Privacy Policy for Lyn Calorie

1. What this policy covers

This policy covers the Lyn Calorie app and the Lyn account you use in it. It explains what information is processed, why, and where it ends up. The password generator and the website have their own policy.

2. Without an account

You can use Lyn Calorie without an account. Your diary, ingredients, meals and goals are then stored only on your phone, and none of it is sent to us. If your phone backs up to Google or iCloud, the app's data may be included.

3. Your account

With an account you can sync between devices, look up products in the product catalog and use logging and estimates with AI. We store:

• Your email address, your language, when the account was created, and your display name and country if you have chosen them
• Your password, only as a hash that cannot be turned back into the password, never in plain text
• For each sign-in: the time, the IP address, the browser or app, and the country, which we look up from the IP address on our own server

Every sign-in requires a code we send by email. The sign-in history is used to detect suspicious sign-ins and is kept as long as the account exists. When your password is changed or reset, we email you an alert with the time and the country, looked up from the IP address on our own server. The country is not stored. We only send you email about codes, password changes and resets, email changes and account deletion. If the account is used for abuse, for example of the catalog, we can ban it. We then store the time and the reason with the account, and the data stays until the account is deleted. A banned account cannot be deleted in the app, but you can ask for deletion by email as described under “Deletion”.

4. Sync

Sync is off until you turn it on after signing in, and it is turned off when you sign out. With sync turned on, your ingredients, meals, diary, goals and own photos are stored on our servers so you have them on your other devices. They are not used for anything else.

5. Your own photos

In Lyn Calorie you can take or choose your own photo of an ingredient or a meal, also with an estimate with AI (section 8).

• The photo is copied in without metadata, such as location and camera details, and stored on your phone
• If you are signed in and have turned on sync, the photo is uploaded so you can see it on your other devices. Without sync, it stays on your phone
• Uploaded photos are stored privately with UpCloud in Finland, in full size and as a small preview. Only you can retrieve them, through our server, and they have no public address
• You can have up to 500 photos in the cloud
• A photo you remove is deleted from your phone and from the cloud once no ingredient or meal uses it. If you delete all your data or your account, all your photos in the cloud are deleted right away. If you only delete the data on your phone, the photos in the cloud remain. Photos that no ingredient or meal uses are deleted automatically after 30 days

The photos are only used to show them to you.

6. The product catalog

The catalog is shared by all users. When you add a product, suggest a correction, report an error or submit a product photo, we store it together with your user ID and the time, so we can keep track of changes and stop abuse. Other users do not see who contributed, unless you have chosen a display name yourself.

• Product photos become public: anyone with the URL can see them. Location and other information in the image file are removed before the photo is saved
• When you submit a product photo, you confirm that you took it yourself and allow Lyn to show it in the catalog. If you want a photo removed, contact us
• A photo suggestion is private until an administrator approves it. If it is rejected or replaced, the photo is deleted
• Contributions stay in the catalog after the account is deleted, linked to an ID that no longer belongs to an account
• The display name is optional, and you have none until you choose one when you register or under Account in the app. If you have chosen one, other signed-in users see it on the products you have added and the photos you have taken (“Added by”, “Photo by”). You remove it by clearing the field, and it disappears when you delete your account. We may remove a name that is offensive or looks like an address. The basis is your consent
• When you add a price for a product, we store the price, the chain, the date you saw it and the time, together with your user id. Other users see the price, the chain and the date, never who added it. When you report a wrong price, we store that in the same way. Prices stay in the catalog after the account is deleted, like other contributions
• If you choose a country, it is stored on your account. The app uses it to show prices from stores in that country, and sends it along when it fetches prices. Other users do not see it, and the app does not use your location. You can remove the country at any time under Account
• Before your first contribution to the catalog, you accept the terms for the catalog. We store the time you accepted them on your account, and it is deleted together with the account

7. The camera

The camera is used to read barcodes and to take photos of products, ingredients, meals and food you want estimated, and only when you open it. Photos you choose from your phone are copied in without personal information from the image file, such as where and when the photo was taken.

8. Logging and estimates with AI

When you are signed in, you can type or say what you have eaten and get suggested entries for your diary, or take a photo of a dish and get an estimate of what it contains. Nothing is logged until you have approved the suggestion, and nothing is stored until you have saved the item. The suggestions and estimates are made by an AI service from Anthropic, which processes the information on our behalf.

• The features are off until you say yes to them. The app asks before you use them for the first time on a device, and you can withdraw your consent at any time with the switch in Settings, which covers both. Your consent applies to the device you gave it on: when you turn the switch off, nothing more is sent from that device
• For logging with AI, this is sent to Anthropic: the sentence you typed or said, the meal and date you have selected, today's date, and the name and unit of up to 150 of the items in your library, the ones you use most first
• For logging with AI, this is not sent to Anthropic: your email address, your user ID or anything else about your account, your diary, your goals or any audio. The sentence is sent as you wrote it, so write only about the food, not other information about yourself or your health
• For an estimate from a photo, the photo is sent, made smaller and without the information in the image file, such as where and when it was taken, together with your language and what you write or answer to improve the estimate. Your account, diary and goals are not sent. The photo is sent as it looks, so take a photo of the food, not of people or anything else you do not want to share
• We do not store or log the sentence, the item names, the photo, what you write and answer for the estimate, or the suggestions and estimates. We only store how many suggestions and estimates you have asked for and how much was sent and received, per day. We use this for the daily limit and to keep track of the cost, and it is deleted together with your account. The log has your user ID, how the request went and figures about it, and is deleted after 30 days
• If you save the item after an estimate, the photo becomes the item's own photo, like other own photos (section 5). You can remove it before you save
• Anthropic does not use the information to train AI models, and deletes it after 30 days. The exception is content their automated systems flag as a violation of their usage policy: it may be kept for up to two years, and the assessment itself for up to seven years. The information is stored in the United States and may be processed in other countries outside the EEA. The transfer is based on the EU standard contractual clauses, which are part of our data processing agreement with Anthropic
• The microphone is used only when you tap it, and the audio is never sent to us. Your speech is turned into text on the phone, and you see the text and can correct it before it is sent. If the phone cannot do this by itself, the phone's regular speech recognition is used, which sends the audio to its provider under their terms, as when you dictate elsewhere: usually Google on Android, Apple on iPhone, iPad and Mac, and Microsoft on Windows. On Android, it only happens on the phone when the language has been downloaded in the phone's settings. If you want to avoid this, you can type instead

9. Deletion

In the app you can:

• Delete the data on your phone, while the data in the cloud remains
• Delete the data in the cloud: synced data and own photos are deleted right away, and sync is turned off
• Delete your account: the data in the cloud and your own photos are deleted right away. If you sign in again within 90 days, you get the account back. After 90 days, the account and the sign-in history are deleted for good

If you no longer have the app, you can ask us to delete your account and data by writing to support@lynsoftware.com from the email address on the account.

If you have contributed to the catalog, or the account was banned, we keep your email address, the dates and your last IP address for three years after the account is deleted, so it can be traced if there is a legal claim. After that, this is deleted too. Deleted data may remain in encrypted database backups for up to 60 days. If the police order us to preserve data about a specific user, we take an encrypted copy of what exists at that time and keep it only for as long as the order applies. We hand over data only when the law requires it.

10. Security and abuse

To protect the service, the server processes your IP address and information about the app (version, platform and a random ID for the installation) for each request, for example to limit the number of attempts and stop attacks. When there is suspicious activity, we store the IP address, the app or browser, the country (looked up from the IP address on our own server), what was attempted and when, and the account when it is known, so the address can be blocked. The information about the activity is deleted after 90 days. A block (the IP address and the reason) is kept until it expires and deleted 90 days after that. Requests are logged (IP address, app or browser, the address without parameters and the response) and deleted after 30 days.

11. Legal basis

We process your account, sync, own photos and catalog contributions to provide the service you asked for. The sign-in history, security and the information about contributions and bans are based on our legitimate interest in protecting the service and being accountable for the catalog. The technical data from the scanner on Android is based on our legitimate interest in using a scanner that works well. The display name is based on your consent, which you withdraw by clearing the field. Logging and estimates with AI are based on your consent, which you withdraw with the switch in Settings on the device. Preserving data under a police order is based on a legal obligation.

12. Where information is processed

Our servers and database are hosted by UpCloud in Norway, and our files by UpCloud in Finland. Everything the app sends to our servers first passes through Bunny.net (Slovenia), which stops attacks and overload before they reach the servers. Bunny uses only servers in the EU, and sees your IP address and what the app sends, but does not store the content. Bunny logs the requests (your IP address shortened, app or browser, country, the address and the response), and requests that look like attacks with the full IP address. The logs are deleted after three days. Email is sent through an email provider in the EU (France). The suggestions and estimates with AI are made by Anthropic, which stores the information in the United States (section 8). On Android, the camera in the app uses a scanner from Google that reads barcodes, both when you scan and when you take a photo of a product or of your food. While the camera is open, the scanner sends technical data to Google: phone model and operating system, app version, an ID for the installation that is not meant to identify you or your phone, and how well the scan worked, including errors. The image and the barcode are not sent. Google uses this to fix errors and improve the scanner, and does not share it with others. Google may process it outside the EEA, including in the United States, and is certified under the EU-U.S. Data Privacy Framework. It cannot be turned off, but only happens while the camera is open; the barcode can also be typed in. Apart from this, we use no analytics tools or advertising networks, and we never sell information.

13. Your rights

You can ask for access to the information we have about you, have it corrected or deleted, and receive a copy of it. You can do most of this yourself in the app, and we handle the rest when you contact us. If you think we process your information incorrectly, you can complain to the Norwegian Data Protection Authority (Datatilsynet).

14. Children

Lyn Calorie is not made for children under 13, and we do not knowingly collect information about them.

15. Changes

When this policy changes, the new version is published here with a new date at the top.

16. Contact

The data controller is Fredrik Magee. Questions about privacy, or a request for access or deletion: