Calally is an AI calorie tracker. To do its job it processes information about your body, your meals, and your goals. Under the GDPR that is health data, a special category that gets the strongest protection in EU law. This page explains exactly what we collect, why, who we send it to, and how you take it back.
Who we are and how to reach us
Calally is the data controller for the personal data described on this page.
For any privacy question, to exercise your rights, or to request a copy of the safeguards we use for international transfers, write to support@calally.com. We answer within 30 days.
What data we collect
Account data. Your email address and the name you sign up with. If you sign in with Apple or Google, we receive the identifier those services return to us.
Health data (special category, GDPR art. 9). This is the core of the app and we want to be blunt about it:
- Weight, height, age, and sex
- Body measurements you enter
- Your goal (lose, maintain, gain) and your target
- Dietary preferences and food restrictions. These can indirectly reveal a religious belief or a medical condition, which is exactly why they get art. 9 protection
- Photos of your meals and of nutrition labels
- Progress photos of your body, if you choose to save them
- Step count from Apple Health, if you connect it
Apple Health (HealthKit). Connecting Apple Health is optional and you control which data you send us. The data you share from HealthKit is never used for marketing or advertising, and is never transferred to third parties for marketing or advertising purposes. We use it only to make your calorie targets more accurate. You can revoke the permission at any time in the iOS Health app, and what you share with HealthKit is also governed by Apple's own terms and privacy policy.
Usage data. The meals you log, the questions you ask the AI coach, and its answers.
Technical data. Security and error logs needed to keep the service running and to detect abuse.
We do not use advertising trackers, we do not run an ad network, and we do not sell anything to data brokers. Calally is a native iOS app: it does not use cookies.
Why health data needs your explicit consent
Under GDPR art. 9(1), processing health data is prohibited by default. It becomes lawful only if one of the exceptions in art. 9(2) applies. For a consumer app like ours the only one that fits is your explicit consent, art. 9(2)(a).
That means a contract is not enough, and neither is our legitimate interest. We ask you, clearly, before we process the health data that powers your nutrition plan, your meal analysis, and the AI coach. If you say no, those features do not run. If you change your mind, you can withdraw consent at any time, and that stops the processing from that moment on.
Legal bases
| Purpose | Legal basis |
|---|---|
| Account creation and user management | art. 6(1)(b), performance of a contract |
| Nutrition plan, meal analysis, AI coach | art. 6(1)(b) and art. 9(2)(a), explicit consent |
| Sharing data with the AI providers listed below | art. 9(2)(a), explicit consent |
| Security, abuse prevention, technical logs | art. 6(1)(f), legitimate interest |
Who we share your data with
Calally does not build its own AI models or its own database. We use named providers, and here is the full list of who receives what. There are no others.
| Provider | What it receives | Where |
|---|---|---|
| Supabase | Everything stored: profile, health data, meals, progress photos, coach conversations | United States (us-east-2, Ohio) |
| Google (Gemini API) | Meal text, meal photos, label photos, messages to the coach, profile context | United States |
| Groq | Voice recordings, transcribed with Whisper | United States |
| Langfuse Cloud | Coach inputs and outputs, plus your user ID | European Union |
| Apple, Google | OAuth authentication only | United States |
| Open Food Facts | The barcode number only. No personal data | European Union |
| Featurebase | Feedback you submit, with your user ID | Provider infrastructure |
Each of these providers acts as a processor on our instructions, under a data processing agreement. They are not allowed to use your data for their own purposes.
Data transferred outside the EU
Our database sits in the United States, and several providers above are US-based. We do not hide this.
These transfers rely on the EU-US Data Privacy Framework, the adequacy decision the European Commission adopted in July 2023, and on the Standard Contractual Clauses included in our providers' data processing agreements. You can ask us for a copy of the safeguards that apply to your data by writing to support@calally.com.
How long we keep your data
Meal photos and voice recordings are not stored. They are sent for processing, analysed, and discarded. We do not keep an archive of them.
Account data, health data, progress photos, and coach conversations are kept for as long as your account is active. When you ask us to delete your account, we delete this data within 30 days.
Technical and security logs are kept for a short retention window and then rotated out.
How to withdraw consent and delete your account
You can do both from inside the app, without writing to us:
- Open Settings in the Calally app.
- To stop the processing of health data, withdraw your consent. The nutrition plan, meal analysis, and AI coach stop working; withdrawal does not affect processing that already happened before you withdrew.
- To remove everything, choose delete account. This deletes your profile, your health data, your meals, your progress photos, and your coach conversations. It is completed within 30 days and it cannot be undone.
If you prefer, write to support@calally.com and we do it for you.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Rectify data that is wrong or incomplete
- Erase your data, the "right to be forgotten"
- Restrict processing in certain circumstances
- Data portability, receiving your data in a machine-readable format
- Object to processing based on our legitimate interest
- Withdraw consent at any time, without giving a reason
- Lodge a complaint with a supervisory authority. In Italy that is the Garante per la protezione dei dati personali (www.garanteprivacy.it)
To exercise any of these, write to support@calally.com.
Children
Calally is not intended for children. You must be at least 16 years old to create an account, which is the age of digital consent in Italy. If we learn that we hold data belonging to someone below that age, we delete it.
Changes to this policy
We update this page when the way we handle data changes, for example when we add or remove a provider. The date at the top always reflects the last revision. If a change is significant, we tell you in the app before it takes effect.