Privacy Policy

1. Who we are

Calorize is a nutrition and wellness diary operated by Lialia Sakhno (sole proprietor, Ukraine). When this policy says "we", "us", or "Calorize", that is who we mean. Contact: [email protected].

This policy explains what personal data we collect, why we collect it, who we share it with, and the choices you have. It applies to the website calorize.ai, the Calorize PWA, and the iOS / Android wrapper apps.

2. Data we collect

Account data

• Name, email address, password (hashed) — when you register.
• Google account identifier (Google ID) and email — if you sign in with Google.
• Apple user identifier (Apple ID) and email — if you sign in with Apple.
• Email verification timestamp.

Health and fitness data

• Body data: sex, date of birth, height, weight, body fat percentage, body measurements.
• Goals: target weight, calorie/macro targets, activity coefficient.
• Daily food intake entries: products, recipes, portion sizes, meal type, timestamps.
• Water intake, workouts, peptide injection logs (where applicable).
• Data imported from Apple Health / Health Connect — only if you enable sync in the mobile app (see the dedicated section below).
• Free-form messages you send to Mira (the AI assistant) and saved memory facts.

Photo data (camera)

When you photograph a meal or product label inside the app, the image is sent to Google (Gemini) for recognition (food name, estimated portion, nutrient lookup). A small copy is kept on our servers with that day's chat so you can see it there, and is deleted automatically within 3 days. If recognition fails, the photo is held for up to 30 minutes so you can retry without retaking it. The textual recognition result is saved in your diary.

Payment data

• On the web: Monobank invoice IDs, saved card token (only for users who opt into auto-renewal). We never see or store full card numbers — Monobank handles them directly.
• On iOS: Apple original transaction ID and product ID. All payment processing happens through Apple — we never see card data.

Technical and usage data

• IP address, browser / device type, operating system, app version.
• Aggregated product usage events (which features you open, in-app errors). Processed in Google BigQuery — see Third-party services below.
• Cookies and local storage used for session management and analytics consent.

Support and feedback data

When you submit feedback in the app, the text and any optional screenshots or screen recordings you attach are stored in our GitHub Issues tracker (private). The attachments themselves are uploaded to Backblaze B2 and deleted once your request is closed. We use this only to respond to and resolve your request.

3. How we use your data

• To run the app: log meals, calculate nutrition, draw progress charts.
• To recognize food from your text, voice, or photo via the AI assistant.
• To remember your preferences (Mira's memory facts) — paid plans only, opt-in.
• To process subscription payments and renewals.
• To diagnose bugs and improve the product through aggregated analytics.
• To send you transactional emails (verification, payment receipts, password reset).
• To respond to your support requests.

We do not sell your personal data. We do not show third-party advertising inside the app.

4. Third-party services

To run Calorize we rely on the following processors. Each only receives the data needed for its function:

• OpenRouter (United States) — the assistant's main route to its AI model: passes the text of your chat messages, diary descriptions and saved memory facts to OpenAI, and the message you send to a small model that picks Mira's emoji reaction.
• OpenAI (United States) — the assistant's AI model and voice recognition: receives the text of your chat messages, diary descriptions and saved memory facts to recognize food and generate your daily and weekly analysis (through OpenRouter, or directly when that route is unavailable), and your voice recordings to transcribe speech.
• Google (Gemini) — photo recognition: receives the photos you take or choose and any note you add, to identify food and read labels. Accessed directly through Google's API.
• DeepSeek (China) — product catalogue enrichment: receives the names and nutrition values of food products to fill in their category and missing nutrients. It does not receive your chat messages or your diary. Accessed directly through DeepSeek's API.
• Soniox (United States) — live voice dictation: receives your voice while you dictate and sends back the text as you speak.
• Google (OAuth) — if you sign in with Google, we receive your Google ID, email, and name.
• Apple (Sign in with Apple, App Store, IAP) — if you sign in with Apple or subscribe through iOS, Apple handles authentication and payment. We receive a stable Apple user identifier and your purchase confirmations.
• Monobank (Universal Bank, Ukraine) — processes web payments and stores card tokens for auto-renewal. We pass your user ID and amount; we never see card numbers.
• Meilisearch (self-hosted) — powers fast food product search across our catalog. Receives only your search query.
• Google (BigQuery analytics) — product analytics: stores aggregated, mostly de-identified usage events (which features are opened, in-app errors) so we can spot bugs and prioritize features.
• Google Ads — if you arrive from one of our Google ads, we keep the click identifier from the link and send Google that identifier with the time of your sign-up and of your first purchase, including its value, to measure the ad. We do not send your name, email or health data. In the EEA, the UK and Switzerland we send it only after you accept the cookie banner; elsewhere, unless you reject it. Rejecting removes the click identifier.
• Backblaze B2 (object storage) — stores the feedback screenshots and screen recordings you upload, until your request is closed. Bucket is publicly readable but URLs are unguessable; remove via support if needed.
• GitHub (Issues) — our customer support tracker. Your feedback text + a stable user reference go into a private repository.
• Resend / SendGrid (email delivery) — delivers transactional emails. Receives your email address and the message body.
• Hetzner (Germany, EU) — hosts the Calorize app servers and the primary database where your diary is stored.
• Hetzner Cloud (Germany, EU) — Langfuse — hosts our internal Langfuse instance, which stores AI prompts, responses, latency, and error traces so we can debug and improve the assistant.

5. AI processing — what to know

Calorize is built around an AI assistant ("Mira"). To work, the assistant needs to receive your input. By using the chat or photo features, you accept that the following data is sent to our AI providers (OpenAI through OpenRouter for text, Google for images, OpenAI and Soniox for voice) for processing:

• The text or voice transcript you send.
• The image you photograph (recognized once; a small copy stays with that day's chat for up to 3 days).
• Recent diary context (e.g. yesterday's meals) so phrases like "same as yesterday" work.
• On a paid plan — saved memory facts you have explicitly opted to keep.

We use paid API tiers and send only the input the assistant needs to answer you. We do not use this data for any purpose other than running the assistant.

If you do not want your messages processed by AI, do not use the chat / camera features — manual logging through the standard form remains available.

6. Apple Health and Health Connect sync (optional)

If you use the Calorize iOS or Android app, you can optionally connect Apple Health (iOS) or Health Connect (Android). Sync is off by default and starts only after you explicitly grant permissions in the system dialog. It is not available on the website or in the PWA.

When you enable sync, Calorize reads from your health store:

• Weight and body composition entries (e.g. from smart scales) — to fill your weight chart without manual weigh-ins.
• Daily step counts, workout sessions (type, duration, calories) and sleep duration — as context for your diary and Mira's daily / weekly analysis.
• Height, date of birth and sex — a one-time read to pre-fill your profile during onboarding (date of birth and sex on iOS only).

And writes back to your health store:

• Daily nutrition totals (calories, protein, fat, carbohydrates, fiber, sugar, sodium, saturated fat), water intake, weight you logged in Calorize, and your calculated body fat percentage.

Health data obtained through Apple Health or Health Connect is used exclusively to provide the features above: your diary, charts and personalized analysis. We never use it for advertising or marketing, never sell it, never share it with third parties, and never include it in product analytics events.

Imported health data is stored in our EU (Germany) database alongside the rest of your diary and is deleted together with your account.

You can stop syncing at any time: turn it off in Calorize settings, or revoke Calorize's permissions in the Apple Health / Health Connect app. To erase previously imported data, delete the entries in your diary or contact us — we will remove them.

7. International data transfers

Our primary database and app servers are hosted in the EU (Germany) by Hetzner. Internal AI observability data (Langfuse) also sits in Germany (EU). Some processors are based in the United States (Google, OpenAI, OpenRouter, Soniox, Apple, Backblaze, GitHub) or in China (DeepSeek), or process data globally. Where we transfer your data outside the EEA, we rely on the processors' Standard Contractual Clauses or equivalent safeguards where available.

8. How long we keep your data

• Active accounts: data is kept for as long as you use the app.
• Inactive accounts (no login for 24 months): we may delete or anonymize data after notice.
• After you delete your account: your personal data is erased immediately from our live database. Encrypted backups containing it are purged within 7 days. Payment records may be retained for 3–7 years where law requires (tax / accounting).
• Backups: encrypted DB backups are kept for 7 days, then automatically purged.
• Your chat with Mira: the current day's conversation and small copies of its photos are kept so it can carry on after a reload or on your watch, and are deleted automatically within 3 days.
• Internal AI traces (prompts, responses and errors, in Langfuse): kept to debug and improve the assistant, currently with no fixed deletion date.

9. Your rights

Regardless of where you live, you can:

• Access the personal data we hold about you.
• Correct inaccurate data — most fields are editable in your profile.
• Delete your account and all associated data — go to Profile → Delete Account.
• Withdraw consent or object to specific processing.
• Export your data — email us and we will send a machine-readable export within 14 days.

If you are in the EU/EEA, UK, or California, you have additional rights under GDPR / UK GDPR / CCPA, including the right to lodge a complaint with your local data protection authority.

10. Cookies and local storage

Calorize uses cookies and local storage for: keeping you logged in (session cookies), remembering UI preferences, product analytics, and measuring our Google ads. We do not show ads inside the app.

11. Security

All traffic is encrypted in transit (HTTPS / TLS 1.2+). Passwords are hashed with bcrypt. Database backups are encrypted at rest. Access to production systems is restricted to authorized personnel and protected by multi-factor authentication.

No system is perfectly secure. If you suspect a breach affecting your account, please email us immediately.

12. Children

Calorize is not intended for children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us their data, contact us and we will delete it.

The peptide section has a higher bar. Its dosing calculator and the numeric protocols beside it are for people aged 18 and over, and Calorize asks for that confirmation before showing them. The confirmation is stored in a cookie in the browser, and for a signed-in account also as a date on the account itself. Nothing else about the visitor is collected at that moment.

13. Changes to this policy

We may update this policy from time to time. Material changes will be announced inside the app and / or by email at least 14 days before they take effect. The "Last updated" date at the top of this page shows the latest revision.

14. Contact

Questions about this policy or your data? Email us at [email protected].