Privacy Policy

TotalCarb ("we", "us", "our") acts as the data controller for personal information processed through the App. This Privacy Policy explains what we collect, why we collect it, who we share it with, how long we keep it, and your rights under applicable Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA).

Information we collect. We collect: (a) account information (name, email address, login credentials, profile data); (b) content you submit (photos, voice inputs, meal entries, and any notes or corrections you provide); (c) usage and device data (app interactions, device identifiers, IP address, basic telemetry); and (d) support communications you send to us. If you create child profiles within the App, we collect the name and any profile data you provide for that child. You, as the account holder, are solely responsible for obtaining any necessary consents in relation to data you submit concerning minors.

How we use it. We process this information to: create and operate your account; generate approximate total carbohydrate estimates by combining AI-powered image, voice, and text analysis with nutrient data sourced from public nutrition databases including the U.S. Department of Agriculture (USDA) FoodData Central, the Canadian Nutrient File (CNF), Open Food Facts, FatSecret, and OpenNutrition; provide, maintain, and improve the App; secure the service and prevent fraud; respond to customer support requests; and comply with legal obligations. Our legal bases are performance of our contract with you, our legitimate interests in operating the App, your consent where required, and compliance with law.

Not a medical device. TotalCarb is not a medical device, medical service, or diagnostic tool, and it is not intended to diagnose, treat, cure, or prevent any disease, including diabetes. TotalCarb has not been reviewed or approved by Health Canada or any other regulatory authority as a medical device or health product. The estimates the App produces are approximations generated by artificial intelligence and reference databases and they may be significantly inaccurate. TotalCarb is only a tool to help you estimate total carbohydrate counts. These estimates must not be used as the sole basis for insulin dosing or any other medical decision. Do not ignore, delay, or modify the advice of your doctor, endocrinologist, diabetes educator, dietitian, or any other qualified healthcare professional based on anything you see in this App. Always confirm carbohydrate counts and insulin or medication decisions with your care team. If you are experiencing a medical emergency, contact your local emergency services immediately.

Who we share it with. We share personal data with: (a) service providers and subprocessors that host the App, run AI inference, provide analytics, and operate support tooling — specifically including Supabase Inc. (database and authentication), Google LLC (AI inference — your submitted photos and voice transcripts are processed by Google's Gemini AI service), Paddle.com Market Ltd (payments), and FatSecret (nutrition data lookup); (b) Paddle.com Market Ltd ("Paddle"), our authorized reseller and Merchant of Record, which processes payments, billing, invoicing, tax, and refunds on our behalf in accordance with Paddle's Buyer Terms; (c) professional advisers such as legal and accounting professionals; and (d) authorities where required by law. We do not sell your personal data or use it for advertising.

Cross-border data transfers. Our service providers, including Supabase, Google, Paddle, and FatSecret, operate infrastructure outside Canada, including in the United States. When your personal data is transferred outside Canada, it may be subject to the laws of those jurisdictions, including lawful access by foreign governments. We take reasonable steps to ensure these providers maintain appropriate protections for your data.

Retention. We keep personal data only as long as needed to operate the App, comply with our legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your account and associated personal data at any time by contacting us at support@totalcarb.ca. Upon a valid deletion request, we will delete or anonymize your personal data within 30 days, except where retention is required by law.

Security. We apply reasonable technical and organizational measures, including encryption in transit and at rest and access controls, to protect your information. No system is completely secure and we cannot guarantee absolute security.

Data breach notification. In the event of a data breach that poses a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible, in accordance with PIPEDA.

Your rights. Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or port your personal data, to object to certain processing, and to withdraw consent. You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca. To exercise any of these rights, contact us at support@totalcarb.ca.

This Privacy Policy should be read together with the Terms of Service, is governed by the laws of Ontario, Canada, and may be updated from time to time. For material changes affecting how your personal data is used, we will notify you within the App and require your acknowledgment before continued use. For non-material changes, continued use of the App constitutes acceptance.

TotalCarb is a service operated by Retro Signs & Design, which is the data controller responsible for personal information processed through the App. References to "we", "us", and "our" in this Privacy Policy refer to Retro Signs & Design, trading as TotalCarb.