Privacy Policy
Caloree holds photographs of your meals and information about your body. This policy says plainly what we collect, who processes it, how long we keep it and what you can ask us to do.
Last updated 2026-11-09
Who is responsible
The controller for the processing described here is:
Vitahealth Ltd
SG24 Soho Savoy Gardens, Triq D' Argens
GZR1362 Gzira
Malta
Malta Business Registry no. C 106863 · VAT MT30732424
For anything about your data, including any of the requests in section 10, write to support@caloreeapp.com.
The short version
What this comes down to:
We collect what the app needs to work: who you are, the body data your targets are calculated from, and the meals you log. Your meal photos and descriptions are sent to an AI provider to be analysed, and are not used to train anyone's models. We use no third-party advertising or analytics trackers — the usage statistics we keep are our own and stay in our own database. We do not sell your data. You can delete your account in the app, which deletes your profile, meals, photos and conversations.
The sections below give the detail, including the legal basis for each purpose and the exact retention rules.
What we collect, and why
| Data | What it is | Why we have it |
|---|---|---|
| Account | Email address; the six-digit sign-in codes we send; or your Google or Apple account identifier and the email address it gives us. A display name if you set one. | To create your account, sign you in and contact you about the service. |
| Profile and body data | Date of birth, gender, height, weight, activity level, workouts per week, diet, your goal, target weight and the pace you chose, preferred macro split, language, units, time zone. | To calculate your personal calorie and macro targets. Without it the app cannot produce a plan. |
| Meals | Photographs of your meals and the text you type; the items recognised, the portions assumed, the calories, protein, carbohydrate and fat; the date and time; meals you save as favourites. | To run the analysis, show your day and keep your diary. |
| Metabalance | The score derived from your logged meals and their sequence over the day. | To show how your meals affect your metabolism (Premium). |
| Weight | The weight entries you add, with dates. | To show your trend against your target. |
| Coach conversations | Your messages to the AI coach and its replies; any report you file about an answer. | To hold the conversation, let you return to it, and investigate reported answers (Premium). |
| Membership and payment | Your membership status, billing periods, the price, and from our payment provider: the payment reference, the card scheme and the last four digits. If you cancel and choose to answer: your cancellation reason and any comment. | To give you access to what you paid for, collect payment, keep our books and understand why people leave. |
| Technical and usage | IP address and request metadata in server logs; which analyses you ran, with the AI model used and the number of tokens; rate-limit counters; feature flags; our own product events (for example "meal logged") with the time they happened. | To keep the service secure and available, enforce the free-tier limits, control our costs and see which features are used. |
| Support | What you write to us, and our replies. | To answer you. |
We do not ask for your address, your phone number or your precise location, and the web app does not request access to your location.
Health data and your consent
Your weight, height, date of birth, diet, goals and the meals you log say something about your health. Under Article 9 of the GDPR this is a special category of personal data that needs stronger protection and a specific legal basis.
We process it on the basis of your explicit consent under Article 9(2)(a) GDPR, which you give when you enter this information during onboarding in order to get a plan. Without it, Caloree cannot do what it is for, so this consent is a practical condition of using the app — but it remains yours to give.
You can withdraw your consent at any time by deleting the relevant entries, or by deleting your account in the app's settings. Withdrawing does not affect processing that already took place lawfully.
We do not use this data for advertising, we do not profile you for anything other than producing your plan and the features you asked for, and we do not pass it to insurers, employers or data brokers.
How the AI analysis works
When you scan a meal, photograph a menu or write to the coach, the content of that request is sent to an AI model to be processed. We reach these models through OpenRouter, Inc., which routes the request to the model provider we have selected for that task. Along with your photo or text we send the instructions for the task and the context the feature needs — for example your targets and what you logged that day, so that the coach's answer makes sense.
What this means for you:
- Your meal photos and descriptions leave our infrastructure for the duration of the analysis, and may be processed outside the EU (see section 8).
- We have agreed terms that the content is processed only to answer our request and not used to train models.
- The result is stored in your account. The request itself, and the model and token counts, are logged so that we can bill correctly and debug failures.
- The output is an estimate produced by a machine. It can be wrong, and you can correct it.
There is no automated decision-making with legal or similarly significant effects for you within the meaning of Article 22 GDPR: the app calculates targets and estimates, and you decide what to do with them.
Our legal bases
| Purpose | Legal basis |
|---|---|
| Running your account, logging meals, calculating targets, the coach, your membership | Performance of the contract with you — Art. 6(1)(b) GDPR |
| Processing your health-related entries | Your explicit consent — Art. 9(2)(a) GDPR |
| Collecting payment, keeping accounting records, complying with tax law | Contract and legal obligation — Art. 6(1)(b) and (c) GDPR |
| Security, abuse prevention, rate limiting, our own usage statistics and cost control | Our legitimate interests in a secure, affordable service — Art. 6(1)(f) GDPR |
| Service emails you need (sign-in codes, billing notices) | Performance of the contract — Art. 6(1)(b) GDPR |
| Any marketing email, if we ever send one | Your consent, which you can withdraw at any time — Art. 6(1)(a) GDPR |
Transfers outside the EU
Some of the providers above are established in, or process data in, the United States. Where personal data is transferred outside the European Economic Area, we rely on:
- the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR, combined with technical measures such as encryption in transit; and
- where applicable, the provider's certification under the EU–US Data Privacy Framework, which the Commission has recognised as providing an adequate level of protection.
You can ask us for a copy of the safeguards in place for a specific provider at support@caloreeapp.com.
How long we keep it
While your account exists, we keep your data so that the app can show you your history. When you delete your account in the app's settings, the following happens:
- your meal photographs and any other files are deleted from storage;
- your profile, plan, meals, weight entries, coach conversations, flags and membership records are deleted from our database;
- your customer record with our payment provider is deleted;
- payment records and our internal usage events are kept but detached from you — the link to your user account is removed, so what remains cannot be traced back to you. We keep these for accounting and statistical purposes.
Beyond that: invoices and payment records are kept for as long as Maltese tax and accounting law requires. Server logs are kept short-term for security and troubleshooting. Support correspondence is kept as long as needed to deal with the matter and any follow-up. Backups are overwritten in the ordinary course, so a deleted item can persist in a backup for a short period before it is gone.
Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it;
- rectify anything inaccurate — much of it you can simply edit in the app;
- erase your data ("right to be forgotten"), which you can do yourself by deleting your account;
- restrict processing, or object to processing based on our legitimate interests;
- data portability — receive your data in a structured, machine-readable format;
- withdraw consent at any time, including the consent for health-related data in section 4;
- not be subject to a decision based solely on automated processing with legal or similarly significant effects — which, as section 5 explains, we do not do.
Write to support@caloreeapp.com to exercise any of these. We answer within one month, and will tell you if we need longer because the request is complex. We may need to confirm your identity before acting, to make sure we are not disclosing your data to someone else. Exercising these rights is free.
Children
Caloree is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has created an account, write to support@caloreeapp.com and we will delete it.
How we protect it
Data is encrypted in transit with TLS. Meal photographs are held in object storage that is not publicly listable and is served only to the signed-in owner. Access to production systems is restricted to the people who need it. Sign-in is passwordless, through a one-time code or Google or Apple, so there is no password of yours for us to lose.
No system is completely secure, and we cannot guarantee absolute security. If a breach occurs that is likely to present a risk to your rights, we will notify the supervisory authority within 72 hours and inform you where the law requires it.
Changes to this policy
We will update this policy when the app or the law changes. The current version is always on this page, with the date of the last substantive change at the top. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect, and ask again for your consent where consent is the basis.
Questions and complaints
Please come to us first at support@caloreeapp.com — we would rather fix something than have you escalate it.
You also have the right to lodge a complaint with a data protection authority. Ours is the Office of the Information and Data Protection Commissioner (IDPC) in Malta, at idpc.org.mt. You may instead complain to the supervisory authority in the EU country where you live or work.
Postal address: Vitahealth Ltd, SG24 Soho Savoy Gardens, Triq D' Argens, GZR1362 Gzira, Malta.