Privacy Policy

Last updated: 21 October 2026

KcalScan ("we", "us") is a nutrition tracking service operated by Tiago Fernandes, available as an iPhone app, an Android app, a web app and this website. This policy explains, in plain language, what we collect and how, what we use it for, who processes it — including the AI services that analyse your meals — how long we keep it, and how you stay in control.

In short. We use your data to run KcalScan for you. We never sell it, never show ads and never share it with advertisers. AI features send the data they need to Google (Gemini) and, as a backup for food analysis only, to OpenAI — and only after you allow it on the in-app permission screen, "Share your data with AI providers?". You can change that choice at any time in Settings → Privacy & AI, and export or delete your data in Settings → Account.

1. Information we collect and how we collect it

Account information — from your sign-in. If you sign in with Apple or Google, we receive your email address (which can be an Apple "Hide My Email" address), your name and, from Google, your profile photo. On iPhone you can instead choose "Continue without an account": we then create an anonymous account on our servers, identified only by a random ID, with no name or email, and store your data under it like any other account; you can later link Apple or Google to keep it, or delete it. KcalScan has no email-and-password accounts. Every account has a random user ID.
Profile and health information — entered by you. Date of birth or age, sex, height, weight and weight history, activity level, goals, diet type, restrictions and allergies, health conditions you choose to declare (with the stage, if you declare kidney disease), pregnancy (due date or weeks of pregnancy, and your weight before pregnancy), breastfeeding and menstrual status, body measurements, the supplements and medications you log, and nutrition plans you import from a professional (which can include body-composition figures and the professional's name). You enter these during setup or in Settings. They are health data, and we use them only to provide the service to you.
Meals and nutrition — entered by you. Your meal logs (foods, amounts, times and nutrients), notes and descriptions, favourites and water intake, plus a small compressed preview of each meal photo, stored with the log.
Photos and documents you choose to analyse. Meal photos (including photos of what you left of a meal), fridge or pantry photos, supplement or medication labels, photos you attach in the AI coach, and PDFs or photos of a nutrition plan. They are sent for AI analysis only if you allow it (section 3). Apart from the meal preview above, we do not store them on our servers.
AI coach conversations and memories. Your messages and the coach's replies are kept on your device only. What KcalScan remembers about you is kept in your account: things the coach saves when you tell it something lasting (for example, a food you don't like or how you take your coffee), notes and food swaps you add in Settings → AI coach & food → What KcalScan remembers, and scan corrections you choose to keep. Food swaps that earlier versions of the app learned from your corrections are listed there for you to keep or discard; any you have not kept after 30 days are deleted. You can see, edit and delete all of them there. So that the app asks only once whether to remember a correction you repeat, your account also keeps a count of the food names you correct on scan results or saved meals; that count is never sent to an AI provider. When the coach takes an action for you — logging a meal, water or your weight, reading your recent meals or today's totals, or saving or deleting a memory — a record of that action and its details is kept in your account. For a memory, that record includes the text the coach was asked to save, and it stays after you undo or delete the memory, until you delete your account.
Location — detected automatically, approximate. To match food estimates to products sold where you are, the app works out your country (and city, when available) when you open the AI coach or Settings. On iPhone and on Android 12 or later it asks for permission to use your approximate location (on iPhone, approximate is the default). On Android 8 to 11, or when the app cannot tell which Android version it runs on, it asks for no location permission and uses your device's time zone, unless an earlier version of the app was already allowed to use your location. If you allow it, the app rounds your position to about 10 km and sends it from your device to the OpenStreetMap Foundation's Nominatim service to look up the country. Versions of the app from before this update send the position without rounding it, and can include it in crash and error reports (Sentry); update the app to have it rounded. If you don't allow it, or on the web, the app uses your device's time zone instead. You can also type your country yourself and lock it in Settings → AI coach & food. Your account stores the country and city, not your coordinates, and the app never uses location in the background. In travel mode we also store the destination and accommodation details you enter.
Apple Health and Health Connect — optional, read with your permission. Steps, energy burned, workouts and sleep (section 5). Daily totals of these are saved in your account unless you switch this off (section 5).
Calendar — optional, read with your permission. If you connect your calendar, the app reads the title, time and location of your events in the next 48 hours, never their notes. They stay on your device and are used only as AI coach context (section 3).
Barcode lookups. When you scan a barcode, the app sends the barcode number from your device to Open Food Facts to fetch the product's nutrition label.
Purchases. Your plan, subscription status, trial dates and store transaction references, received from the App Store, Google Play (through RevenueCat) or Stripe. We never receive your card details.
Your privacy choices. Whether you allowed or declined AI data sharing, or closed the permission screen without choosing; which version of that screen you saw and when; the app version and kind of device (iPhone, Android or web) you answered on; and your email and notification preferences.
Messages to us. Feedback you send in the app and emails you send us.
Usage, device and diagnostics — collected automatically. App events such as screens viewed, scans started and purchases (Google Analytics for Firebase); crash and error reports with performance traces (Sentry), which include your user ID and email so we can fix problems on your account, plus technical context such as the web addresses the app contacted just before an error; device model, operating system, app version, language and time zone; and technical logs on our servers, such as IP addresses and request times, which also support rate limiting and app-integrity checks (Firebase App Check with Apple App Attest on iPhone, Google Play Integrity on Android and Google reCAPTCHA on the web).
On the marketing website: if you arrive via a referral link, a kcall_ref cookie stores the referral code for 30 days so sign-up credit goes to the right person. Our website analytics run in cookieless mode by default (Google Consent Mode with storage denied).

2. How we use your information

Provide the service: log meals, compute nutrition, keep your diary, and sync it across your devices.
Calculate your targets: calorie, macronutrient, water and micronutrient targets from your profile, declared health conditions, pregnancy or breastfeeding status and, if you turn on dynamic targets, your wearable activity. The published equations and reference values, with links to their sources, are listed in the app under Settings → Sources & methodology; where a rule is our own, the app labels it as a KcalScan estimate.
Run the AI features you use — only if you allow AI data sharing: estimate nutrition from photos and text, read pantry and supplement labels, import nutrition plans, write meal verdicts and report summaries, and power the AI coach (section 3).
Adapt to where you are: your country, so food estimates use products sold there; and your time zone, for daily totals and reminders.
Create reports you ask for: the PDF nutrition report is built on your device and goes only where you choose to share it.
Send reminders you turn on, such as supplement reminders and the end-of-day summary.
Manage subscriptions, trials, referrals and payments, including a discount offer when a free trial ends.
Communicate with you: service messages about your account and purchases; welcome and getting-started emails and a short monthly email about new features, which you receive unless you switch off "Product news emails" in Settings → Help & support or use the unsubscribe link in any email; and, on Android, occasional product news notifications, which you can switch off in the same place. To decide which reminders and emails to send, we group accounts each day by recent activity (for example new, active or lapsed).
Keep KcalScan reliable and safe: fix crashes, understand which features are used, prevent abuse (authentication, rate limits and app-integrity checks), and keep the records the law requires, such as invoices.

We do not sell your personal data, do not show ads, do not share your data with advertisers or data brokers, and do not track you across other companies' apps or websites. We do not use your data to train AI models. Google does not use what our AI features send it (section 3) to improve its products or to train AI models, apart from models used only to detect abuse. OpenAI does not use what our AI features send it (section 3) to train its models.

3. AI processing and your permission

Your permission comes first

Before KcalScan sends any of your data to an AI provider, it asks for your permission on a dedicated screen, "Share your data with AI providers?". The screen lists the data each AI feature sends, names the providers — Google (Gemini) and OpenAI — and offers two buttons of the same size, Allow and Don't allow. It is separate from accepting our terms and this policy. New users see it during setup; people who already used KcalScan see it once, the first time they open an updated version of the app. If you close it without choosing, nothing is sent, and the app asks again the next time you use an AI feature.

If you allow it, each AI feature sends the data listed in the table below when you use it.
If you don't, nothing is sent to any AI provider, and our servers refuse AI requests from your account. Manual logging, barcode lookup, your diary and targets, Trends, detailed nutrients, PDF reports without the AI summary, and Apple Health and Health Connect keep working. AI features show "AI features are off", with a button to turn them on.
You can change your choice at any time in Settings → Privacy & AI, under "AI data sharing". Turning it off stops any further sending. It cannot recall requests that were already processed; those are kept by the providers only as described below.
If we add an AI provider or start sending a new category of personal data, we will ask you again.
Older versions of the app. Versions of KcalScan from before this update do not show this screen. If you use an AI feature in one of them, it sends the data listed below, and photos are sent as they are — unless you have turned AI data sharing off in an updated version, in which case our servers refuse the request. Update the app to make or change your choice.

What each AI feature sends, and to whom

AI requests travel from your device to our own servers (Google Cloud Functions), which forward them to the AI provider. Providers receive the content the task needs — never your name, email address, account ID or payment details, unless they appear in something you choose to send, such as a nutrition plan document with your name on it. Before a photo leaves your device, the app removes hidden details the camera may have added, such as where the photo was taken; if it cannot remove them, it does not send the photo. PDF files are sent as they are, including any details stored in them, such as the author's name.

Google (Gemini) handles every AI feature. OpenAI is a backup, used only when Gemini is unavailable and only for the food-analysis features marked below. AI coach conversations, meal verdicts, the report summary and plan import never go to OpenAI; meals the AI coach logs for you are analysed like any other meal.

Feature	Data sent	Sent to
Meal photo analysis — including the first scan during setup, retries, meals the AI coach logs from a photo you attach, and photos of what you left of a saved meal (Platinum)	The photo; any description you add; your country; food names you've corrected or told the coach about; names of foods you often log at that meal; the app language. For a photo of what you left: that photo, the meal's stored preview, and the meal's food names and calories	Google (Gemini); OpenAI as backup
Text estimates — AI quick add, Recalculate, automatic recalculation after you correct a food name, and meals the AI coach logs from what you write	The food description or item names (for meals the coach logs, the meal as described in your message); your country; the app language	Google (Gemini); OpenAI as backup
Pantry photo scan and sorting your kitchen staples ("Organize unsorted")	The fridge or pantry photo; the names of your kitchen staples	Google (Gemini); OpenAI as backup
Supplement label scan and supplement quick add	The label photo; the supplement or medication text you type	Google (Gemini); OpenAI as backup
Nutrition report AI summary ("Include AI summary") — on by default once you have allowed AI data sharing; you can switch it off for any report	Names of foods logged in the report period; and, without your name: age, sex, height, weight, BMI, goal, declared health conditions and allergies, weight trend, intake against targets, nutrients below or above target, meal timing, frequent foods, supplements, plan adherence, and steps, active energy and sleep from Apple Health or Health Connect	Food names: Google (Gemini), OpenAI as backup. Everything else: Google (Gemini) only
AI coach conversations (Platinum) — including the end-of-day check-in opened from a notification and "Ask the coach about this meal"	Your messages, the conversation so far and photos you attach; your profile (sex, age, height, weight, activity level, goal, diet type, restrictions, declared health conditions, pregnancy and breastfeeding status); country, local date and time, and travel destination and accommodation; kitchen staples; your saved memories (what you told the coach to remember, the notes and food swaps you added, and the scan corrections you chose to keep); today's and recent days' meals with your notes; nutrient totals, targets and recent averages; supplements and whether you took them today; your imported nutrition plan, including the professional's name; if connected, steps, energy burned, workouts, sleep (duration, score and stages), 7-day averages, and a day-by-day table of the last 7 days (meals you logged, and energy burned, steps and sleep from Apple Health or Health Connect), and older days when the coach looks them up; if connected, the title, time and location of up to 10 calendar events in the next 48 hours	Google (Gemini) only
Meal verdict (Platinum) — created when you open a meal's summary	Meal type; food names; the meal's calories, macronutrients and micronutrients; your daily targets; the app language	Google (Gemini) only
Nutrition plan import	The PDF files or photos you pick. They are not stored; only the plan extracted from them is saved to your account	Google (Gemini) only

How the AI providers protect your data

Google (Gemini API, paid service). Google processes these requests as our data processor, under the Gemini API Additional Terms of Service for paid services and Google's Data Processing Addendum for Products Where Google is a Data Processor, which covers Gemini API paid services. Google does not use the prompts, photos, documents or responses to improve its products, and does not use them to train AI models other than models used only to detect abuse of its service. It keeps them for 55 days, only to detect and prevent abuse and for legally required disclosures; in that period they can be reviewed only by authorised Google staff investigating possible abuse.
OpenAI (API). OpenAI processes these requests as our data processor, under the OpenAI Services Agreement and its Data Processing Addendum. OpenAI does not use the requests it receives through its API to train its models, and we have not opted in to sharing them with OpenAI for that purpose. It keeps requests for up to 30 days to provide the service and detect abuse, and then deletes them — unless longer retention is required by law or needed to protect its services or others from harm; for example, an image its systems flag for child-safety review is kept for manual review.

Same or equal protection. Both agreements require Google and OpenAI to process your data only on our instructions, to bind the people who handle it to confidentiality, to keep it secure, to help us respond when you exercise your rights, to delete it when the service ends, and to protect international transfers with the EU Standard Contractual Clauses. Together with the commitments above, they give your data the same or equal protection as this policy.

AI output can be inaccurate. Check estimates, especially if you have allergies, and do not rely on AI for medical decisions.

4. Service providers and other third parties

These companies process personal data for us, to provide their service to KcalScan:

Google Firebase / Google Cloud — sign-in (Firebase Authentication), our database (Cloud Firestore, stored in the European Union), our server functions (Cloud Functions, which run in the United States), app-integrity checks (Firebase App Check, with Google reCAPTCHA on the web and Google Play Integrity on Android), notifications, and app analytics (Google Analytics for Firebase).
Google (Gemini) and OpenAI — AI processing, only with your permission (section 3).
RevenueCat — subscription management for App Store and Google Play purchases (your user ID and purchase records).
Stripe — payments on the web. Your card details go directly to Stripe and never touch our servers. Stripe also acts as an independent controller of the payment data it needs to prevent fraud and meet financial regulations, under its own privacy policy.
Sentry (EU-hosted) — crash and error reports, including your user ID and email.
Brevo — account emails, getting-started emails and the monthly product news email (your email address, first name, user ID, platform, language and activity group, such as active or lapsed).

Same or equal protection. Each of these providers processes personal data on our behalf (apart from Stripe's own role described above), under data processing terms that require it to keep the data confidential and secure and to use it only to provide its service to us. This gives your data the same or equal protection as this policy.

These services receive data as independent companies, under their own terms:

Apple — Sign in with Apple, App Store purchases and App Attest on iPhone. Google — Sign in with Google, and Google Play purchases on Android. What you give them directly is governed by their privacy policies.
Vercel — hosts this website and the web app, and passes web sign-in and referral-link requests on to our Firebase servers. Like any web host, it receives your device's IP address and the pages and requests your browser sends, which it handles under its own terms and privacy policy. The iPhone and Android apps do not use it.
Open Food Facts (barcode lookups) and the OpenStreetMap Foundation (Nominatim country lookup) are open-data services, not our processors, and the app contacts them directly from your device. We send them only a barcode number or your position, rounded as described in section 1 — never your name, email, account ID or any health information. Like any website, they can see your device's IP address, which they handle under their own privacy policies (Open Food Facts, OpenStreetMap Foundation).

5. Apple Health, Health Connect and calendar

Connecting a health source or your calendar is optional — every other feature works without it — and we only ever read what you explicitly grant.

Apple Health (iPhone) — read only. We read steps, active energy, resting energy, sleep, and workouts. KcalScan writes nothing to Apple Health.
Health Connect (Android) — read, plus write if you opt in. We read steps, active and total energy burned, exercise sessions, and sleep. If you switch the option on, meals you log can also be written back as nutrition records so they appear in apps like Google Health and Samsung Health; you can switch it off in KcalScan or revoke it in Health Connect at any time.
Calendar — read only. The title, time and location of your events in the next 48 hours, never their notes.

We use health and activity data to calculate your Total Daily Energy Expenditure (TDEE) and to power optional dynamic calorie targets. If you allow AI data sharing, it is also used as context for the AI coach and for the AI summary of your nutrition report — for example, suggesting recovery-appropriate meals after a workout — and is then sent to Google (Gemini) as described in section 3: steps, energy burned, workouts, and sleep duration, score and stages. It is never sent to OpenAI. Calendar events are used only as AI coach context, in the same way. Daily totals of your steps, energy burned, workouts and sleep (one entry per day) are saved in your account, so you can see past days on any device and the AI coach can compare days. Switch off "Save activity history" in Settings → Devices & calendar to delete them and stop saving. Other activity and sleep readings from Apple Health or Health Connect, and calendar events, stay on your device; our servers do not store them.

We never use health data for advertising or marketing, never sell it, and never share it with advertising networks, data brokers, or resellers. Apart from the AI processing you allow in section 3, which is used only to give you health and nutrition guidance, it is not shared with anyone. We never use it to train AI models, and Google does not use what the AI features send it to train AI models, apart from models used only to detect abuse (section 3). OpenAI does not use what the AI features send it to train its models either (section 3). This holds for data read from Apple Health, in line with Apple's HealthKit requirements, and for data read from Health Connect, in line with the Health Connect permitted-use policies. You can revoke access at any time in Apple Health, in Health Connect, or in your device's calendar settings; to stop only the AI use, turn off AI data sharing in Settings → Privacy & AI.

6. Data storage and security

Your diary, profile and settings are stored in Google Cloud Firestore in the European Union, encrypted in transit and at rest. Sign-in records (your email, name and profile photo) are kept by Google Firebase Authentication, which may store them in the United States. Our server functions run on Google Cloud in the United States.
Access is restricted; our servers use authentication, app-integrity checks (Firebase App Check) and rate limits to prevent abuse.
The keys for our AI providers live only on our servers, never in the app.
A local copy of your recent data is kept on your device so the app works offline; it syncs when you're back online. Your messages to the AI coach and its replies stay on your device only, as do calendar events and the activity and sleep readings other than the daily totals saved in your account (section 5). The memories KcalScan keeps for you, and the records of the actions the coach takes for you, are stored in your account (section 1).

7. Your rights and choices

Under the GDPR and similar laws, you can:

Access and update your data — most of it directly in the app's Settings.
Export your data — Settings → Account → Export my data.
Delete your account and all associated data — Settings → Account → Delete account (or "Delete my data" if you use KcalScan without an account).
Withdraw consent at any time, without affecting the rest of the service or processing that happened before:
- AI data sharing — Settings → Privacy & AI.
- Location — deny it in your device settings, or type your country and lock it in Settings → AI coach & food.
- Apple Health, Health Connect and calendar — Settings → Devices & calendar, or the system settings of each.
- Product news emails and notifications — Settings → Help & support, or the unsubscribe link in any email.
Complain to your data protection authority (in Portugal, the CNPD).

8. Data retention and deletion

Data	How long we keep it
Your account: profile, diary, meal previews, settings, your AI data sharing choice and other preferences, coach action records, feedback	While your account exists. When you delete it, it is erased from our live database straight away, except the daily app-usage snapshots below; the database's short-term recovery copies expire within 7 days.
Activity history: daily totals of steps, energy burned, workouts and sleep	While your account exists, or until you switch off "Save activity history" in Settings → Devices & calendar, which deletes it straight away.
Accounts created with "Continue without an account"	The same: kept until you delete the data in Settings → Account → Delete my data. We do not delete inactive accounts automatically. These accounts have no sign-in, so if you remove the app without deleting the data first, it stays stored and we cannot link it back to you.
Data on your device: offline copy, AI coach conversations, calendar events, and activity and sleep readings other than the daily totals above	Until you log out, delete your account or remove the app.
Daily app-usage snapshots used to time reminders and emails (user ID, first name, platform, language, activity counts, which health source is connected)	30 days, then deleted automatically — also after you delete your account.
AI requests held by the AI providers	Google: 55 days. OpenAI: up to 30 days, longer only in the cases described in section 3.
Crash and error reports (Sentry)	Up to 90 days.
App analytics events (Google Analytics)	Event-level data up to 14 months, and the analytics identifier until up to 14 months after your last activity; summary reports that do not identify you may be kept longer.
Server logs, such as IP addresses and request times	30 days.
Your email contact at Brevo	Until you delete your account. If you unsubscribe, we keep your address only to make sure we don't email you again.
Purchase, billing and referral records	As long as tax and accounting law requires. Referral records are kept for commission accounting; they hold no name or email, and after you delete your account the random ID they carry no longer matches any account. RevenueCat keeps the purchase history stored under your random user ID, with no name or email. Apple, Google Play and Stripe keep their own purchase records under their own policies.

9. Children

KcalScan is for adults aged 18 or over and is not directed to anyone younger. New users confirm that they are 18 or older and enter their date of birth during setup. If the date of birth on an account shows an age under 18, our servers refuse its AI requests, so nothing from it is sent to an AI provider; the rest of the account keeps working. If we learn in any other way that an account belongs to someone under 18, we record the account holder's date of birth on the account, so that our servers refuse its AI requests in the same way, and we delete the account when the account holder, or their parent or guardian, asks us to. If you believe someone under 18 has an account, contact us.

10. International transfers

Our database is in the European Union, but our server functions run in the United States, sign-in records may be stored there, and our providers — including Google and OpenAI for AI processing — may process data in the United States and other countries. Where data leaves the EU/EEA or the UK, we rely on recognised safeguards, such as the EU Standard Contractual Clauses included in our providers' data processing terms.

11. Changes to this policy

When we change this policy, we update the date at the top and, for significant changes, tell you in the app or by email. If a change adds an AI provider or a new category of personal data sent to AI, we will ask for your permission again in the app before sending anything under the new terms.

Contact

Questions about this policy or your data:

Email: tiago@kcalscan.app