Oneleaf — for California residents
Effective date: 07th of July 2026
This California Notice at Collection and Privacy Notice (the “California Notice”) supplements our Privacy Policies and applies solely to residents of the State of California (“you” or “consumers”). It applies to the “Oneleaf” and “Calorie Tracker by Oneleaf” mobile applications, our websites (including oneleafhealth.com and its subdomains), our quizzes and onboarding questionnaires, and all related services (together, the “Services”), operated by Oneleaf SAS, 7 place de l'Hôtel de Ville, 93600 Aulnay-sous-Bois, France (“Oneleaf”, “we”, “us”). It is provided pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations (together, the “CCPA”).
Terms used in this California Notice have the meanings given to them in the CCPA. Where this California Notice conflicts with our general Privacy Policies, this California Notice prevails for California residents.
1. NOTICE AT COLLECTION: CATEGORIES OF PERSONAL INFORMATION
The table below describes the categories of personal information (as defined by the CCPA) that we have collected in the preceding 12 months and that we collect at the time this notice is provided; the sources; the business purposes; the categories of third parties and service providers to which each category is disclosed; and whether each category is “sold” or “shared”.
Examples we collect: Name, email address, unique user ID, IP address, device identifiers (IDFA / GAID where permitted)
Disclosed to (service providers / third parties): Hosting provider; analytics providers; payment processors; email provider; advertising platforms and attribution partners
Retention: Life of the account + 2 years of inactivity; then archival periods described in our Privacy Policies
Sold / Shared: Sold: No . Shared: Yes (device identifiers, IP address, hashed email) for cross-context behavioral advertising and audience management
Examples we collect: Name, contact details, payment token and redacted card details (full card numbers are processed by our payment processors and never stored by us)
Disclosed to (service providers / third parties): Payment processors (Stripe, Apple); customer support platforms
Retention: Life of the account; invoicing data 10 years
Sold / Shared: Sold: No. Shared: No
Examples we collect: Age, gender (self-reported)
Disclosed to (service providers / third parties): Hosting and analytics providers (as part of profile data)
Retention: Life of the account + 2 years of inactivity
Sold / Shared: Sold: No. Shared: No
Examples we collect: Subscription plan and status, purchase and refund history, trial and cancellation records
Disclosed to (service providers / third parties): Payment processors; analytics; advertising platforms and attribution partners (non-sensitive subscription events only, e.g. trial start, purchase)
Retention: Life of the account; evidential archive 5 years; invoicing 10 years
Sold / Shared: Sold: No . Shared: Yes (non-sensitive subscription events)
Examples we collect: App and website usage, pages and screens viewed, features used, session data, interactions with our ads and emails
Disclosed to (service providers / third parties): Analytics providers; advertising platforms and attribution partners
Retention: Traffic data 13 months; analytics data per our Privacy Policies
Sold / Shared: Sold: No . Shared: Yes (standard app and website events)
Examples we collect: Coarse location (country, state, ZIP code) derived from IP address or billing information. We do not collect precise geolocation.
Disclosed to (service providers / third parties): Hosting; analytics; tax compliance provider
Retention: Same as identifiers
Sold / Shared: Sold: No. Shared: No
Examples we collect: Calorie Tracker only: meal photographs and progress photographs you choose to upload
Disclosed to (service providers / third parties): Hosting provider; AI service providers (for food recognition, with your consent)
Retention: Until you delete them or your account is deleted
Sold / Shared: Sold: No. Shared: No
Examples we collect: Quiz and onboarding answers (current and target weight, height, eating habits, sleep, stress, smoking habits, goals); nutritional logs; body metrics; data from Apple Health where you enable it
Disclosed to (service providers / third parties): Hosting provider; AI service providers (Calorie Tracker features, with your consent). Never disclosed to advertising platforms.
Retention: Life of the account + 2 years of inactivity
Sold / Shared: Sold: No. Shared: No
Examples we collect: Program and content recommendations, personalized plans and insights derived from your profile and usage
Disclosed to (service providers / third parties): Hosting provider (as part of your profile)
Retention: Life of the account + 2 years of inactivity
Sold / Shared: Sold: No. Shared: No
Sources. We collect personal information directly from you (account creation, quizzes, in-app logging, support communications), automatically from your devices (cookies, SDKs, and similar technologies), from our payment processors, and, where you enable an integration, from Apple Health.
Business and commercial purposes. We collect and use personal information for the purposes described in Section 1 of our Privacy Policies: providing and personalizing the Services; creating and managing accounts; processing payments; customer support; security and fraud prevention; analytics and service improvement; advertising measurement and audience management (non-sensitive data only); marketing communications; legal compliance; and defense of legal claims.
Sensitive personal information. We collect the sensitive personal information described above solely to provide the Services you request, to personalize your programs, and for the other purposes permitted by Section 7027(m) of the CCPA regulations. We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you, and we do not sell or share it. Accordingly, we do not offer a “Limit the Use of My Sensitive Personal Information” link.
No sale; sharing for advertising. We do not sell personal information for monetary consideration, and we have not done so in the preceding 12 months. We do “share” limited categories of personal information (identifiers, non-sensitive subscription events, and internet activity information) with advertising platforms and attribution partners (Meta, Google, AppsFlyer) for cross-context behavioral advertising and advertising audience management, including to exclude existing customers from our campaigns. You have the right to opt out of this sharing (see Section 3).
Minors. Our Services are not directed at anyone under 18, and we do not knowingly collect, sell, or share the personal information of consumers under 16 years of age.
2. YOUR CALIFORNIA PRIVACY RIGHTS
As a California resident, you have the following rights, subject to the conditions and exceptions provided by the CCPA:
How to exercise your rights. Submit a request by emailing [email protected] from the email address linked to your account, with the subject line “California Privacy Request”, specifying the right you wish to exercise. We will confirm receipt within 10 business days and respond within 45 calendar days, extendable once by an additional 45 days where reasonably necessary (in which case we will notify you).
Verification. We will verify your identity by matching the information you provide with information we hold (for example, your account email address and recent account activity). We may request additional information where necessary; we will only use it for verification.
Authorized agents. You may designate an authorized agent to submit a request on your behalf. We will require proof of your written authorization and may require you to verify your identity directly with us.
Appeals. If we deny your request in whole or in part, you may appeal by replying to our response with the subject line “Appeal”. If your appeal is unsuccessful, you may contact the California Privacy Protection Agency or the California Attorney General.
3. HOW TO OPT OUT OF SHARING
You can opt out of the sharing of your personal information for cross-context behavioral advertising by any of the following means:
We will apply your opt-out within 15 business days. If you opt out, we will no longer share your personal information with advertising platforms for cross-context behavioral advertising; you may still see non-personalized ads.
4. SHINE THE LIGHT
California’s “Shine the Light” law (Cal. Civ. Code § 1798.83) permits California residents to request certain information regarding our disclosure of personal information to third parties for their own direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.
5. CONTACT
For any question about this California Notice or our privacy practices: [email protected], or by post: Oneleaf SAS, 7 place de l'Hôtel de Ville, 93600 Aulnay-sous-Bois, France. For more information about our practices, see our Oneleaf Privacy Policy and our Calorie Tracker Privacy Policy.
