Ojas — Privacy Policy

App: Ojas AI Calorie Tracker ("Ojas")
Publisher: Gulladurthi Hari Priya, trading as Su Labs ("Su Labs", "we", "us")
Registered address: 1/118, Malepadu, Cuddapah, Andhra Pradesh 516360, India
Contact: sulabsstudio@gmail.com
Grievance Officer (India, DPDP Act 2023): Gulladurthi Hari Priya — sulabsstudio@gmail.com — +91 90149 52484
Effective date: 26 August 2026 · Last updated: 26 August 2026 · Version: 1.0

Status: publisher identity, contact details and pricing completed 26 August 2026. ⚠️ NOT REVIEWED BY A LAWYER, and that matters more for a worldwide listing than it would for an India-only one — Ojas ships globally from day one, so GDPR and UK GDPR apply to EU/UK users and CCPA/CPRA to California, on top of the DPDP Act. A food diary combined with Health Connect readings is arguably health data, which GDPR Article 9 treats as a special category with a higher consent bar, and Article 27 can require an EU representative for a controller established outside the EU. None of that has been assessed by counsel. Reviewed against the DPDP Act 2023, Google Play's Data Safety and Health Connect policies, and — if you list outside India — GDPR/UK GDPR and CCPA. This text describes Ojas's actual behaviour as implemented in code on 16 August 2026; §16 records exactly what was audited so a reviewer can verify each claim against the source.

1. The short version


Your food diary, weight and profile	Live on your phone. A private, compressed backup is also stored against your account so a lost phone doesn't cost you your history.
What leaves your phone	Meal text, dish names and your day's totals (to generate coaching); food photos (to identify the food); barcode numbers; a monthly summary of numbers. Each is described field-by-field in §5.
Who else processes it	Anthropic (the AI that writes the text and reads the photos) and Google Firebase (accounts and storage, Mumbai region). Nobody else.
Photos	Sent for identification, never stored by us — not in any database, not in any file store.
Health Connect activity	Read live, shown on screen, never sent anywhere and never included in your backup.
Advertising & tracking	None. No ad SDKs, no analytics SDKs, no third-party trackers, no profiling for advertising.
Selling data	Never. Not sold, not rented, not shared for anyone else's marketing.
AI training	Your data is not used to train AI models.
Deleting	Delete account in Profile → Help & account erases your cloud backup, your account and everything on the device.

This summary is for orientation only. The sections below are the actual terms.

2. Who we are

Ojas is an Indian calorie and macro tracker published by Gulladurthi Hari Priya (Su Labs), Cuddapah, India. For the purposes of the Digital Personal Data Protection Act, 2023 (DPDP Act) we are the Data Fiduciary for the personal data described here. For the GDPR, where it applies, we are the controller.

Questions, requests and complaints: sulabsstudio@gmail.com.

3. The data we handle, in full

We collect nothing about you that you did not enter, capture, or explicitly connect. There is no background collection, no contact-list access, no location access, no advertising identifier, and no cross-app tracking.

3.1 Account and identity

Data	Where it comes from	Why
An anonymous account identifier (uid) created when you first open the app, before you sign in	Generated by Firebase Authentication	Gives your data an owner from the first launch, so nothing is stranded if sign-in happens later
Google account identifier, display name and email address	Google Sign-In, when you sign in (required to use the app)	Identifies your account so your backup can be restored on a new phone
Firebase Authentication's own sign-in records — IP address, timestamps, device/user-agent information	Collected by Google Firebase when you sign in	Account security and abuse prevention, by Google as our processor
Data-owner marker — the uid that owns the data currently on this device	Written by the app locally	Stops a second Google account signing in on the same phone from inheriting the previous person's health record

Signing in links Google to the anonymous account already created; it does not create a second one.

3.2 A per-installation identifier

The app generates a random 32-character installation ID on first use and stores it on the device. It is sent with every AI request so we can attribute API costs to an installation and detect abnormal usage (see §5.6). It is not your account, not your Google ID, and not a device or advertising identifier. It is cleared and regenerated if you delete your account or reinstall.

3.3 Health and dietary data you enter

Under the DPDP Act this is personal data; under the GDPR most of it is special category (health) data. We treat all of it as sensitive.

Body profile: name (optional), age, sex, height, weight, activity level.
Goals: calorie and macro targets, target weight, goal history (each change, with the date it took effect), and your look-and-feel/body goals (hair, skin, energy, weight loss, weight gain).
Life stage: whether you have told the app you are pregnant or breastfeeding, which raises your daily target.
Allergies and diet: declared allergies/intolerances, vegetarian / eggetarian / non-vegetarian preference, lactose-free preference.
Consent record: a timestamped record that you accepted the health-goal disclaimer, kept so we can show what you agreed to and when.
Food diary: every entry — food name, emoji, meal slot, portion, calories, protein, carbs, fat, and the date.
Weight history: each weight you record, with its date.
Derived and learned local data: your custom foods, your own dish vocabulary (the words you use for dishes — e.g. logging dal as "pappu"), typical portion sizes you use, scan-correction labels (what the photo scanner read versus what you said it was), foods you searched for that we didn't have, streaks and earned seals.
Subscription state: trial start date and status.

3.4 Photos of food

When you scan a meal or a package label, the photo is captured (or picked from your gallery), downscaled by the app, and sent for identification. See §5.3 for exactly what happens to it — including the fact that we never store it.

3.5 Meal descriptions you type

Free text such as "3 idli with sambar and a glass of buttermilk" is sent to be parsed into items and nutrition. Whatever you type in that field is sent as written, so please don't type anything there you wouldn't want processed.

3.6 Barcodes

Scanning a packaged product sends the barcode number only to Open Food Facts. No account, profile or diary data accompanies it. Open Food Facts will see the request's IP address, as any web service does.

3.7 Activity from Health Connect (Android, optional)

Only if you tap Connect and grant permission. Covered in full in §7.

3.8 Technical and cost telemetry

Every AI request writes one operational record containing: the installation ID (§3.2), which feature was used, which AI model, the date, input/output token counts, the computed cost, server processing time, and whether the server had to cold-start. Photo scans additionally record whether a correction was requested and how many hint items were sent — counts only. These records are deleted after 90 days (§11).

These records never contain your food, your photo, your text, your name or your account. They exist so we can see what the service costs to run and spot abuse.

3.9 Server logs

Our backend and Google Cloud keep short-lived operational logs (errors, request metadata, IP addresses). One warning log — an oversized backup — records your account uid. We don't use logs for analytics or profiling.

3.10 What we do not collect

No location, contacts, calendar, microphone, call or SMS data. No advertising ID. No device fingerprinting. No analytics SDK, no crash-reporting SDK, no attribution or marketing SDK — the app ships with none of them. No third-party cookies (there is no web app). We do not buy or receive personal data about you from data brokers or any other source.

4. Where your data is stored

Store	What's in it	Location
Your device	Everything in §3.3, plus your settings and learned local data. Held in the app's private storage (an encrypted-at-rest SQLite database and preferences file that only Ojas can read).	Your phone
Your account backup — Firestore `user_backups/{your uid}`	One compressed blob containing your entire local state (§3.3), plus its size, a diary-entry count and the last-updated time.	asia-south1 (Mumbai)
Anonymous food contributions — Firestore `contributions` and `verified_foods`	See §6. No identifier of any kind.	asia-south1 (Mumbai)
Cost telemetry — Firestore `usage`	§3.8. Installation ID only.	asia-south1 (Mumbai)
Account records	Your uid, Google identifier, name, email, sign-in metadata, held by Firebase Authentication.	Google infrastructure, which for authentication may be outside India (see §12)
AI processing	Transient — the request content is processed by Anthropic to produce the response.	See §10

Android's own automatic backup is switched off. By default Android copies an app's data to your Google Drive; we have disabled that (allowBackup="false" plus explicit extraction rules) so your health data is not silently duplicated somewhere you were never told about. Direct phone-to-phone transfer during new-device setup remains enabled, because that copies between your own devices and never touches a third party's servers.

5. Every transfer, feature by feature

This is the complete list of things the app sends off your device. If a feature isn't here, it doesn't transmit.

5.1 Daily and weekly coaching

Sent to: our backend (Google Cloud Functions, Mumbai) → Anthropic (Claude Haiku 4.5).
Contents: the day or week under review — your calorie/macro targets and totals; each logged meal with food names, portions and macros; which meal slots have no entry; a list of food names per day for the recent week; the week's averages and extremes; a short history of previous days' totals; the app's own computed summary and detected patterns; which past suggestions you acted on or ignored; and a minimal profile of goal direction, diet preference and lactose-free flag.
Not sent: your name, email, uid, age, sex, height, exact weight, target weight, allergies, pregnancy/breastfeeding status, or photos.
Purpose: to write the coaching text. Every number shown is calculated on your device; the AI only phrases it.

5.2 Estimating a dish or a typed meal

Sent to: our backend → Anthropic (Claude Haiku 4.5).
Contents: the dish name or the meal text you typed, the portion, your diet preference, and — for typed meals — a short list of dish names you have logged before, so your own vocabulary is understood.
Not sent: anything else about you.

5.3 Photo scan of a meal or label

Sent to: our backend → Anthropic (Claude Sonnet 5).
Contents: the downscaled image; your diet preference; a short list of dishes you've logged before; the scanner's own past mistakes on this device (pairs of "read as X, was actually Y"); and, if you correct a result, the correction so the same photo can be re-read.
Storage: the image is held in memory only for the duration of the request. It is never written to our database or any file storage, and we keep no copy of it. On your phone, the camera or gallery leaves a temporary copy in the app's private cache, which Android clears; the photo is not attached to your diary entry or included in your backup.

5.4 Barcode lookup

Sent to: Open Food Facts (open database, ODbL licence).
Contents: the barcode number.
If the barcode isn't found, we offer to read the printed label from a photo instead — that path is §5.3.

5.5 Monthly report note

Sent to: our backend → Anthropic (Claude Sonnet 5), once per month.
Contents: the finished month's summary numbers — days logged, average calories and protein, your targets, on-goal days, longest streak, best day's date, weight change over the month, the names of the foods you logged most, a comparison against the previous month, and your goal direction and diet.
Not sent: your diary itself. Every number in the report is computed on your device; the AI writes only the closing note.

5.6 Cost telemetry

Sent to: our own backend, with every request in §5.1–5.5.
Contents: §3.8.

5.7 Account backup

Sent to: our backend → Firestore, Mumbai.
Contents: one compressed copy of everything in §3.3.
When: automatically, at most once every 20 hours, when you leave the app, and only while signed in — or immediately if you tap back up now.
Who can read it: it is stored compressed and our backend reads nothing inside it except the number of diary entries, so the restore screen can tell you what you're about to replace.
Restoring replaces whatever is on that device.

5.8 Anonymous food contributions

See §6.

6. Anonymous contributions and how Ojas learns

When you log a food that the AI estimated, the app sends a record to our backend containing: the dish name, the AI's estimate, the amount you actually logged, your diet preference, the category, the confidence, and whether you edited the numbers.

This record carries no account, no uid, no installation ID, no device identifier and no timestamp of your session — only the server's write time. It cannot be linked back to you by us or by anyone else.

Each night these are grouped by dish and rolled up into crowd-verified estimates that everyone's app then uses, so common dishes get more accurate and cheaper to look up over time. This is the mechanism by which the app improves.

Because these records carry no identifier, they cannot be traced to you and therefore cannot be individually retrieved or withdrawn. Deleting your account does not remove them, because there is nothing in them that says they were yours. If you would prefer not to contribute at all, do not log AI-estimated foods, or contact us and we will discuss options. [If a consent toggle is added, document it here.]

Correction labels from the photo scanner (§3.3) stay on your device and are not part of this pipeline.

7. Health Connect (Android) — special disclosure

If you tap Connect on the Activity card, Ojas requests read-only access through Android Health Connect to:

Steps
Active calories burned
Total calories burned (only because Samsung Health writes total rather than active; we derive the active part from it)
Exercise sessions (for duration)

We use this solely to display your activity on the Home and Insights screens and to suggest — never automatically apply — a calorie target that matches your real activity.

This data is:

read-only — Ojas never writes to Health Connect;
never transmitted to our servers or to Anthropic or any other third party;
never persisted by Ojas — it is read live each time a screen needs it and held only in memory;
not included in your account backup or in any export.

You can revoke access at any time in Health Connect → App permissions → Ojas. Revoking it removes the Activity card's data immediately and affects nothing else.

We do not use Health Connect data for advertising, for any purpose other than those stated above, and we do not transfer it to any third party. We do not share it with data brokers, information-resellers, or for any determination of credit, insurance or employment.

8. Permissions the app asks for, and why

Permission	Why	Optional?
Internet	AI features, backup, barcode lookup	Required
Camera	Scanning barcodes and photographing meals	Yes — only asked when you use the scanner
Photos / media (gallery)	Choosing an existing photo of a meal	Yes — only when you pick from gallery
Notifications	Local meal reminders you schedule	Yes
Run at boot	Re-arms your reminders after a restart	Tied to notifications
Alarms & reminders	Lets a reminder arrive at the time it names. Without it Android may deliver an 8pm reminder hours later.	Yes — reminders still work without it, just imprecisely
Physical activity / Health Connect	Steps and activity for the Activity card	Yes — off unless you connect it

Reminders are scheduled on your device by Android. There is no push notification service; we cannot send you a message and we do not know whether a reminder was shown.

9. Accuracy — what Ojas knows, and what it doesn't

We consider this a privacy matter as much as a product one: you should know how reliable the numbers about your own body are.

AI estimates are estimates. When a dish isn't in our database, the nutrition figures are a model's best reconstruction from a typical recipe and portion — not a laboratory measurement. They are labelled as estimates in the app, carry a stated confidence, and are editable before you log them. Real dishes vary enormously with oil, ratio and portion.

Photo identification can be wrong. The scanner misreads unfamiliar dishes, and we ask you to confirm or correct what it saw. We measure how often it is right using your corrections, kept on your device — and we treat that figure as a floor, not a score, because people correct obvious errors and let subtle ones pass.

Packaged-food data is crowd-sourced. Barcode results come from Open Food Facts, which is entered by volunteers. The same product can appear with different numbers. We pick the most complete record and show its source, but we cannot guarantee it matches the pack in your hand. Check the label.

Numbers are computed on your device; the AI only writes. Averages, streaks, totals and the monthly report's figures are calculated by the app itself. The model is given the finished numbers and is instructed never to compute new ones or to state a measurement it wasn't given.

We do not fabricate what we don't measure. Our food data carries calories, protein, carbs and fat, plus fibre, calcium, iron and sodium where they can be grounded. The app will say "not enough data" rather than invent a figure, and never reports vitamins or nutrients it has no source for.

Logging is not eating. A day with no entries means it wasn't logged. The app is explicitly built never to conclude that you skipped a meal or ate too little from an absence of data.

Activity figures come from your phone or wearable, not from us, and are only as accurate as the device that recorded them.

Ojas is not a medical device and does not provide medical advice. Nothing in the app — including the calorie targets, the pregnancy/breastfeeding adjustment, the wellness goals and the coaching text — is a diagnosis, a treatment, or a substitute for a qualified doctor or dietitian. If you have a medical condition, are pregnant or breastfeeding, or are considering a significant dietary change, consult a professional. Do not use the app to restrict intake below what your clinician advises.

10. Who else processes your data

Processor	What they receive	Where	Their terms
Anthropic PBC (Claude)	The request contents in §5.1–5.5, including food photos and meal text	Anthropic's infrastructure	Processes API content to return a response; does not use it to train models. Content may be retained for a limited period for safety and abuse-prevention purposes under Anthropic's published policy. See anthropic.com/legal
Google — Firebase Authentication	Your Google account identifier, name, email, sign-in metadata and IP	Google infrastructure (may be outside India)	firebase.google.com/support/privacy
Google — Cloud Functions & Firestore	Your account backup, anonymous contributions, cost telemetry, request logs	asia-south1 (Mumbai)	firebase.google.com/support/privacy
Google Play	Purchase and subscription processing, if you subscribe	Google	play.google.com/about/play-terms
Open Food Facts	Barcode numbers you scan, and your IP	Open Food Facts servers	openfoodfacts.org — data under ODbL

We do not use any other processor. We have no advertising, analytics, attribution or A/B-testing vendor.

Payments. If and when subscriptions are sold, purchases are processed by Google Play. We never receive or store your card, UPI or bank details — we receive only the fact that a subscription is active.

11. How long we keep things

Data	Retention
Everything on your device	Until you delete it, delete your account, clear the app's storage, or uninstall
Account backup	For as long as your account exists. Each backup replaces the last — we keep the current one, not a history. Deleted with your account. Logging out does not delete it; that is what lets you come back.
Account record (uid, Google identity)	Until you delete your account
Cost telemetry	90 days. Records older than that are deleted automatically every night.
Anonymous contributions and verified foods	Retained indefinitely as part of the community food database. They carry no identifier and are not linked to you (§6).
Server logs	Short-lived, per Google Cloud's default log retention

12. International transfers

Our backend, your backup and all contributions are held in Google's asia-south1 (Mumbai) region. Two exceptions:

Firebase Authentication stores account records on Google's global infrastructure, which may be outside India.
AI processing by Anthropic happens on Anthropic's infrastructure, which is outside India.

Both are transfers to processors acting on our instructions, under their respective data-processing terms. [If you distribute in the EU/UK: state the transfer mechanism — SCCs — here after confirming it with counsel.]

13. Your rights and how to use them

Under the DPDP Act 2023 (and, where it applies, the GDPR) you have the rights below. Most are exercisable inside the app immediately; for the rest, write to sulabsstudio@gmail.com and we will respond within [30] days.

Right	How
Access / a copy of your data	Profile → Help & account → Backup & restore → Full backup (JSON) or CSV. This is a complete machine-readable export of everything the app holds about you.
Correction	Edit any entry, goal or profile field in the app.
Erasure	Profile → Help & account → Delete account. This deletes your cloud backup first, then your account, then wipes the local database and all settings on the device. It is irreversible. (Anonymous contributions are unaffected — see §6.)
Withdraw consent	Disconnect Health Connect; turn off reminders; stop using AI features; or delete your account entirely.
Portability	The JSON export is complete and re-importable.
Grievance redressal	Gulladurthi Hari Priya, sulabsstudio@gmail.com — the escalation route required by the DPDP Act.
Nominate someone (DPDP)	Write to us to nominate a person who may exercise your rights if you die or become incapacitated.
Complain to a regulator	To the Data Protection Board of India, or your local supervisory authority.

If you sign in on a phone that already holds another account's data, the app detects the mismatch and does not merge the two records.

14. Security

All network traffic uses HTTPS.
Your backup is stored compressed, and our backend never reads inside it except to count diary entries.
Backend endpoints are access-controlled, and the AI provider's API key exists only on the server — never in the app.
On-device data sits in the app's private sandbox, protected by Android's own app isolation and device encryption. Ojas does not add a separate passcode.
Android's automatic cloud backup is disabled (§4).
Deleting your account removes the cloud copy before the account itself, so your data cannot outlive the account that consented to it.

No system is perfectly secure and we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the Data Protection Board of India as the DPDP Act requires.

15. Children

Ojas is not directed to children under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

16. What was audited, and what is still open

This section is for our own record and for reviewers; it is published for transparency. It is not a term of the policy.

Verified against the source on 16 August 2026: the Flutter client (lib/), the backend (functions/src/index.ts, 2,152 lines) and the Android manifest.

Confirmed by code: the five AI endpoints and their exact payloads (dailyInsight, estimateFood, estimateMeal, scanFood, monthlyNote); no image is written to any store; contributions carries no identifier and the installation-ID header is not sent on that call; usage telemetry carries no food content; Health Connect data is read through a short-lived provider, never persisted and never in the backup payload; Android auto-backup is disabled in both the modern and legacy rule files; account deletion removes the cloud backup before the account; the app bundles no analytics, crash-reporting or advertising SDK.

Open items before this is published:

~~Fill every placeholder, including the Grievance Officer.~~ Done (26 August 2026). The DPDP Act requires a Grievance Officer to be named and reachable; Gulladurthi Hari Priya is named, with an email and a phone number that both work. ⚠️ privacy@sulabs.in was NOT used — the domain has no MX records, so mail to it bounces.
~~Set a retention limit on the usage collection.~~ Done — 90 days, enforced nightly by the pruneUsage scheduled function.
Children: decide the age line and whether the DPDP Act's parental-consent requirement is met. It is not implemented today.
Consent for contributions (§6): confirm with counsel whether an opt-out or opt-in toggle is needed, and build it if so.
Confirm and cite Anthropic's current API retention terms rather than describing them generally.
Host this at a public URL and link it from the Play listing, the Health Connect permissions screen (the manifest already declares that activity), and Profile → Help & account.
Payments (§10) are described for Google Play Billing; billing is stubbed in the app today and must be live before that paragraph is accurate.
Backend endpoint authentication is being strengthened before public launch (tracked in the compliance register).
Publish a matching Terms & Conditions and a Play Data Safety form consistent with this document.

17. Changes to this policy

If we change how we handle your data we will update this document, change the "Last updated" date, and — for anything material — tell you in the app before the change takes effect.

18. Contact

Gulladurthi Hari Priya (Su Labs), 1/118, Malepadu, Cuddapah, Andhra Pradesh 516360, India — sulabsstudio@gmail.com Grievance Officer: Gulladurthi Hari Priya, sulabsstudio@gmail.com