Privacy Policy

Updated: 6 August 2026

This privacy policy explains what personal data restincal.com (hereinafter "the service") collects about its users, how that data is used, and how you can manage your own data in accordance with the European Union's General Data Protection Regulation (GDPR). If you do not accept the service's privacy practices or any part of them, stop using the service immediately.

1. Data Controller

The data controller is Johannes Pakkanen, a private individual (natural person) who maintains restincal.com as an independent developer.
Service: restincal.com
Email: support@restincal.com

2. What data do we collect?

We collect only the data necessary for the service to function:

Account information (sign-in): when you sign in with your Google account, we receive your name, email address and profile picture from Google. For email and password sign-in, we receive only your email address, passwords are never stored in plain text (Firebase Authentication).
User-entered profile, wellness and health data: we collect and process the following data that you enter into the service yourself:
- Basic profile data (requires explicit consent, given at sign-in and when creating your account): age, height, sex and activity level. These are used as mathematical variables to calculate your basal metabolic rate and individual calorie needs.
- Health and wellness data (requires explicit consent): weight, body fat percentage, target weight, calorie and macro goals, food diary entries and foods, recipes and their quantities saved in the diary.
- User display data: the username you choose, used within the app and in connection with any community content.
We process your weight, body fat percentage and food diary as health data under the meaning of legislation. We require your explicit consent to process them (given at sign-in) so that the app can track your weight and body fat development and record and calculate the calories you eat. All this data is stored in the service's database and linked securely to your user account. The calorie calculator can also be used without signing in, in that case, entries are stored only on your device and are never synced to our servers or linked to any personal data.
Community content: if you add foods or recipes to the shared public database or share a recipe with the community, this data and your chosen username are visible to all users of the service.
Usage and analytics data: Google Analytics 4 collects anonymised information about app usage (e.g. page loads, device type) for service development purposes.
Advertising data: Google AdSense collects data to display ads and improve their relevance.

3. Cookies

The service uses cookies and similar technologies to perform the app's basic functions and to serve advertisements. Cookies are divided into three categories:

Necessary cookies: keep you signed in and remember basic app settings. Without these the app does not work.
Analytics cookies (Google Analytics): help us understand how the app is used so we can improve it.
Advertising cookies (Google AdSense): used to display and target advertisements.
Browser local storage (localStorage): the app stores cached data in your browser so that page loads are fast and your data persists between sessions. Stored locally:
- your user ID, display name and account status to keep you signed in between page loads
- your food diary entries, weight and body fat records as a fast cache for signed-in users (synced to Firestore cloud)
- your calorie and macro goals, personal foods and recipes
- a temporary calorie calculator session for users who are not signed in, stored locally only, never sent to any server
- an optional notification email address set by the user (e.g. for sharing recipes), stored locally only and cleared on sign-out
All of this data is cleared automatically on sign-out. Data containing health information (food diary, weight, body fat) is accessible only directly on your device or through your account in the secure cloud service. Using the service on public or shared devices (such as library computers) is not recommended. If the service is nevertheless used on such a device, for security reasons the user should remember to sign out of the service and clear the browser cache, cookies and browsing history when finished.

Management: you can change or withdraw your cookie consent at any time via the cookie banner at the bottom of the site. You can also block cookies in your browser settings, but this may affect how the service works.

4. Third parties and data transfers

We use trusted partners to run the service. The services listed below act as data processors (GDPR Art. 28) on behalf of RestinCal, governed by Google's Data Processing Addendum. Your data passes to the following systems:

Google Firebase, handles sign-in, app data and database management.
Google Analytics & Google AdSense, handle visitor statistics and ad display. Google and independent partners may show ads based on prior browsing history.
Google reCAPTCHA, Open Food Facts & Fineli, protect against bot traffic (App Check) and handle barcode lookups for product information (only the barcode number is sent, no health data). Barcode scanning and OCR nutrition-label reading run entirely on your device, no images or camera data are sent to any server.

⚠️ Important privacy guarantee: RestinCal never sends the health data you enter (such as weight or body fat percentage) to AdSense's advertising system. Ads are based only on the general theme or your browser history. You can opt out of personalised ads in Google's ad settings.

Because the service uses Google's infrastructure, data may be transferred outside the EU/EEA (to the United States). These transfers are protected by the EU Standard Contractual Clauses and the EU–US Data Privacy Framework required by law to ensure adequate data security.

5. Data retention, deletion and security

Your data is retained only for as long as your user account exists. You have full control over your own data:

Deletion: you can delete your account and all your personal data immediately from within the app (Settings → Delete account and all data) or by requesting deletion by email (support@restincal.com). We respond to requests within one month of receipt (GDPR Art. 12).
Community content: deleting your account destroys all your personal entries (weights, food diary) but foods or recipes you have contributed to the shared database are not deleted, they are anonymised and separated from your personal data as part of the shared platform, in accordance with Terms of Service clause 8.

Security: all data in transit is encrypted via HTTPS. Data is stored on Google Firebase servers with user-specific access controls. The service applies technical and organisational security measures in accordance with GDPR Article 32.

6. Your statutory rights (GDPR)

Under EU law you have the right to:

Access (Art. 15): find out what data has been stored about you
Rectification (Art. 16): correct inaccurate or incomplete data
Erasure (Art. 17): request deletion of your data ("right to be forgotten")
Restriction of processing (Art. 18): request that processing be restricted, for example when the accuracy of data is disputed
Data portability (Art. 20): receive your data in a structured, commonly used and machine-readable format for transfer to another service, applies to data processed on the basis of consent or contract
Right to object (Art. 21): object to processing of your data carried out on the basis of legitimate interests (e.g. anonymised statistics); you can always object to processing for advertising purposes
Withdrawal of consent (Art. 7): withdraw your consents (such as cookies or health data processing) at any time. Because weight, body fat and food diary data are core to the service's functionality, withdrawing consent for health data processing means deleting your account in practice. Cookie consent can be withdrawn separately via the cookie banner.
Right to lodge a complaint (Art. 77): lodge a complaint with a supervisory authority (see clause 8)

To exercise any of these rights, contact us by email: support@restincal.com. We respond within one month.

7. Legal bases for processing

We process personal data on the following legal bases under the EU GDPR:

Performance of a contract, necessary so we can provide you with a user account, sync your food diary and keep the app running.
Explicit consent (Article 9), processing of weight, body fat percentage and food diary for calorie calculation and tracking is based on your explicit consent, given via a dedicated consent checkbox at sign-in that is separate from acceptance of the Terms of Service (GDPR Art. 7). Consent is voluntary but required to use the service's core features. You can withdraw consent by deleting your account.
Legitimate interests, technical development of the app, performance monitoring, and prevention of bots and abuse. Users' private entries (food diary, weight, goals) may also be used in anonymised and aggregated form for service development and statistics in a way that does not allow an individual user to be identified.
Consent, analytics and advertising cookies, for which you can withdraw consent via the cookie banner at any time.

8. Right to complain

If you have questions about how your data is processed, please contact the administrator by email first: support@restincal.com.

9. Changes to this policy

This policy may be updated if the app's technology or legislation changes. Users will be notified of significant changes within the app. This privacy policy forms part of the service's Terms of Service, which also describes general liability limitations.