Privacy Policy

Who is responsible for your data

Brocalai is a mobile app operated by Carlos Alberto Rodriguez Zapata, an individual trading as Brocalai, at Agostaderito #136, Ojocaliente I, CP 20190, Aguascalientes, Mexico. Under Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), that person is the responsable — the data controller — for everything described here.

"Brocalai", "we" and "us" in this document mean that person. "You" means whoever is using the app.

This policy covers the Brocalai mobile app on iOS and Android, its home screen widget, its watch companion, and this website. It does not cover anything you reach by leaving them.

What we collect

Only what the app needs to do its job. Nothing is bought from data brokers, and nothing is inferred about you beyond the nutrition figures the app openly shows you.

What we never collect

• Card and payment details. Apple and Google take the payment. We never see a card number.
• Your location. The app has no location permission and does not ask for one.
• Your contacts, calendar, messages or browsing history.
• Health platform data. Brocalai does not read from Apple Health or Google Fit.
• Photos other than the ones you scan. Choosing a photo grants access to that photo, not to your library.

Your food photos, specifically

This is the part people most want a straight answer on, so here it is in full.

• When you scan a meal, the photo is sent to Google's Gemini API to be analysed. That is what turns a picture into a dish name and a set of macros.
• The photo is then stored in Firebase Storage under your account, attached to the log entry it produced, so the entry still shows the meal when you scroll back through your history weeks later.
• Photos are private to your account. They are not public, not shared with other users, and not used to advertise to you.
• Deleting a log entry deletes its photo. Deleting your account deletes all of them.
• Menu photos are analysed the same way. What is kept from a saved menu is the extracted text and estimates, so reopening a saved menu costs no new analysis.

Why we use it, and on what basis

Every item in section 2 exists for one of these reasons, and no others.

• To run your account. Signing you in, keeping your log on your devices, restoring it when you change phone.
• To do the thing you asked for. Analysing a photo, reading a menu, looking up a barcode, calculating a target.
• To apply the free tier fairly. Counting scans so the daily limit and your Pro status work.
• To keep the app working. Aggregate usage patterns that show which screens fail, load slowly, or get abandoned.
• To meet legal obligations. Tax and consumer-protection records tied to subscriptions.

Who else processes it

Brocalai is a small operation and relies on established providers rather than running its own servers. Each of these is a processor acting on our instructions, under its own contract and privacy terms.

We may also disclose data where the law compels it: a valid court order, a lawful request from an authority, or where it is necessary to establish or defend a legal claim.

Where your data is stored

Firebase and the Gemini API run on Google infrastructure, which means your data is processed on servers outside Mexico, including in the United States and the European Union. Open Food Facts is hosted in France. RevenueCat is hosted in the United States.

By using Brocalai you consent to that international transfer, which is necessary to provide the service. Where EU or UK data protection law applies, these transfers rely on the European Commission's Standard Contractual Clauses as incorporated into each provider's terms.

How long we keep it

• Your account, profile, log, photos, menus and weight entries: until you delete them, or until you delete your account.
• An individual log entry and its photo: until you delete that entry.
• Analytics events: retained by Firebase Analytics for up to 14 months, then deleted automatically.
• Subscription records: kept as long as tax and consumer-protection law requires, which may outlast your account.
• Backups: deleted data can persist in provider backups for a short window before those backups rotate.

Deleting your account

You can do this yourself, in the app, without asking anyone. Open your profile, choose to delete your account, and confirm.

That single action erases your food log and its photos, your saved menus, your weight entries, your targets, your scan counters and your profile document, then removes the sign-in account itself.

Cancelling a subscription is separate and is done in your App Store or Google Play account. Deleting your Brocalai account does not cancel an active subscription.

Your ARCO rights

Under the LFPDPPP you have the right to Acceso, Rectificación, Cancelación y Oposición — to access your data, correct it, have it cancelled, and object to its processing. You may also withdraw a consent you previously gave.

Most of these you can exercise directly in the app: your profile screen shows and edits everything you have given us, and account deletion covers cancellation. For anything you cannot do in the app, write to the address in section 15 and include enough detail to identify you and to make clear what you are asking for.

We will answer within 20 business days as the law requires, and if the request is granted it will be acted on within the following 15 business days. If you are not satisfied with the outcome, you may bring the matter to Mexico's data protection authority.

If you are in the EU or the UK

Brocalai ships in six languages and is used in Europe, so the GDPR and UK GDPR apply to those users. Alongside the rights above you have the right to data portability, the right to restrict processing, and the right to lodge a complaint with your national supervisory authority.

Our legal bases are: performance of a contract for your account, your log and your subscription; consent for analytics and for optional reminders, which you can withdraw at any time in the app; and legitimate interests for keeping the service secure and working, balanced against your rights.

We do not carry out automated decision-making that produces legal effects. The nutrition estimates the app produces are informational, and you decide what to do with them.

If you are in California

Under the CCPA as amended by the CPRA you may request to know what personal information we have collected, to have it deleted, and to correct it. Sections 2, 8 and 15 tell you how.

We have not sold or shared personal information in the preceding twelve months, and we do not sell or share the personal information of anyone, of any age. We will not discriminate against you for exercising any of these rights.

Security

• Traffic between the app and every service it talks to is encrypted in transit with TLS.
• Data at rest on Google infrastructure is encrypted by the platform.
• Firestore and Storage rules restrict every document and file to the account that owns it. Nobody reads another user's log.
• Credentials held on your device are kept in the platform keychain or keystore, not in ordinary app storage.
• Passwords are handled by Firebase Authentication. We never see or store one.

No system is perfect. If a breach affects your personal data we will notify you and the relevant authority without undue delay, as the LFPDPPP and, where it applies, the GDPR require.

Children

Brocalai is for people aged 16 and over. We do not knowingly collect personal data from anyone younger. If you believe a child under 16 has an account, write to us and we will delete it and its data.

A calorie tracker is a poor fit for a developing body, and this age limit is deliberate rather than merely legal.

Changes to this policy

When this policy changes we update the date at the top of the page. If a change materially affects how your data is handled, we will tell you in the app before it takes effect, and where the law requires it we will ask for your consent again rather than assume it.

Continuing to use Brocalai after a change takes effect means you accept the updated policy. If you do not, delete your account.

Contact

Questions about this policy, or an ARCO, GDPR or CCPA request, go to the same place and are read by a person.

We aim to answer within two business days, and within the statutory deadline in every case where one applies.