cally privacy policy

Last updated: 26 October 2026

This policy explains what cally does with your data. It covers the cally app for Android (app id app.cally) and for iPhone, the website askcally.com, and the earlier test app (com.calorielens.uae) until it stops working. If something here changes, we’ll update this page and, for important changes, tell you in the app before they apply.

This site uses Google Analytics and Microsoft Clarity to understand how visitors use it.

1. Who we are

cally is made by Elie Saade, an individual developer in the United Arab Emirates. In this policy, “we” means Elie Saade as the maker of cally. You can reach us at support@askcally.com.

If you live in Washington, Nevada or Connecticut in the United States, our consumer health data policy also applies to you: askcally.com/consumer-health-data.

2. The short version

3. Your account

3.1 Signing in

You sign in with your Google account. On iPhone you can also use Sign in with Apple. Google sends us your email address and a code that confirms who you are. We check the code and then drop it, and we never keep the name or picture on your Google profile. Supabase, which runs sign-in for us, keeps your email and your Google account ID. cally’s own records keep only a scrambled version of that ID, with your country, your home time zone, whether your log is kept in your account, when your account was made and last used, and the install ID and app version of each phone you sign in on.

So each request can be checked quickly, our server’s network also keeps a short copy of your account’s status, plan, choices and time zone, for up to 6 hours, with no email or account ID.

When you sign in, Google Play (on iPhone, Apple’s App Attest) also checks that the request comes from a genuine copy of cally (section 15). On iPhone, Google sign-in works the same way, through Google’s own sign-in for iPhone.

With Sign in with Apple, we keep the email Apple shares and a scrambled version of your Apple ID. You can choose Hide My Email. Then we only see a private address that Apple forwards to you. When you delete your account in the app, we tell Apple to end cally’s access to your Apple ID. If you stop using Sign in with Apple for cally in your Apple settings, Apple tells us and we sign you out on every phone: we keep a note of when, under a scrambled code, until your phones next connect, at most 400 days. If you delete your Apple account, Apple tells us and we delete your cally account.

3.2 Your age

cally is for adults. When you sign in, you pick your birth year, and Google Play, when it gives one, tells us whether the account belongs to an adult (on newer iPhones, Apple’s age range feature does the same). Our server uses them to check your age and doesn’t keep them. Your birth year is part of your plan (section 4). If you’re under 18, sign-in stops and nothing is kept on our server. Your phone keeps a single note that the check said under 18, without your birth year, so it can show you the right screen.

If you’re signed in and change your birth year in You to one under 18 while your phone can’t reach our server, your phone keeps that year and a scrambled tag of your account, never in a backup, until it can send the year to our server, once. Our server doesn’t keep it: it deletes your account as an under-18 account (section 22), and your phone is wiped. If you sign out before then, the year is deleted without being sent.

3.3 Staying signed in

Your phone keeps the sign-in session encrypted and never puts it in a backup. On iPhone it stays in the Keychain on that device only, never in iCloud Keychain. The session ends when you sign out or delete your account.

3.4 Your choices are recorded

When you agree to something, like the cloud log, health details or the coach, or say no, cally records your answer, the version of the words you saw, when, and the app’s version. These records are kept on your phone and, once you’re signed in, in your account, until you delete your account. Your agreement to the cally dot, and on iPhone to the cally shortcut, is kept for each phone. Your answers about food rules and your eating window are recorded only on your phone (section 9.4).

4. Where your log lives

4.1 On your phone

Your food log, meals, Your foods, plan, weigh-ins, body measurements, water, steps and reminders are kept on your phone. cally works without a connection for most things.

While you set cally up, your answers so far, like your birth year, height and weight, are kept on your phone, so you can pick up where you left off. They’re deleted once your plan is saved. Your answers about health, like GLP-1 or a pregnancy, are never kept there: if you close the app before your plan is saved, cally asks them again.

4.2 In your account (if you choose)

When you set up cally, you choose where your log lives. If you choose to keep it in your account, a copy goes to our database in Frankfurt, Germany, and stays in step across your phones. That copy includes each meal’s name, calories, nutrients, meal and time, the restaurant and the food app it came from, your plan, weight, measurements, water, steps by day, reminders and what cally remembers. Each entry, weigh-in and glass of water notes which of your phones added it, and one that came from or went to Health Connect keeps Health Connect’s own code for that record. If you use the coach, it also includes your coach chats, locked with your account’s own key (section 9.2). It never includes your photos, food rules or eating window.

Health details go to your account only if you also agreed to health details (section 10).

You can stop the cloud log any time in Privacy choices. Your account copy is then deleted and the log stays on this phone.

4.3 Phone backups

If you use Android’s backup, cally’s main data is included in your Google account’s backup, encrypted with your screen lock when you have one, whether or not you also keep your log in your account: your log, plan, weigh-ins, measurements, water, steps, reminders, what cally remembers, your health details if you agreed to them, and the record of your choices. It also includes the answers of a setup you haven’t finished, like your birth year and weight, never your health answers. cally leaves out its most private files: chats, your session, your food rules, your eating window, your device ID and its note of your plan. You can turn Android’s backup off in your phone’s settings. On iPhone, cally keeps your log, chats and health values out of iCloud backup, and your session out of iCloud Keychain. A new iPhone gets your log back from your account, if you keep it there, or from an export.

5. The cally dot (Android)

The cally dot uses Android’s accessibility service. Before you switch it on, cally shows you what it does and asks you to agree, and records that you agreed.

5.1 Only in food apps

It works only in the food apps you use, like Talabat or DoorDash. It never reads other apps, messages, passwords or what you type, and it never taps or types for you.

5.2 Page type, on your phone

While a food app is open, cally checks on your phone whether you’re on a dish, a menu, the checkout or an order screen, so the dot can help or step aside. Nothing from this check is kept, and it’s shared only when you ask cally on that page.

5.3 When you tap the dot

When you tap the dot on a dish, cally reads that dish and takes one screenshot of the food app. Everything outside the food app, like notifications or the keyboard, is covered before it leaves your phone. If Android can’t take it that way, cally uses the dish’s text alone, and it never asks to capture or record your screen. The dish and the screenshot go to our server and Google Gemini, with OpenAI as a backup, to work out the calories. Our server doesn’t keep the screenshot. It keeps the dish and its estimate so the same dish gets the same number (section 8.1).

To read text in a screenshot on your phone, cally uses Google’s ML Kit. ML Kit sends Google usage and performance data, like your phone model and how long reading took, but not the image or its text.

5.4 Show picks and Ask cally

It reads the dishes on your screen only when you tap Show picks. It reads up to 25 dishes you can see, never the rest of the menu, and never scrolls or taps in the food app. To see more, you scroll and tap again. cally keeps what it read on your phone for that visit, at most 60 minutes, so it can answer follow-up questions, and sends it with each question you ask in that visit. Our server doesn’t keep it. cally never connects to the food app’s servers and never signs in to them.

5.5 Fits your day, log after ordering, and the hello

cally works out on your phone how a dish fits what’s left of your day. After you order, it can offer to log what you looked at. It keeps the dishes you looked at in memory for an hour and saves nothing until you tap Log it. On a restaurant page the dot may also say hello and offer help, a few times a day at most; you can switch this off in the app.

5.6 Switching it off

You can pause or hide the dot in cally, or switch the accessibility service off in Android Settings, under Accessibility. To show the dot over your food apps, cally also uses Display over other apps and Usage access to know which app is open. Both work on your phone only.

6. cally on iPhone

6.1 The Dynamic Island

On iPhone, the cally dot lives in the Dynamic Island. If you set up the “When Talabat opens” automation in Apple’s Shortcuts app, your iPhone tells our server which food app opened, so the server can wake the island through Apple’s push service. The wake-up sends the food app, a random visit code and whether you use Back Tap or the Action Button. We use that only to start the island and keep nothing beyond a count for your iPhone, under a scrambled code, that limits how often it can happen, for about 2 days.

To show an answer, our server sends the island, through Apple’s push service, the dish’s name, calories, protein, carbs and fat, up to three picks with their calories, the calories you had left, the meal and whether calm mode is on. We don’t keep it after sending. The island and Lock Screen show the dish, calories and a Log it button, never health details, medicines or chats. Calm mode hides every number.

On iPhone, cally reads nothing on your screen unless you run the cally shortcut or use Visual Intelligence (sections 6.2 and 6.3).

6.2 The cally shortcut

When you run the cally shortcut, with Back Tap or the Action Button, your iPhone takes one screenshot, cuts off the status bar and the home bar, and sends it with the text your iPhone read on it to our server and Google Gemini, with OpenAI as a backup. With it go the food app, the calories you had left at that moment, your market, the meal and whether calm mode is on. The screenshot is never saved to Photos, and your iPhone deletes it right after the request. Our server doesn’t keep the screenshot. It keeps the dish and its estimate as in section 8.1, and the answer for 10 minutes so that trying again isn’t counted twice (section 15). What was read stays on your iPhone for that visit, at most 60 minutes, so cally can answer follow-up questions.

The shortcut works only after you turn it on in cally. We record that you agreed, which words you saw and when, on your iPhone and, once you’re signed in, in your account. You can turn it off in You. Adding the shortcut opens Apple’s iCloud page and sends nothing about you to cally. Try it on a sample menu uses answers stored in the app and sends nothing.

6.3 Visual Intelligence

On iPhones with Apple Intelligence, Apple’s Visual Intelligence asks every app that offers to help with what your camera or screen shows. cally checks on your iPhone whether it looks like food, and sends nothing. Only if you tap Ask cally about this dish does the image go to cally, as in 6.2.

6.4 Siri and Shortcuts

You can ask Siri to log water or ask cally. Siri handles your voice under Apple’s terms and passes cally the request.

7. Estimates

7.1 Photos and typed meals

When you snap or choose a photo of food, or type a meal, cally sends it through our server to Google Gemini, with OpenAI as a backup. Our server doesn’t keep the photo or your words. It keeps the answer for 10 minutes, with your account, so trying again isn’t counted twice. Google may keep requests for up to 55 days and OpenAI for up to 30 days, to check for misuse.

When you take a photo in cally’s camera on Android, cally also reads the phone’s tilt and the lens’s focus distance to measure the portion. Those readings stay on your phone. cally keeps a copy of your photos in its storage on your phone, and they never go to your account.

7.2 Quick questions

When one answer can change the number a lot, cally asks one quick question, like whether a dish is shared. Your answer goes with the estimate.

7.3 Voice

A clip of up to 60 seconds (30 seconds in the earlier test app) goes through our server to Deepgram, which turns it into text. Deepgram doesn’t keep the audio or use it to improve its models. Our server doesn’t keep the audio. It keeps the text for 10 minutes, with your account, so trying again isn’t counted twice.

7.4 Barcodes and search

When you scan a barcode, cally sends the barcode number to our server, which looks it up in our copy of public food data. If our copy doesn’t have it, our server asks Open Food Facts for that barcode alone, never with anything about you. Barcode answers are kept up to 7 days, with nothing about you, and we count barcodes nobody had, by country and month, without you. A code a shop prints on food it weighs itself is never looked up.

When you search for a food, cally first searches your own foods and the food lists on your phone, then sends the words to our server. When one of the words is in Latin letters (FatSecret’s free food data is in US English), our server may also send the words, and nothing about you, to FatSecret through our relay on Fly.io, and keeps FatSecret’s answer for up to 24 hours under a scrambled form of the words. We don’t keep or log your searches.

For the daily limits, our server counts how many lookups and searches your account makes each day, never what you looked up (section 15).

7.5 Label snaps

When a barcode isn’t found, you can snap the nutrition label. Gemini reads it, and our server doesn’t keep the photo; Google may keep the request up to 55 days to check for misuse. The values come back to your phone sealed, so only your account can use them, for up to 24 hours. Our server keeps that answer for 10 minutes, so trying again doesn’t read the label twice. Once you confirm, the food is saved in Your foods on your phone.

If you share food fixes (section 8.2), your confirmed label also counts toward cally’s food data, which publishes a label only when enough people’s snaps agree.

8. Same dish, same number, and shared fixes

8.1 Same dish, same number

So the same dish on a food app always gets the same number, cally keeps a dish’s estimate under a code made from the country, the food app, the restaurant, the dish and its description or price. Once two accounts agree on it, it’s kept for up to 12 months; until then, for 30 days. It holds nothing about you except a short scrambled code for each account that made or confirmed it, so a wrong number can be removed. Your own repeat answers are kept for 30 days with your account, so your dish stays the same for you, and are deleted with your account.

8.2 Shared food fixes (off unless you switch it on)

If you switch on sharing fixes in Privacy choices, the numbers you correct and the labels you confirm are counted with other people’s to improve cally’s food data. Each fix is stored with a code made inside our database, not your account ID, and kept up to 24 months. cally publishes a value only when enough people agree, and only as a middle value with a rough count, never one person’s fix. It takes a value down again when agreement drops. If you switch sharing off or delete your account, your fixes are forgotten at once.

9. The coach

cally, your AI food coach, is a chat about your food. It’s run by AI.

9.1 What a message sends

When you send cally a message, cally sends it through our server to Google Gemini, with up to 6 earlier messages in the chat and a short card your phone makes for that message: your plan, today’s numbers and what you logged, your week’s averages, foods you don’t eat, the things cally remembers that fit the question, and your time zone and language. If you agreed to health details, every message also carries your health details (including whether your plan has no calorie deficit) and your weight trend (section 10). Only with your agreement, and only when the message is about choosing or logging food, it carries your food rules and eating window (section 9.4). If you ask over a food app, it also sends the app, the restaurant, and the dish or the dishes read on your screen. It never sends your name, email, birth year, photos or precise location. When one of cally’s earlier replies showed a card for logging food, your phone also sends our server the card’s foods with that reply: each one’s name, amount, calories, protein, carbs and fat, where its numbers came from, and whether each was logged from that card. Our server uses them so cally doesn’t offer or log the same food twice, and doesn’t send them on to Gemini as they are: Gemini gets the reply’s words, and a food from that card only when cally puts it on a new card or tells you it is already logged.

So cally can look things up for you, yesterday’s log, your daily totals for the last 14 days and your own foods also go to our server with each message. They reach Gemini only when cally looks them up to answer. On your phone, cally can also look up your log on another day and your weigh-ins (with health details), and work out whether your target can change. It never looks up steps, active calories or workouts (section 11.2). What it looks up goes to Gemini as part of that answer.

Google may keep requests for up to 55 days to check for misuse. Our server doesn’t keep your message. It keeps cally’s reply for 10 minutes, with your account, so trying again isn’t counted twice (section 15), and a dish cally estimates for you on a food app as in section 8.1. When cally learns something about your food life, our server checks it and sends it back to your phone to keep (section 9.3).

cally’s widgets show calories left and the dot on your home screen, from your phone. Talk on a widget opens a coach message, as above.

9.2 Where chats are kept

Your chats are kept on your phone. If you keep your log in your account (section 4.2), your chats are kept there too, so they’re on every phone you sign in to. This is already chosen when you sign in, and one tap keeps everything on this phone only, then or later in Privacy choices.

In your account, every chat is locked with your account’s own key. The words are never readable in our database, and its backups hold only locked copies, for up to 7 days. Only our server opens them, to send them to your phones and to put them in your copy (section 20.3). A message that got a safety reply never leaves your phone (section 9.5).

Chats are deleted after 90 days, or after 30 days or a year if you choose, on your phones and in your account. A message you delete, or Clear chats, is deleted everywhere at your phones’ next sync, and turning off the coach in Privacy choices deletes every chat from your account at once. A reply you report is kept as section 9.6 says.

9.3 What cally remembers

cally remembers useful things about your food life on its own, like foods you don’t eat, what you usually order or a routine it sees in your log. Each time, it shows one line in the chat, like “Remembered: doesn’t eat mushrooms”, with Forget it. Everything is listed in What cally remembers, where you can edit or forget any item. Pause memory stops cally keeping and using memories without deleting them. Switching memory off in Privacy choices deletes everything cally remembers, from your account at once and from your other phones when they next connect.

cally never keeps anything about mental health, signs of an eating disorder, distress, other people, or guesses about your religion, health or identity. It never keeps the name of a medicine or a condition, or a pregnancy or breastfeeding, as something it remembers, even with health details on: if you mention one, cally uses it only in that conversation. Settings you choose yourself, like GLP-1 support or a plan with no calorie deficit, stay settings (section 10). Health details, like an allergy, a food you avoid for a health reason or how a food makes you feel, are kept only after you agree to health details.

What cally remembers is kept on your phone and, if you keep your log in your account and agreed to memory, in your account.

9.4 Food rules and your eating window

Food rules, like halal, and your eating window stay on your phone and out of backups. When you ask cally about choosing or logging food, it sends them as plain rules, like “no pork” or “eats between 18:10 and 04:30”, to Google Gemini for that message only. They never go to your account.

9.5 When things feel hard

If a message sounds like a crisis, an eating disorder, a medical emergency, or someone under 18, cally answers with a reply written by people, with local helplines and the emergency number.

Your phone checks each message first. If it spots a crisis, the message doesn’t leave your phone: cally shows the reply at once and sends only a count of that kind of reply and the language, never your words. For the other kinds, when you’re online your message goes to cally as usual, so it can answer with the right reply. Offline, your phone answers by itself and sends only the count when it’s back online (a count waits on your phone for up to 7 days). Our server also checks each message with Google Gemini, with up to 6 messages before it, the short note of older ones, your minimum calories, and over a food app the app, the page and the dish names on your screen.

Those chats are kept 30 days on your phone and never used for memory. For 30 days after, cally stops showing picks and calorie fits. To show the right helplines, your phone sends our server only your country. Our crisis protocol is at askcally.com/crisis.

9.6 Reporting a reply

If you report a reply, that reply, your message before it and the reason you chose go to us, stored with a scrambled code instead of your account ID, so we can check it. We keep reports for 30 days.

9.7 Your week

Once a week, cally can write a short note about your week from its numbers: the days you logged, calories and protein, your most logged foods, meals out and your goal. Never your name, weight, health details, memories or chats. The numbers go to Gemini to write it, Google may keep them up to 55 days to check for misuse, and the note stays in your chat on your phone.

10. Health details

Some things count as health information: a medicine like a GLP-1, a doctor’s numbers, a fluid limit, an allergy or intolerance, a food you avoid for a health reason, how a food makes you feel, or a medicine day reminder. cally keeps these only after you agree to health details, and asks before keeping the first one.

With your agreement, health details are kept on your phone and, if you keep your log in your account, in your account. They go to Gemini only in coach messages that need them. You can switch health details off in Privacy choices. They’re then removed from your account at once, and health memories are deleted from your phones too.

Your answer counts for your whole account, and cally asks once. If you said yes on one phone and then sign in on a new phone, or one restored from a backup, that phone uses your yes and doesn’t ask again, as long as you agreed to the same words (in English or Arabic, on Android or iPhone). Privacy choices there shows health details on, where you can switch them off, and if you keep your log in your account, your health details come back to that phone from it. This also happens if that phone asked you before you signed in and you said “Not now”. If you agreed to older words, cally asks again. A “Not now” on a phone where you never said yes reaches your account only if your account holds no yes, so it never removes health details you set on another phone, like a doctor’s fluid limit. Switching health details off in Privacy choices, on any of your phones, removes them from your account at once, and your other phones remove them when they next connect.

Each plan you save while health details are on also notes, in your plan’s history, whether it was made for GLP-1 support or a protein or fluid limit. Today those notes stay in your plan’s history, on your phone and, if you keep your log in your account, in your account, when you switch health details off. They’re deleted with Delete all my data or your account.

If you tell cally you’re pregnant or breastfeeding, cally doesn’t keep those words. It keeps only that your plan has no calorie deficit, and cally doesn’t suggest a daily target. cally also uses this setting when your plan can’t offer weight loss, but that plan keeps a daily target. So the setting alone doesn’t say why, but together with the rest of your plan it can only mean a pregnancy or breastfeeding: a pregnancy saves no daily target, and if you set your own target, your plan’s history records that cally didn’t hold back weight loss for your body. It is part of your plan: it stays on your phone, and goes to your account with your log if you keep your log there, whether or not health details are on, so your plan in your account shows it. With health details on, coach messages say that your plan has no calorie deficit, next to your daily target, which every message carries (section 9.1). If you ask cally to change your target while this setting is on, the coach is told only that your plan keeps no calorie deficit, never why, whether or not health details are on. A pregnancy or breastfeeding is never kept as something cally remembers (section 9.3).

Your plan uses your weight, height and goal. That stays on your phone unless you keep your log in your account.

If you live in Washington, Nevada or Connecticut, see our consumer health data policy: askcally.com/consumer-health-data.

11. Health Connect and Apple Health

11.1 Health Connect (Android)

Health Connect is off until you switch it on in cally, and cally asks Android for each kind of data. cally can write the meals you log. If you allow it, cally reads your weight, with earlier weigh-ins when Health Connect allows it. Each weight it reads becomes a weigh-in in cally, just like one you type: it shows on Progress, it is kept in your account when your log is kept there (section 4.2), and it is part of your weight trend (section 10). If you allow it, cally also reads your steps, your active calories and today’s workouts (the type, when it started and how long it lasted) to show them on Today. Those stay on your phone: they are not stored, not sent to cally’s servers or the coach, and burned calories are not added to your calorie target. cally never opens Health Connect from the dot or in the background. Meals written to Health Connect stay there until you delete them there.

11.2 In the coach

Steps, active calories and workouts from Health Connect or Apple Health are not used in the coach. A weight read from them is a weigh-in like any other, so it is part of the weight trend the coach gets if you agreed to health details (section 9).

11.3 Apple Health (iPhone)

On iPhone, Apple Health works the same way. It’s off until you switch it on. cally can write the meals, water and weight you log. If you allow it, cally reads your weight, which becomes a weigh-in in cally like one you type (as in 11.1), and your steps, active energy and today’s workouts, to show them on Today. Your steps, active energy and workouts stay on your iPhone: they are not stored, not sent to cally’s servers or the coach, and burned calories are not added to your calorie target. cally never asks from the island, a shortcut, a widget or in the background. You can delete what cally wrote with Delete what cally wrote.

12. Reminders and notifications

12.1 Reminders

Reminders you set, like a meal or weigh-in reminder, are kept on your phone, and in your account if you keep your log there. A medicine day reminder counts as a health detail. To send notifications, cally keeps your phone’s notification code from Google Firebase Cloud Messaging in your account. About a day before a free trial ends, cally can remind you that way, if notifications are on.

12.2 iPhone

On iPhone, your iPhone schedules your reminders itself, and cally has no Firebase. The island’s updates come through Apple’s push service, using codes your iPhone gives us, which we keep in your account until they change or you delete it; the island’s code is dropped when the island ends, within 8 hours.

To avoid being charged, cancel in your App Store subscriptions at least 24 hours before a free trial ends, as Apple requires. Your iPhone reminds you before that cutoff: when cally learns of your trial, your iPhone sets a reminder for about 26 hours before it ends. It’s set even if you’ve switched cally’s other reminders off, and it stays if you sign out, because Apple still renews the subscription; it shows unless you’ve turned off cally’s notifications in your iPhone’s settings. As a backup, our server can send the same reminder through Apple’s push service 26 to 30 hours before the trial ends; your iPhone shows only one. The reminder names no food, number, price or person.

13. Subscriptions and the free trial

13.1 Google Play

cally’s subscription is sold through Google Play. When you start the trial or subscribe, cally sends the purchase details Google Play gives it to our server, which checks them with Google Play and keeps them with your account: the product, plan and offer, its state and dates, and the purchase code, encrypted. Google Play keeps a scrambled account code with your purchase, made by our server, so the purchase can be matched to your account. Google tells our server when a subscription renews, changes or ends; we keep those notices for 30 days, with the purchase code scrambled. We never see your card or billing address. Your phone keeps our server’s last answer about your plan, like its state and end date, so cally starts with it; never the purchase code.

If we give an account free access, for example for Google’s app review or for testers, we record the plan, the end date and why.

13.2 One free trial

To keep one free trial per person, we keep a scrambled version of your Google or Apple account ID and the date of your trial for 24 months, even after you delete your account. If a second Google Play trial slips through, we end it and refund it in full. On iPhone, our server asks Apple to skip the trial instead, because only Apple can cancel or refund an App Store subscription.

13.3 Proof of what you agreed to

When you start a trial or subscribe, we keep the offer, the price and the renewal words you saw, and when you accepted, without your account ID, for up to 3 years, also after you delete your account.

13.4 App Store (iPhone)

On iPhone, Apple sells the subscription. Apple handles the payment, cancelling and refunds, under Apple’s terms. cally sends the purchase details Apple gives it to our server, which checks them with Apple. To keep one free trial per person, our server can tell Apple to skip the trial if you already had one on Android. A subscription bought on one phone works on the other with the same account. Apple keeps an account code our server makes with your purchase, so the purchase can be matched to your account. Apple tells our server when a subscription renews, changes or ends; we keep those notices for 30 days. If Apple refunds a purchase, we keep a scrambled code of that purchase, which says nothing about you on its own, for up to 400 days, so the refunded time isn’t given back by mistake. We keep it up to 400 days after Apple’s last notice about that purchase, also when Apple reverses the refund. We never see your card or billing address.

14. Crash reports and usage stats

14.1 Android

You can change both in Privacy choices. cally doesn’t use your advertising ID.

14.2 iPhone

cally for iPhone has no crash reporting or usage stats of its own. If you choose to share crash reports with app developers in your iPhone’s settings, Apple passes cally’s crash reports to us. cally for iPhone doesn’t use the advertising identifier, doesn’t track you across other companies’ apps or websites, and never asks to.

15. IDs and security checks

cally makes its own random install ID, sent with the app’s version and your time zone, to apply limits and run checks. Google Play Integrity (on iPhone, Apple’s App Attest) confirms to our server that a request comes from a genuine copy of cally on a genuine phone, when you sign in, buy, and use AI features. We keep that a check passed, for each install, for up to 2 days. On iPhone, we keep the public part of the App Attest key for your install, with nothing about you, until your iPhone makes a new one. It belongs to the install, not your account, so deleting your account doesn’t remove it.

So the daily limits work and nothing is charged twice, our server keeps, with your account, counts of how much you use each AI feature each day, week and month, your home time zone, the codes of your requests in the last 10 minutes with their answers (which can name dishes read on your screen), and the times of your last minute’s requests. Day counts are kept 2 days, week counts 3 weeks and month counts 2 months, and all of it is deleted with your account, apart from the time you were last signed out everywhere, which stays one more day.

To slow down abuse, we count sign-in checks for each Google account each day, under a scrambled code, for 2 days, and sign-ins and account requests for each install by the minute. Our server counts your internet address only in its memory and never stores it. Supabase, which runs sign-in for us, keeps its own record of sign-ins and session renewals, which can include the internet address, for 30 days, and deletes it with your account.

Our server’s records hold the kind of request, result, size and time, never what you sent.

16. Help and support

In Help, you can ask a question about using cally. The question goes to Google Gemini to answer. We don’t keep it; Google may keep it up to 55 days to check for misuse. To limit misuse, we keep a count of questions for each install, under a scrambled code, for up to 2 days, and that the install passed a Play Integrity check (on iPhone, App Attest), for 24 hours.

If you email support@askcally.com, we use what you write to help you. When we look up your account to help, we record that we did, and keep that record for 24 months.

17. Who processes your data

These companies process data to run cally, as described above:

We don’t use any of them for ads, and we don’t sell, rent or share your data with anyone else, unless you ask us to (like sharing a label photo with Open Food Facts) or the law requires it.

18. Where your data is processed

Your account and log are stored in Frankfurt, Germany. Some records, like the access check, the deletion log and shared dish numbers, are kept on Cloudflare’s network, with no name or email in them. Google, OpenAI, Deepgram and FatSecret process requests mainly in the United States, and Google may store Gemini requests for a short time in other countries where it has facilities. Our relay for FatSecret runs on Fly.io in Paris, France. So your data may be processed outside the country you live in.

19. How long we keep it

20. Deleting your data and your account

20.1 In the app

You can delete a meal, a memory or a chat in cally. Delete all my data clears everything on your phone.

Deleting your account, in You under Account, needs a fresh sign-in with Google, or with Apple if you use Sign in with Apple. It stops your Google Play renewal and removes your account and everything in it, apart from the few records listed in section 19, and your phone wipes its copy (and, on Android, resets usage stats). Your account can’t be used from the moment you ask. If Google Play can’t confirm at once that the renewal stopped, the rest waits for that confirmation for up to a week, then goes ahead. On iPhone, if you subscribed through the App Store, cally first shows a button to Apple’s subscriptions page, because only you can cancel there; you can still delete right away. For Sign in with Apple, we also tell Apple to end cally’s access.

20.2 On the web

You can also delete your account at askcally.com/delete, by signing in with Google. The page shows your account’s email, partly hidden, before you confirm, and loads Google’s sign-in and fonts from Google. Phones signed in to that account are signed out the next time they renew their session. If you use Sign in with Apple, delete in the app or email us.

20.3 Your copy

You can export your log as a file in You, under Account, and send it where you like with your phone’s share sheet. cally can import that file again. The part only our server holds, like your consents and subscription history, needs a fresh sign-in with Google or Apple first. Chats kept in your account are in that part too.

Meals written to Health Connect or Apple Health stay there until you delete them there.

21. Your rights

You can ask what data we hold about you, get a copy, ask us to correct or delete it, object to how we use it, and withdraw any consent, by switching the feature off or by emailing us. Depending on where you live, for example under the UAE’s data protection law or a US state’s privacy law, you may have more rights. We reply within 30 days. If you’re not happy with our answer, you can complain to your local data protection authority or your state’s attorney general.

22. Children

cally is for people aged 18 or older. We don’t knowingly collect data from anyone under 18. If cally’s safety check suggests someone under 18 is using an account, we pause its AI features until the person confirms their age. If they confirm they’re under 18, the account is deleted and its Google Play subscription is refunded rather than only cancelled; on iPhone we offer Apple’s refund request. If our database can’t be updated at that moment, our server’s network keeps the account ID for up to 7 days, until the pause can be recorded. If you think someone under 18 is using cally, email us.

23. Security

All traffic between cally and our server is encrypted. The keys for the AI services stay on our server, never in the app. Purchase codes are encrypted on our server. No system is perfectly secure, so please keep your phone updated and use a screen lock.

24. Accuracy

cally’s numbers are estimates. A dish can be off by a lot, depending on the recipe, the portion and what the screen or photo shows. cally isn’t a medical device and doesn’t give medical advice. If you have a medical condition, an allergy or specific needs, talk to a doctor or a dietitian.

25. Changes to this policy

We’ll update this page when cally changes, and change the date at the top. For important changes, we’ll tell you in the app before they apply.

26. Contact

Email support@askcally.com. We aim to reply within 30 days.

27. The earlier test app

Until it stops working (from Mon 7 Dec 2026), the earlier test app (com.calorielens.uae) and the first test builds still use a random device ID to count daily use. The server keeps only a scrambled code with each day’s counts, including how many AI requests were made for that device, and deletes them just after midnight UTC.

If you subscribed in the earlier test app, our server checks your subscription with Google Play. It keeps the answer under a scrambled code, never the purchase code itself: up to 24 hours when active, 10 minutes when not, and a note that it was active for up to 31 days, so it can be checked again.

If you switched on Help us improve estimates in the earlier test app, those details are deleted within 30 days. Thirty days after the earlier app stops working, everything kept for it is deleted.