Privacy Policy

Last updated: 2026-05-12 · Effective date: at app launch

CeliacTrack ("we," "our," or "the app") is a mobile application that helps Canadians with celiac disease track gluten-free food purchases and generate Medical Expense Tax Credit (METC) summaries for the Canada Revenue Agency (CRA). This policy explains what data we collect, why, where it lives, and what control you have over it.

This policy is written to comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws (including British Columbia's Personal Information Protection Act).

1. Who we are

CeliacTrack is operated by Thomas Mazalek of Coldstream, British Columbia, Canada. Contact us at hello@celiactrack.ca with any privacy questions.

2. What we collect — and why

We collect only what the app needs to do its job. Specifically:

Account data

• Email address — used to sign you in and to recover your account if you forget your password.
• Encrypted password — handled by our authentication provider (Supabase). We never see your plaintext password.

Tax-credit calculation data

You enter or capture the following so the app can compute your credit estimate:

• Province of residence — needed to apply the correct provincial credit rate.
• Household size and number of celiac household members — used to compute the per-item household share ratio that CRA requires.
• Annual net income — used to compute the 3%-of-income threshold.
• Photos of grocery receipts and your line items — the basis of your claim.
• Photos or URLs of non-gluten-free "comparable" products — the evidence the CRA requires for the incremental-cost calculation.

Usage data

• Standard device diagnostics (operating system version, app version, crash reports) — used to fix bugs and to improve the app.
• AI lookup quota counter — stored only on your device.

Payment data

We do not see or store credit-card information. All payments are processed by Apple (App Store) or Google (Play Store) and handed to RevenueCat for subscription state management. RevenueCat receives an anonymous identifier and your purchase status only.

3. How we use it

We use your information only to:

• Operate and maintain the app (sign-in, scan, calculate, export).
• Generate your CRA tax-credit summary on demand.
• Provide customer support if you contact us.
• Detect and prevent fraud or abuse.
• Comply with legal obligations (e.g., a valid court order).

We do not sell your data. We do not use it to train AI models. We do not show advertising.

4. Where data is stored

Storage in the US is a routine cross-border transfer for cloud infrastructure. The processors above are bound by data-processing agreements consistent with PIPEDA's accountability requirements.

5. Third-party services

When you tap "Look up product" or "Suggest a comparable", the product description text and store name (e.g., "Glutino Pretzels, Costco") are sent to Anthropic, Inc. ("Claude AI") which performs a web search and returns structured product information. No personally identifying information is sent — Anthropic receives only the non-personal text snippet. Anthropic does not use this data to train its models. Results are cached so the same product isn't re-queried for every user.

Other third parties:

• Apple App Store / Google Play Store — payments and subscriptions
• Supabase Inc. — database, authentication, storage, edge functions
• RevenueCat Inc. — subscription state, restore flows, paywall
• Anthropic, Inc. — receipt OCR and product lookup AI
• Expo (Application Services, Inc.) — over-the-air updates and crash reporting

6. How long we keep it

Your data is kept as long as your account is active. When you delete your account from inside the app (Profile → Delete account), we:

• Remove every record from our database within seconds
• Remove every photo from our storage within minutes
• Cancel any active subscription via the app store (you'll need to manage cancellation through Apple/Google directly)
• Retain only what's required by law (e.g., transaction records for Canadian tax compliance) for the minimum legally required period

Inactive accounts (no sign-in for 24 months) may be flagged for deletion after a notice email.

7. Your rights

Under PIPEDA you have the right to:

• Access the data we hold about you — email us and we'll send a full export.
• Correct information that's inaccurate — most fields are editable directly in the app.
• Delete your account and all associated data — use Profile → Delete account, or email us.
• Withdraw consent to processing at any time by deleting your account.
• Lodge a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the BC Office of the Information and Privacy Commissioner (oipc.bc.ca) if you believe we've violated your rights.

8. Children

CeliacTrack is intended for adults filing Canadian tax returns. We do not knowingly collect data from anyone under 18. If we learn we have collected data from a minor we will delete it.

9. Security

• All data in transit is encrypted (TLS 1.2+).
• Data at rest in Supabase is encrypted (AES-256).
• Row-level security policies restrict every database query to your own user id — another user cannot read your data even if they tried.
• Receipt and comparable photos are accessible only via short-lived signed URLs requested by your authenticated device.
• We use App Store / Play Store distribution only — the app is not side-loaded.

We cannot guarantee absolute security but we follow industry-standard practices. If we discover a breach affecting your data, we will notify you and the Privacy Commissioner of Canada per PIPEDA's breach notification requirements.

10. Changes to this policy

If we make material changes to this policy we will update the "Last updated" date and notify you inside the app at next sign-in. Continued use after that notice constitutes acceptance.

11. Contact

Thomas Mazalek
494 Middleton Close, Coldstream, BC V1B 4E7, Canada
Email: hello@celiactrack.ca

For privacy concerns specifically, write to privacy@celiactrack.ca.