if you upload one (stored with Cloudinary).
• Content you create: posts, comments, votes, recipes, and ingredient/item entries (including glycemic index and carbohydrate ratios you enter).
• Chat messages you send to the recipe assistant, and the assistant's replies.
• Basic technical data Devise records for security purposes: sign-in timestamps and IP addresses, failed login attempts.

Why we process health-related data

Glycemic index, carbohydrate ratios, and recipe difficulty are dietary data you choose to enter to manage diabetes-friendly meals. Because this can reveal health-related information, we treat it as a special category of data and only process it with your explicit consent, given when you accept this policy at sign-up. You can remove this data at any time by deleting the related items, recipes, or your account.

Who else sees your data

• Cloudinary stores and serves uploaded photos.
• Chat messages are sent to a third-party AI provider to generate recipe suggestions.
• Heroku hosts the application and its database.

We do not sell your data, and we do not share it for advertising purposes.

How long we keep it

We keep your data for as long as your account exists. Deleting your account removes your posts, comments, recipes, items, and chats.

Your rights

You can access, correct, or export your data at any time from your profile settings. You can delete your account and associated content from your account settings page. If you'd like help with any of this, or have a question about your data, contact us at CarboData Support.