Privacy policy

Last updated: 3 November 2026

This policy explains what data the Calorko website and app collect, why, who we share it with and how you can delete it. It is written in plain language, with nothing hidden in the small print.

Who is responsible

The data controller is Jovan Ilić, Podgorica, Montenegro. For any privacy question, write to [email protected].

In short

• The website sets no cookies and does not follow you from page to page.
• Meal photos are not stored by default. They are sent for analysis and discarded, unless you turn on "keep photos".
• We use no advertising SDKs and we do not sell data to anyone.
• You can delete your account and all data from inside the app, or by email without it, and export your data as CSV.

Website

Cookies and statistics

The website is static and sets no cookies, so there is no cookie banner. We measure visits with Cloudflare Web Analytics. Each time a page is opened, a small script from Cloudflare sends a short report, and all we see are aggregate numbers: which pages were viewed, where visitors came from (for example Google search or a social network), which countries, which browser and type of device (phone or computer) they use, and how fast the page loaded. The tool sets no cookies, stores nothing on your device, builds no visitor profiles and does not track you across other websites. Cloudflare does not use your IP address or browser details to recognise individual visitors.

When we test two versions of the home page, the version you see is picked at random each time you open the page, and nothing is stored on your device (no cookies, no browser storage). We save the version label (such as “hero1-b”) only with an early-access sign-up sent from the form at the top of the home page; it is not sent to the visit statistics.

Hosting

The website is served by Cloudflare Pages. Cloudflare processes IP addresses in server logs for security and attack protection. We do not use those logs to track individuals.

Early-access list

If you sign up for early access, we store your email address, whether you want to test the app before launch and, if you do, the Google account address you use on Google Play, the page language, the page or campaign you signed up from, the version of the home page you saw (when we test two versions) and the time of sign-up. The data sits in a Supabase database on servers in the EU (Dublin, Ireland), in a table the website can only write to, not read. We use it only to tell you when the app is out and, if you ticked testing, to invite you to the test. For the test we give your address to Google (tester list on Google Play), for that purpose only. Your IP address is used only briefly, in memory, to limit the number of sign-ups, and is not stored. We send no newsletter and sell no addresses. We delete the list 12 months after the app launches, and your address earlier as soon as you ask at [email protected].

App

Account

Sign-in runs on Supabase Auth: a Google account or an email link. We store your email address and account identifier. The sign-in email with the link is sent through Resend, from [email protected].

Profile and plan

To calculate your daily calorie and macro target, you enter sex, year of birth, height, current and target weight, goal and activity level. We store these, together with the meals and weights you log, so the app can work. We treat weight and diet data as sensitive: we process it only to show you your diary and progress, never for advertising.

Meal photos

When you photograph a meal, the image is downscaled on your phone and sent to our server function, which passes it to an AI model for analysis. The result (dish name, items, grams, calories) is saved with your meal. To answer repeated requests we cache the result under a fingerprint (hash) of the image, not the image itself. The photo itself is stored only if you turn on "keep photos"; it is then visible only to you.

Scan usage

The free plan includes 3 AI scans per day, so for each scan we record the time and technical details (which AI service answered and how long it took). This is how we enforce the daily limit and check that the app stays fast.

Subscription

Payment is handled by Google (Google Play). We never see your card details. RevenueCat only tells us whether a subscription is active and until when.

Product analytics

With PostHog we record in-app events, for example that an onboarding step was completed, a scan was started or saved, or the daily limit was reached. It shows us what is broken and what to fix.

Barcodes

When you scan a barcode that is not in our database, we look the number up in Open Food Facts. Only the barcode number is sent, nothing about you.

Who we share data with

We use the following processors, only for the purposes listed:

• Cloudflare — website hosting, passing early-access sign-ups to the database, and aggregate website statistics (Cloudflare Web Analytics, no cookies).
• Supabase — sign-in, database (with per-user access rules, known as row-level security) and server functions.
• Resend — sending the sign-in emails (magic link) from [email protected]: your email address and the email itself, on servers in the EU (Ireland).
• Google (Gemini) — main AI model for analysing meal photos and descriptions.
• OpenAI — fallback AI model, used only when the main one does not respond.
• RevenueCat — subscription status.
• Google — Google Play, billing and Android testing.
• PostHog — in-app product analytics.

Some of these services process data outside the European Economic Area. In those cases the transfer relies on safeguards provided for by the GDPR, such as standard contractual clauses.

Legal basis

• Performance of a contract — account, food diary, plan and subscription, because the app cannot work without them.
• Consent — the early-access list and storing photos. You can withdraw consent at any time.
• Legitimate interest — security logs and aggregate statistics, so the website and app run reliably.

How long we keep data

We keep account data for as long as the account exists. We delete the early-access list 12 months after the app launches, as described above.

You can delete your account in two ways: in the app (Profile → Delete account), or without the app by emailing [email protected] from the address you sign in with, with the subject “Delete account”; we then delete the account and all its data within 30 days. This deletes your profile, meals, weights, plan and settings, stored photos and the link between your account and your purchases at RevenueCat. We keep nothing except what the law requires for purchases; Google Play keeps its own billing records. Deleting the account does not cancel a Pro subscription; you cancel that in Google Play. The steps are also on the Support page.

Your rights

Under the GDPR and Montenegro's Law on Personal Data Protection you have the right to:

• access the data we hold about you;
• correct inaccurate data;
• ask for deletion (in the app: Profile → Delete account, or by email, as described above);
• take your data with you (in the app: CSV export);
• restrict or object to processing;
• withdraw consent;
• complain to Montenegro's Agency for Personal Data Protection and Free Access to Information or to the supervisory authority in the country where you live.

Send requests to [email protected]. We reply within 30 days.

Security

All traffic goes over HTTPS. In the database each user can read and change only their own rows. Only Jovan Ilić has access to production data.

Changes

When we change this policy, we publish the new version on this page with a new date. We will also tell you about significant changes in the app. See also the terms of use.