Privacy
Last updated: 14 August 2026This page sets out what data Kalorist processes, why, and for how long. Questions: kalorist.ge@gmail.com.
Who is responsible
Giga Tatarashvili, Burgfriedenstr. 3, 60489 Frankfurt am Main, Germany. Contact: kalorist.ge@gmail.com.
Health data — explicit consent
Your weight, height, age, sex, goals and meal records are special-category (health) data under Article 9 GDPR. We process them only with your explicit consent, which the app asks for before the first question (Art. 9(2)(a)). You may withdraw it at any time by deleting your account.
What we process
| Data | Why | Where |
|---|---|---|
| Weight, height, age, sex, activity, goal | To calculate your daily calorie target | Supabase, EU (Frankfurt) |
| Meal photo | To recognise the dish | Supabase Storage (EU); sent to an AI provider for analysis |
| Meal records and calories | Your daily and weekly totals | Supabase, EU |
| Weight history | To show your progress | Supabase, EU |
| Apple Health steps and active energy | To refine your daily target | Your phone only — never uploaded |
| Progress photos | Before / after comparison | Your phone only — never uploaded |
| Subscription status | Access to paid features | RevenueCat |
Your account
Kalorist requires an account. You create it with Apple or Google at the start, and we receive only the identifier they issue and an email address — Apple's Hide My Email is supported and works normally. We never ask for a name or a phone number.
The account is not something you consent to; it is what makes the service possible (Art. 6(1)(b) GDPR — performance of a contract). Dish recognition runs on our servers, your diary is stored there so it survives a lost or replaced phone, and your subscription is restored by identity. Without an account none of that can be delivered — and neither can a deletion request, since we would have no way to tell whose data was whose.
Your health data is separate and works differently: weight, goals and meals are only processed after you give explicit consent on the screen that follows sign-in (Art. 9(2)(a)). Signing in does not give that consent, and you can withdraw it at any time — though because the app exists to process exactly that data, withdrawing it means closing the account.
If you sign in and stop before giving that consent, we delete the empty account automatically after 30 days.
Artificial intelligence
To recognise a dish we process the photo with Google's (Gemini) and Anthropic's (Claude) models, acting as our processors. Every result is an estimate, is labelled as an AI estimate, and is editable (EU AI Act, Art. 50). It is not medical advice.
How long we keep it
For as long as the account exists. Deleting your account deletes every record and every photo immediately — see deleting your data.
Your rights
- Access and portability (Art. 15, 20) — in the app, "Export data" (JSON and PDF).
- Erasure (Art. 17) — in the app, "Delete account".
- Rectification (Art. 16) — every record is editable.
- Withdrawal of consent (Art. 7(3)) — at any time, with future effect.
- Complaint to a supervisory authority (Art. 77).
Cookies
This site sets no cookies and uses no analytics — see cookies.