Privacy policy

This policy describes how VÕ MINH KHÔI ("Kallo", "we") collects, uses, shares and protects personal data when you use Kallo on the web, iOS and Android.

It applies to every Kallo account, including accounts without a Premium subscription, and to anyone who joins the waitlist before having an account.

1. Who is responsible for your data#

The data controller is VÕ MINH KHÔI, at 88/2 Đ. Đào Duy Anh, Đức Nhuận ward, Ho Chi Minh City 700000, Vietnam.

For any privacy question, access request or complaint, write to support@kallo.fit.

2. What we collect#

Account information#

Your email address, sign-in method (email and password, Google, or Apple), and an account identifier. We do not store readable passwords — authentication is handled by Supabase Auth.

If you sign in with Apple in the iOS app, we also store an encrypted Apple refresh token. We use it for one thing only: revoking Kallo's access at Apple when you delete your account. Deletion revokes it and then deletes it; if Apple cannot be reached at that moment, we retry automatically every hour, and our team follows up on any revocation that still fails. If you signed in with Apple on the web, that token is held by our authentication provider and we cannot revoke it; you can remove Kallo in your Apple Account settings under Sign in with Apple.

Profile and goals#

Display name, handle, avatar, the language you picked; weight, height, age, biological sex and activity level; your goal of cutting, bulking or maintaining, the pace you set for it, and the calorie and macro targets derived from those; the country you grew up in and the country you live in.

Your avatar photo, if you upload one, is public: it is stored in a public storage bucket under a random, unguessable file name so it can appear on your invite link and in friends' feeds, and anyone who has the link can view it. We resize and re-encode every photo on our servers before storing it, which strips embedded metadata such as location. Removing or replacing your avatar deletes the file from storage; copies already cached by browsers or our content delivery network may keep loading for a few minutes afterwards.

Both countries are ones you pick yourself during onboarding, from a list. Kallo does not read your device location: the app requests no location permission, uses no GPS, and does not infer where you are from your IP address.

Cooking habits#

How much oil you typically use, your default rice and protein portions, and how much broth you drink. These make estimates match how you actually cook.

Meal log#

The sentence you write to describe a meal, when you logged it, the meal slot, the entry mode (Normal, Manual or Cheat meal), the dishes and ingredients Kallo recognises, estimated weights, cooking method, ingredient-match confidence, alcohol where relevant, the slider positions when you use Cheat meal, and all 28 nutrient values computed for each meal and each item.

Nutrition label photos#

The photo of each nutrition label you scan, stored in a private bucket and linked to your account, and to the meal when you save it in the iOS app. With it we keep the scan outcome — what Kallo read from the label, or the error if reading failed, which model read it and how long it took — and, when you save the meal in the iOS app, the values you saved. See section 3.

Weight over time#

Your weight entries and the dates they belong to.

Circle content#

Friendships, meals you share, reactions, replies, portion invites, the groups you join and the messages you send in groups or private chats.

Blocks and reports#

The people you block, and any report you file about content or a profile. See section 6.

Feedback#

Feedback type, your message, any screenshot you attach (stored in a private, non-public bucket), plus app version, platform, language and the screen you were on.

Billing#

Premium entitlement status, the store you purchased through, product identifier, start and expiry, renewal state, and the customer identifier issued by the billing provider. We never receive or store full card numbers — payment details are handled by Apple, Google, RevenueCat Billing or Stripe.

Waitlist#

If you sign up before having an account: email, language, signup source, a hashed confirmation token, and a hash of your IP address used for abuse prevention. We do not retain the raw IP address for this purpose.

Operational and anti-abuse data#

Technical records of each analysis: processing stages, timings, token counts and errors. Anti-abuse events are recorded against HMAC-hashed identifiers rather than raw account identifiers.

Usage events and error reports#

When the app or website runs into an error, we record a diagnostic report: what went wrong in our code, the screen or address it happened on, your app version, device type and operating system, and your account identifier.

We also record a small set of usage events, such as "a meal was saved" or "the Premium screen was opened", with the same technical details, to understand which features people use and where they get stuck.

Neither ever contains your meal descriptions, body measurements, name or email, and the addresses are stripped of anything that identifies a shared meal, group or invite. We do not record your screen or your keystrokes.

3. What actually reaches the AI model#

When you request a meal analysis, the AI model receives only:

• Your meal description.
• The country you grew up in and the country you live in.
• Your cooking habits.
• The language you want the result in.

When you scan a nutrition label, the model receives only the photo you scan. We also store that photo in a private storage bucket, linked to your account and, when you save the meal in the iOS app, to that meal. Before storing it we re-encode it on our servers, which strips embedded metadata such as location. Alongside it we keep the scan outcome (what Kallo read, or the error; which model read it and how long it took) and, when you save the meal in the iOS app, the values you saved. Only you and the Kallo team can access the photo and these records; the team uses them to check and improve how accurately Kallo reads labels. We do not use them to train AI models, and they are never shared with other users. They are kept until you delete your account, as part of which they are deleted.

When you search for an ingredient while logging by hand, and only if you have given AI permission (see below), the text you type may be sent to Google's embedding model to find ingredients with a similar meaning. Only the search text is sent. We keep that text and its embedding in a shared cache, not linked to your account, so the same search is faster next time. Without AI permission, ingredient search uses Kallo's own text matching and nothing is sent to Google.

The model does not know your weight goal, your pace, your calorie or macro targets, weight, height, age, sex, email, name, or meal history.

We do not use your content to train shared AI models.

Your permission comes first#

Kallo asks for your permission the first time you use AI meal analysis or label scanning, before anything is sent to the model. You can withdraw it at any time in Settings → Preferences → AI meal analysis. After that, AI analysis and label scanning stop, and ingredient search sends nothing to Google. Manual logging keeps working, with ingredient search falling back to text matching, and so does barcode scanning.

What happens to it on Google's side#

Production Kallo calls Gemini through Vertex AI on Google Cloud — the enterprise service, not the consumer Gemini app. Under Google Cloud's terms, prompts and responses are not used to train or fine-tune Google's models.

There are two exceptions:

• Caching for up to 24 hours. Google caches inputs to reduce latency on subsequent requests. The cached copy sits in the data centre that served the request.
• Abuse monitoring for up to 30 days. If automated safety classifiers flag a request as suspicious, Google may retain that prompt to investigate a policy violation. That data is still not used to train models.

Kallo calls Vertex AI's global endpoint, so a request may be served from any region Google operates in. That means the data listed above — and only that data — can leave Vietnam while it is being processed. See section 9.

Developer machines and internal scripts use a different connection (Google AI Studio) with test data, not your account data.

4. Why we use it#

Our legal bases are: performance of a contract with you (providing the service you signed up for), legitimate interests (system safety, abuse prevention, quality), your consent (for example health-related data and optional notifications), and legal obligations.

Some of what you provide — weight, height, eating habits — may count as sensitive personal data under Vietnamese law. We process it on the basis of your consent, and you can withdraw that consent at any time by deleting the data or your account.

We do not sell your personal data, and we do not share it for third-party advertising.

5. Providers that process data for us#

This list changes as our infrastructure changes; updates are reflected here.

Beyond the providers above, we may transfer personal data in connection with a merger, sale of company assets, financing, or acquisition of all or part of our business by another entity. Where that happens, we will give notice in advance, and the receiving party remains bound by this policy.

We may also disclose personal data where required by law, where necessary to establish or defend the legal rights of ourselves or a third party, or where necessary to protect the life or health of an individual in an emergency.

6. When you share in Circle#

A meal you share is visible to the audience you choose — friends, a group, or a private chat — including its description, dishes and nutrition figures.

Friend invites work by link: anyone holding your link can connect with you by accepting it, without a further approval from you. You can remove a friend at any time. A friend sees only what you share after the two of you connected, not meals you shared earlier.

Automatic sharing is off for new accounts. If you turn it on in Settings, new meals are shared with your friends without further action, and we record when you changed the setting. Turn it off at any time to keep new meals private.

Content others have already viewed or copied into their own log may persist after you delete your original.

Blocking and reporting#

You can block someone: they no longer see your shared meals, replies or messages, and you no longer see theirs. Blocking also ends your Circle connection and deletes the notifications between the two of you.

You can also report content or a profile. A report stores who filed it, what was reported (its type and identifier, and the person it belongs to), the reason, any note you add, and its review status. The Kallo team reviews every report and aims to act on it within 24 hours. We keep a report as a moderation record, including after it is resolved, until your account is deleted. When you file a report, an alert with its details is emailed to the Kallo team and may remain in our team mailbox. To follow up, write to us in Settings → Feedback.

7. Retention and deletion#

We keep account content while your account is active, and afterwards only for as long as needed for security, dispute resolution, legal compliance and backup recovery.

You can delete your account in Settings. Deletion runs as a scheduled job that also erases your customer record at the billing provider and, if you signed in with Apple in the iOS app, revokes Kallo's access at Apple.

Deletion removes your data from the systems that serve the app. Where our hosting provider holds system-level backups, deleted data may persist in them until they are overwritten; during that window it is not used to serve the app and is not accessible in it. We do not currently publish a fixed backup retention period, and we will state one here once we set it.

8. Security#

We apply several layers of protection:

• Encrypted connections in transit.
• Row-level authorisation in the database, so one account's data cannot be read from another.
• Server-side permission checks on every cross-account read in Circle.
• An origin lock that only accepts traffic arriving through our edge layer.
• Private storage buckets for feedback screenshots and label photos. Avatars are public by design (see section 2), stored under unguessable file names, and only our servers can write them, after re-encoding each image.
• Tightly restricted access to server credentials.

No system is perfectly secure. If an incident affects your personal data, we will notify you as applicable law requires.

9. International transfers#

The providers listed in section 5 may process data in countries other than where you live. Specifically:

• Application servers run on Google Cloud Run in the asia-southeast1 region (Singapore). Google Cloud has no region in Vietnam, so application data is processed outside Vietnam.
• The database, operated by Supabase, is also in Singapore, next to the application servers.
• AI meal analysis goes through Vertex AI's global endpoint, so it may be processed in any region Google operates in, including outside Vietnam. Only the data listed in section 3 travels this path.
• Diagnostic records of AI meal analyses are stored by Cloudflare in its Asia-Pacific region for 14 days.
• Error reports (Sentry) are stored in the United States, and usage events (PostHog) in the European Union.
• Every other provider processes data in the regions it operates.

Where data leaves Vietnam, we do so in line with personal data protection law, including preparing and retaining a transfer impact assessment where required.

10. Your rights#

Under Decree 13/2023/ND-CP on personal data protection, and under the law where you live, you have the right to:

• Know what data is processed and how.
• Access and receive a copy of your data.
• Correct inaccurate data.
• Withdraw consent you previously gave.
• Delete your personal data.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Complain to the competent authority.
• Claim compensation for damage, as the law provides.

To exercise any of these, email support@kallo.fit. We may need to verify your identity first, and will respond within the statutory period.

Most requests you can handle yourself immediately: edit your profile, delete an individual meal, or delete your whole account — all in Settings.

Access and portability. Settings → Account → Export my data gives you a machine-readable JSON copy straight away: your account and sign-in details, profile, meal and weight history, Circle profile, friendships, the content you shared or wrote in the Circle and in chats, notifications, registered devices (with device tokens shortened), feedback, billing records, and recent app activity. Files you uploaded, such as a profile photo or a feedback screenshot, are listed by storage location rather than included; label photos are listed with their identifier, date and linked meal. Other people's messages and reactions, and internal security and debugging records, are not part of the file; Your data lists what is left out and why. For a copy of anything not in the file, email us as above.

11. Children#

Kallo is not directed to anyone under 13. In Vietnam, processing the personal data of anyone under 16 requires consent from a parent or legal guardian.

If you believe your child has given us data without the necessary consent, contact support@kallo.fit and we will delete it.

12. Cookies and on-device storage#

We use cookies and local storage only as far as necessary:

• Keeping you signed in.
• Remembering your chosen language.
• Remembering interface state, such as whether the sidebar is open or collapsed.
• Keeping a random identifier in local storage so usage events from the same browser can be counted as one visitor. It is not shared with advertisers.

We use no advertising cookies and embed no third-party ad-network trackers.

13. Automated decision-making#

Kallo's nutrition estimates are produced by automated means. Those estimates do not constitute automated decisions producing legal or similarly significant effects within the meaning of Article 22 GDPR: they are nutritional information, and they determine no access to services, credit, employment or any other entitlement.

You can review, edit or delete any individual result both before and after it is saved. If you would like a human to review how a result was produced, contact support@kallo.fit and we will explain the main factors involved.

We do not carry out profiling for advertising, credit scoring, insurance risk assessment, or any purpose beyond delivering the service you requested.

14. Do-Not-Track signals#

Most web browsers, and some mobile operating systems and applications, include a Do-Not-Track ("DNT") feature you can use to signal a preference not to have your browsing activity monitored.

No uniform technology standard for recognising and honouring DNT signals has been finalised. We therefore do not respond to DNT signals or any comparable automated mechanism. Should a binding standard be adopted, we will update this policy. California law requires us to disclose this.

15. Privacy rights of United States residents#

This section applies if you reside in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia.

Categories of personal data collected#

The table below lists the categories of personal data, as classified under California law, that we have collected in the preceding twelve (12) months.

We retain each category above for as long as your account exists, unless the law requires a different period.

No sale, no sharing#

In the preceding twelve (12) months we have not sold and not shared personal data with third parties for commercial or targeted-advertising purposes within the meaning of the state laws above. We have no plans to do so.

We do not collect or process sensitive personal data for the purpose of inferring characteristics about you.

Your rights#

Depending on your state of residence, you may have the following rights:

• Right to know whether we are processing your personal data.
• Right to access your personal data and the categories being processed.
• Right to correct inaccuracies.
• Right to request deletion of your personal data.
• Right to obtain a copy of the data you provided, in a portable format.
• Right to non-discrimination for exercising these rights.
• Right to opt out of processing for targeted advertising, the sale of personal data, or profiling in furtherance of decisions with legal effects.
• Right to limit the use and disclosure of sensitive personal data.
• Right to obtain a list of third parties to which we have disclosed personal data, to the extent your state's law provides.

How to exercise your rights#

Email support@kallo.fit. Most actions you can also take yourself in Settings, including downloading a portable copy of your data with Export my data.

Request verification. On receiving a request we must verify that you are the data subject. We use the information in your request solely for that purpose. If we cannot verify you from the data we already hold, we may ask for additional information.

Authorised agents. You may designate an agent to submit a request on your behalf. We may deny a request where the agent does not produce valid written authorisation.

Appeals. If we decline your request, you may appeal by emailing support@kallo.fit. We will respond in writing, setting out the action taken or not taken and the reasons for it. If your appeal is denied, you may complain to your state attorney general.

California "Shine The Light" law. Under California Civil Code Section 1798.83, California residents may request, once a year and free of charge, information about the categories of personal data (if any) we disclosed to third parties for their direct marketing purposes. Because we make no such disclosures, the answer to any such request is "none".

16. Complaints to a supervisory authority#

If you believe we are processing your personal data unlawfully, you have the right to complain to a supervisory authority:

• Vietnam. The Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security, is the authority responsible for personal data protection under Decree 13/2023/ND-CP.
• European Economic Area. The data protection authority of your member state.
• United Kingdom. Information Commissioner's Office — ico.org.uk/make-a-complaint, telephone 0303 123 1113.
• Switzerland. The Federal Data Protection and Information Commissioner (FDPIC).

We would ask you to contact us first at support@kallo.fit. We will acknowledge a complaint within 30 days, investigate without undue delay, and inform you of the outcome with an explanation.

17. Data from Google APIs#

If you sign in with a Google account, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We receive only your email address, display name and avatar from your Google account, and use them only to create and maintain your Kallo account.

18. Changes to this policy#

As the service or the law changes, we will update this document and change the date at the top. For material changes we will give notice in the app or by email before they take effect.

19. Contact#

Privacy questions and requests: support@kallo.fit

Operated by VÕ MINH KHÔI, 88/2 Đ. Đào Duy Anh, Đức Nhuận ward, Ho Chi Minh City 700000, Vietnam.