Calma — Privacy Policy
Version 1.0 · effective ⚠ EFFECTIVE_DATE
This is an English translation provided for convenience. In case of any discrepancy, the Polish version at https://calmaai.net/privacy prevails.
Calma counts calories from a photo of your meal. To do that it needs data about you and about what you eat — and that is sensitive data. Below we set out exactly what we collect, why, who processes it on our behalf and how you stay in control.
In short: we do not sell data, we show no ads, we use no analytics or advertising trackers at all, and we do not train AI models on your data. You can delete your Account and all your data at any time.
1. Controller
The controller of your personal data is ⚠ OPERATOR_NAME, ⚠ OPERATOR_ADDRESS, VAT ID (NIP) ⚠ NIP, ⚠ OPERATOR_REGISTRY.
Data-protection contact: privacy@calmaai.net Technical support: support@calmaai.net
We have not appointed a data protection officer — all requests are handled at the address above.
2. What data we process
| Category | Specifically | Source |
|---|---|---|
| Account data | email address, hashed password, Account identifier, creation date, email-confirmation status; for social login — your identifier at the provider (Google, Facebook, X) and email address | you / the login provider |
| Profile data | first name, date of birth, sex, height, weight, activity level, app language, profile photo (optional) | you |
| Nutrition goal | goal type (lose / maintain / gain), target weight, rate of change, daily calorie limit | you / calculated |
| Food diary | meal entries: product or dish, weight, calories, protein, fat, carbs, meal type, date and time consumed | you |
| Meal photos | photos taken in the App or picked from your library, plus photos attached to your own products and dishes | you |
| Own products and dishes | names, per-100 g nutritional values, ingredients, custom portion sizes, barcode (if provided), favourites | you |
| AI usage data | the number and timestamps of AI Scans and AI Corrections performed (the Free-plan quota log) | automatic |
| Subscription data | subscription status, plan, product identifier, period end, cancellation flag, transaction and subscriber identifiers at the payment operator | Apple / RevenueCat |
| Technical data and logs | IP address, device type and model, OS and App version, technical events and errors, server request logs | automatic |
| Correspondence | the content of your support requests and complaints and the email address you sent them from | you |
What we do not collect: payment card data (handled by Apple), location data, contacts, data from the device's health apps (Apple Health is not connected), advertising identifiers.
Health data. Your weight, height, weight goal and food Diary are health data — a special category of data under Article 9 GDPR. We process them solely on the basis of your explicit consent, given when you start using the App, and only to make the App work. You can withdraw consent at any time (section 9), but withdrawal means we can no longer provide the service: without this data the App cannot calculate a limit or keep a Diary.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and running the Account, authentication, keeping the Diary, calculating the calorie limit, statistics, syncing across devices | Art. 6(1)(b) GDPR — performance of the contract (the Terms) |
| Processing health data (weight, height, goal, Diary) so the App's features work | Art. 9(2)(a) GDPR — explicit consent |
| Analysing a meal photo with an AI model and AI Correction | Art. 6(1)(b) GDPR (contract) and Art. 9(2)(a) GDPR (explicit consent) |
| Handling subscriptions, verifying Premium entitlements, settling purchases | Art. 6(1)(b) GDPR — performance of the contract |
| Tax and accounting records | Art. 6(1)(c) GDPR — legal obligation |
| Security, abuse prevention, enforcing Free-plan limits, error diagnostics, backups | Art. 6(1)(f) GDPR — legitimate interest (protecting the service from abuse and keeping it stable) |
| Handling complaints and support requests | Art. 6(1)(b) and (c) GDPR |
| Establishing, exercising and defending claims | Art. 6(1)(f) GDPR |
| Local meal reminders | Art. 6(1)(a) GDPR — consent (the system notification permission) |
Providing data is voluntary but necessary to use the App: without an email address no Account can be created, and without profile data the App cannot calculate a daily limit.
4. Meal photos and artificial intelligence
4.1. A photo you take in the App is stored in our file storage on Supabase infrastructure (a private, non-public bucket — accessible only to you and to the server function that performs the analysis).
4.2. The photo is then sent to the AI model provider — ⚠ AI_PROVIDER (⚠ AI_PROVIDER_LOCATION) — which returns an estimate: dish name, weight, calories and macros. The model provider receives the photo and, where applicable, your correction text — without your email address, name or any other Account data.
4.3. The model provider acts as our processor under a data-processing agreement and may not use the submitted content for its own purposes or to train models.
4.4. Photos saved with a Diary entry are kept until you delete the entry or the Account — so the entry still looks the same when you return to it a month later.
4.5. If you do not want a photo to reach the AI model provider, do not use AI Scan — every meal can be added manually by entering its weight and nutritional values.
4.6. An AI result is an estimate and stays editable before saving. We do not make automated decisions about you that produce legal effects or similarly significantly affect you (Article 22 GDPR), and we do not profile you for marketing.
5. Recipients
We do not sell data and do not share it for marketing purposes. We use the following providers, who process data on our behalf:
| Provider | Role | Data |
|---|---|---|
| Supabase Inc. | database hosting, authentication, file storage, server functions, transactional email (one-time codes, password reset) | all Account, profile, Diary data and photos |
⚠ AI_PROVIDER |
meal photo analysis and AI Correction | meal photo, correction text |
| RevenueCat, Inc. | subscription management and purchase verification | Account identifier, transaction identifiers, subscription status and plan |
| Apple Inc. | App distribution and App Store payments | purchase data under Apple's privacy policy |
| Google LLC / Meta Platforms / X Corp. | social login, if you choose it | scope depends on the provider (typically identifier and email address) |
⚠ HOSTING_PROVIDER_SITE |
hosting of the https://calmaai.net website | technical visit data |
Data may also be disclosed to authorities entitled under the law and, where necessary, to our legal and accounting advisers, to the extent needed for their services.
6. Transfers outside the EEA
6.1. Account, profile, Diary data and photos are stored on Supabase infrastructure in the ⚠ SUPABASE_REGION region.
6.2. Some providers (Supabase, RevenueCat, Apple, ⚠ AI_PROVIDER) are established or have technical facilities outside the European Economic Area, including in the USA. Such transfers are based on the Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR) and, for U.S. entities, also on the adequacy decision for the EU–U.S. Data Privacy Framework where the provider is certified under it.
6.3. You can obtain a copy of the safeguards used by writing to privacy@calmaai.net.
7. Retention
| Data | How long |
|---|---|
| Account, profile, goal, Diary, own products and dishes, favourites, photos | until you delete them or delete the Account; permanent deletion, including from backups, is completed within 30 days of the request |
| Inactive Accounts (no sign-in) | after 24 months of inactivity we send a warning email, and 30 days later delete the Account and its data |
| AI Scan and AI Correction log | for the lifetime of the Account — it enforces the Free-plan limit |
| Subscription data and proof of purchase | 5 years from the end of the tax year of the purchase (tax obligations) |
| Technical and security logs | up to 12 months |
| Correspondence and complaints | 3 years after the case is closed (limitation period) |
After these periods we delete or anonymise the data. Shared product-database entries (name and nutritional values, with no link to an Account) may remain in the App as anonymised data.
8. Security
- all server connections over TLS; data in the database and file storage encrypted at rest,
- data isolation at the database level (Row Level Security) — a query can only return rows belonging to your Account,
- passwords stored only as cryptographic hashes; we never see them,
- the device session is kept in the secure system keystore,
- the photo bucket is private; access only through signed, time-limited URLs,
- administrative access limited to those who need it; sensitive operations performed server-side,
- vulnerability and incident reports: privacy@calmaai.net.
If a personal-data breach is likely to result in a high risk to your rights, we will notify you and the Polish supervisory authority within the deadlines required by the GDPR.
9. Your rights
You have the right to:
- access your data and obtain a copy of it,
- rectification of inaccurate or outdated data,
- erasure ("right to be forgotten"),
- restriction of processing,
- data portability — on request we will export your Diary and profile data in a machine-readable format (JSON or CSV),
- object to processing based on legitimate interest,
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal,
- lodge a complaint with a supervisory authority.
Most of this you can do yourself in the App: edit your profile and goal, delete entries, products, dishes and photos, delete the Account in settings. Other requests are handled at privacy@calmaai.net — we respond within 30 days (for complex requests we may extend this by up to two further months and will tell you why).
Supervisory authority in Poland: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl
10. Device permissions
| Permission | What for | Required |
|---|---|---|
| Camera | taking a meal photo for an AI Scan | no — you can add meals manually |
| Photo library | picking an existing meal photo or a profile photo | no |
| Notifications | local reminders for breakfast, lunch and dinner | no |
Reminders are scheduled locally on the device — we send no push notifications from a server and collect no push tokens. You can revoke any permission at any time in iOS settings.
11. No ads, no analytics
The App contains no advertising, no advertising identifiers, and we use no Google Analytics, Firebase, Meta SDK, AppsFlyer or any other analytics or attribution tooling. We do not track you across other apps and websites within the meaning of App Tracking Transparency and do not ask for tracking permission, because we do no tracking. Should that ever change, we will say so before rolling it out and, where the law requires it, ask for your consent.
12. Children
The App is intended for people aged 16 and over. We do not knowingly collect data from younger people. If we learn that an Account belongs to someone under 16, we will delete it together with its data. Reports: privacy@calmaai.net.
13. The https://calmaai.net website
The website presents the App and hosts the Terms and this Privacy Policy. It uses only cookies strictly necessary for its operation and security; we use no marketing or profiling cookies. The hosting provider processes standard server logs (IP address, request time, browser type) to keep the site secure and available.
14. Changes to this Policy
We will announce material changes at least 14 days before they take effect — in the App or by email to the address linked to your Account. If a change requires your consent, we will ask for it separately. Every version is numbered and dated; earlier versions are available on request.
Appendix: App Store privacy label (for reference)
A helper mapping, consistent with the declaration in App Store Connect.
Data Linked to You
- Contact Info: email address
- Health & Fitness: weight, height, weight goal, food diary
- User Content: meal photos, own products and dishes
- Identifiers: Account identifier and subscriber identifier
- Purchases: purchase history and subscription status
- Diagnostics: error logs and technical events
Data Not Linked to You: none. Data Used to Track You: none.