Privacy

Privacy Policy

Caloza is designed without advertising trackers. This policy explains what stays on your device or private iCloud, what is sent for AI analysis, and what the subscription service retains.

Effective: August 2, 2026

Privacy at a glance

Caloza has no ads, third-party analytics SDK, or cross-app tracking. A meal photo and optional notes leave your device only when you submit them for AI meal analysis. Apple Health data is processed on-device and is not sent to Caloza’s server or AI providers.

1. Scope and controller

Caloza: AI Calories Nutrition Tracker is operated by JTC INTERACTIVE - FZCO. This policy covers the Caloza iPhone app, the Caloza Pro subscription and AI service, and the website at caloza.app.

For information processed by the Caloza service, JTC INTERACTIVE - FZCO is the service operator and privacy contact. Email admin@jtcapps.com with questions or rights requests. Apple separately controls information it processes for the App Store, Apple Account, Apple Health, and iCloud under Apple’s policies and your settings.

2. Information Caloza processes

Information stored on your device or in your private iCloud

Depending on the features you use, Caloza stores meal photos, meal descriptions and notes, timestamps, estimated calories and nutrients, detected ingredients and portions, quality scores, meal history, app preferences, optional supplement entries, and profile inputs such as date of birth, sex, height, weight, and weight-goal settings.

SQLite is the local source of truth. When iCloud is available, Caloza may also store meal photos and a meal-history backup in your private Caloza iCloud container and synchronize selected settings through iCloud key-value storage. JTC INTERACTIVE - FZCO does not receive this private iCloud content through the Caloza server.

Information submitted for AI meal analysis

When you request an estimate, Caloza processes the meal photo you selected plus optional General Notes and Meal Notes. The AI-generated nutrition response can include likely foods, portions, calories, nutrients, processing and food-quality signals, and confidence or explanation fields.

Subscription and pseudonymous service information

Caloza creates a pseudonymous installation and app-account identifier so its server can verify paid access. The server processes an opaque installation credential and Apple-signed purchase information such as product, original transaction, entitlement status, expiration, renewal, billing grace, refund, revocation, and Sandbox or Production environment. Caloza does not receive your Apple ID, password, or payment-card details.

Service protection and operational information

The server processes request identifiers, request and response status, token and cost totals, privacy-preserving rate-limit hashes, and security records needed to prevent replay, fraud, abuse, and overspending. Operational logs may contain an IP address, request path, status, timestamp, and service error information. Caloza does not include a client telemetry or diagnostics uploader.

Website information

The website does not set analytics or advertising cookies, use tracking pixels, or collect information through a web form. Its web server may process the ordinary network information needed to deliver and protect a page, including IP address, requested path, time, user-agent information, and response status. If you email support, we receive the address and content you choose to send.

3. AI meal-analysis transfer

Submitting a meal for AI analysis initiates the transfer. The selected photo and optional notes travel over encrypted connections:

  1. from your iPhone to Caloza’s authenticated server;
  2. from Caloza’s server to OpenRouter; and
  3. from OpenRouter to Google Gemini, the current AI model provider.

The content is used only to generate the nutrition analysis you requested. Caloza configures OpenRouter requests for zero-data-retention routing and to deny provider data collection. Caloza does not use meal content for advertising or cross-app tracking.

Raw meal photos and prompt text are not logged or retained by Caloza’s server. A completed AI response may be retained for up to 24 hours so a safe network retry does not create another charge. AI providers still process the content transiently to produce the response.

If the AI recipient or purpose changes materially, Caloza will update this policy and provide additional notice where required before the changed processing begins.

4. Apple Health information

With your permission, Caloza reads only Active Energy Burned from Apple Health to calculate energy context on your device. Caloza does not write data to Apple Health. Active Energy Burned is not sent to Caloza’s server, OpenRouter, or Google Gemini and is not used for advertising, marketing, data brokerage, or cross-app tracking.

5. How information is used

Caloza uses information to:

  • provide the meal estimate, history, trends, local backup, and settings you request;
  • verify, restore, and maintain Caloza Pro access;
  • enforce monthly AI allowances, rate limits, cost ceilings, and idempotent retries;
  • secure the app and service, prevent fraud and abuse, and investigate availability problems;
  • respond to support, export, deletion, correction, and privacy requests; and
  • meet accounting, legal, App Store, dispute, and security obligations.

Where data-protection law requires a legal basis, processing is based on performing the service or contract you request, our legitimate interests in security and reliable operation where those interests are not overridden, and compliance with legal obligations.

Caloza does not sell personal information, share it for cross-context behavioural advertising, build advertising profiles, or use third-party advertising trackers.

6. Service providers and disclosures

Information is disclosed only as needed to the following recipients:

  • Apple: App Store distribution, StoreKit purchases, subscription status, Apple Health, and optional private iCloud storage under your Apple settings.
  • OpenRouter: secure routing of a meal-analysis request you submit.
  • Google Gemini: current generation of the requested meal analysis.
  • Infrastructure providers: hosting, network, database, backup, and security services needed to operate Caloza.
  • Authorities or transaction parties: only when reasonably necessary to comply with law, protect rights or safety, investigate fraud, or complete a legitimate corporate transaction subject to appropriate safeguards.

We require service providers to process information for the instructed service and with protections appropriate to the information. No provider receives Apple Health data through Caloza’s server.

7. Retention

  • Raw AI photo and prompt: not retained in Caloza server logs or database after forwarding the request.
  • Completed AI response and idempotency record: up to 24 hours after completion.
  • Rate-limit hashes: approximately two days.
  • Service and database logs: rotated daily or at 10 MiB, with up to 14 compressed archives.
  • Monthly request, token, and cost totals: retained as needed for quota enforcement, financial controls, reconciliation, and service planning; account-linked totals are deleted or de-identified when no longer needed, subject to legal obligations.
  • Subscription and signed Apple records: retained while needed to provide or restore access and to meet billing, refund, fraud-prevention, dispute, accounting, and legal obligations.
  • Local and private iCloud meals/settings: retained until you delete them using the app, Files/iCloud controls, or device and iCloud settings. Deleting the server account does not delete this separate local or private iCloud content.
  • Support email: retained as long as reasonably needed to resolve the request, keep an appropriate support record, or meet legal obligations.

8. Security

Caloza uses encrypted transport, server-held provider keys, Apple-signed transaction verification, ThisDeviceOnly Keychain credentials, access controls, rate and cost ceilings, bounded logs, and operational security controls. No system is completely secure, and we cannot guarantee that every incident is impossible.

9. Your choices and privacy rights

  • AI meal analysis: Caloza sends a selected meal photo and optional notes only when you submit that meal for an estimate. Do not submit a meal for analysis if you do not want that content transferred to the AI service.
  • Apple Health: Change access in iPhone Settings or the Health app.
  • Photos and camera: Change permissions in iPhone Settings. Caloza asks only when you use those features.
  • Subscription: Manage or cancel through Apple Subscriptions.
  • Access, export, correction, or deletion: Follow the Data Requests instructions or email admin@jtcapps.com.

Depending on where you live, you may have rights to know, access, correct, delete, restrict, or object to processing; receive a portable copy; withdraw consent; or complain to a data-protection authority. We will not discriminate against you for exercising a privacy right. We may need a safe, non-secret verification step before acting on account-linked information.

Important: Deleting a Caloza service account does not cancel Apple billing and does not delete local or private iCloud meal history. Manage the subscription separately through Apple.

10. International processing

Caloza and its providers may process information in countries other than where you live. Where required, we use contractual, technical, and organizational safeguards intended to protect information during those transfers. Mandatory local privacy rights continue to apply.

11. Children

Caloza is not directed to children under 13 and is not designed to manage a child’s diet, growth, medical nutrition, or weight loss. We do not knowingly operate the service for a child under the minimum age allowed by applicable law. Contact us if you believe a child has provided service data unlawfully.

12. Changes to this policy

We may update this policy as the service, vendors, or laws change. The effective date will be updated here, and additional notice will be given where required before a materially changed AI recipient or processing purpose applies.

13. Contact

JTC INTERACTIVE - FZCO
Privacy and support email: admin@jtcapps.com
Data requests: https://caloza.app/data-request/
Support: https://caloza.app/support/