Privacy Policy

3.1 Food and drink photos

• —What: the photo you take or pick from your library. Before it leaves your device, the App reduces it to at most 1280 px on the longest edge and strips all metadata (including GPS location, camera details, and timestamps). Only the image orientation is kept.
• —Why: to recognise the food and estimate calories and macronutrients (Section 05), and to show the photo in your meal log.
• —Where: stored in our private object storage, Cloudflare R2 (Cloudflare, Inc., USA); the storage location is chosen automatically by Cloudflare. Photos are filed under your anonymous user ID, and a copy stays on your device. If recognition finds no food in a photo, no meal is created and our server deletes that photo from our storage as soon as recognition finishes. If that deletion fails, the photo stays in storage until you delete your account.
• —On-device analysis: up to and including App version 1.0.1, before uploading, the App ran a local check with Apple's Vision framework to see whether the photo looks like food, and did not upload a photo it classified as not food. From App version 1.0.2, the App still runs Apple's Vision framework on your device, but only to guess the kind of dish or drink and its container to help estimate the portion; it never decides whether a photo is uploaded. Every photo you take or pick for recognition is uploaded, and whether it shows food is determined during the AI recognition described in Section 05. This Vision analysis runs entirely on your device. The App also computes a fingerprint (SHA-256 hash) of the photo on your device so that re-taking an identical photo within 24 hours reuses the previous result instead of re-uploading. The fingerprint never leaves your device.
• —Photo Library access: the App requests access to your photo library only when you choose an existing photo. It does not scan your library.

3.2 Recognition results and your meal log

• —What: recognised item names, estimated portion size, calories, protein, fat, carbohydrates, a confidence score, meal type, the time the meal was logged, and any edits or manual entries you make (including custom food names).
• —Why: this is your food diary; we keep a copy on our server so it survives reinstalling the App on the same device. Sign-in is anonymous and the session token never leaves this device's Keychain, so a different device cannot sign back into the same account — each device keeps its own separate log.
• —Where: on your device and in our database (Neon PostgreSQL, us-east-1, USA).

3.3 Corrections and feedback

• —What: when you edit a recognised value, the App records which field changed, the old and new value, and how confident the recognition was. When you tap "Flag wrong result" on a meal, the App sends our server the ID of that meal (the random ID the App created when you logged it and used when the photo was recognised), a reason category, optionally the positions of the flagged items in the meal, and optionally a note of up to 500 characters. In the current version the category is always "other" and no item positions or note are attached. The photo is not sent again, and neither are food names or nutrition values.
• —Why: to measure how accurate the recognition is and to find systematic errors. We do not use this data to train machine-learning models. If that ever changes, we will ask for your separate opt-in consent first. Portion sizes you set as a food's default serving are remembered, on your device and in our database, so future logs of that food are pre-filled.
• —Where: our database.

3.4 Body and goal data (health data)

• —What synced to our servers: sex, date of birth, height, current weight and weight history, activity level, goal (lose / maintain / gain), and any calorie target you set manually. From App version 1.0.2 this also includes your target weight and weekly pace.
• —What stays only on your device: units and display name. In App version 1.0.1 and earlier, your target weight and pace also stay only on your device; from App version 1.0.2 they are synced to our servers, as described above, for the same purpose as the rest of this data.
• —Why: to calculate your daily calorie and macro targets and to show your weight trend.
• —Legal basis: explicit consent (GDPR Art. 9(2)(a)), which you give by entering this data in onboarding and can withdraw at any time by deleting your data (Section 10). Without it the App cannot calculate targets, but you can still log meals.
• —Apple Health (HealthKit): App version 1.0.1 and earlier do not access Apple Health. From App version 1.0.2, only if you choose to connect it, the App reads your step count, workouts and active energy from Apple Health, to show today's activity and to add the calories you burned to your daily calorie budget. This data is read and used only on your device: it is not sent to our servers, to the AI service, or to our analytics and crash-reporting providers. The App never writes to Apple Health. You can revoke access at any time in the Health app or in iOS Settings.

3.5 Account and session data

• —What: a randomly generated user ID, a session token stored in your device's Keychain, and for each session the IP address and device user-agent string.
• —Why: to keep you signed in, to protect the service from abuse, and to enforce rate limits.

3.6 Device, diagnostics and usage data

• —What: device model, OS version, App version, the Apple identifier-for-vendor (IDFV), crash reports, and usage events, including: a photo failed the food pre-check (App version 1.0.1 and earlier only), the paywall was shown, a meal was logged (by photo or manually), a recognition succeeded, failed, or was reused, water was logged, and fasting setup started, completed, or was blocked (including when you decline the fasting consent screen). For fasting, the events also include: a fasting session started or ended, a plan was paused, an end time was edited, a break was overridden, and fasting data was deleted. From App version 1.0.2, usage events also carry your answers to the onboarding questions, linked to the same anonymous account ID and also stored as properties of your anonymous analytics profile: how many workouts you do a week, your goal (lose / maintain / gain), your diet type, what gets in your way, what you would like to achieve, whether you have tried other calorie apps, whether you work with a trainer or dietitian, where you heard about the App, and whether you turned on the optional features of adding burned calories to your daily goal, connecting Apple Health, and rolling over unused calories. Your height, weight, target weight, date of birth, sex and pace are not sent to analytics. This list is not exhaustive and can grow as features are added. These usage events are linked to your anonymous account ID. They never contain food names, weights, or photos, but some contain health-related values: the calories of a meal that breaks a fast, the planned and actual length of a fast in hours, your fasting protocol and eating window, water logging events, whether fasting setup was blocked (because of your age, a health screening answer, or a declined consent), and, from App version 1.0.2, your goal, diet type, workouts per week, main obstacle, what you would like to achieve, whether you work with a trainer or dietitian, and whether you connected Apple Health. Amplitude derives an approximate location (country, region, and city) from the IP address of each request; the App does not send precise location. In the App, Amplitude Session Replay records masked replays of in-app screens and interactions (taps and navigation) to help us understand how the product is used and to debug problems. Text you type, the camera view, and all food photos are masked (replaced with placeholders) before anything leaves your device. Replays can still show health values displayed on screen, such as calorie totals, weight entries and fasting timers. Replays are tied to your anonymous account ID, are kept per Amplitude's retention policy, and are used for product analytics and debugging only. For crash and error reports, the App sends Sentry the device model, OS version, App version, your anonymous account ID, and a short trail of the screens and actions that preceded the error. Sentry does not receive photos, screenshots, meal data, or precise location. Errors on our backend are also reported to Sentry with your anonymous account ID, without photos or request bodies. If you are reading this on our website (calsn.app), the same product-analytics tool records only the pages you view (page views), together with Amplitude's default device properties (browser type, operating system, language) and the IP-derived approximate location. The website sets no cookie, keeps no persistent browser ID, and does not record clicks, form input, or session replays. App version 1.0 sends crash reports to Google Firebase Crashlytics instead of Sentry and does not record session replays; version 1.0.1 and later work as described in this section.
• —Why: to fix crashes and to understand which features are used, in the App and on this website.
• —Processor: crash and error reports go to Sentry (Functional Software, Inc.) only, and are used only to fix bugs. Usage events and Session Replay data from the App, and page views from this website, go to Amplitude, Inc. under the same project (Section 06).

3.7 Purchase data

• —What: an anonymous RevenueCat app-user ID, the product you purchased, transaction and receipt data provided by Apple, price, and country. We never see your payment card details; Apple processes payment.
• —Why: to unlock the subscription you paid for and restore it on your devices.

3.8 Server logs

Our servers log each request's method, path, status, duration, and the client IP address. Logs may include the storage key of a photo (which contains your anonymous user ID). Logs never contain photos, prompts, or recognition results.

3.9 What we do not collect

Name, email, phone number, contacts, precise location, microphone audio, advertising identifier (IDFA), or data from other apps (Apple Health data is read only on your device; see 3.4). We do not send push notifications from our servers; reminders are scheduled locally on your device.

3.10 Fasting and eating-window data

• —What: if you turn on fasting, the eating-window schedule you choose (protocol, window time, days), when each fast starts and ends, why it ended, and whether a logged meal ended it.
• —Why: to run the fasting feature — to show where you are in your eating window and to tell you whether a meal you logged ended a fast.
• —Where: on your device and in our database (Neon PostgreSQL, us-east-1, USA).
• —Analytics: app usage events sent to Amplitude (Section 3.6), linked to your anonymous account ID, include some fasting-related values: the calories of a meal that breaks a fast, the planned and actual length of a fast in hours, your fasting protocol and eating window, and whether fasting setup was blocked (because of your age or a health screening answer).
• —Consent: fasting is off by default. We ask for your consent on a separate screen before any eating-window data is stored, and turning fasting on is the only thing that starts that collection.
• —Fasting is not medical advice: Calorie Snap is not a medical device and does not provide medical advice. Fasting isn't suitable for everyone. Consult a doctor before changing your eating pattern.

3.11 Food search

• —What: when you search for a food by typing, the App first searches the food pack stored on your device. If that pack has no good match, the App sends the text you typed, together with a numeric text embedding of it computed on your device, to our server.
• —Why: to search our larger food database and return matching foods.
• —Who and how long: the request is sent with your anonymous account session, like every other request, and is not linked to your health profile beyond that account ID. We use the text and the embedding only to answer the request and do not store them. They are not sent to any third party.

3.12 Water intake

• —What: each water entry you log: the amount in millilitres, the day it counts toward, the time you logged it, and a random entry ID. When you delete an entry, the App sets its amount to zero on our server instead of removing the record, so the deletion syncs; that zero-amount record stays until you delete your account.
• —Why: to show your daily water total against your water goal, and to keep a server copy so your water log survives reinstalling the App on the same device, the same as your meal log.
• —Where: on your device and in our database (Neon PostgreSQL, us-east-1, USA). Usage events about water logging are described in Section 3.6.

11.1 European Economic Area, United Kingdom and Switzerland

The legal bases in Section 04 apply. Explicit consent is required for the health data in 3.4 and for photo recognition; it is requested in the App and can be withdrawn as described in Section 10.

11.2 United States — California

Under the CCPA/CPRA you have the rights to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information for cross-context behavioral advertising and have not done so in the preceding 12 months. We collect the categories: identifiers (anonymous ID, IP), commercial information (purchases), internet activity (usage events), sensitive personal information (health data as described in 3.4 and water intake as described in 3.12, used only to provide the service you request), and inferences (calorie targets). We do not discriminate against you for exercising your rights.

11.3 United States — Washington, Nevada, Connecticut and other consumer-health-data laws

Our Consumer Health Data Privacy Policy applies in addition to this policy. We collect consumer health data only with your consent, do not sell it, and delete it on request.

11.4 Brazil

Under the LGPD, health data is sensitive data processed on the basis of your specific consent. You may contact us for the rights listed in Art. 18 LGPD.

11.5 Ukraine

Processing is carried out in accordance with the Law of Ukraine "On Personal Data Protection". You may contact the Ukrainian Parliament Commissioner for Human Rights regarding your rights.