1. Controller
The controller is Soner Bora, Urnenstr. 14, 59192 Bergkamen, Germany. Send privacy requests to support@calonomy.com.
2. Scope
This policy applies to the Calonomy website and the iOS and Android mobile app. Calonomy helps users record and review nutrition, activity, goals and food prices. Calonomy is not a healthcare provider and is not subject to HIPAA.
3. Visiting the website
Our hosting provider processes connection data needed to deliver and secure the website, including IP address, time, requested URL, referrer, status code and user agent. For users in the EEA, the legal basis is our legitimate interest in a secure and reliable website under Article 6(1)(f) GDPR.
The root page reads the language and region information sent by your browser. DACH regions are directed to German and other regions to English. We do not use GPS or precise location for this purpose.
4. App data we process
- Account and login data such as email address, user ID and authentication information from Apple or Google.
- Profile and goal data such as age, sex, height, weight, activity level, nutrition goal, language, country and units.
- Nutrition and activity data such as foods, portions, meals, nutrients, calories, macros, weight history, goals and activities.
- Financial app data such as food prices you enter, currency and related summaries. Calonomy does not access bank accounts or payment card details.
- Optional connected health data, currently steps and calories burned; Health Connect may provide active and total calories.
- Camera and image data when you scan a barcode or voluntarily use AI photo analysis.
- Purchase and subscription data such as product, entitlement status and technical transaction identifier; we do not receive full payment details.
- Device language and region plus technical security and error data.
5. Purposes and legal bases
- Providing the app, account, synchronization, goals, reports and support: performance of our contract under Article 6(1)(b) GDPR.
- Health-related information and connected health data: explicit consent under Articles 6(1)(a) and 9(2)(a) GDPR.
- AI photo analysis and camera features: consent through your voluntary activation under Article 6(1)(a) GDPR.
- Purchase status and Calonomy Pro: performance of our contract under Article 6(1)(b) GDPR.
- Security, abuse prevention and troubleshooting: our legitimate interests under Article 6(1)(f) GDPR.
- Legal retention and evidence duties: Article 6(1)(c) GDPR.
Consent is voluntary and can be withdrawn for the future. Withdrawing an optional permission only disables the related optional feature.
6. AI photo analysis and camera
AI photo analysis is clearly labelled as an AI feature. When you start it, the meal photo you take is encrypted in transit to a Supabase Edge Function and processed by an AI service provider integrated for this purpose. The analysis estimates foods, portions and nutrients. The app does not save the photo as a profile image or diary attachment. It may be processed by the involved processors within their contractually defined technical log and deletion periods; the result you confirm can be saved as an entry.
AI results may be inaccurate or incomplete. They are an input aid, not medical advice and not a decision producing legal or similarly significant effects. Photos should not include faces, documents or other personal information that is not needed for the analysis.
7. Apple Health and Health Connect
The connection is optional and starts only after you activate it and grant the system permission. Calonomy reads only the steps and calories burned needed for its visible activity feature; Health Connect may provide active and total calories. These values may be synchronized with your account to show daily values and goals.
We do not sell health data or use it for advertising, marketing, credit decisions or data brokerage. You can revoke access in Apple Health, Health Connect or device settings. Data already synchronized to Calonomy can be removed by deleting your account.
8. Recipients and services
- Supabase for backend hosting, authentication, database synchronization and Edge Functions.
- An AI service provider engaged by Calonomy solely for meal images you intentionally submit.
- RevenueCat for Calonomy Pro subscription and entitlement status.
- Apple and Google for sign-in, device permissions, store purchases and subscription management.
- Open Food Facts for product and nutrient information requested through search or barcode.
- Frankfurter for exchange rates when comparing prices in different currencies.
- Hosting and security providers for operation of the website.
Providers receive only the data needed for their task. Processors and subprocessors acting for us are contractually bound. Apple, Google and external data sources may be independent controllers for their own processing.
9. International transfers
Providers may process data outside the EEA. Where the GDPR applies, we use an adequacy decision, including the EU-US Data Privacy Framework for certified US providers, or Standard Contractual Clauses under Article 46 GDPR with additional safeguards where required.
10. Retention and deletion
- Account, profile, nutrition, activity and food-price data is generally retained until the account or individual entry is deleted.
- A photo submitted for AI analysis is not intended for permanent storage in Calonomy; it is processed within the involved processors’ technical log and deletion periods. The confirmed result may remain in the account.
- Server and security logs are retained only as long as necessary for operation, troubleshooting and abuse prevention.
- Records required by law are restricted and retained for the applicable statutory period.
- Deleted data in backups is not used operationally and is removed through the provider’s regular overwrite cycle.
Delete your account in the app or through our web deletion page. App Store or Google Play subscriptions must also be cancelled with the store.
11. EEA and UK rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability or object to processing. You may withdraw consent for the future. You can also complain to a data protection authority. Our competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia: ldi.nrw.de.
12. United States privacy rights
Calonomy does not sell personal data, share it for cross-context behavioural advertising, or use sensitive data for unrelated profiling. Where applicable state law grants rights, you may request confirmation, access, correction, deletion, portability or withdrawal of consent. We do not discriminate for exercising privacy rights. Recognized Global Privacy Control signals match our default because we do not sell data or share it for advertising.
Send privacy requests and appeals against a denied request to support@calonomy.com.
13. Children, security and changes
Calonomy is intended for users aged 16 and over and is not directed to children under 13. We use appropriate safeguards, including encrypted transmission and access controls, but no system can guarantee absolute security. If a breach requires notice, we will notify affected users and authorities under applicable law, including the US Health Breach Notification Rule where it applies.
We update this policy when our features, recipients or legal duties change and will appropriately highlight material changes.