Privacy Policy

1. Who is responsible

The data controller is adlerlagune OG, trading as adler.studio, Seitenstettengasse 5/37, 1010 Vienna, Austria. For privacy questions, requests, or complaints, email phil@adler.studio.

2. Data we process

Account and sign-in data

When you use Sign in with Apple, we receive an Apple account identifier and, if you choose to share them, your name and email address. We create an internal account ID and securely issue session tokens. Tokens stored on your iPhone are kept in the Keychain.

Profile, nutrition, and progress data

Depending on the features you use, we process your username, avatar, measurement preferences, height, birth date, calculation sex, activity level, nutrition targets, weight goals, food logs, saved and custom foods, nutrition values, weigh-ins, and related timestamps. This data is used to provide account sync and the app's tracking features.

Photos and camera data

Food photos you submit for AI analysis are resized and stripped of metadata before transfer. Photos attached to tracked meals may be stored with your account so they remain available across devices. Barcode-community submissions include package-front and nutrition label photos; review evidence is deleted after the submission is approved or rejected.

Progress photos and generated pose guides are stored on your device and in your private Apple iCloud/CloudKit database. They are not available to other kcalamari users. You control them through your device, iCloud, and in-app deletion controls.

AI requests

If you use kcalamari AI, the food or goal text, an ordinary food photo, or package photos you explicitly submit are sent through our backend to OpenAI to return an analysis. We request that response storage be disabled and do not intentionally keep prompts or analysis photos after the request is completed. OpenAI's security and abuse-monitoring retention may still apply.

If you choose Bring Your Own Key, your OpenAI API key is stored only in your device's Keychain and the request goes directly from your device to OpenAI. We do not receive your key, prompt, or photo for those requests.

Apple Health

With your explicit permission, kcalamari reads body-weight samples from Apple Health to show relevant weigh-ins and avoid duplicate entries. Health permissions can be changed in iOS Settings. Health data is never used for advertising or sold.

Purchases and app activity

Apple processes App Store purchases. We receive signed transaction information and subscription status so we can unlock paid features. We also process limited onboarding events, feature choices, request timestamps, error details, and security logs needed to operate and protect the service. We do not use third-party advertising trackers.

Open Food Facts

Branded-food search and barcode lookups can contact Open Food Facts directly from your device. The search term or barcode and technical connection data such as your IP address are then processed by Open Food Facts under its own policies.

This website

This website does not use advertising cookies, analytics cookies, account login, or contact forms. Our hosting provider necessarily receives basic request data such as IP address, browser details, and request time to deliver and secure the site.

3. Why we process data

• To provide the app, account, sync, subscription, support, and requested AI features under our contract with you.
• To process optional permissions and features based on your consent, including Apple Health access.
• To secure, troubleshoot, and improve the service based on our legitimate interests, while minimizing the data used.
• To comply with tax, accounting, consumer-protection, and other legal obligations.

4. Service providers and subprocessors

We use the following providers only where needed for the service. Apple and Open Food Facts may act as independent providers under their own terms rather than as our subprocessors.

Where personal data is transferred outside the European Economic Area, we rely on a lawful transfer mechanism and appropriate safeguards as required by applicable data-protection law.

5. Retention and deletion

Account and synced app data are kept while your account is active. You can delete your account in kcalamari under Settings → Account → Delete Account. This removes the account and server-side tracking data, subject to short-lived backups, security records, and records we must retain by law. Data kept locally or in your private iCloud may need to be removed separately from the app, your device, or iCloud.

If you cannot access the app, email phil@adler.studio from the address associated with your account. We may ask for information needed to verify the request.

6. Security

We use measures including encrypted transport, short-lived access tokens, rotating refresh tokens, iOS Keychain storage, protected local files, private CloudKit databases, and access controls. No system is perfectly secure, but we limit access and review our safeguards as the service changes.

7. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or objection to processing. You may withdraw consent at any time without affecting earlier lawful processing. Contact phil@adler.studio. You also have the right to lodge a complaint with the Austrian Data Protection Authority or your local supervisory authority.

8. Children and changes

kcalamari is not directed to children. Users must meet the minimum age required to consent to digital services in their country; progress-media features are limited to adults.

We may update this policy when the app or legal requirements change. Material changes will be communicated in the app or on this page, and the effective date above will be updated.