Privacy Policy

1. Information We Collect

We collect information you provide directly to us, such as when you create an account, use our services, or contact us for support.

Personal Information

• Name and email address
• Profile information (age, weight, height, fitness goals)
• Food and exercise logs
• Health data from Android Health Connect and Apple HealthKit integration
• Payment information (processed securely by third-party providers)
• Google account information (when using Google OAuth login)
• Profile pictures and other uploaded content
• Photo uploads for AI-powered nutrition analysis
• Voice recordings when you use voice logging (transcribed and processed to identify the foods and activities you describe)

Health Data Collection

With your explicit permission, we may collect the following health data:

• Weight and Body Measurements: for nutrition and fitness tracking
• Activity Data: steps, exercise duration, and physical activity
• Sleep Data: sleep duration and quality metrics
• Heart Rate Data: resting and active heart rate information
• Vitals: heart rate variability, respiratory rate, blood oxygen and blood glucose
• Nutrition Data: food intake and nutritional information
• Fitness Goals: personal fitness and health objectives

Important: All health data collection requires your explicit consent and can be revoked at any time through your device settings.

Device Identifiers

We collect device identifiers for the following purposes.

Security & Fraud Prevention

We collect the following device identifiers and attestation signals to detect account abuse, prevent fraud, and enforce fair usage of our services:

• iOS: Identifier for Vendor (IDFV) and Keychain-based identifiers
• Android: Android ID, Google Services Framework ID, and MediaDRM ID
• Apple DeviceCheck: two per-device bits that persist across app reinstalls and account resets, used to detect devices previously associated with abuse
• Android Play Integrity: Google's Play Integrity API with Device Recall to verify device integrity and maintain per-device recall bits that persist across reinstalls

These identifiers and attestation signals are stored on our servers and are not shared with third parties. They are used solely for security purposes.

Attribution & Campaign Measurement

To understand how users discover our app and measure the effectiveness of our marketing campaigns, we collect advertising identifiers with your consent:

• iOS IDFA: collected only with your explicit consent via the App Tracking Transparency prompt. Shared with our attribution partner (AppsFlyer) and subscription platform (RevenueCat).
• Android Advertising ID (GAID): used for campaign attribution. Shared with AppsFlyer and RevenueCat. You can reset or disable this identifier in your Android device settings under "Ads".

These advertising identifiers are used solely for attribution analytics and subscription revenue measurement. They are not used to serve advertisements within the app. You can opt out of advertising identifier collection at any time through your device settings.

Usage Information

• Device information and identifiers
• Log data (IP address, browser type, pages visited)
• Authentication tokens and session data
• App usage patterns, feature interactions, and error logs
• Subscription and payment data

Aggregated and De-identified Information

We may aggregate, de-identify, or anonymize information so that it can no longer be linked to you. We may use and disclose such information for analytics, research, and service improvement, and we will not attempt to re-identify it except as required or permitted by law.

2. How We Use Your Information

We use the information we collect to:

• provide, maintain, and improve our services;
• process transactions and send related information;
• send technical notices and support messages;
• respond to your comments and questions;
• personalize your experience, including AI-powered nutrition analysis of photos you upload;
• integrate with Apple HealthKit and Android Health Connect where you grant permission;
• process subscription payments and manage billing;
• measure product performance, debug errors, and improve features;
• prevent fraud, abuse, and enforce fair use of the service;
• comply with legal obligations.

3. Information Sharing

We do not sell, trade, or otherwise transfer your personal information to third parties without your consent, except:

• with service providers who assist us in operating our website and conducting our business;
• when required by law or to protect our rights;
• in connection with a merger, acquisition, or sale of assets.

AI Services and Your Consent

Some features use third-party artificial intelligence (AI) services: photo, food label and menu analysis, voice and text food logging, recipe import and translation, meal suggestions, insights, and Calori AI chat. Before any of your data is sent to these services, the app explains what is sent and who receives it, and asks for your permission. If you decline, nothing is sent to them.

• What is sent: photos you take for analysis; food descriptions you type or say, and voice recordings; your messages to Calori AI, together with the profile details (such as age, sex, height, weight and activity level), goals and food diary entries needed to answer; and health data from Apple Health or Health Connect (steps, energy burned, sleep, heart rate, heart rate variability, respiratory rate, blood oxygen and blood glucose) when Calori AI or insights need it. Your email address and payment details are never sent.
• Who receives it: OpenAI, Google, Anthropic and SpaceX (xAI), mostly reached through the OpenRouter gateway (OpenRouter, Inc.); some Google requests go directly to Google Cloud Vertex AI, and Calori Live voice conversations go directly to OpenAI. Voice recordings are transcribed by OpenAI's Whisper model hosted by Groq, Inc., reached through OpenRouter.
• Why: only to produce the result you asked for — for example, the nutrition estimate for a photo or a reply in chat — which is returned to Calori.
• Protection: these providers process the data on our behalf under terms that require at least the same level of protection as this policy and prohibit using it for any other purpose.
• Your choice: you can allow or withdraw this at any time in the app under Settings → AI data sharing. Without it, you can still log food by searching, scanning barcodes or entering it manually.

4. Data Security

We implement appropriate security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure.

5. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this privacy policy, unless a longer retention period is required by law.

• Account Information: retained until you delete your account or request deletion
• Usage Data: retained for up to 2 years for analytics and service improvement
• Authentication Data: retained for the duration of your account plus 30 days
• Error Logs: retained for up to 90 days
• Payment Information: retained as required by law and payment processor requirements

6. Your Rights

You have the following rights regarding your personal information:

• Access: request access to the personal information we hold about you
• Correction: request correction of inaccurate or incomplete information
• Deletion: request deletion of your personal information and account
• Portability: request a copy of your data in a structured, machine-readable format
• Restriction: request restriction of processing of your personal information
• Objection: object to processing of your personal information for certain purposes
• Withdrawal of Consent: withdraw consent for data processing where consent is the legal basis

To exercise these rights, write to us through our contact form. We will respond within 30 days.

7. Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to enhance your experience, analyze usage, and provide personalized content. You can control cookie settings through your browser preferences.

8. Third-Party Services

We integrate with several third-party services to provide our experience, including Google (Analytics, OAuth, Firebase, Cloud Storage), RevenueCat (subscription management), OpenRouter, OpenAI, Google (Gemini, Vertex AI), Anthropic, SpaceX (xAI) and Groq (AI features — see "AI Services and Your Consent" above), AppsFlyer (attribution), and Sentry (error monitoring). All third-party services are required to maintain appropriate security measures and are prohibited from using your personal information for any purpose other than providing services to us.

9. International Data Transfers

Our service is operated globally. Your personal data may be transferred to and processed on servers outside your country or jurisdiction, including in the European Union and the United States, where data protection laws may differ from those in your country. We implement appropriate safeguards — such as Standard Contractual Clauses and vetted sub-processors — to protect your information when it is transferred internationally. By using the service, you consent to this international data transfer.

10. Compliance with Data Protection Laws

• GDPR: for users in the European Union
• CCPA / CPRA: for users in California, USA
• PIPEDA: for users in Canada
• Other applicable local data protection laws

11. Data Deletion and Account Management

You have the right to delete your account and all associated personal data at any time. You can do so directly from the app settings, or ask us through our contact form.

What Gets Deleted

• Your profile and personal information
• All food entries and health data
• Your preferences and settings
• Your subscription and payment history
• Uploaded photos and processed images
• Analytics data associated with your account

Deletion requests are processed within 1–3 business days.

12. App Store and Device Permissions

Our app complies with Apple App Store and Google Play Store policies, including data safety, health data, and privacy requirements. Integration with Apple HealthKit and Android Health Connect requires explicit permission; health data is used only for the app's fitness, nutrition and health features, including Calori AI and insights, which send it to the AI providers named in "AI Services and Your Consent" only with your permission. Health data is never used for advertising or marketing and is never sold; it is encrypted in transit and at rest, and is not shared with any other third party without your explicit consent. You can revoke any device permission at any time through your device settings.

13. Children's Privacy

Our service is not intended for, and is not available to, children under 13. We do not knowingly collect personal information from anyone under 13. If you believe that a child under 13 has provided us with personal information, please contact us so we can delete it.

14. Third-Party Links and Services

Our service may contain links to, or integrations with, third-party websites, apps, or services. This Privacy Policy does not apply to those third parties, and we are not responsible for their content, privacy practices, or how they handle your information. Please review the privacy policies of any third party before providing information to them.

15. Changes to This Policy

We may update this privacy policy from time to time. Updates will be posted on this page with a revised effective date. If the changes are material, we will notify you through a notice within the service or by email, where applicable. Your continued use of the service after the effective date constitutes your acceptance of the updated policy.