CalTrak Privacy Policy
CalTrak does not require a CalTrak account. Your main food log stays on your device. Optional online features process the information needed to provide them, and we keep limited service statistics. We do not sell your data or use it for advertising.
Your app data
Your food log, goals, measurements and settings are stored on your device using SwiftData on iOS and Room on Android. CalTrak does not automatically synchronize this database to a CalTrak account. Backups and information you choose to export or share create separate copies controlled by their destinations.
Online features
Food and barcode lookups send your query or barcode through our service to nutrition providers such as FatSecret, USDA or Open Food Facts. AI lookup sends the text, image or PDF you select and any follow-up information to Google Gemini or our configured OpenAI fallback. This can include nutrition or health-related information you choose to submit. Recipe import retrieves the requested URL. Streak encouragement uses your streak count and locale. Providers process this information under their own terms.
Nutrition response caches expire after one hour and AI result caches after 30 minutes. Follow-up AI context, which can include the original attachment, expires after 15 minutes. These are in-memory caches with periodic cleanup. Streak response caches expire after 36 hours. Provider-side processing, caching and safety retention are separate from these CalTrak cache limits; we do not promise zero retention by our providers.
Daily active installations
Existing app versions send a random installation identifier with service requests. It is not a hardware or advertising identifier, but it can remain the same across app launches. The server receives it to count installations using online features that day. It does not send the identifier to nutrition or AI providers.
For counting, we transform it with a new random hashing key each calendar day (America/New_York). The counting file contains only that day's hashes and platform categories, without searches, food logs or AI content. It is replaced at the next day boundary, with periodic cleanup. Raw installation identifiers are not saved in request metrics or feedback. We retain daily totals longer to understand usage; these totals do not identify installations. This measures installations making online requests, not unique people or everyone opening the app offline.
Day-specific hashes are pseudonymous information, not a claim that every aspect of using an online service is anonymous. They are kept separately from request activity. Backup copies have the separate retention described below. Existing apps still transmit their current identifier; changing what appears in network traffic requires an app update.
Operational information
Our servers and infrastructure providers necessarily receive connection information, including IP addresses. CalTrak uses IP addresses for short-lived, in-memory abuse prevention. New application request logs do not include IP addresses, submitted search text, AI descriptions, attachment contents or installation identifiers. We retain request route categories, response status, timing, platform and limited technical flags in a seven-day metrics window, subject to a record cap and periodic cleanup. New application logs rotate daily with a seven-day retention limit. Aggregate daily and lifetime counters are retained longer.
Cloudflare and Google Cloud provide delivery, hosting and security infrastructure. Their processing and retention are governed by their applicable terms and configurations, separately from the application's metrics. CalTrak does not claim that infrastructure providers never process or log connection information.
Feedback and meal sharing
Feedback stores the message and optional contact information you choose to submit, receipt time, app version/build and platform. We no longer save connection or device-identifying metadata with new feedback. Feedback expires after 30 days and is removed by periodic cleanup. Please avoid including sensitive information that is not needed for support.
Creating a meal link uploads the selected meal and a share image. Anyone with the link can access it until it expires after 30 days. Expired files are removed on access or by a daily sweep. Copies saved by recipients or cached by other services are separate.
Backups and earlier records
Scheduled daily server snapshots are configured for seven-day retention and can retain copies after a live record expires. A separate manual recovery snapshot created after the September 23 cleanup is retained until a replacement recovery point is verified; it does not automatically expire under the daily schedule.
On September 23, 2026, we removed historical VM journal/syslog files and the eight older server snapshots, sanitized live request metrics and feedback, and removed stored Tip Jar events. Earlier support notifications or email correspondence may still contain information you submitted and device metadata. This cleanup does not erase copies held independently by infrastructure providers or message recipients. Contact us about information you have submitted, including access or deletion questions.
Apple Health and Health Connect
Health integration is optional and requires permission. CalTrak uses authorized nutrition, body measurement and activity information to synchronize supported records, show workouts and calculate activity-based calorie adjustments. It does not write workouts. Routes can require additional permission. Review or revoke access in Apple Health or Android’s Health Connect settings. Health integration does not automatically upload your health database to CalTrak’s proxy; information you explicitly submit to online or sharing features is handled as described above.
Optional tips
Apple's App Store or Google Play handles purchases. CalTrak does not receive your card or bank details. Our backend discards Tip Jar interaction events sent by older clients and does not store purchase tokens, receipts or order IDs. Store processing and third-party SDK diagnostics are separate.
Android services and diagnostics
Google Maps provides configured workout maps. The bundled ML Kit barcode scanner processes camera images on-device. These SDKs can send technical metadata, installation identifiers and diagnostics to Google; local barcode decoding does not disable that telemetry. See Google’s Maps SDK disclosure and ML Kit disclosure.
Speech entry uses your device’s recognition service, which may process audio remotely when on-device recognition is unavailable. Selecting an image for an AI lookup is a separate action from local barcode scanning.
CalTrak’s Android diagnostic reporting keeps up to 30 reports locally. You choose whether to share a diagnostics file using the device’s share chooser; CalTrak does not automatically upload these reports. SDK diagnostics are separate.
Managing your information
You can remove local app data by deleting the app or using the device’s app-data controls. Manage records already written to Apple Health or Health Connect separately in those services. Exported backups, shared meals and submitted feedback are separate copies. Contact us about information submitted to CalTrak, including access or deletion questions.
Changes and contact
We update the date above when this policy changes. For privacy or support questions, email [email protected].