Privacy Policy — Calora AI

Last updated: 4 August 2026

Calora AI is a nutrition tracker built by Bekhruz Valijonov (Uzbekistan). Contact: mavensystemssupport@gmail.com

This policy describes what the app does with your information. It is short because the app does very little: there is no account, no server of ours, and no analytics.

The short version

Calora AI stores your data on your device only. We operate no server and receive no copy of your diary, your weight, your photos or your messages. The only time data leaves your phone is when you use a feature that requires an outside service — AI recognition, the coach, or barcode lookup — and then it goes directly from your phone to that service, never through us.

What is stored on your device

All of the following is kept in a database on your phone and nowhere else:

• Profile you entered during onboarding: age, sex, height, weight, activity level, goal, dietary restrictions and allergies.
• Food diary: meals, foods, portions, calories and nutrients.
• Weight history and progress milestones.
• Coach conversation history and AI memory notes.
• App settings, including your chosen language and units.
• API keys for AI providers you connect yourself. These are held in the operating system’s secure storage (Android Keystore), not in the app database.

You can export all of this at any time (Profile → Privacy → Export) and you can erase all of it permanently from the same screen. Because we hold no copy, an erasure is final.

What leaves your device, and to whom

Nothing is transmitted unless you use one of the features below.

1. AI features — photo recognition, label scanning, and the coach

Calora AI does not run its own AI. It sends requests to an AI provider, and there are two possible arrangements.

Built-in model. If you use the built-in option, requests go to OpenRouter (openrouter.ai) using an API key belonging to the developer. What is sent:

• for a meal photo or nutrition label: the image you captured and a short instruction;
• for the coach: your profile figures, your diary for the current day, your AI memory notes, and the previous messages of the conversation.

Your own provider. If you connect your own provider (OpenAI, Anthropic, OpenRouter, or any OpenAI-compatible service), the same information is sent directly from your phone to that provider using your key.

In both cases the request travels from your device to the provider. It does not pass through any server of ours, and we do not see, store or log its contents. What the provider does with the data is governed by that provider’s own privacy policy, which you should read.

2. Barcode lookup

When you scan a barcode, the code alone is sent to Open Food Facts (openfoodfacts.org), a public food database, to retrieve the product name, brand and nutrition values. No personal data, no account and no key are involved.

3. Nothing else

There is no analytics, no advertising, no crash reporting, no tracking identifier and no telemetry of any kind. The app makes no network requests beyond the two cases above.

Camera, notifications, and other permissions

• Camera — used only while you are photographing a meal or scanning a barcode. Frames are processed for that purpose only. Photos are not stored in a gallery of ours and are not uploaded anywhere except to the AI provider, as described above, and only for the picture you deliberately take.
• Notifications — used for meal reminders you set yourself. They are generated on your device; there is no push server.
• Internet — used for the two cases described above.

Children

Calora AI is not directed at children and is intended for users aged 18 and over. We do not knowingly collect information from children.

Health disclaimer

Calora AI is not a medical service or a medical device. Calorie targets come from formulas, and nutrition estimates from photographs are approximations produced by an AI model, not measurements. For anything involving illness, medication or pregnancy, consult a physician or a registered dietitian.

Your rights

Because your data never leaves your device except as described, the ordinary data-subject rights — access, portability, correction and erasure — are exercised directly in the app: everything is readable on screen, exportable as JSON or CSV, editable, and erasable. We cannot access, correct or delete your data on your behalf, because we do not hold it.

If you are in the European Economic Area or the United Kingdom, this policy is written to satisfy the GDPR/UK GDPR. Where the app transmits data to an AI provider, the legal basis is your consent, given by choosing to use that feature; you may withdraw it by not using the feature or by removing the provider connection.

Residents of Uzbekistan are covered by the Law on Personal Data (No. ZRU-547) on the same terms.

Changes to this policy

If this policy changes, the updated version will be published at this address and the date at the top will change. Material changes will also be noted in the app’s release notes.

Contact

Questions about this policy: mavensystemssupport@gmail.com