Privacy Policy

Effective date: September 4, 2026

What’s new in this version: We now share limited advertising data with our advertising partners (Meta, TikTok and Google, via AppsFlyer) so we can measure and improve our ads. Your food logs, photos, body measurements and health data are never shared with advertising partners. We do not display ads inside the app.

Calorie (“we”, “us”, “our”) is operated by Javid Rezaei, a sole trader based in Queensland, Australia. Calorie is a photo-based calorie and nutrition tracking app. This policy explains what information the app collects, how it is used and shared, and the choices you have. Please read it carefully, together with the sections that apply to where you live. If you do not agree with it, do not use the app.

1. Information We Collect

• Account information. Your email address and a password, used to create and sign in to your account. Passwords are handled by our authentication provider and are never visible to us in plain text.
• Food logs. The foods you log: food name, serving description, calories, protein, carbohydrates, fat, how the entry was created (photo scan, barcode scan, or manual entry), and when it was logged.
• Nutrition goals and body measurements. Your daily calorie and macro targets, and the details used to calculate them — age, weight, height, sex, and activity level. Together with your food logs, this describes your dietary habits, body measurements, and physiological characteristics, and is sensitive health-related information.
• Photos you take for scanning. Photos you take of a meal are sent for scanning so we can identify the food. A photo may include your surroundings, your body, or other people — take care with what you capture. Progress photos you save are stored only on your device and are never sent to us.
• Barcodes you scan. The barcode number is used to look up the product’s nutrition information.
• Marketing-attribution and device identifiers. When you install the app from one of our own marketing campaigns, our attribution provider AppsFlyer may receive device and advertising identifiers and install/purchase events so we can measure that campaign. AppsFlyer never receives your health data, food logs, body measurements, or photos (see Section 3).
• Product-analytics and technical data. Information generated when you use the app — device type and operating system, app interactions and events, crash diagnostics, and IP address — used to run, secure, debug, and improve the app.

2. How Food Photos Are Used

When you scan a meal, the photo is sent over an encrypted connection to our server, which forwards it to Google’s Gemini vision service to identify the foods in the image and estimate portion sizes for the scan you requested. The identified food names are matched against the USDA FoodData Central database to obtain nutrition values, and the resulting food log entry is stored in your account.

We use technologies including machine learning and artificial intelligence to operate and improve the app.

3. Marketing Attribution and Analytics (No In-App Advertising)

We do not display advertising in the app. We never use your health information, food logs, body measurements, or photos for advertising. We use only the following, and only as described:

• Marketing attribution for our own campaigns. To measure how well our own acquisition campaigns perform, we use AppsFlyer, an install-attribution and campaign-measurement provider. AppsFlyer receives device and advertising identifiers and install/purchase events only. It does not receive your health data, food logs, body measurements, nutrition goals, or photos — that boundary is absolute.
• Product analytics and crash reporting. We use PostHog (usage and feature analytics) and Sentry (crash and error reporting) to run and improve the app. These process app usage, device, and diagnostic data. We do not sell this data, and we do not use it for advertising.
• App Tracking Transparency (iOS). Where iOS requires App Tracking Transparency (ATT) permission for a tracking identifier such as the IDFA, we request that permission and respect your answer; we do not use a tracking identifier without permission. You can review or change this at any time in Settings → Privacy & Security → Tracking. On Android you can reset or delete your Advertising ID in your device settings.

4. Service Providers and Partners

Calorie relies on the following providers to function:

• Service: Supabase — Purpose: Account authentication, database, storage, and serverless functions — What it receives: Email, hashed password, food logs, goals, body measurements (encrypted at rest and in transit)
• Service: Google Gemini API — Purpose: Food identification from photos — What it receives: Meal photos, to identify the food and estimate portion size
• Service: USDA FoodData Central — Purpose: Nutrition data for identified foods — What it receives: Food-name search terms only (e.g. “grilled chicken breast”).
• Service: Open Food Facts — Purpose: Nutrition data for barcode scans — What it receives: The scanned barcode number, sent from your device.
• Service: Apple App Store (StoreKit) — Purpose: Subscription purchase, billing, and renewal — What it receives: Your purchase and subscription status. Payment details are handled by Apple and are never received by us.
• Service: PostHog — Purpose: Product and usage analytics — What it receives: App events, usage patterns, device and technical data. No health data is sold.
• Service: Sentry — Purpose: Crash and error reporting — What it receives: Crash diagnostics, device and technical data.
• Service: AppsFlyer — Purpose: Measuring our own acquisition campaigns — What it receives: Device and advertising identifiers and install/purchase events only — never health data, food logs, body measurements, or photos.
• Service: Meta (Facebook, Instagram) — Purpose: Measuring our own ad campaigns on Meta platforms — What it receives: Your advertising identifier and app events (install, onboarding completed, subscription started), via AppsFlyer. Never your health data, food logs, body measurements, or photos.
• Service: TikTok — Purpose: Measuring our own ad campaigns on TikTok — What it receives: Your advertising identifier and app events (install, onboarding completed, subscription started), via AppsFlyer. Never your health data, food logs, body measurements, or photos.
• Service: Google — Purpose: Measuring our own ad campaigns on Google platforms — What it receives: Your advertising identifier and app events (install, onboarding completed, subscription started), via AppsFlyer. Never your health data, food logs, body measurements, or photos.

Advertising and Attribution

We advertise Calorie on social media and search platforms. To understand which ads work, we share limited information with our advertising partners — currently Meta (Facebook and Instagram), TikTok, and Google — through our measurement partner AppsFlyer.

What we share: your device’s advertising identifier, the fact that you installed and opened the app, certain app events such as completing onboarding, and whether you started a subscription.

What we never share: your food logs, photos, body measurements, health data, name, or email address. These are never sent to any advertising partner.

We may show you ads for Calorie on other apps and websites after you have installed or visited, and our advertising partners may help us recognise the same person across the devices they use. We may also provide our partners with a secure, hashed version of your email address so they can measure results and reach people with similar interests.

Our website uses advertising and analytics cookies. You can control these in your browser settings.

Under California law this is treated as “sharing” personal information for cross-context behavioural advertising. We do not sell your personal information.

Your choice: on iOS you are asked for permission before any advertising identifier is shared. If you decline, none is shared. You can change this at any time in iOS Settings → Privacy & Security → Tracking. You may also email [email protected] to opt out.

Beyond these providers, personal information is disclosed in the circumstances described in Section 5 (legal and protective disclosures) and Section 6 (business transfers).

5. Other Uses and Disclosures

Beyond operating the app as described above, we may use and disclose personal information where reasonably necessary to:

• Comply with law. Respond to lawful requests from law enforcement, courts, regulators, or other authorities — such as a subpoena, court order, or other legal process.
• Defend our legal rights. Establish, exercise, or defend legal claims, whether in pre-litigation correspondence, litigation, arbitration, or a regulatory proceeding.
• Protect the Service and its users. Detect, investigate, and prevent fraud, abuse, misuse, or security incidents, and protect the rights, property, or safety of Calorie, our users, or others.
• Enforce our terms. Investigate and act on suspected violations of our Terms of Service.

6. Aggregated, De-identified, and Business Transfers

We may de-identify or aggregate information so that it no longer identifies you, and use and disclose it for purposes consistent with this policy. We maintain de-identified data without attempting to re-identify it except as permitted by law.

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of our assets, personal information may be disclosed to counterparties and their advisors and transferred to the successor entity as one of the transferred assets. Any successor must honor this policy for the information it receives, and you will be notified of material changes as described in Section 17.

7. International Transfers

Calorie is operated from Australia, and our providers process data in the United States and other countries. Wherever your information is processed, we apply the protections described in this policy and require our providers to protect it with appropriate technical and contractual safeguards. Additional safeguards that apply to transfers of EU, EEA, and UK personal data are described in Section 16.

8. Your Rights and Choices; Deleting Your Account

• Access and edit. Your food logs and goals are visible in the app, and you can edit or delete any log entry directly in the app at any time.
• Delete your account. You can permanently delete your account and all associated data (food logs, goals, weight history, photos, and account details) directly in the app at any time — go to Settings → Account Actions → Delete Account. The deletion is immediate and cannot be undone. Alternatively, you may email [email protected] from your account email and we will delete your account for you.
• Data export. You may request a copy of your data at the same address.

If you are in California or another US state with a privacy law, Australia, Canada, the EU/EEA, or the UK, additional rights and disclosures apply to you — see Sections 13–16 below.

9. Data Retention

We keep your account data, food logs, goals, and body measurements for as long as your account exists. When your account is deleted, this data is deleted from our active database.

In deciding how long any category of information needs to be kept, we consider its amount, nature, and sensitivity, the potential risk of harm from unauthorised use or disclosure, the purposes it serves, and any applicable legal requirements.

10. Security

All data travels over encrypted connections (TLS) and is stored encrypted at rest. Access to your data is enforced at the database layer with row-level security. API keys for the services we use are held server-side and are never embedded in the app. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

Data breach notification. If a data breach occurs that is likely to result in serious harm to affected individuals, we will notify the individuals and the relevant regulators as required by law — including, in Australia, under the Notifiable Data Breaches (NDB) scheme in Part IIIC of the Privacy Act 1988 (Cth), and, elsewhere, under applicable breach-notification laws (for example, US state breach laws and the GDPR).

11. Children’s Privacy

Calorie is not directed at children. You must be at least 13 years old (or at least 16 where local law sets a higher threshold, such as parts of the EU) to create an account. We do not knowingly collect personal information from children; if we learn that we have, we will delete it. If you believe a child has created an account, contact us at the address below.

12. Health Disclaimer

Calorie estimates are generated from photos and public nutrition databases and are approximations, not medical advice. The app is not a medical device and should not be used to diagnose or treat any condition. Consult a qualified professional before making significant dietary changes.

13. US & California Residents

This section provides the disclosures required by the California Consumer Privacy Act as amended by the CPRA (“CCPA”), and applies to California residents; residents of other US states with similar laws have comparable rights as noted below.

Categories of personal information we collect

• Category: Identifiers — What it includes: Email, account ID, device identifiers, IP address; advertising identifiers for measuring and improving our advertising — Purposes: Account, security, product analytics, advertising measurement and optimisation
• Category: Sensitive personal information — What it includes: Health-related information: dietary habits (food logs), body measurements (age, weight, height, sex, activity level), physiological conditions, and meal photos — Purposes: Providing the service. Never for advertising.
• Category: Internet / device activity — What it includes: App interactions and events, crash diagnostics — Purposes: Product analytics, security, and debugging
• Category: Commercial information — What it includes: Subscription and purchase status — Purposes: Billing and subscription management

No sale of personal information; limited sharing for advertising

We do not sell your personal information. We do share limited device and advertising identifiers and app events with our advertising partners, which California law treats as “sharing” for cross-context behavioural advertising. We never share health-related information — food logs, body measurements, nutrition goals, or photos — for advertising, and we do not use sensitive personal information to infer characteristics about you.

Your California rights

• Right to know and access — request the categories and specific pieces of personal information we hold about you.
• Right to delete — request deletion of your personal information (you can also delete log entries or your account in the app).
• Right to correct — request correction of inaccurate information.
• Right to opt out of sale or sharing — you can opt out by declining the tracking prompt on iOS, changing it at Settings → Privacy & Security → Tracking, or emailing [email protected]. We honour Global Privacy Control (GPC) signals.
• Right to limit the use of sensitive personal information — we already limit use of your health-related information to providing the service; we never use it for advertising.
• Non-discrimination — we will not treat you differently for exercising these rights, though some features may depend on the subscription you hold.

To exercise any of these rights, email [email protected] from your account email. We will verify the request against your account and respond within the timeframe the law requires. You may use an authorized agent, provided we can verify the request.

Other US states

If you live in another US state with a comprehensive privacy law (for example Virginia, Colorado, Connecticut, Texas, or Oregon), you may have similar rights of access, correction, deletion, and portability. Because we process health-related data, many of these laws require your consent before we process sensitive data; where that applies, we rely on the consent you give by agreeing to the Terms and using the app. We do not sell personal data; our advertising sharing is described in the Advertising and Attribution section above. Exercise these rights at the address above; if we decline and your state gives a right to appeal, reply with APPEAL in the subject line, and you may then contact your state Attorney General.

Consumer health data (Washington & Nevada)

Washington and Nevada have laws specifically covering consumer health data. Your food logs, body measurements, and photos are health-related information covered by these laws. We do not sell consumer health data, and we never share it for advertising. See our dedicated Consumer Health Data Privacy Policy for the full disclosures and your rights under Washington’s My Health My Data Act and Nevada’s SB 370.

14. Australia (Privacy Act 1988)

If you are in Australia, we handle your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

• Collection and use. We collect the personal (and sensitive) information described in this policy for the purposes described. Your food logs, body measurements, and photos are sensitive information under the Act; we collect and use them to provide the service. You may stop further use by deleting your data or account.
• Access and correction. You may request access to, and correction of, the personal information we hold about you (APPs 12–13), at the address below.
• Overseas disclosure. As described in Section 7, your information may be disclosed to and processed by our providers overseas, including in the United States (APP 8).
• Data breaches. We comply with the Notifiable Data Breaches scheme as described in Section 10.
• Complaints. If you have a privacy complaint, contact us first at [email protected]. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

15. Canada

If you live in Canada, we handle your personal information under PIPEDA and applicable provincial laws. We rely on the consent you give by agreeing to the Terms and using the app, which covers your health-related details, and implied consent for routine operations. You may access and correct your information, and request deletion, at [email protected], and complain to the Office of the Privacy Commissioner of Canada or your provincial regulator. Quebec residents have additional portability and de-indexing rights under Law 25.

16. EU, UK & EEA Residents (GDPR)

If you live in the European Economic Area or the United Kingdom, the GDPR (and its UK equivalent) applies to our processing of your personal data.

Data controller

The controller is Javid Rezaei, trading as Calorie, Queensland, Australia. Contact: [email protected].

Legal bases and health data

If you are in the EU, EEA or UK, your meal photos are sent to our vision provider solely to perform the scan you requested and return its result.

We rely on: performance of a contract (Art. 6(1)(b)) to provide the service — that is, to run the scan you requested, keep your food log, and calculate your targets; legitimate interests (Art. 6(1)(f)) for security and product analytics; consent (Art. 6(1)(a)) for advertising measurement and optimisation, which you give through the App Tracking Transparency prompt on iOS and can withdraw at any time at Settings → Privacy & Security → Tracking; and legal obligation (Art. 6(1)(c)) where applicable. Your food logs, body measurements, and photos are special-category health data under Art. 9; we process them only as necessary to provide the service you asked for, which we consider to fall under Art. 9(2)(a) as processing you have explicitly requested by submitting a scan. Your health data is never used for advertising.

Your GDPR rights

• Access, rectification, erasure, restriction, portability, and objection at any time.

Exercise these rights at [email protected]. You may also lodge a complaint with your local data protection authority (in the UK, the Information Commissioner’s Office). Transfers outside the EEA/UK rely on appropriate safeguards such as Standard Contractual Clauses.

17. Changes to This Policy

We may update this policy as the app evolves. We will post the updated policy at this address and update the effective date above. Material changes will be highlighted in the app.

18. Contact

Questions, requests, or concerns about your privacy: Javid Rezaei (trading as Calorie), Queensland, Australia [email protected]