Who is responsible
The controller for the CalFit app and this website is CalFit, Layth Fadhala, Kolonnenstr. 8, 10827 Berlin, Germany. Send privacy questions and requests to [email protected].
Data CalFit processes
Depending on how you use CalFit, we process:
- Account data: a random account ID, your email address if you register with email, and an account identifier (plus email, if shared) when you sign in with Apple or Google.
- Profile and health-related data: age, sex, height, weight, goals and activity level from onboarding, plus meals, meal photos and descriptions, nutrition estimates, corrections and progress entries.
- Subscription status: entitlement and transaction status from Adapty and the app stores.
- Technical and security data: IP address, device and app information, access logs and usage limits.
- Support messages you send us.
Purposes and legal bases
We use your data to provide the app and your account, sync your entries, analyze a meal when you ask for it and verify premium access (Art. 6(1)(b) GDPR, performance of a contract).
Health-related data such as body measurements, meals and nutrition entries is processed only with your explicit consent (Art. 9(2)(a) GDPR). You can withdraw consent at any time with effect for the future; features that need this data then stop working.
We use technical data to keep CalFit and this website secure, prevent abuse and enforce fair-use limits (Art. 6(1)(f) GDPR, legitimate interests), and we keep records where the law requires it (Art. 6(1)(c) GDPR).
AI meal analysis
When you request a scan, only the meal photo or description and the minimum technical context needed for the request are sent to our AI provider, currently Google Gemini with OpenAI as a fallback. Your account ID, email address and profile are not sent. The result is an estimate and should be reviewed before saving. Please keep people, documents and other unrelated information out of meal photos.
Website and server logs
This website sets no cookies and loads no analytics or advertising. When you visit the website or use the app, our servers record technical access data: IP address, date and time, requested address, status code and browser or app information. We use these logs only to operate and secure the service and delete them automatically after 14 days. Application error logs are kept for up to 30 days.
Storage and retention
Entries waiting to sync can be stored on your device so the app works offline. On our servers, unsaved scan photos expire after 24 hours and photos attached to saved meals are deleted after 30 days; the meal and nutrition record remains until you delete it or your account. When you delete your account, your data is erased except for a minimal deletion record and data we must keep by law. If you use CalFit as a guest without a linked login, we cannot identify your account after you uninstall the app, so delete your data in the app first.
Service providers and transfers
We use the following providers. Those that process data on our behalf are bound by data processing agreements.
Some providers are based in the United States or process data there. These transfers rely on the EU–U.S. Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.
- Hetzner Online (Germany): servers and private photo storage in the EU.
- Cloudflare: network delivery and protection for the website and the app's server connection.
- Google (Gemini API) and OpenAI: AI meal analysis.
- Adapty: subscription status and purchase restoration.
- Zoho (EU data center): email delivery and the support mailbox.
- Apple and Google: app distribution, sign-in and payments, as independent controllers.
Subscriptions and payments
Apple or Google processes store purchases. CalFit and Adapty receive entitlement and transaction status needed to unlock premium features and support purchase restoration. CalFit does not receive your full payment-card details.
No tracking or advertising
CalFit does not use advertising, advertising identifiers, partner tracking or marketing cookies. We do not sell your data or use your meals for advertising.
Your choices and rights
You can request access to, correction, deletion, restriction or portability of your data, object to processing based on legitimate interests and withdraw consent at any time. You can also lodge a complaint with a data protection authority, for example the Berlin Commissioner for Data Protection and Freedom of Information. Contact [email protected] to make a request.
Account deletion and age
You can delete your account in the app or follow the steps on our account deletion page. CalFit is intended only for adults aged 18 or older.
Changes to this policy
We may update this policy when the product, providers or legal requirements change. Material changes will be communicated in the app or on this page before they take effect where required.