Privacy Policy

Effective June 25, 2026 · Version 2026-06-25

This Privacy Policy explains how Klori ("Klori", "we", "us") collects, uses, and protects your personal data. Klori is a nutrition-tracking application currently in beta, operated by an individual developer (the "Operator") based in the Philippines, who is the data controller for the purposes of the Data Privacy Act of 2012 (Republic Act No. 10173) and the rules of the National Privacy Commission ("NPC").

1. Who we are

The Operator is an individual offering Klori for testing. For any privacy request, contact marcdanieldelacruz599@gmail.com.

2. Data we collect

• Account data: your name, username, email address, and a securely hashed password.
• Sign-in identifiers: if you use Google or Facebook sign-in, the unique account identifier those providers return so we can recognise you.
• Health and profile data (sensitive personal information): your age, sex, height, weight and weight history, activity level, body-goal, and calorie/macronutrient targets. We use these to calculate energy needs and personalise your goals.
• Diet and activity logs: the foods and meals you log, and your water intake.
• Community contributions: foods, ingredients, recipes, comments, ratings, bookmarks, and reports you submit.
• Images: your profile photo and any images attached to content you submit.
• Device and usage data: authentication tokens, a device name you provide, an optional push-notification token, and your IP address (used for security and rate limiting).
• Communications: email verification codes and password-reset emails.

3. How we use your data

• To provide and operate the app (accounts, logging, dashboards, recipes).
• To calculate energy needs and personalise calorie/macro goals.
• To run community features and to keep shared data accurate and safe (moderation).
• To send transactional email (verification, password reset).
• To secure the service (rate limiting, abuse prevention).

4. Legal basis

We process your data based on your consent (which you give at sign-up and may withdraw by deleting your account), on the performance of our agreement with you (to provide the service you request), and on our legitimate interests in keeping the service secure. Health and profile data is treated as sensitive personal information and processed only to deliver features you choose to use.

5. Sharing and third-party processors

We do not sell your data. We share data only with service providers that help us run Klori:

• Hosting (our server and database provider).
• Email delivery (to send verification and password-reset messages).
• Google and Facebook (only if you choose their sign-in).
• USDA FoodData Central and Open Food Facts (food and barcode lookups; your queries may be sent to retrieve product data).
• Firebase Cloud Messaging (push notifications, if enabled).
• Crash-reporting and analytics providers we may use to diagnose errors and understand usage during beta; these are configured to minimise and, where possible, anonymise data.

Some of these providers are located outside the Philippines (including the United States), so your data may be processed abroad under appropriate safeguards.

6. Community content is public

Content you submit to the community (foods, ingredients, recipes, comments, ratings) is, once approved, visible to other users. Do not include private information in submissions.

7. Data retention

We keep your account and personal data until you delete your account. Email verification codes are pruned automatically shortly after they expire. Community contributions you made may be retained in an anonymised form after deletion to preserve the integrity of the shared database (see §8).

8. Your rights and how to exercise them

Under the Data Privacy Act you may access, correct, object to, or request erasure of your personal data, and request data portability. You can:

• Correct your profile data in the app at any time.
• Delete your account in the app (Profile → Delete account). This permanently removes your personal data and revokes your sessions; community content you contributed is detached from your identity rather than deleted, to keep shared nutrition data accurate.
• Contact marcdanieldelacruz599@gmail.com for any other request, or to lodge a complaint with the NPC.

9. Security

We protect data in transit with HTTPS, store passwords only as salted hashes, encrypt sign-in tokens on your device, restrict administrative access, and apply rate limiting. No system is perfectly secure, but we take reasonable measures appropriate to a beta service.

10. Children and minors

Klori is for users aged 16 and over. If you are 16 or 17, you confirm that a parent or guardian permits your use. We do not knowingly collect data from anyone under 16; if you believe a child under 16 has registered, contact us and we will delete the account.

11. Changes

We may update this policy and will change the version above. Material changes may require you to re-accept before continuing to use the app.

This document is a draft provided for Klori's beta program and is pending legal review. It is not legal advice. Questions: marcdanieldelacruz599@gmail.com. Version 2026-06-25.