Privacy Policy

1. Introduction

Hedgepal ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we access, collect, use, disclose, retain, and safeguard your information when you use the Hedgepal mobile app or visit our website. Hedgepal is an AI-powered calorie and nutrition tracking app, and this policy covers the health and nutrition data the app collects as part of that service.

2. Information We Collect

We may collect information about you in a variety of ways. The information we may collect on the site includes:

• Personal Data: Name, email address, phone number, and other information you voluntarily provide
• Server Logs: IP address, browser type, operating system, and referral information
• Cookies: We use cookies to enhance your experience on our website
• Analytics: Information about how you interact with our website
• App usage and advertising measurement data: Information about how you use the mobile app — such as app installs, app opens, and key in-app events — together with device and advertising identifiers, collected through the Meta SDK as described in Section 7

3. Health Data We Collect and How We Use It

Hedgepal is a nutrition and calorie tracking app, so it collects health and fitness data that you enter yourself. We want to be explicit about what this includes:

• Body measurements: Height, current weight, target weight, and your weight log history over time
• Demographic health attributes: Date of birth (used to calculate age) and gender, which are required inputs for calorie and macronutrient calculations
• Derived health metrics: Body Mass Index (BMI), body fat estimates, and other metrics we calculate from the measurements above
• Nutrition and dietary data: Food and meal logs, food photos you submit, calorie intake, macronutrient breakdowns (protein, carbohydrates, fat), and your daily nutrition targets
• Goals and progress: Calorie and macro goals, weight goals, logging streaks, and progress history

How we access and collect it. All health data is collected directly from you, and only when you actively enter or submit it in the app — during onboarding, when updating your profile, when logging a meal or a weight entry, or when submitting a food photo. Hedgepal does not read health data from Apple Health, Google Fit, or any other third-party health platform unless you explicitly connect it and grant permission, and it does not collect health data passively or in the background.

How we use it. Your health data is used only to provide the app's core functionality:

• Calculating your personalized calorie and macronutrient targets
• Estimating nutrition values for the meals and food photos you log
• Displaying your progress, charts, history, and derived metrics such as BMI
• Syncing your data across the devices you sign in on
• Providing personalized responses in the AI assistant when you ask about your own data

We do not sell your health data, and we do not use it for advertising or ad targeting. We do not share it with data brokers or advertisers. Your health, nutrition, food log, photo, and body measurement data is never included in the advertising and measurement events sent to Meta described in Section 7 — those events report only that an action occurred (for example, that the app was installed or a subscription was purchased), never the contents of your health data. Health data is shared only with the infrastructure and AI processing providers described in Sections 5 and 6, strictly to operate the app on your behalf, or where required by law.

4. Use of Your Information

Having accurate information about you permits us to provide you with a smooth, efficient, and customized experience. Specifically, we may use information collected about you via the site to:

• Generate a personal profile about you so that future visits to the site will be personalized
• Increase the efficiency and operation of the site
• Monitor and analyze usage and trends to improve your experience with the site
• Respond to your comments, questions, and requests
• Send promotional communications about new products, services, and events
• Measure the performance of our advertising — for example, understanding how many people installed the app or subscribed after seeing one of our ads
• Show you relevant ads for Hedgepal on third-party platforms, and avoid showing ads to people who already use the app

5. Disclosure of Your Information

We may share information we have collected about you in certain situations:

• By Law or to Protect Rights: If we believe the release of information is necessary to comply with the law
• Third-Party Service Providers: To vendors, consultants, and other service providers who need access to such information to carry out work on our behalf
• Advertising and Measurement Partners: To Meta Platforms, Inc., through the Meta SDK integrated in our app, for attributing app installs and measuring the performance of our advertising, as described in Section 7
• Business Transfers: If Hedgepal is involved in a merger, acquisition, or sale of assets

6. Third-Party AI Processing

Hedgepal uses Microsoft Azure OpenAI Service, operated by Microsoft Corporation, to power its AI features. This section explains exactly what is sent, when it is collected, and how it is used.

What data is sent

The following user-submitted content is transmitted to Microsoft Azure OpenAI Service for AI processing:

• Food photos you take or upload in the app
• Meal descriptions and text input you type to log or describe a meal
• Chat messages you send to the AI assistant ("Ask Hedgie")

How it is collected

This data is collected only when you actively submit it in the app — by taking or uploading a food photo, typing a meal description, or sending a chat message to the AI assistant. Hedgepal does not passively collect or transmit photos, text, or messages in the background, and nothing is sent for AI processing unless you choose to submit it.

How it is used

Data sent to Microsoft Azure OpenAI Service is used only for the following purposes:

• Generating nutrition and calorie estimates from your food photos
• Powering AI chat responses in the "Ask Hedgie" assistant
• Improving the accuracy of food recognition within your own account

This data is not sold to any party and is not used for advertising or ad targeting.

Third-party protection

Microsoft Azure OpenAI Service does not use customer data to train its AI models. Microsoft processes this data as a data processor on Hedgepal's behalf under the Microsoft Products and Services Data Protection Addendum (DPA), which contractually restricts how the data may be accessed, used, and retained. These protections are equal to or greater than the protections described in this Privacy Policy.

7. Advertising and Analytics — Meta SDK

The Hedgepal mobile app includes the Meta SDK (the Facebook SDK for iOS and Android), provided by Meta Platforms, Inc. We use it to understand where our app installs come from and to measure whether our advertising on Facebook and Instagram is working. This section explains what it collects, when, and how it is used.

What the Meta SDK collects

• App events: Standard app activity such as app installs, app opens, sessions, completed registration, start of a free trial, and subscription purchases
• Device and technical data: Device model, operating system and version, language, country or region, time zone, screen dimensions, network connection type, and app version
• Identifiers: A Meta-generated app-scoped identifier (Anonymous ID) and, on devices where you have permitted tracking, the platform advertising identifier (Apple's IDFA or Google's Advertising ID)
• Install attribution data: Information indicating which ad or campaign, if any, led to your app install
• Purchase value data: Where you buy a subscription, the amount and currency of that purchase, so we can measure advertising return

What it never collects. The Meta SDK does not receive your health, nutrition, or body data. Your food logs, food photos, meal descriptions, weight and body measurements, BMI and body fat figures, calorie and macro data, AI chat messages, and goal information are never sent to Meta. We do not send your name, email address, or phone number to Meta through the SDK, and we do not use Meta's Advanced Matching feature to transmit hashed contact details.

How it is collected

The SDK runs inside the Hedgepal app and records these events automatically as you use the app — you do not submit them yourself. Event data is transmitted directly from your device to Meta's servers. Because the SDK operates in the background of the app, this collection happens whenever the app is open, subject to the permission and opt-out controls described below.

How this data is used

• Attributing app downloads and installs to the advertising campaigns that produced them
• Measuring how our ads perform, including how many people installed the app or subscribed after seeing one
• Understanding aggregate app usage patterns so we can improve the product
• Delivering and optimizing our own ads for Hedgepal on Meta's platforms, including showing ads to audiences similar to our existing users and excluding people who already have the app

Meta acts as an independent controller for the data it receives through the SDK and processes it under its own Meta Privacy Policy, which we encourage you to read. Meta may use this data for its own purposes, including ad delivery and measurement across its platforms. We do not sell this data, and we receive advertising reporting from Meta only in aggregated, non-identifying form.

Your choices and how to opt out

• On iOS: Under Apple's App Tracking Transparency framework, we ask for your permission before accessing your device's advertising identifier (IDFA). If you decline, no IDFA is collected. You can change this at any time in Settings → Privacy & Security → Tracking, or disable tracking for all apps there.
• On Android: You can reset or delete your Advertising ID in Settings → Google → Ads, which stops the identifier being shared with advertisers.
• Through Meta: If you have a Facebook or Instagram account, you can review and disconnect off-platform activity, and adjust your ad preferences, in your Meta Ad Preferences settings.
• By contacting us: You can email hello@hedgepal.app to ask us to stop processing your data for advertising measurement.

Declining tracking or opting out does not limit any feature of the app. All core functionality — logging food, tracking weight, AI estimates, and the assistant — works exactly the same either way.

8. Security of Your Information

We use administrative, technical, and physical security measures to help protect your personal information. While we have taken reasonable steps to secure the personal information you provide to us, no security measures are completely impenetrable.

9. Data Retention

We retain your data for as long as your account remains active, so that your food logs, weight history, and progress stay available to you across devices. Specifically:

• Account and profile data: Retained for the life of your account, and deleted when you delete your account
• Health, nutrition, and food log data: Retained for the life of your account so you can view your history and long-term progress, and deleted when you delete your account
• Food photos: Retained with the associated meal entry until you delete that entry or delete your account
• AI chat messages: Retained so your conversation history remains available in the app, and deleted when you delete your account
• Server logs and diagnostic data: Retained for up to 12 months, then automatically deleted
• Advertising and app event data: Held by Meta under Meta's own retention practices and privacy policy, not by us. Because Meta is an independent controller of this data, deleting your Hedgepal account does not delete it from Meta — use the Meta controls in Section 7 to manage it.

You can delete individual items — a logged meal, a food photo, or a weight entry — at any time from within the app, without deleting your whole account. Deleting an individual entry removes it from our active systems.

After you request account deletion, your data is permanently removed from our production systems within 30 days. We may retain a limited amount of information for longer where we are legally required to do so — for example, transaction and tax records relating to subscription purchases — or where necessary to resolve disputes or enforce our agreements. Residual copies may persist in encrypted backups for a limited period after deletion, and are overwritten on our normal backup rotation.

10. Your Rights and How to Delete Your Data

You can request deletion of your account and all associated data at any time. There are two ways to do this:

• In the app: Go to Settings → Account → Delete Account and confirm. This is the fastest method and requires no email.
• By email: Send a deletion request to hello@hedgepal.app from the email address associated with your account. We respond to deletion requests within 48 hours.

Either method permanently removes your account and all associated data — including your profile, health and body measurements, food and weight logs, food photos, and AI chat history — from our servers within 30 days, subject to the limited legal exceptions described in Section 9. Account deletion is permanent and cannot be undone.

Deleting your Hedgepal account does not cancel a paid subscription, because subscriptions are billed by Apple or Google rather than by us. Cancel your subscription in the App Store or Google Play before deleting your account.

You may also request a copy of your data, ask us to correct inaccurate information, or withdraw consent for optional processing, by emailing hello@hedgepal.app. Most profile and health information can also be corrected directly in the app under Settings.

11. Contact Us

If you have questions or comments about this Privacy Policy, please contact us at:

12. Changes to This Privacy Policy

Hedgepal reserves the right to modify this privacy policy at any time. Changes and clarifications will take effect immediately upon their posting to the website. Your continued use of the website following the posting of revised Privacy Policy means that you accept and agree to the changes.