Privacy Policy

Last updated: October 8, 2026

Calorie Crusher ("we", "our", "us") operates the Calorie Crusher mobile application (the "App") and the website at caloriecrusher.ai (the "Site"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data.

This policy is information about how we process your data. It is not a contract, and using the App is not taken as agreement to it. Where processing relies on your consent, we ask for that consent separately: in the App when you create your account, or through an iOS permission dialog.

The short version

• Your data is yours. What you log, photograph and tell the assistant belongs to you.
• We do not sell it. We do not rent it, trade it, or use it for advertising.
• We do not train AI models on it. Not ours and not anyone else's. Our AI provider processes your requests to answer them, and we have not agreed to let it use your content for training.
• You can delete it. Deleting your account in the App removes your account and everything in it from our systems. Copies held by our AI provider expire on its own schedule, within 30 days.

1. Information We Collect

1.1 Personal Data You Provide

Email address: used solely for account creation and sign-in. We do not collect your name, phone number, physical address, or any other personal identifiers.

Sign in with Apple: if you choose it, Apple gives us a stable identifier for your Apple ID and the email address you decide to share, which may be an Apple private relay address. We use both only to sign you in and to match the account you already have. When you delete your account we ask Apple to revoke the sign-in.

1.2 Data You Create Within the App

When you use the App, you may create the following data which is stored in your account:

• Food logs and nutrition data: Meals you log, AI-generated calorie and macro estimates, micronutrient data, daily goals, weight entries, recipes, and saved foods.
• Chat history: Conversations with the AI calorie assistant, including text messages you send.
• Dietary preferences: Food preferences, likes, dislikes, and dietary restrictions you configure.
• Consent records: Which version of the Terms of Service you accepted and when, and when you gave your health-data consent, so that we can show you what you agreed to and prove that we asked.
• How you heard about us: If you answer the optional one-time question after sign-up (for example "A friend" or "Social media"), we store your answer, or that you skipped it. We use it only in aggregate to understand where people find the App.

1.3 Data Collected With Your Permission

The following data is collected only when you explicitly grant permission through iOS system prompts:

• Health data (Apple HealthKit or Health Connect): Active calories burned, read from Apple HealthKit on iOS or from Health Connect on Android to display your daily energy balance. See Section 7 for detailed disclosures.
• Photos: Meal photos you choose to capture or select for AI-based calorie estimation. Photos are transmitted to our servers for processing.
• Approximate location: Coarse location (city-level) used to improve local food and shopping search results. We do not access precise GPS coordinates or track location history.

1.4 Automatically Collected Data

We collect minimal technical data to operate and maintain the service:

• API usage metrics: Request counts, response times, and error rates, used for service reliability monitoring.
• Device type and OS version: Sent with API requests for compatibility purposes.
• App version, device language and region: Sent by the App with each request. We keep the latest values on your account to know which versions are still in use and which languages to support.
• Country: Derived from the IP address of your connection when you use the App, and stored on your account as a two-letter country code only. We do not store your IP address with your account, and we do not derive anything more precise than the country. The lookup uses IP Geolocation by DB-IP, which runs on our own servers, so your address is not sent to DB-IP.

We do not use third-party analytics SDKs (no Google Analytics, Firebase Analytics, Mixpanel, or similar). We do not use advertising SDKs or tracking frameworks. We do not collect device advertising identifiers (IDFA).

2. How We Use Your Information

We use the information described above for the following purposes:

• Provide core functionality: AI calorie estimation, food logging, nutrition tracking, recipes, goals, and insights.
• Display your progress: Daily intake summaries, macro breakdowns, trends, and goal tracking.
• Personalize AI responses: Use your dietary preferences and chat history to provide relevant, context-aware nutrition guidance.
• Account management: Sign-in, authentication, and subscription management.
• Service maintenance: Monitor API performance, diagnose errors, and improve reliability.
• Communication: Send essential account-related emails (e.g., password reset, critical service notices). We do not send marketing emails.

We do not use your data for anything else. In particular we do not sell it, we do not use it for advertising or for profiling on behalf of others, and we do not use it to train or improve AI models. We do not read your food logs or chats as part of running the service. We look at them only when you ask us to in a support request, when we have to investigate abuse or a security problem, or when the law requires it.

3. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA) or the United Kingdom, we process your data under the following legal bases:

• Contract performance: Processing necessary to provide the App and its features (Article 6(1)(b) GDPR).
• Consent: For optional data such as HealthKit or Health Connect access, photos, and location: you grant or revoke consent through iOS or Android system permissions (Article 6(1)(a) GDPR).
• Explicit consent for health-related data: Your body measurements, weight, goals and what you eat can reveal information about your health. We process this data only with your explicit consent (Article 9(2)(a) GDPR), which the App asks for when you create your account and again if what you are consenting to changes. The App cannot work without this data. You can withdraw your consent at any time by deleting your account in the App under Account, or by writing to support@caloriecrusher.ai. Withdrawal does not affect the lawfulness of processing before it.
• Legitimate interests: Service reliability monitoring and fraud prevention (Article 6(1)(f) GDPR).
• Legal obligation: When required to comply with applicable laws (Article 6(1)(c) GDPR).

4. AI Processing and Third-Party Services

Your food descriptions and meal photos are processed by third-party AI services to generate calorie and nutrition estimates. To make responses relevant, the AI request can also include the parts of your Calorie Crusher profile that are useful for the current request, such as goals, body metrics, dietary preferences, relevant memory and chat context, and today's logged nutrition.

• OpenAI: processes food text descriptions and meal photos to estimate calories, macros, and micronutrients. OpenAI processes this data according to their privacy policy.

No training. We use OpenAI through its business API. Under its API terms, content sent to the API is not used to train OpenAI's models unless the customer opts in, and we have not opted in. We do not train models on your data ourselves either.

If you grant location permission, we may send a coarse city/region/country location to OpenAI to ground local food and shopping searches. We do not send your email address, authentication identifiers, precise GPS coordinates, or Apple HealthKit active-energy data to AI providers.

5. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data. We share data only with the following categories of service providers, strictly for operating the App:

• AI processing providers (OpenAI): request content and relevant personalization context, as described in Section 4.
• Cloud infrastructure (Oracle Cloud): servers and databases that host the App backend.
• Database provider (MongoDB Atlas): stores your account and food log data.
• Email delivery (SMTP provider): sends account-related emails only.
• Payment processing (Apple App Store): manages subscriptions. We do not directly process payment information.
• Subscription management (Adapty): receives your account identifier and App Store purchase receipts to verify the Plus subscription and Extra AI Messages purchases. Adapty does not receive your food log.
• Sign in with Apple (Apple Inc.): when you use it, Apple knows that you signed in to the App. We receive only the identifier and email address described in Section 1.1.

These providers help us run the App. We do not allow them to use your data for advertising, and we have not agreed to let any AI provider use it to train models.

We may also disclose data when required by law, court order, or governmental authority, or to protect the rights, safety, or property of our users or the public.

6. Data Retention

• Account data (email): Retained for as long as your account is active. Deleted upon account deletion request.
• Food logs and chat history: Retained for as long as your account is active. You can delete individual entries within the App or request full deletion.
• Request logs: For each request to our servers we record technical data: the time, the route, the result, your device type and app version, your account ID and email address, a shortened IP address, and AI usage and cost figures. They do not contain the text of your messages or your photos. They are purged automatically after 30 days and removed when you delete your account.
• Photos: Processed in real-time for AI estimation. Not stored permanently on our servers after processing.
• AI request processing: OpenAI keeps the requests we send it, including photos, for up to 30 days for abuse monitoring and to hold the state of the response, and then deletes them. It does not use them for training. We cannot make it delete them sooner. We also use extended prompt caching for up to 24 hours to reduce response time and input cost.

Inactive accounts: If you have not signed in or used the App for 24 months, we delete your account and everything in it. We send a warning to your account email 30 days before that happens, and opening the App in that time keeps the account. Accounts with a running paid subscription are not deleted this way.

When you delete your account in the App, we remove your account and everything in it: your food log, weights, favourites, recipes, chat history and what the assistant has learned about you. We also ask Adapty to delete your subscription profile. Anything still held on our other systems is removed within 30 days, and copies at our AI provider expire within the 30 days described above, except where retention is required by law. An App Store subscription is separate: cancel it through your Apple Account.

7. Health Data (Apple HealthKit and Health Connect)

We integrate with Apple HealthKit solely to read active energy burned (calories) and display it alongside your food intake for a complete daily energy balance view. We comply fully with Apple's HealthKit guidelines:

• HealthKit data is never sold to third parties, data brokers, or advertisers.
• HealthKit data is never used for advertising, marketing, or user profiling.
• HealthKit data is never shared with third parties except as displayed to you within the App.
• HealthKit data is not stored on our servers. It is read from the device and displayed in real-time.
• HealthKit data is never disclosed to AI providers or any external service.
• You can revoke HealthKit access at any time in iOS Settings > Privacy & Security > Health.

Health Connect (Android). On Android, the App reads the same single data type, active calories burned, from Health Connect, and only after you grant the Health Connect permission. The commitments above apply in full: Health Connect data is not stored on our servers, is never sold, shared, or used for advertising or profiling, and is never disclosed to AI providers or any other external service. It is read from the device and shown to you in the App. You can revoke the App's Health Connect access at any time in the Health Connect settings on your device (Settings > Security & privacy > Privacy > Health Connect, or the Health Connect app), and you can withdraw your health data consent in the App under More > Privacy.

8. Data Storage and Security

We take the security of your data seriously:

• Encryption in transit: All data transmitted between the App and our servers is encrypted using TLS (HTTPS).
• Encryption at rest: Database storage is encrypted at rest.
• Authentication: Secure token-based authentication (JWT) for all API requests.
• Access control: Server infrastructure uses private subnets, firewalls, and role-based access.
• Secure credential storage: Authentication tokens are stored using iOS Keychain (via flutter_secure_storage).

While we implement industry-standard security measures, no system is 100% secure. If you become aware of a security issue, please contact us immediately at support@caloriecrusher.ai.

9. International Data Transfers

Our servers are located in the United Kingdom (Oracle Cloud, London region). If you access the App from outside the UK, your data will be transferred to and processed in the UK. For EEA users, the UK is recognized as providing an adequate level of data protection.

AI processing via OpenAI may involve data transfer to the United States. OpenAI participates in standard contractual clauses and other transfer mechanisms to ensure adequate protection.

10. Your Rights

10.1 All Users

• Access: Request a copy of the data we hold about you.
• Deletion: Request deletion of your account and all associated data.
• Correction: Update or correct your data within the App or by contacting us.
• Permissions: Revoke HealthKit or Health Connect, camera, photo library, or location permissions at any time in your device's Settings.

10.2 EEA and UK Users (GDPR)

In addition to the above, you have the right to:

• Data portability: Receive your data in a structured, machine-readable format.
• Restriction: Request restriction of processing in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Withdraw consent at any time for consent-based processing, without affecting the lawfulness of prior processing.
• Lodge a complaint: File a complaint with your local data protection authority (e.g., the UK Information Commissioner's Office at ico.org.uk).

10.3 California Users (CCPA/CPRA)

• You have the right to know what personal information we collect and how it is used.
• You have the right to request deletion of your personal information.
• We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
• We do not respond to Do Not Track (DNT) browser signals, as there is no uniform standard for DNT.

11. Children's Privacy

The App is not directed to children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If we learn that we have collected data from a child under the applicable age, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at support@caloriecrusher.ai.

12. Cookies and Tracking

The App does not use cookies. The website at caloriecrusher.ai does not use analytics cookies, advertising cookies, or tracking technologies. No third-party cookies are set.

13. Third-Party Links

The App or Site may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.

14. Business Transfers

If Calorie Crusher is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction, but only to a buyer that is bound to the commitments in this policy, including that your data is not sold and not used to train AI models. We will notify you via email or prominent notice in the App before your data is transferred, so that you can delete your account first if you prefer.

15. Changes to This Policy

We may update this Privacy Policy when the App, our processing or the law changes. We will post the updated policy on this page with a revised "Last updated" date.

For material changes, such as new purposes, new categories of data or new recipients, we will tell you in the App or by email before they take effect. Where the processing relies on your consent, we will ask for your consent again rather than assume it.

This policy is information about our processing, not a contract, so we do not treat your continued use of the App as agreement to it.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

Email: support@caloriecrusher.ai

Website: https://caloriecrusher.ai