CaliLane · Legal

Privacy Policy

How CaliLane handles personal information, health data and user choices.

Pre-launch draft · Company registration pending

1. Controller and scope

Merrow Interactive (new limited company under formation), organisation number to be added after registration, is the controller for personal data processed through CaliLane unless another party is clearly identified. This policy applies to the CaliLane app, account services, community features, support and related product analytics.

2. Information you provide

Depending on the features you use, we may process account and contact details, profile information, age, height, weight, body-fat values, goals, activity level, training frequency, food logs, nutrition values, recipes, allergies, foods to avoid, creatine settings, progress notes, progress photos, community profile data, messages, reports and support requests.

3. Health and activity information

Information about health, body, nutrition and activity may be sensitive personal data. CaliLane processes it to provide the personal features you request, such as calculations, history, progress views, reminders and optional health integrations. Where required, we rely on your explicit consent. You can withdraw consent, disable integrations or delete information, but some personal features may then stop working.

4. Apple Health and Health Connect

If you choose to connect Apple Health or Health Connect, CaliLane requests only supported permissions shown by your device. The app uses authorised data to display or update selected health and activity features. We do not use health-platform data for advertising, data brokerage or unrelated marketing. You can change permissions in CaliLane and in your device settings.

5. Local storage, accounts and backup

Some information may be stored locally on your device. If you create an account or enable account backup or sync, selected information may also be stored in our backend so it can be restored or used across supported devices. The app indicates when a feature is local-only, account-based or synchronised where this distinction matters.

6. Technical and security information

We may process app version, operating system, device platform, language, timestamps, authentication events, network and request metadata, error information and security signals. We use this information to operate the service, prevent misuse, troubleshoot problems and protect accounts. We avoid collecting precise location unless a future feature clearly requests it and provides separate information.

7. Optional product analytics

If you enable product analytics, CaliLane may record app openings, active installations, feature use, completed actions, recipe-flow events, technical errors, app version, platform and language. A persistent, hashed installation identifier can distinguish the same installation over time, so this information is pseudonymous rather than fully anonymous. Product analytics does not include your name, email address, food names, quantities, calorie values, weight values, body-fat values, progress photos or raw Apple Health or Health Connect measurements. Raw product analytics is retained for up to 90 days and is then deleted or converted into aggregated statistics without the installation identifier.

8. Optional country step statistics

If you separately enable country step statistics, CaliLane may send the country or region you selected, local date and that day's step count using a rotating server-generated daily subject value. No GPS is used. Individual daily contributions are retained for no more than 30 days. Country comparisons are displayed only when privacy thresholds are met.

9. Purposes and legal bases

We process account and service data to perform our agreement with you; health and other sensitive data on the basis of explicit consent where required; optional product analytics and country step statistics on the basis of consent; security, abuse prevention and limited service improvement on the basis of legitimate interests; and records when needed to comply with legal obligations or establish, exercise or defend legal claims.

10. Service providers and recipients

We may use carefully selected providers for hosting, databases, authentication, email, app distribution, device integrations, error handling and customer support. They may process information only under our instructions and appropriate agreements, unless they act as an independent controller for their own service. We do not sell personal data and do not allow health data to be used for targeted advertising.

11. International transfers

Some providers may process data outside Sweden or the European Economic Area. When required, we use an adequacy decision, approved standard contractual clauses or another lawful transfer mechanism together with appropriate safeguards. More detailed processor and transfer information will be made available before public launch and updated when providers change.

12. Retention

We keep personal data only for as long as needed for the purpose, to provide the account, meet legal obligations, resolve disputes and protect the service. Account and synced data is normally retained while your account is active and removed or de-identified after a valid deletion request, subject to limited backup cycles and legal retention. Support and security records may be retained longer when necessary. Specific analytics periods are described above.

13. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, objection and data portability, and withdraw consent at any time. Withdrawal does not affect processing already carried out lawfully. You may also complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority. We may need to verify your identity before fulfilling a request.

14. Automated decisions

CaliLane may use rules and calculations to create estimates, goals, summaries and recommendations. These features do not make decisions that produce legal effects or similarly significant effects about you. You remain responsible for deciding how to use the information.

15. Children

CaliLane is not intended for children under 16. We do not knowingly create accounts for children below the applicable minimum age without valid parental or guardian authorisation. Contact us if you believe a child has provided information improperly.

16. Security

We use technical and organisational measures designed to protect personal data, including access controls, authenticated services, encrypted transport and restricted administrative access. No system can guarantee absolute security. Please protect your device and login details and notify us about suspected misuse.

17. Changes and contact

We may update this policy when CaliLane, our providers or the law changes. Material changes may be shown in the app and may require a new acknowledgement or consent. Privacy questions and rights requests can be sent to support@calilane.se.

18. Local use without an account

Where CaliLane offers local mode, core information such as personal logs, badges and local CaliScore data may be stored only on your device. We do not receive an account-based cloud copy merely because you install or use the app locally. Local mode does not mean that no network processing can ever occur: limited information can be transmitted when you deliberately use an online or account feature, contact support, or separately enable optional product analytics or country step statistics. Those optional statistics remain subject to their own choices described above. Information that has never been synced or backed up to our systems cannot be restored by us if the app data or device is lost, cleared or removed.

19. Account, community and ranking data

If you create an account and use account, community or ranking features, we may process the account user identifier, username, display name, avatar path, community privacy status, selected country code, server-verified CaliScore, verified unlocked badge identifiers and counts, legendary badge count, score version, verification timestamps, derived ranking position and participant counts. The visible leaderboard may provide eligible signed-in community users with your display name, username, avatar if provided, a private-profile or lock indicator, CaliScore, ranking position and relevant country or global context. A private community setting does not automatically hide the ranking row. Users who have blocked each other are filtered from ordinary leaderboard results. Raw weight values, individual food logs, progress photos and raw Apple Health or Health Connect measurements are not displayed in the leaderboard. Account, community and ranking processing needed to provide the features you request is generally based on performance of our agreement with you. Where sensitive health-related information is processed to provide personal features or inputs from which badges or scores are derived, the underlying sensitive information remains subject to the explicit-consent rules described in this policy; ranking does not turn optional analytics or country step statistics on.

20. Ranking visibility, retention and deletion

A user who remains local and signed out does not have a server-verified leaderboard account entry. Under the current service design, ordinary visibility of one user to other users in the leaderboard requires an active community profile, while the signed-in user can still receive their own verified ranking where available. If a community profile is no longer active, ordinary leaderboard visibility to other users stops under the current design. Ranking snapshots and related account data may be retained while needed to provide the account and ranking service, maintain ranking integrity, prevent abuse and resolve disputes. When an account is validly deleted, ranking and profile data is deleted or irreversibly de-identified from active systems together with other account data, subject to the limited backup, security and legal-retention exceptions described in this policy and the account-deletion information. Your rights to access, correction, deletion, restriction, objection and withdrawal of consent for consent-based processing apply as described above.

Pre-launch draft

The complete legal text is published for transparency before launch. The registered company name and organisation number will be inserted after the new limited company has been registered. No private residential address will be published. The documents will be reviewed again before CaliLane launches publicly.