Privacy Policy
Effective from TBD
Calora AI is an iOS and Android app for tracking what you eat from photos. This page explains what data we receive, why, who we share it with, how long we keep it and how you can control it. We follow the EU General Data Protection Regulation (GDPR) and the personal data protection law of the Republic of Moldova.
1. Who we are and how to reach us
The data controller is BR TEAM PRO SRL (IDNO 1018600004310), str. Otovasca 15, of. 2, MD-2023, Chișinău, Republica Moldova.
For any question about your data, write to support@caloraai.app. We reply within one month, as the GDPR requires.
2. What data we use and why
| Data | Why | Legal basis |
|---|---|---|
| Account: email (if you sign in by email or Apple or Google shared it), name from Apple or Google, sign-in identifier, language, time zone, theme, the “Keep meal photos” setting | sign-in, sync between devices, emails with a sign-in code and about a ready data export | contract |
| Device: installation identifier (random, created by the app), platform, app version, the result of the app integrity check (App Attest by Apple, Play Integrity by Google) | the guest account, protecting the trial scan from abuse | legitimate interest |
| Profile and goals: goal, sex, age, height, weight, target weight, activity — all optional | only to calculate your daily calorie and P/F/C target | your consent |
| Diary: meals, dishes, portions, calories and P/F/C | keeping the diary and statistics | contract |
| Food photos | estimating the dish from the photo and thumbnails in the diary | contract |
| Scan results: dish, ingredients, grams, confidence of the estimate, your corrections; the model and the cost of the call | showing and correcting the result, counting your scan quota, controlling AI costs | contract, legitimate interest |
| Purchases: subscription status, period, store, transaction numbers, scan packs. We have no payment details — Apple and Google take the payment | granting Plus and packs, restoring purchases | contract |
| Technical logs: time and address of a request, IP address, errors | running and protecting the service, limiting the number of guest accounts from one address | legitimate interest |
| App events: which screens and actions were used, platform, version, language, a pseudonymous identifier | understanding what works in the app and improving it | legitimate interest |
| Crash reports: description of the failure, device model, system and app version, a pseudonymous identifier | finding and fixing failures | legitimate interest |
We do not sell data, show ads or build advertising profiles.
3. Food photos and AI
- The photo reaches our server over a secure connection. The server immediately removes EXIF and other metadata from it, including location and camera data, and makes the image smaller. The original file is not kept.
- The dish is estimated by an external AI service. We send the request through OpenRouter to a model made by OpenAI. OpenRouter chooses the provider that runs the request: OpenAI or another company that hosts this model, such as a cloud provider. The model receives the photo through a temporary link that works for 5 minutes.
- The request goes only to providers that do not keep its content (Zero Data Retention) and do not use it to train models. If no such route is available, the scan is not performed and is not sent anywhere else.
- Photos are never published or sold.
- While “Keep meal photos” is on, a photo is kept until you delete it, all photos or your account — including photos of scans you did not save to the diary.
- If you turn the setting off, the photo of a new scan is deleted once you save the scan to the diary or right after the scan fails, and the photo of a scan you did not save — 24 hours after the scan ends. Photos kept before stay — you can remove them with “Delete all photos”.
- A photo that was never sent for a scan is deleted after 24 hours.
4. Who we share data with
| Recipient | What it receives | Where |
|---|---|---|
| OpenRouter | the photo and the text of the request to estimate the dish | USA |
| The model provider chosen by OpenRouter: OpenAI or a company that hosts the model | the same, only to produce the answer; does not keep it under Zero Data Retention | the country depends on the OpenRouter route |
| RevenueCat | account identifier, receipts and status of purchases from the App Store and Google Play | USA |
| Apple and Google | sign-in with Apple or Google, purchases in the App Store and Google Play, the app integrity check | under their own rules |
| Sentry | crash and error reports of the app and the server with a pseudonymous identifier; IP address and request content are not stored | EU region |
| PostHog | app events with a pseudonymous identifier; IP address is not stored, sessions are not recorded | EU Cloud, EU |
| Hetzner | server, database, photo storage and backups; our mail server that sends emails runs there too | Germany |
OpenRouter and RevenueCat are in the USA, and the model provider may also be outside the EU. Data is transferred outside the EU on the basis of the European Commission’s standard contractual clauses.
Apple and Google process the data of your Apple or Google account and of purchases in their stores under their own privacy policies.
5. How long we keep data
- Account, profile, diary and scans — as long as the account exists.
- Photos — as described in section 3.
- Deleted diary entries — 30 days more, then they are erased for good.
- A guest account without sign-in is deleted together with its photos if it has not been used for 30 days.
- A data export archive and its link — 7 days.
- Database backups — 14 days, then they are replaced by new ones. Within this period deleted data also disappears from backups.
- App events in PostHog — for up to 365 days, error reports in Sentry — for up to 90 days, then the service itself deletes them.
- Technical server logs — for a limited time, then deleted automatically.
After you delete your account, the following remains:
- a device record — the random installation identifier and a mark that the trial scan was used, not linked to any account;
- irreversible hashes of your sign-in methods with the limits still running, so that deleting the account and signing in again does not reset them: the number of scans used in the current week or subscription month, the times of unpaid scans (not charged to your quota) in the last 24 hours without their content, and the number of photo uploads in the last 24 hours — each until its period ends;
- app events in PostHog and error reports in Sentry with the pseudonymous identifier — for up to 365 days and 90 days respectively; once the account is deleted, this identifier is not linked to anything we keep;
- total AI costs per day, without users.
6. Your rights
Under the GDPR you can:
- access your data and get a copy in a machine-readable format — in the app: “Profile” → “Data and privacy” → “Download my data”. The archive contains JSON, a CSV of your diary and your photos. Export is available after you sign in;
- correct your data — profile, goals and diary entries can be changed in the app;
- erase your data — “Profile” → “Data and privacy” → “Delete account and data” or “Delete all photos”. Cancel your App Store or Google Play subscription separately;
- restrict processing and object to processing based on legitimate interest;
- withdraw consent to the processing of your profile data — change it in the app, delete your account or write to us. Withdrawal does not affect processing before it;
- lodge a complaint with a supervisory authority: in the Republic of Moldova — the National Center for Personal Data Protection (datepersonale.md), in the EU — the data protection authority of your country.
Anything you cannot do in the app you can request by email to support@caloraai.app from the address linked to your account.
7. Children
Calora AI is not intended for people under 16. If you learn that a child under 16 has created an account, write to us and we will delete it.
8. Security
- The app exchanges data over an encrypted connection (HTTPS) with our server and directly with RevenueCat (purchases), PostHog (app events), Sentry (error reports), and Apple and Google (sign-in, purchases and the app integrity check).
- Photos and exports are kept in private storage and are reachable only through temporary links.
- Secret keys of external services are kept only on the server, never in the app.
- Only our team has access to the server and the data.
9. Changes to this policy
If the policy changes, we will update this page and the date at the top. We will tell you about significant changes in the app.
Calora AI is not a medical service. The photo estimate is approximate and does not replace a doctor’s advice.