Who is responsible
The controller for the CalFit app and this website is CalFit, Layth Fadhala, Kolonnenstr. 8, 10827 Berlin, Germany. Send privacy questions and requests to [email protected].
Data CalFit processes
Depending on how you use CalFit, we process:
- Account data: a random account ID, your name and profile photo if you add them or share them through Apple or Google, your email address if you sign up with email or add one, and an account identifier (plus the email they confirmed, if shared) when you sign in with Apple or Google, and the time zone your phone is set to, so your day starts at your own midnight.
- Profile and health-related data: age, sex, height, weight, goals and activity level from onboarding, plus meals, meal photos and descriptions, nutrition estimates, corrections, weight history, exercise and water entries, progress photos and other progress entries.
- Apple Health or Health Connect data, only if you connect it: workouts with their duration and calories burned, weigh-ins, body fat and drinks. Steps are read on your phone and never sent to us.
- Subscription status: entitlement and transaction status from the app stores and our subscription service provider.
- Technical and security data: IP address, device and app information, access logs and usage limits.
- Support messages you send us.
Purposes and legal bases
We use your data to provide the app and your account, sync your entries, analyze a meal or workout when you ask for it and verify your subscription (Art. 6(1)(b) GDPR, performance of a contract).
Health-related data such as body measurements, meals and nutrition entries is processed only with the explicit consent you give in the app’s privacy notice (Art. 9(2)(a) GDPR). You can withdraw it at any time in the app under Profile → Privacy → Withdraw consent; this does not affect the lawfulness of processing before the withdrawal. Because CalFit cannot work without this data, withdrawing consent deletes your account and its data; deleting the app alone does not.
We use technical data to keep CalFit and this website secure, prevent abuse and enforce fair-use limits (Art. 6(1)(f) GDPR, legitimate interests), and we keep records where the law requires it (Art. 6(1)(c) GDPR).
AI analysis
When you scan a meal or describe a workout, only the photo or description and the minimum technical context needed for the request are sent to our AI service providers. Your account ID, email address and profile are not sent. The result is an estimate and should be reviewed before saving. Please keep people, documents and other unrelated information out of meal photos.
Website and server logs
This website sets no cookies and loads no analytics or advertising. When you visit the website or use the app, our servers record technical access data: IP address, date and time, requested address (including food search terms), status code and browser or app information. We use these logs only to operate and secure the service and delete them automatically after 14 days. Application error logs are kept for up to 30 days.
Storage and retention
Entries waiting to sync can be stored on your device so the app works offline. On our servers, unsaved scan photos expire after 24 hours and photos of meals in your diary are deleted after 30 days; the meal and nutrition record remains until you delete it or your account. A photo kept in Saved foods stays until you remove it from Saved foods or delete your account. Progress photos and your profile photo are kept until you delete them or your account. When you delete your account, your data is erased except for a minimal deletion record and data we must keep by law. We email a short record of the deletion to your confirmed address, or to the one Apple or Google shared with us, unless Apple hid it. If you use CalFit as a guest without a linked login, we cannot identify your account after you uninstall the app, so delete your data in the app first. Guest accounts, and accounts whose email was never confirmed and that don't use Apple or Google sign-in, are deleted automatically 12 months after they were last used, or 12 months after a subscription ends if that is later. Support emails are kept as long as needed to handle your request and deleted at the latest three years later. Deleted data can remain in our encrypted backup for up to two days until it is overwritten.
An email address you enter waits beside your account until you type the 6-digit code we email to it. A code works for 60 minutes and is stored only in coded form. If another account confirms the address first, it is removed from yours. If you use Forgot password, we email a link to set a new password to your confirmed address; it works for 60 minutes. If an address reaches its hourly limits, we ask Apple or Google to confirm that a further request comes from the genuine CalFit app on a real phone. We receive only their answer.
Recent food suggestions
When you log a database food or typed meal estimate, CalFit keeps a reusable Recent suggestion with its name, portion, ingredients and nutrition. Deleting the diary entry does not remove this suggestion. You can remove it separately from Recently logged; deleting your account removes both. The suggestion does not store a meal photo.
PDF summary reports
If you ask for a PDF summary report, CalFit makes it from your entries and emails a download link to the address you enter, which can be someone else's, such as your doctor's. The link and the file are deleted after three days.
Apple Health and Health Connect
If you connect Apple Health (iPhone) or Health Connect (Android), CalFit reads, with your permission, only the kinds of data you allow: steps, workouts with their duration and calories burned, body weight, body fat and drinks logged in other apps. It reads only while the app is open and only the last 30 days.
Steps stay on your device and are not sent to our servers. Workouts, the first weigh-in of each day, drinks and your recent body fat are saved to your account like entries you log yourself, to work out your day’s calories and water, your weight trend and your plan. This data is never used for advertising, never sold and never shared beyond the service providers that run CalFit, unless you send it yourself in a PDF summary report. CalFit’s use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.
If you allow it when connecting, CalFit also writes each meal’s calories and nutrients and the water you log in CalFit to Apple Health or Health Connect, and keeps them up to date when you edit or delete them. You can turn this off at any time in the app; what was written stays there.
You can stop at any time in the app or in your phone’s health settings. Entries already added stay until you delete them or your account.
Groups
If you join a group, its other members see your display name, profile photo, current streak, on which days this week you stayed on target and today's calories against your goal. They never see your meals, photos of food, weight or other nutrition. Before you join, the app shows exactly this and asks you to agree; this sharing is based on that consent (Art. 9(2)(a) GDPR), and leaving the group withdraws it. In CalFit's public groups these members can be people you do not know. People who look at a group before joining, any CalFit user for a public group or anyone with the invite for a private one, see the name and photo of up to three of its newest members.
You can leave a group at any time, which removes you from its leaderboard and deletes the reactions sent to or by you there. You can block a member so neither of you sees the other, and report a member to us; a report includes the reason, both members and the group, and is used only to keep groups safe. Deleting your account removes your memberships, reactions, reports and blocks.
Service providers and transfers
We use service providers for the following tasks. Those that process data on our behalf are bound by data processing agreements.
Some providers are based in the United States or process data there. These transfers rely on the EU–U.S. Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.
- Hosting, servers and private photo storage in the EU.
- Network delivery and protection for the website and the app's connection to our servers.
- AI analysis of meals and workouts.
- Subscription status and purchase restoration.
- App updates.
- Email delivery.
- Apple and Google: app distribution, sign-in, payments and app integrity checks, as independent controllers.
Subscriptions and payments
Apple or Google processes store purchases. CalFit and its subscription service provider receive entitlement and transaction status needed to unlock the paid features and support purchase restoration. CalFit does not receive your full payment-card details.
No tracking or advertising
CalFit does not use advertising, advertising identifiers, partner tracking or marketing cookies. We do not sell your data or use your meals for advertising.
Your choices and rights
You can request access to, correction, deletion, restriction or portability of your data and withdraw consent at any time. You can also lodge a complaint with a data protection authority, for example the Berlin Commissioner for Data Protection and Freedom of Information. Contact [email protected] to make a request.
Your right to object
Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. We then stop, unless we can show compelling legitimate grounds that override your interests or need the data to establish, exercise or defend legal claims. Send your objection to [email protected].
Account deletion and age
You can delete your account in the app or follow the steps on our account deletion page. CalFit is intended only for adults aged 18 or older.
Changes to this policy
We may update this policy when the product, providers or legal requirements change. Material changes will be communicated in the app or on this page before they take effect where required.