Official Legal Document

Privacy Policy

Last Updated & Effective: March 15, 2026 • Applicable to all platforms (iOS, Android, Web)

OUR CORE PRIVACY PROMISE:
Your health and dietary journey belongs exclusively to you. Cuvly does not sell, rent, or monetize your personal data, scan history, or craving logs to third-party food manufacturers or advertising networks. Camera frames are processed strictly locally on your device to read product barcodes; photos are never saved, uploaded, or transmitted to remote servers.

1. Overview & Scope

This Privacy Policy explains how Aigentro / Cuvly ("we", "us", or "our") collects, uses, protects, and discloses information when you use the Cuvly mobile applications, websites, and APIs (the "Service"). We comply with global privacy standards, including the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA / CPRA).

2. Information We Collect

A. Information You Provide to Us

Account Details: When you register, we collect your email address, full name, and password (securely hashed with salt via bcrypt).
Personalized Wellness Preferences: Your customized daily sugar goals (e.g. 25g limit), preferred measurement units (grams or teaspoons), reminder preferences, and reset curriculum start date.
Check-in & Craving Telemetry: Optional daily reflection check-ins (mood, energy rating, cravings experienced) and craving timer durations logged during reset protocol exercises.

B. Camera & Device Hardware Access (Apple Store 5.1.1 Compliance)

Camera Usage Rule:
Cuvly requests camera access for the sole purpose of scanning product UPC/EAN barcodes.

Camera frames are analyzed on-device in volatile memory.
No photos or video frames are ever recorded, saved to your photo roll, or uploaded to our cloud servers.
Only the extracted numeric barcode sequence (e.g., "012345678905") is transmitted to lookup nutritional data.

C. Automatically Collected Technical Information

Device Information: Device model, operating system version, app version, language, and coarse time zone to deliver accurate daily resets.
Aggregated Anonymous Usage Analytics: Anonymized lifecycle events (e.g., onboarding completion, streak milestones) used strictly to diagnose app stability and optimize performance. You can disable telemetry at any time in Profile Settings.

3. How We Use Your Information

We process your data for the following lawful and legitimate purposes:

To deliver personalized sugar tracking, calculate sugar cube equivalents, and assess daily targets.
To manage your 90-day reset curriculum progress and deliver mindful audio reflection guides.
To send essential transactional notifications (email verification codes, password resets, and critical service updates).
To process subscription entitlements via Apple App Store and Google Play billing APIs.
To safeguard the security, integrity, and availability of our infrastructure.

4. How We Protect & Share Your Data

We do not sell your personal information. We only share information with vetted service providers bound by strict data processing confidentiality agreements:

Cloud Database & Hosting: MongoDB Atlas (SOC 2, ISO 27001 certified cloud database with automated encryption at rest) and Vercel / AWS cloud infrastructure.
Transactional Email: Secure SMTP email transports used solely to transmit one-time authentication codes.
App Store Platforms: Apple Inc. and Google LLC for processing in-app subscriptions and receipt validation.
Anonymous Social Share Cards: Visual milestone cards generated for social sharing (Instagram, WhatsApp) contain zero personal identifying information, zero account names, and zero email addresses.

5. Data Retention & Account Deletion (GDPR & CCPA Rights)

We believe in absolute data ownership and the right to be forgotten:

Instant Account Deletion: You can delete your account at any time directly in the mobile app via Profile > Privacy & Data > Delete Account & History.
Permanent Purge: When requested, your account records, scans, craving history, and identifiers are permanently purged from our active databases within 30 days.
Data Portability (Export): You can export a full copy of your personal data archive in machine-readable JSON format via Profile > Privacy & Data > Export Personal Data.

6. Your Privacy Rights (GDPR & California Residents)

Depending on your location, you hold the following rights under GDPR and CCPA/CPRA:

Right of Access & Portability: Request details and receive a machine-readable copy of your personal data.
Right to Rectification: Correct inaccurate or incomplete profile settings.
Right to Erasure ("Right to Be Forgotten"): Request immediate permanent deletion of your data.
Right to Opt-Out: Toggle off anonymous analytics tracking inside Profile Settings.
Non-Discrimination: We will never deny services, charge different prices, or alter quality of service if you exercise your statutory privacy rights.

To exercise any of these rights, use the in-app controls or email our Data Protection Team at cuvly.support@aigentro.com.

7. Children's Privacy

Cuvly does not knowingly collect or solicit personal information from children under the age of 13 (or under 16 in certain EU jurisdictions). If we become aware that we have collected information from a child without verifiable parental consent, we will promptly delete that information from our records.

8. Security Measures

We implement industry-standard technical and organizational security measures, including:

End-to-end transport layer security (TLS 1.3 / HTTPS) for all data transmitted between the mobile app and our APIs.
Bcrypt password hashing with high salt rounds.
Short-lived verification codes and secure JSON Web Token (JWT) session authorization.
Database-level encryption at rest.

9. Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect new features, legal regulations, or operational practices. When significant changes occur, we will notify you through an in-app notice or by email, and update the "Last Updated" date at the top of this document.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at:

Aigentro / Cuvly Privacy & Security Office
Email: cuvly.support@aigentro.com
Support: cuvly.support@aigentro.com
Website: https://cuvly.aigentro.com