Privacy policy

In short

We never sell your data and the app shows no ads.

Your food log and weight history live on your phone. They reach our servers only for the features that need them: AI meal analysis, the Kalo coach, and cloud backup if you sign in and turn it on.

To work, Kaloria processes health information (meals, weight, goals). We ask for your explicit consent for that in the app.

In the EU, EEA and UK, usage statistics and install measurement run only if you allow them. You can change your choice anytime in the app under Profile → Data & privacy, and on the website under Cookie settings.

Who is responsible

The controller of your personal data is Jan Horák, sole trader (fyzická osoba podnikající, OSVČ), ID No. 06599648, Czech Republic — registered business address in the Czech Trade Register (ares.gov.cz, ID No. 06599648) ("we"). Contact: info@kaloria.ai.

We have not appointed a data protection officer; write to the address above about anything in this policy.

What we process, why, and on what legal basis

The legal bases below refer to the EU General Data Protection Regulation (GDPR).

• Your profile, food log, water, weight and goals: to calculate your plan and show your progress. Stored on your device. Legal basis: performance of our contract with you (Art. 6(1)(b)) and, because this is health information, your explicit consent (Art. 9(2)(a)), which you give in the app before your plan is created.
• AI meal and voice analysis: when you photograph a meal, describe it or dictate it, the photo, text or audio is sent to our server and from there to AI providers that return the nutrition estimate (via OpenRouter, to models such as Google Gemini or OpenAI; dictation via Soniox). Your name, weight and goals are not attached to these requests. We keep analysis logs for 12 months to improve accuracy and handle complaints. Legal basis: contract and explicit consent (Art. 9(2)(a)).
• The Kalo coach: when the coach is on, your profile (name, age, sex, height, weight, goal, activity, diet) and recent journal are sent with your messages and with automatic coach comments, so the answers fit you. Conversations are stored on our server, also without an account, until you delete them or your account. You can turn Kalo off in Settings. Legal basis: contract and explicit consent (Art. 9(2)(a)).
• Account and cloud backup (optional): if you sign in with e-mail, Apple or Google, we store your e-mail address and account ID. If you also turn on backup and sync, your journal, weight, water, workouts, chats and (Pro) meal photos are stored on our servers so they sync across devices. You give a separate explicit consent for this, which you can withdraw in Account. Legal basis: contract (Art. 6(1)(b)) and explicit consent (Art. 9(2)(a)).
• Purchases: subscriptions are bought through Apple App Store or Google Play; we receive the purchase status, not your payment details. RevenueCat manages subscription status for us. Legal basis: contract (Art. 6(1)(b)) and legal obligations such as accounting (Art. 6(1)(c)).
• Invite and creator codes: when you use a code or a creator's link, we and our affiliate platform InfluTo (influ.to) record the code and the install so that you receive the offer and the creator can be paid a commission; InfluTo also receives your later subscription events for this purpose. Legal basis: contract (Art. 6(1)(b)) and our legitimate interest in paying our partners correctly (Art. 6(1)(f)).
• Usage statistics (Google Analytics for Firebase): anonymous-ID based statistics about which screens and features are used, so we can improve the app. No body or nutrition values are sent. In the EU, EEA and UK this runs only with your consent (Art. 6(1)(a) GDPR and the national rules on access to your device); elsewhere on the basis of our legitimate interest (Art. 6(1)(f)), with an opt-out in Settings.
• Install measurement (AppsFlyer, RevenueCat attribution, Apple Search Ads): which post, creator or campaign brought a new user, using device identifiers (IDFV, Android advertising ID; IDFA only if you allow tracking on iOS) and IP address. No health data is sent. In the EU, EEA and UK this runs only with your consent; on iOS the system tracking prompt appears only after that. Legal basis: consent (Art. 6(1)(a)) or, outside these regions, legitimate interest (Art. 6(1)(f)).
• Crash reports (Firebase Crashlytics): technical details of a crash (device model, OS, app version, stack trace) so we can fix it. Legal basis: legitimate interest in a working app (Art. 6(1)(f)); you can turn crash reports off in Settings.
• Notifications: local reminders never leave your phone. If you allow coach push notifications, your push token is sent to our server and delivered through Expo, Apple and Google. Legal basis: consent (your notification permission).
• Apple Health and Health Connect: read and written only with your permission, to sync steps, activity, weight, water and nutrition. This data is never used for advertising and never shared with analytics or attribution providers.
• E-mails: sign-in codes and replies to your messages are sent through Resend. Legal basis: contract (Art. 6(1)(b)).
• Server logs: our servers record IP address, time and request details for security and abuse prevention and delete them after 90 days. Legal basis: legitimate interest (Art. 6(1)(f)).
• Website (kaloria.ai): Google Analytics runs only after you accept it in the cookie bar (in Europe); without consent no Google tag is loaded. The website shows no advertising and uses no advertising cookies.

Who helps us (processors and recipients)

These providers process data on our behalf under data processing agreements, or receive it as explained above:

• INTERNET CZ (Czech Republic): server hosting for our API, updates and InfluTo.
• OVHcloud (France): storage of meal photos for cloud backup.
• OpenRouter (USA) and the AI model providers it routes to, such as Google and OpenAI: AI meal analysis and the Kalo coach.
• Soniox (USA): speech-to-text for dictation.
• Google (Ireland/USA): Firebase Analytics, Crashlytics, Health Connect; Google Play for purchases.
• Apple (Ireland/USA): App Store purchases, Apple Health, push delivery.
• RevenueCat (USA): subscription status.
• AppsFlyer (Israel/USA): install measurement, only with your consent in the EU, EEA and UK.
• InfluTo (Czech Republic): invite and creator codes, commissions.
• Expo / 650 Industries (USA): push notification delivery.
• Resend (USA): e-mail delivery.

Transfers outside the EU

Some providers are in the USA or Israel. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, on the European Commission's adequacy decision for Israel, or on the EU Standard Contractual Clauses.

How long we keep data

• On your device: until you delete it (Profile → Delete all data) or uninstall the app.
• Account and cloud backup: until you delete your account; deletion completes after a 7-day grace period.
• AI analysis logs: 12 months.
• Kalo conversations: until you delete them or your account; for guests, on request by e-mail.
• Server logs: 90 days.
• Usage statistics: up to 14 months (Google Analytics retention).
• Install measurement: up to 24 months.
• Purchase and accounting records: as long as the law requires (typically 10 years).

Your rights and choices

You have the right to access your data, to have it corrected or deleted, to restrict processing, to data portability (Profile → Export my data) and to object to processing based on legitimate interest. You can withdraw any consent at any time, without affecting processing before the withdrawal: in the app under Profile → Data & privacy (usage statistics, install measurement, crash reports), in Account (cloud backup), in your phone settings (tracking, notifications, Health permissions), and on the website under Cookie settings.

Because the app cannot calculate your plan without processing your health information, withdrawing that consent means stopping use of the app and deleting your data, which we will do on request.

To exercise your rights, write to info@kaloria.ai. We answer within one month.

You may complain to a supervisory authority, in particular in the EU country where you live or work. Our lead authority is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.cz). In Hungary: NAIH (www.naih.hu); in Slovakia: Úrad na ochranu osobných údajov SR (dataprotection.gov.sk); in Germany: the data protection authority of your federal state.

Children, automated decisions, changes

Kaloria is for people aged 16 and over.

Calorie and nutrition estimates are generated automatically, but no decision with legal or similarly significant effects is made about you by automated means.

We will update this policy when our processing changes. Material changes are announced in the app; where your consent is needed again, we will ask for it.