What leaves your phone, and what does not.

Your diary is yours. Your photographs never leave your phone.

Kcal reads a meal from a photograph, and it keeps a diary. Those are two different things, and they are treated differently: the reading is a question asked and answered, and the photograph that asked it is deleted as soon as the answer comes back. It is never stored by us, and it is never part of what syncs between your devices.

The diary itself — what you ate, what it contained, what you weigh — stays on your phone unless you sign in. Signing in is what makes it appear on your other devices, and it is optional.

A photograph goes to Google, and comes back as numbers.

When you photograph a meal, scan a label, or describe one out loud, the picture or the words are sent to our server and passed to Google’s Gemini model, which reads them and returns a name and nutrition figures. Google is our processor for that request and nothing more.

We use Gemini on a paid tier, under which Google does not use what is sent to improve its models. The request carries the picture, the language you want the answer in, and nothing else — no name, no account, no identifier.

Neither we nor Google keep the photograph. Our server holds no copy at any point after the answer is returned. What we do record is that a reading happened: which kind it was, which language, whether it succeeded, how confident it was, how long it took and how many tokens it cost. Not what the food was.

A number, and only the number.

A scanned barcode is looked up against Open Food Facts, a public database of packaged food. The number is sent; nothing about you goes with it. Products we look up are cached on our server so the next person does not have to wait, which is a fact about the product and not about you.

Only if you want the diary on more than one device.

Kcal works without an account. Signing in exists so the same diary appears on your phone and your iPad, and so it survives a lost device.

Signing in uses Sign in with Apple. Apple tells us a stable identifier for you and an email address, which may be one of Apple’s relay addresses if you chose to hide yours. We store the identifier, the address and nothing else about who you are; the address is used to answer you if you write to us.

While you are signed in, the diary is stored on our server so it can be handed to your other devices: meals, their nutrition, your weight, your targets and your profile. Photographs are not included — they stay on the phone that took them.

What you eat and what you weigh are a special category.

Under the UK and EU GDPR, data about diet and body weight is health data — Article 9 — and needs your explicit consent rather than a general permission. Kcal asks for that consent in its own words before anything is sent, and you can withdraw it in Settings, after which the app stops sending readings and continues to work by hand.

If you connect Apple Health, steps and workouts are read from it and your weigh-ins are written back to it. That exchange happens entirely on your phone. Nothing from Apple Health is sent to us, and turning it off is done in Health, which is also the only place that can show you what was shared.

None at the moment.

Kcal contains no analytics SDK and no third-party tracking. It does not use the device advertising identifier and it does not build profiles.

The app asks during setup whether you would allow anonymous usage statistics. Nothing is collected under that permission today. If that changes, this page will describe exactly what is measured before it is measured, and it will still be off unless you turned it on.

Sent by you, and only what is on the screen.

A thumbs-up or thumbs-down on a reading sends whether it was helpful, which kind of reading it was, the language, how confident the app had been, and the app and system version. It does not send the meal, the picture or anything identifying you.

Reporting a problem opens your own mail application with a message already written. It is sent when you press send, and you see the whole text first.

Germany, on machines we rent.

Our server and its database run in Nuremberg, Germany, on infrastructure rented from Hetzner Online GmbH. Data stays in the European Economic Area at rest.

Google processes readings under its own terms and may do so outside the EEA; those transfers rely on the standard contractual clauses in Google’s terms. Apple handles sign-in and payment under its own terms and never gives us your card details.

Until you delete it, and no longer.

Your diary is kept while your account exists. Deleting your account in Settings erases it from our server — the diary, the profile, the weigh-ins, the sessions — and it is gone, not marked hidden.

The records that a reading happened, with no content in them, are kept for up to twelve months so we can tell whether the app is getting better or worse at its job.

Ask, take, or leave.

You can ask what we hold about you, correct it, take a copy of it, or have it erased. The app does the last two without asking us: Settings exports your whole diary as a file, and deleting your account removes it from our server.

You can also object to processing or ask us to restrict it, and you can withdraw consent at any time. Write to contact@varion-rp.com and we will answer within a month.

If you think we have handled your data badly, you can complain to a supervisory authority — the Information Commissioner’s Office in the United Kingdom, or the authority in the EU country where you live.

Not for under-16s.

Kcal is not directed at children and should not be used by anyone under sixteen. A calorie target is not a neutral thing to put in front of a child.

Said before, not after.

An updated policy appears on this page with a new date. We do not change it retroactively: if we ever start collecting something new, it will say so here before it begins.