Your data

This is the readable summary. The full, legally operative version is the privacy policy.

What Kallo stores#

• Account — your email and how you sign in.
• Profile — display name, avatar, language, countries.
• Body metrics — weight, height, age, sex, activity, goal and targets.
• Cooking habits — oil, default portions, broth.
• Meal log — the sentence you wrote, the dishes, weights and 28 nutrient values.
• Weight over time.
• Circle content — friends, shared meals, messages.
• Feedback — what you sent and any screenshot.
• Nutrition-label scans — each label photo you scan, what Kallo read from it (or why it could not), and the values you saved (when you save the meal in the iOS app). The photo is stored without its location or camera details. Only you and the Kallo team can see them, to check and improve label reading; they are kept until you delete your account.
• Billing status — never a card number.

What actually reaches the AI model#

This is the question most worth asking, and the answer is more specific than you might expect.

When you request a meal analysis, the model receives only:

• Your meal description
• Your country of origin and country of residence
• Your cooking habits
• The language you want the result in

When you scan a nutrition label, it receives only the photo. Kallo also keeps that photo privately, with the scan outcome (what was read, which model read it and how long it took) and, when you save the meal in the iOS app, the values you saved, visible only to you and the Kallo team, until you delete your account. Once you have given AI permission, ingredient search text may also go to Google's embedding model to find similar ingredients; without it, search uses Kallo's own text matching only. Kallo asks your permission before your first AI analysis or label scan.

The model does not receive: your weight, height, age, sex, goal, pace, calorie targets, email, name, or meal history.

Your content is not used to train shared AI models. Kallo calls Gemini through Vertex AI on Google Cloud, where the enterprise terms say prompts and responses are not used to train Google's models. Google does cache inputs for up to 24 hours to reduce latency, and may retain a request for up to 30 days if a safety classifier flags it as suspicious — detail in the privacy policy.

Getting your data out#

Settings → Account → Export my data downloads a JSON file straight away, on the web and in the mobile app. It contains:

• Account — your id, email, when you signed up and last signed in, and your sign-in methods: each linked Google, Apple or email identity with its dates, plus the profile details it holds (name, photo link, email and whether it is verified). Sign-in tokens are never included.
• Profile — body metrics, goal and targets, countries, language, cooking habits, onboarding progress, and whether new meals are shared to your Circle automatically.
• Circle profile — your handle, display name and avatar settings.
• Meal log — every meal with its dishes and nutrients, your weight history, the days you marked as fully logged, and your nutrition-label scans with what was read and what you saved.
• Circle — your friends (by handle, with when each friendship was accepted), the meals you shared, the reactions and replies you left, meal copies and splits you sent or received, and your own Circle activity.
• Chats — the chats you are in or created, who is in them (by user id), and every message you sent.
• Notifications and the devices registered for push notifications. Device tokens are cut down to their last few characters.
• Feedback you sent, with its status.
• Billing — your Premium grants and their sync state.
• App activity — meal-analysis requests still held (kept for about a week), analyses not yet saved, ingredients the food database could not match, and product analytics events linked to your account.
• Files — your uploaded profile photo, any feedback screenshots and your scanned label photos, listed by storage location. The images themselves are not inside the file.

Other people's content stays out: the export has your own messages, replies and reactions, not theirs. Friendships you have blocked are left out too, because the record does not show who blocked whom. Internal records such as rate-limit counters, model-debugging traces and raw billing-provider webhooks are not included. For anything not in the file, including a copy of a screenshot, write to support@kallo.fit.

Deleting data#

• A single meal — delete it directly in your log.
• Your whole account — in Settings. Deletion runs as a scheduled job, which also erases your customer record at the billing provider.

Backups rotate on a cycle, so deleted data can sit in a backup briefly before being overwritten. During that window it is no longer used to serve the app.

Your rights#

You have the right to know, access, correct, delete, restrict processing, withdraw consent, receive your data in a portable form, and complain to the competent authority. The full list and how to exercise it is in the privacy policy.