CarbTally Privacy Policy

CarbTally ("we", "our", "us") is a free carb-counting app published by LW Data Labs Ltd, a company registered in England and Wales (company number 17048417, ICO registration C1934754). This policy explains what data CarbTally handles when you use the app.

Our processing of any personal data is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where users are located in the European Economic Area (EEA), EU GDPR also applies.

1. What CarbTally stores on your device

The app keeps the following locally, using Android's standard app storage. None of it is uploaded to us or to any server we control:

• Food log entries: what you've added to a given day's log, and their carb/calorie/protein/fat values.
• Favourites: foods you've starred for quick re-adding.
• Daily carb goal: the target you set, if any.
• Display preferences: e.g. whether you've switched the log to a carbs-only view.

Uninstalling the app, or clearing its storage in Android's app settings, permanently deletes all of this. There is no account to delete because there is no account.

2. Data sent to third parties

2.1 Food search (Open Food Facts)

When you search for a food, the search text you type is sent to Open Food Facts, a free, independent, open food-data database, to look up nutrition information. We do not attach your name, device ID, or any other identifier to that request beyond a generic app identifier in the request header (used only so Open Food Facts can see which app is calling their API, as their service asks integrators to do).

2.2 Barcode scanning (camera)

CarbTally can scan a product barcode instead of you typing a name. Doing so uses your device's camera, so Android asks for camera permission the first time you tap the scan button. You can refuse, and the rest of the app works exactly as before.

The camera preview is processed entirely on your device to read the barcode. No photo, video, or camera frame is stored, uploaded, or sent to us or to anyone else. The only thing that leaves your device is the barcode number itself, which is sent to Open Food Facts to look up that product, exactly as a typed search would be.

2.3 Advertising (Google AdMob)

CarbTally is free to use and shows ads through Google AdMob to fund development. AdMob collects device and advertising identifiers in order to serve and measure ads. Google collects and processes that data as an independent controller, and we never see your individual ad-interaction data.

If you are in the UK, the EEA or Switzerland, CarbTally asks for your consent before any personalised advertising is used. The consent form appears the first time you open the app and is provided by Google's User Messaging Platform. You can accept, refuse, or choose which purposes and vendors you allow.

Consent is the lawful basis for personalised advertising in those regions. Refusing does not stop the app working and does not remove ads. It means the ads you are shown are non-personalised.

You can change or withdraw your choice at any time using the Privacy options control in the app's top bar. You can also review or reset your advertising ID, and control ad personalisation generally, in your device's Google ad settings. See Google's Privacy Policy for how Google handles this data.

3. Third-party services at a glance

4. What we don't collect

• No name, email address, or account of any kind.
• No health data, and CarbTally does not diagnose, treat, cure, or prevent any medical condition. If you use it alongside managing a health condition such as diabetes, it's a general food-information tool, not medical advice. Speak to a healthcare professional about your specific dietary needs.
• No location, contacts, or microphone access. The camera is used only to read a barcode when you ask it to, and what it sees never leaves your device.
• No analytics or crash-reporting SDK.

5. Your rights

Because CarbTally doesn't hold a server-side copy of your data, most UK/EU GDPR data-subject rights are satisfied by design: there is nothing on our servers to access, correct, or export, and uninstalling the app (or clearing its storage) erases everything instantly and completely.

For data that Google or Open Food Facts process independently as described above, you'd exercise your rights directly with them, using the policy links in Section 3. If you have any question about how CarbTally itself works, or believe something in this policy doesn't match reality, contact us using the details in Section 8, and you always have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

6. International data transfers

Open Food Facts and Google AdMob may process data outside the UK/EEA where their own infrastructure operates. We rely on those providers' own safeguards (including Standard Contractual Clauses or equivalent, where applicable) for that processing, since we do not control their infrastructure.

7. Children's privacy

CarbTally is not directed at children under 16. We do not knowingly collect data from children under 16. By design, we don't collect identifying data from anyone. If you believe a child has been affected in a way this policy doesn't account for, contact us and we'll look into it.

8. Changes to this policy, and contact

We may update this policy if what CarbTally does changes, for example if a future version adds a feature that sends data somewhere new. The "Last updated" date at the top will always reflect the latest revision.

• Email: [email protected]
• Website: lwdatalabs.co.uk
• Supervisory authority: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, SK9 5AF: ico.org.uk