Kaloform is built to help you track what you eat and how you train. This notice explains what data is collected, where it is kept, and who it is shared with.
01DATA CONTROLLER
- Data controller
- Efecan Küçük
- Contact
- destek@mechaway.tech
02WHAT IS COLLECTED
Stored on our server with your account:
- Your email address and an irreversible hash of your password (the password itself is never stored)
- Your profile: age, sex, height, weight, activity level and goal
- Your food entries: what you ate, how much, which meal and on which date
- Your daily calorie and macro targets
Kept only on your device and never sent to the server:
- Your weight and body measurement records
- Your workout programs, sessions and sets
- Your water intake, activity entries and the foods you added yourself
- Step and active energy data read from the Health app
- Your language and appearance preferences
Deleting the app removes this data from your device.
03PHOTOS AND ARTIFICIAL INTELLIGENCE
When you take a photo of a meal, the photo is sent to our server and from there to our AI provider (OpenAI models via OpenRouter) for recognition. Likewise, when we estimate the nutrition of a food that is not in our database, the food's name is sent to that provider, and when you paste a training plan, the text you pasted is sent.
Apart from the content described above, none of your personal details (email, identity, location) are passed to the provider. Photos are not stored permanently on our server; they are processed only for the duration of the recognition request.
AI results are estimates and always go through your confirmation.
04HEALTH APP DATA
If you turn on the Apple Health connection, the app READS exactly two values from Health: your daily step count and your active energy. It never WRITES anything to Health and does not access any other health data.
This data stays on your device; it is not sent to our server, to our AI provider, or anywhere else. It is used only to adjust your daily calorie budget. You can turn the connection off at any time from the Profile screen; doing so also deletes that day's adjustment entry.
05USAGE STATISTICS AND CRASH REPORTS
We use PostHog to see where the app gets stuck and which screens are used. PostHog processes this data on servers in the European Union, which also counts as a transfer of your data outside your country. We use Google Firebase Crashlytics for crash reports; this data is also processed on Google's servers and may be transferred outside your country.
Every request to PostHog necessarily carries your IP address, as any network connection does. We keep GeoIP turned off, so PostHog does not derive or store location information such as country or city from that IP.
What is sent:
- Which screen you opened (excluding the weight, body measurement, fasting and workout screens — not even their names are sent), which step you completed, and how you logged the entry (photo, search or repeat)
- Four categorical details derived from your profile: your goal, your sex, your activity level and your app language
- Four settings sent as on/off only: whether your Apple Health connection is on, whether fasting tracking is on, whether you have a saved workout program, and whether your calorie target was calculated by formula or entered by hand. These four are sent as yes/no; your fasting hours, the contents of your workout program and your health data are not sent
- Device model, operating system version, app version and an identifier generated by PostHog — attached to every event automatically. Before you sign in this identifier is random and anonymous; after you sign in it is matched to your account and becomes a stable, account-linked identifier.
- A technical report if the app crashes
What is not sent: your weight, your body mass index, your body measurements, your fasting hours, your workout records, what you ate, your calorie values, the text you type into the search box, or your health data — these fields are never added to any measurement event. Personal identifiers such as your email address and your name are additionally blocked by a filter built into the code. Your advertising identifier (IDFA) is not collected, and your data is not used for advertising or tracking.
You can turn usage statistics off from the "Usage statistics" switch on the Profile screen.
06WHERE DATA IS STORED
Accounts and food entries are hosted on MongoDB Atlas. Servers are hosted in Germany (Falkenstein); the database is in the Frankfurt region. The usage statistics described in section 5 are held on PostHog's infrastructure in the European Union; the crash data is held on Google's infrastructure.
07RETENTION
Your data is kept for as long as your account exists. When you delete your account from within the app, your account and all of your food entries are permanently removed from the server, and the data on your device is cleared at the same time. This cannot be undone.
08SHARING
Your data is not sold, is not used for advertising, and is not shared with third parties beyond the processing described in sections 3 and 5.
09YOUR RIGHTS
You have the right to access, correct and delete your data. You can delete it from the Profile screen inside the app. For other requests, write to the contact address above.
10CHILDREN
The app is not designed for users under 13.
11HEALTH NOTICE
Kaloform is for information only and does not provide medical or dietary advice. Calculated targets and indicators are estimates based on general formulas. Consult a health professional for your nutrition and training decisions.
12CHANGES
If this notice changes, the updated version is published in the app and the date above changes.