ClariMeal Privacy Policy

Effective date: October 13, 2026

ClariMeal ("the app", "we") is operated by Anatolii Frolov. Contact: [email protected].

This policy explains what data the app handles, where it goes and what never leaves your phone. We wrote it in plain English on purpose.

The short version

• Your food diary, weight history and profile are stored on your device. We do not have a copy and cannot see them.
• There is no account. We do not require your name, email or phone number; an optional display name, if you add one, is not sent to us.
• There are no ads and no data sales. Your data is not our product.
• Meal photos are analyzed by third-party AI services only after you agree. They normally delete this data within 30 days and never use it to train AI; safety or legal holds on a specific item can last longer.
• We use Amplitude to understand how people use the app. It does not receive food names, diary entries, weight measurements or photos. Setup step numbers can reveal your choice to keep your current weight. You can turn usage analytics off in Settings.
• If you are in the United States, our separate Consumer Health Data Privacy Policy also applies, as required by Washington, Nevada and Connecticut law.

1. Data kept on your device

The app keeps the following data in local storage on your phone. AI scans also involve the transfers described in section 2.1. Device backups are described in section 4.

• Profile: an optional display name, sex, date of birth, height, weight, activity level, goal, target weight, units
• Calorie and nutrient targets
• Food diary: logged foods, meal types, portions, nutrients, optional notes
• Weight history
• Custom foods, saved scans and favorites
• Meal photo thumbnails (small copies saved for your diary)
• One unlogged scan result, kept so you can finish logging after the app closes. It contains the reduced photo copy sent for analysis and the returned estimate, together with the target date, meal type and consent timestamps
• Achievements, streaks and app settings

You can edit or delete your diary, profile and weight data in the app. You can discard an unlogged scan result. Deleting the app removes its local data. Section 7 explains when an unlogged scan result is deleted.

Photo library (iOS). ClariMeal can ask for photo library access (full or limited, your choice) solely to show an instant preview of the photo you pick for a scan. The request appears only after you pick a photo. The preview is created on your device and is never uploaded; the photo sent for analysis is the reduced copy described in section 2.1, and that happens only with your scan consent. The app also keeps this reduced copy with the unlogged scan result as described in section 7. Picking photos keeps working without this permission, and you can change it at any time in system Settings.

2. Data processed when you use online features

Some features need the internet. AI scan requests pass through our relay service (hosted on Cloudflare Workers). The relay forwards them and does not store their content. To block abuse, Cloudflare checks the IP address of each request to the relay. For requests it blocks, Cloudflare keeps a security record (IP address, requested path and time) for up to 31 days.

2.1 AI photo scanning (only with your consent)

When you scan a meal, the app sends a reduced-size copy of the photo, and any correction text you type, to third-party AI services: OpenAI and Anthropic. They recognize the food and return calorie and nutrient estimates. When you use Fix Results, the request also includes the current estimate for that photo, including any changes you made to it (dish name, calories, nutrients, amount and components), so the service can correct it. The request goes to OpenAI first. If that request ends with an error response, the app sends the same request to Anthropic, unless our relay refused it because of a usage limit or because AI scanning is not available in your region. In that case the same photo may be processed by both services.

If the app is set to German, we try to show dish and component names in German. The app tells our relay the language with each AI request. For translation, the relay sends only names from the AI answer to OpenAI. This also applies when the answer comes from Anthropic. The photo, the numbers and the identifier described in section 2.4 are not part of that request. The relay does not store the names or the language setting. Names that cannot be translated stay in English.

• This happens only after you agree on the consent screen shown before your first scan
• You can withdraw consent at any time in Settings. Scanning stops until you agree again. The app also deletes the unlogged scan result as described in section 7
• Per their API policies, both providers never use this data to train AI models and normally delete it within 30 days. Items under a legal hold or flagged by a provider's automated safety systems can be kept longer under its policies
• We do not store your photos on any server. The photo in your diary is a local copy on your device. The app saves one unlogged scan result so you can return to it after the app closes. If saving fails, the app tells you that the result was not saved for recovery. Section 7 explains when a saved result is deleted. The saved photo is sent for analysis again only if you choose Fix Results
• Barcodes are detected on your device. Barcode lookup and Android scanner telemetry are described in section 2.3

2.2 Food database search

Searching the food catalog works entirely on your device: the app looks up its bundled food database locally. Your search text is never sent over the internet and never reaches us or anyone else.

2.3 Barcode lookup

When you scan a barcode, the barcode number (digits only, no photo) is sent to Open Food Facts (a non-profit food database) to find the product. As with any internet request, Open Food Facts also receives your IP address and the app's name.

On Android, the barcode scanner uses Google ML Kit, which reads the barcode on your device. ML Kit sends Google technical information about the feature: device and app information, per-installation identifiers, performance metrics, settings of the scanner, the size of its input and output, its version, event types and error codes. According to Google, this data is encrypted in transit and not shared with third parties. On iPhone the scanner uses Apple's built-in camera features and sends nothing to Google.

2.4 Pseudonymous device identifier

To protect the AI service from abuse, the app generates a random identifier on first use. It is pseudonymous: it contains no personal details and we cannot connect it to a person, but it stays the same while the app is installed, including after you delete all data in the app, and it can come back when you restore a device backup. It is sent with AI requests. Daily scan counters for this identifier are kept on our infrastructure and scheduled for deletion within 48 hours; a service failure may delay that deletion. The relay also keeps short-lived records of each request with this identifier: whether it was a new scan or a fix, and whether your app has a subscription. They are scheduled for deletion within 48 hours. If you use free scans, we also keep, for this identifier, the number of free scans and fixes used, with no end date, so the free limit keeps working. This record stays if you later subscribe. It contains no meal photos, correction text or nutrition estimates. Deleting the app or its data does not remove it. AI requests also tell the relay whether your app has a subscription, so it can apply the right limit. Our relay also derives a country code from the network request to check whether AI scanning is available in your region; the app never asks for your precise location.

2.5 Subscriptions

ClariMeal Pro is sold through the App Store or Google Play. The store handles payment; we never see your card details. To check whether you have a subscription and to unlock Pro features, the app uses RevenueCat, a subscription service. Each time the app starts, it connects to RevenueCat with a random ID that RevenueCat creates for your installation, even if you never subscribe. RevenueCat receives your purchase and subscription records from the store (product, price, currency, dates and transaction IDs), your store country, your device model and language settings, the app and system version, and your IP address. On iOS it also receives the device's identifier for vendor and the App Tracking Transparency permission status, which it updates when that status changes. RevenueCat uses the IP address to record the country of your last connection. It does not receive your diary, profile, weight, photos or nutrition estimates. We also use RevenueCat to see how subscriptions perform overall.

2.6 App usage analytics

To see which features people use and which features need improvement, the app sends usage events to Amplitude, an analytics service that processes this data for us. Our Amplitude data is stored in its EU data center in Frankfurt, Germany.

• What is sent: events about the welcome screen, your choices there and the route used to leave it. Together, these events can show whether you agreed to keep your health data on your device. Setup events include step numbers. Some setup steps are skipped when you choose to keep your current weight. Events also show when your plan is ready, whether you choose to scan or continue later, and when setup finishes. We record whether you accept or decline AI photo analysis. Subscription events show when the subscription screen opens, which screen it opened from and why it closes. These source screens include the camera, scan result, Progress, Summary and summary history screens. Events include your monthly or yearly plan selection, purchase attempts and whether a trial is available to you. We record when you tap Restore Purchases. Other events record changes to the badge celebration setting and the number of the week in which you open the app. Each event includes the app's platform, version and event time
• What is not sent: food names, calories, nutrients, portion sizes, diary entries, weight measurements, numerical targets, photos, text you type, your advertising ID or account details. Screen names can indicate which meal-related features you use. Setup step numbers can reveal your choice to keep your current weight
• Analytics ID: the app creates a random ID used only for analytics. It sends Amplitude a hash of this ID. This allows Amplitude to link events from the same installation. It is separate from the identifier described in section 2.4. Deleting the app removes the local analytics ID. Delete All Data in Settings also removes it. Your analytics setting stays unchanged. If analytics is on, the app creates a new ID with the next event. The app marks the ID and your analytics setting to be left out of device backups. On iOS, Apple does not guarantee this
• IP address: we do not send your IP address in analytics events, and Amplitude does not derive your location from it. Like any server, Amplitude sees the connection address while receiving data. The app never asks for your location
• We keep these events only as long as we need them to understand how the app is used and to improve it. If our agreement with Amplitude ends, Amplitude allows 30 days for export and then deletes the data, except where the law requires it to keep data or the data is needed to resolve a dispute between us
• Turning it off: usage analytics is on by default. You can turn it off with the Usage analytics switch in Settings. The app then stops sending new events. It also deletes the local analytics ID. A request sent before you turn analytics off may still reach Amplitude. Turning analytics off does not delete events Amplitude already holds. If you turn analytics on again, the app creates a new ID with the next event. The switch applies to this installation. After you reinstall the app, restore it from a backup or set up a new phone, usage analytics may be on again until you turn it off. To have past events deleted, email us at [email protected]

2.7 App ratings

The app may ask the App Store or Google Play to show its rating prompt. If you rate or review the app there, the store receives your rating and review under its own terms. The app does not receive them.

2.8 Contacting support

You can email us at [email protected] or use the contact form on our website. Cloudflare hosts the contact form and processes your email address and message to send them to our support mailbox, which is hosted by Google (Gmail). Our replies go to the email address you enter. The website does not store your message. To limit abuse, Cloudflare uses your IP address to count how many messages are sent per minute. The website does not store the IP address. We keep support emails as long as we need them to answer you and handle your request.

2.9 Age check (iPhone)

On iOS 26.2 or later, ClariMeal first asks Apple whether age assurance applies to your account. If Apple confirms that it does, the app requests an age range before you continue past the date-of-birth step or import existing data. The app uses it only to enforce its minimum age of 18. Your entered date of birth is not sent to Apple for this check. The returned range is discarded after the check. Only the decision remains in memory until setup ends or is reset. Neither is saved to device storage, included in backups or exports, sent to our servers or used for analytics. Setup is blocked if the returned range does not establish that you are at least 18, you decline to share, or the range request fails. On earlier iOS versions, or if Apple reports that age assurance does not apply or the eligibility check fails, the app uses its existing date-of-birth checks. Apple handles its age checks under its own privacy policy.

3. What we do not do

• No account, registration or login
• No collection of contact details, except the email address you use if you contact support (section 2.8); an optional display name, if you add one, is not sent to us. It is included in your device backup and in an export file you create
• No advertising and no ad SDKs
• We use Amplitude for app usage analytics (section 2.6) and RevenueCat for subscription checks and analytics (section 2.5). Google ML Kit sends technical data from the Android barcode scanner (section 2.3). Our relay also receives scan usage information to enforce limits (section 2.4)
• No sale or rental of data to anyone

4. Device backups

Your operating system may back up app data to your own cloud account:

• Android: Google Auto Backup saves your diary, profile and settings to your Google account (photos and unlogged scan results are excluded). Controlled in your device settings and covered by Google's terms
• iOS: app data is included in your device's iCloud backup if you use one. The app marks unlogged scan results to be left out of backups, but Apple does not guarantee this. Controlled in your device settings and covered by Apple's terms

These backups belong to your Google or Apple account. We have no access to them.

Deleting data or withdrawing consent in the app works on this device. It does not change backups made earlier, which may still contain your diary. The app asks for consent again when a restored consent record does not match this installation. If a restore also brings back the matching installation marker, the saved consent may remain effective. The app cannot delete data from these backups. You can delete them in your device's backup settings.

5. Legal bases (GDPR / UK GDPR)

A food diary can reveal information about your health, so we treat it with the strictest care:

• AI photo analysis: your explicit consent (Article 9(2)(a) GDPR), given on the consent screen and revocable in Settings
• Subscriptions: performing the contract you enter when you subscribe (Article 6(1)(b)); checking at each start whether you have a subscription and measuring how subscriptions perform: our legitimate interest (Article 6(1)(f))
• App usage analytics: our legitimate interest in understanding how the app is used so we can fix problems and improve it (Article 6(1)(f)). Section 2.6 describes the events and what can be inferred from them. You can turn usage analytics off in Settings
• Barcode lookup, the Android barcode scanner's technical data to Google and abuse protection: our legitimate interest in providing the features you request, keeping them working and keeping the service safe (Article 6(1)(f))
• Age check on iPhone: our legitimate interest in enforcing our minimum age of 18 and in complying with the US state laws that apply to the app (Article 6(1)(f)). The age range comes from Apple (section 2.9)
• Support requests: our legitimate interest in answering your message and handling your request (Article 6(1)(f))
• On-device catalog search: performing the lookup you request (Article 6(1)(b)) where ClariMeal is treated as controller of this local operation; your search text is not stored and never leaves your device
• Your on-device records remain under your control. AI scan transfers are described in section 2.1.

6. International transfers

Data sent to OpenAI, Anthropic, Cloudflare, RevenueCat and Google (ML Kit on Android and our support mailbox) may be processed in the United States. Transfers from the EU and UK are protected by recognized safeguards: Cloudflare and Google participate in the EU-U.S. Data Privacy Framework and its UK Extension. OpenAI, Anthropic and RevenueCat rely on Standard Contractual Clauses and, for transfers from the UK, the UK Addendum.

Amplitude stores our analytics data in the EU. Amplitude, Inc. is a U.S. company, and its staff and subprocessors in the United States can access the data. Those transfers rely on the EU-U.S. Data Privacy Framework and, for transfers from the UK, its UK Extension. If these do not apply, Amplitude's data processing agreement provides Standard Contractual Clauses and the UK Addendum as fallback safeguards.

For a copy of the contractual safeguards, email [email protected].

7. Retention

An unlogged scan result expires 7 days after the app first saves its reduced photo copy. Fix Results does not restart this period. The app checks for expired results when it starts or returns to the foreground. Files may remain longer while the app is closed or if deletion fails. Failed deletion is retried during a later check.

8. Your rights

Because your data lives on your device, you exercise most rights directly in the app:

• Access and correction: view and edit everything in the app
• Deletion: delete entries in the app, or delete the app itself. Earlier device backups may still contain copies. You can delete backups in your device's backup settings (section 4)
• Free scan count on our relay: if you used free scans, our relay keeps how many free scans and fixes your app's random identifier has used (section 2.4). It contains no meal photos, correction text or nutrition estimates. Deleting the app or its data does not remove it. This record is linked to a random app identifier, which the app does not display. We cannot locate it using your name or email address alone. We will assess any additional information you provide to help us locate the record and verify that it concerns you. If we cannot verify your request, we will explain why
• Portability: export your data to a JSON file from Settings, and import it back or onto another device. The export is a plain unencrypted file shared through your device's own share sheet; it never leaves your device through us and is not uploaded to any server
• Subscription records: to request access to or deletion of data RevenueCat holds about you, email us. If you have purchased a subscription, include your App Store or Google Play order ID to help us find the record. Without a purchase, the app does not show the random ID, so we may not be able to find the record and will explain why. If you keep using the app after deletion, RevenueCat may create a customer record again using the same random ID stored on your device. Deleting these records does not cancel a subscription; you manage it in your store's subscription settings
• Object: you can object to our use of your personal data for subscription checks and analytics by contacting [email protected]. The app needs the subscription check to work as a paid app, so we may decline an objection to it and will explain why. If you object to subscription analytics, we delete your RevenueCat record if we can locate it and verify that it concerns you. If we cannot, we explain why. While you keep using the app, RevenueCat may create the record again under the same random ID. Uninstalling the app stops further connections from that installation to RevenueCat. Clearing app data does not disable RevenueCat: connections resume if you open the app again. Neither action deletes records already held by RevenueCat
• Object to app usage analytics: you can stop future events with the Usage analytics switch in Settings. This does not delete events Amplitude already holds. You can also object to our processing of those events by emailing [email protected]. The app does not display its analytics ID, so we may be unable to find your events. We will assess any additional information you provide to help us find your events and verify that they concern you. We will explain our response
• Support and security records: to request access, correction or deletion of support emails or security records (sections 2 and 2.8), email [email protected]. You can also object, for reasons relating to your particular situation, to processing based on our legitimate interests
• Restriction: in the cases set out in Article 18 GDPR, you can ask us to restrict how we process your personal data by emailing [email protected]
• Withdraw consent: Settings, AI photo analysis; for on-device health data, Settings, On-device health data. Withdrawal does not affect the lawfulness of processing before it and does not change earlier device backups (section 4)

If you are in the EU or UK, you can also contact us at [email protected] and lodge a complaint with your data protection authority.

If you are in the United States, our Consumer Health Data Privacy Policy describes your access, deletion and appeal rights under Washington, Nevada and Connecticut law.

9. Children

ClariMeal is for adults aged 18 and over. You must be at least 18 to use the app. Age checks may process information indicating that someone is under 18 solely to prevent access.

10. Changes

If we change this policy, we will update it at this address and change the effective date. Material changes that affect how your data is handled will be shown in the app before they apply.

11. Contact

Anatolii Frolov · [email protected]

Person responsible for personal data protection (privacy officer): Anatolii Frolov, reachable at [email protected].