# Privacy policy

> What Kallo collects, what actually reaches the AI model, how long it is kept, and the control you have over it.

This policy describes how VÕ MINH KHÔI ("Kallo", "we") collects, uses,
shares and protects personal data when you use Kallo on the web, iOS and
Android.

It applies to every Kallo account, including accounts without a Premium
subscription, and to anyone who joins the waitlist before having an account.

## 1. Who is responsible for your data

The data controller is VÕ MINH KHÔI, at 88/2 Đ. Đào Duy Anh, Đức Nhuận ward, Ho Chi Minh City 700000, Vietnam.

For any privacy question, access request or complaint, write to
[support@kallo.fit](mailto:support@kallo.fit).

## 2. What we collect

### Account information

Your email address, sign-in method (email and password, Google, or Apple), and
an account identifier. We do **not** store readable passwords — authentication
is handled by Supabase Auth.

If you sign in with Apple in the iOS app, we also store an **encrypted Apple
refresh token**. We use it for one thing only: revoking Kallo's access at Apple
when you delete your account. Deletion revokes it and then deletes it; if Apple
cannot be reached at that moment, we retry automatically every hour, and our
team follows up on any revocation that still fails. If you signed in with Apple on the web, that token is held by our
authentication provider and we cannot revoke it; you can remove Kallo in your
Apple Account settings under **Sign in with Apple**.

### Profile and goals

Display name, handle, avatar, the language you picked; weight, height, age,
biological sex and activity level; your goal of cutting, bulking or maintaining,
the pace you set for it, and the calorie and macro targets derived from those;
the country you grew up in and the country you live in.

Your avatar photo, if you upload one, is **public**: it is stored in a public
storage bucket under a random, unguessable file name so it can appear on your
invite link and in friends' feeds, and anyone who has the link can view it. We
resize and re-encode every photo on our servers before storing it, which strips
embedded metadata such as location. Removing or replacing your avatar deletes
the file from storage; copies already cached by browsers or our content delivery
network may keep loading for a few minutes afterwards.

Both countries are ones **you pick yourself** during onboarding, from a list.
Kallo does **not** read your device location: the app requests no location
permission, uses no GPS, and does not infer where you are from your IP address.

### Cooking habits

How much oil you typically use, your default rice and protein portions, and how
much broth you drink. These make
estimates match how you actually cook.

### Meal log

The sentence you write to describe a meal, when you logged it, the meal slot,
the entry mode (Normal, Manual or Cheat meal), the dishes and ingredients Kallo
recognises, estimated weights, cooking method, ingredient-match confidence,
alcohol where relevant, the slider positions when you use Cheat meal, and all 28
nutrient values computed for each meal and each item.

### Nutrition label photos

The photo of each nutrition label you scan, stored in a private bucket and
linked to your account, and to the meal when you save it in the iOS app. With it
we keep the scan outcome — what Kallo read from the label, or the error if
reading failed, which model read it and how long it took — and, when you save the
meal in the iOS app, the values you saved. See section 3.

### Weight over time

Your weight entries and the dates they belong to.

### Circle content

Friendships, meals you share, reactions, replies, portion invites, the groups
you join and the messages you send in groups or private chats.

### Blocks and reports

The people you block, and any report you file about content or a profile. See
section 6.

### Feedback

Feedback type, your message, any screenshot you attach (stored in a private,
non-public bucket), plus app version, platform, language and the screen you were
on.

### Billing

Premium entitlement status, the store you purchased through, product identifier,
start and expiry, renewal state, and the customer identifier issued by the
billing provider. **We never receive or store full card numbers** — payment
details are handled by Apple, Google, RevenueCat Billing or Stripe.

### Waitlist

If you sign up before having an account: email, language, signup source, a
hashed confirmation token, and a **hash of your IP address** used for abuse
prevention. We do not retain the raw IP address for this purpose.

### Operational and anti-abuse data

Technical records of each analysis: processing stages, timings, token counts and
errors. Anti-abuse events are recorded against **HMAC-hashed identifiers**
rather than raw account identifiers.

### Usage events and error reports

When the app or website runs into an error, we record a **diagnostic report**:
what went wrong in our code, the screen or address it happened on, your app
version, device type and operating system, and your account identifier.

We also record a small set of **usage events**, such as "a meal was saved" or
"the Premium screen was opened", with the same technical details, to understand
which features people use and where they get stuck.

Neither ever contains your meal descriptions, body measurements, name or email,
and the addresses are stripped of anything that identifies a shared meal, group
or invite. We do not record your screen or your keystrokes.

## 3. What actually reaches the AI model

When you request a meal analysis, the AI model receives **only**:

- Your meal description.
- The country you grew up in and the country you live in.
- Your cooking habits.
- The language you want the result in.

When you scan a nutrition label, the model receives **only the photo** you scan.
We also store that photo in a private storage bucket, linked to your account
and, when you save the meal in the iOS app, to that meal. Before storing it we
re-encode it on our servers, which strips embedded metadata such as location.
Alongside it we keep the scan outcome (what Kallo read, or the error; which model
read it and how long it took) and, when you save the meal in the iOS app, the
values you saved. Only you and the Kallo team can access the photo and these
records; the team uses them to check and improve how accurately Kallo reads
labels. We do **not** use them to train AI models, and they are never shared with
other users. They are kept until you delete your account, as part of which they
are deleted.

When you search for an ingredient while logging by hand, and only if you have
given AI permission (see below), the text you type may be sent to Google's
embedding model to find ingredients with a similar meaning. Only the search text
is sent. We keep that text and its embedding in a shared cache, not linked to
your account, so the same search is faster next time. Without AI permission,
ingredient search uses Kallo's own text matching and nothing is sent to Google.

The model does **not** know your weight goal, your pace, your calorie or
macro targets, weight, height, age, sex, email, name, or meal history.

> **Why this matters**
>
> Goal adjustment happens **on our servers, after** the model returns — not by
> telling the model you are cutting. That keeps your goal from biasing the
> estimate, and the boundary is enforced by the type system in our source code
> rather than by convention.

We do **not** use your content to train shared AI models.

### Your permission comes first

Kallo asks for your permission the first time you use AI meal analysis or label
scanning, **before anything is sent** to the model. You can withdraw it at any
time in **Settings → Preferences → AI meal analysis**. After that, AI analysis
and label scanning stop, and ingredient search sends nothing to Google. Manual
logging keeps working, with ingredient search falling back to text matching, and
so does barcode scanning.

### What happens to it on Google's side

Production Kallo calls Gemini through **Vertex AI on Google Cloud** — the
enterprise service, not the consumer Gemini app. Under Google Cloud's terms,
prompts and responses are **not used to train or fine-tune Google's models**.

There are two exceptions:

- **Caching for up to 24 hours.** Google caches inputs to reduce latency on
  subsequent requests. The cached copy sits in the data centre that served the
  request.
- **Abuse monitoring for up to 30 days.** If automated safety classifiers flag a
  request as suspicious, Google may retain that prompt to investigate a policy
  violation. That data is still **not** used to train models.

Kallo calls Vertex AI's **global endpoint**, so a request may be served from any
region Google operates in. That means the data listed above — and only that
data — can leave Vietnam while it is being processed. See section 9.

Developer machines and internal scripts use a different connection (Google AI
Studio) with test data, not your account data.

## 4. Why we use it

| Purpose | Data involved |
| --- | --- |
| Authenticate you and keep you signed in | Account, device |
| Produce nutrition estimates | Meal text, cooking habits, country, nutrition label photos |
| Personalise targets and charts | Profile, body metrics, goal, meal log |
| Show content you share | Circle, shared meals |
| Maintain Premium access | Billing data from the provider |
| Prevent abuse, fraud and overload | Rate-limit events, hashed identifiers |
| Keep Circle safe | Blocks, reports and the content reported |
| Troubleshoot and improve reliability | Operational logs, error reports, feedback |
| Understand how features are used | Usage events, device and app version |
| Respond to support | Your message, account |
| Meet legal obligations | As applicable |

Our legal bases are: **performance of a contract** with you (providing the
service you signed up for), **legitimate interests** (system safety, abuse
prevention, quality), **your consent** (for example health-related data and
optional notifications), and **legal obligations**.

Some of what you provide — weight, height, eating habits — may count as
**sensitive personal data** under Vietnamese law. We process it on the basis of
your consent, and you can withdraw that consent at any time by deleting the data
or your account.

**We do not sell your personal data**, and we do not share it for third-party
advertising.

## 5. Providers that process data for us

| Provider | Role | Data reached |
| --- | --- | --- |
| Supabase | Authentication, database, file storage | Account, all app data, avatars, feedback screenshots and label photos |
| Google Cloud (Vertex AI, Gemini) | AI meal analysis, label reading, ingredient search | Meal text, country, cooking habits, language; nutrition label photos; ingredient search text |
| Google Cloud Run | Application hosting | Request traffic, server logs |
| Google Cloud Translate | Translating ingredient data | Ingredient names |
| Cloudflare | Content delivery, attack protection; diagnostic records of AI meal analyses, kept 14 days | Request metadata, IP address; meal text and the AI's answers, stored without your account identifier |
| Resend | Authentication and notification email; content-report alerts to our team | Email address, message content; the details of reports you file |
| RevenueCat | Cross-platform subscription state | Account identifier, purchase metadata |
| Apple App Store, Google Play | In-app payments | Your payment details, held by the store |
| Stripe (via RevenueCat Billing) | Web payments | Payment details |
| Paddle | Web payments (merchant of record) | Payment details, invoice and tax data |
| Open Food Facts | Packaged product lookup | The barcode you scan |
| Sentry (US region) | Error reporting | Error reports, device and app details, account identifier |
| PostHog (EU region) | Product usage analytics | Usage events, device and app details, account identifier |

This list changes as our infrastructure changes; updates are reflected here.

Beyond the providers above, we may transfer personal data in connection with a
**merger, sale of company assets, financing, or acquisition of all or part of
our business** by another entity. Where that happens, we will give notice in
advance, and the receiving party remains bound by this policy.

We may also disclose personal data where required by law, where necessary to
establish or defend the legal rights of ourselves or a third party, or where
necessary to protect **the life or health of an individual** in an emergency.

## 6. When you share in Circle

A meal you share is visible to the audience you choose — friends, a group, or a
private chat — including its description, dishes and nutrition figures.

Friend invites work by link: anyone holding your link can connect with you by
accepting it, without a further approval from you. You can remove a friend at
any time. A friend sees only what you share after the two of you connected, not
meals you shared earlier.

Automatic sharing is **off** for new accounts. If you turn it on in Settings,
new meals are shared with your friends without further action, and we record
when you changed the setting. Turn it off at any time to keep new meals
private.

Content others have already viewed or copied into their own log may persist
after you delete your original.

### Blocking and reporting

You can **block** someone: they no longer see your shared meals, replies or
messages, and you no longer see theirs. Blocking also ends your Circle
connection and deletes the notifications between the two of you.

You can also **report** content or a profile. A report stores who filed it, what
was reported (its type and identifier, and the person it belongs to), the reason,
any note you add, and its review status. The Kallo team reviews every report and
aims to act on it within 24 hours. We keep a report as a moderation record,
including after it is resolved, until your account is deleted. When you file a
report, an alert with its details is emailed to the Kallo team and may remain in
our team mailbox. To follow up, write to us in **Settings →
Feedback**.

## 7. Retention and deletion

We keep account content while your account is active, and afterwards only for as
long as needed for security, dispute resolution, legal compliance and backup
recovery.

You can delete your account in **Settings**. Deletion runs as a scheduled job
that also erases your customer record at the billing provider and, if you signed
in with Apple in the iOS app, revokes Kallo's access at Apple.

> **Before you delete**
>
> Deleting your Kallo account does **not** cancel a subscription bought through
> Apple or Google. Cancel in the store first if you want charges to stop. A
> subscription bought on the web is cancelled as part of deletion.

Deletion removes your data from the systems that serve the app. Where our
hosting provider holds system-level backups, deleted data may persist in them
until they are overwritten; during that window it is not used to serve the app
and is not accessible in it. We do not currently publish a fixed backup
retention period, and we will state one here once we set it.

## 8. Security

We apply several layers of protection:

- Encrypted connections in transit.
- Row-level authorisation in the database, so one account's data cannot be read
  from another.
- Server-side permission checks on every cross-account read in Circle.
- An origin lock that only accepts traffic arriving through our edge layer.
- Private storage buckets for feedback screenshots and label photos. Avatars
  are public by design (see section 2), stored under unguessable file names,
  and only our servers can write them, after re-encoding each image.
- Tightly restricted access to server credentials.

No system is perfectly secure. If an incident affects your personal data, we
will notify you as applicable law requires.

## 9. International transfers

The providers listed in section 5 may process data in countries other than where
you live. Specifically:

- **Application servers** run on Google Cloud Run in the `asia-southeast1`
  region (Singapore). Google Cloud has no region in Vietnam, so application data
  is processed outside Vietnam.
- **The database**, operated by Supabase, is also in Singapore, next to the
  application servers.
- **AI meal analysis** goes through Vertex AI's global endpoint, so it may be
  processed in any region Google operates in, including outside Vietnam. Only
  the data listed in section 3 travels this path.
- **Diagnostic records of AI meal analyses** are stored by Cloudflare in its
  Asia-Pacific region for 14 days.
- **Error reports** (Sentry) are stored in the United States, and **usage
  events** (PostHog) in the European Union.
- **Every other provider** processes data in the regions it operates.

Where data leaves Vietnam, we do so in line with personal data protection law,
including preparing and retaining a transfer impact assessment where required.

## 10. Your rights

Under Decree 13/2023/ND-CP on personal data protection, and under the law where
you live, you have the right to:

- **Know** what data is processed and how.
- **Access** and receive a copy of your data.
- **Correct** inaccurate data.
- **Withdraw consent** you previously gave.
- **Delete** your personal data.
- **Restrict** or **object to** certain processing.
- **Receive your data** in a portable format.
- **Complain** to the competent authority.
- **Claim compensation** for damage, as the law provides.

To exercise any of these, email
[support@kallo.fit](mailto:support@kallo.fit). We may need to verify your
identity first, and will respond within the statutory period.

Most requests you can handle yourself immediately: edit your profile, delete an
individual meal, or delete your whole account — all in **Settings**.

**Access and portability.** **Settings → Account → Export my data** gives you a
machine-readable JSON copy straight away: your account and sign-in details,
profile, meal and weight history, Circle profile, friendships, the content you
shared or wrote in the Circle and in chats, notifications, registered devices
(with device tokens shortened), feedback, billing records, and recent app
activity. Files you uploaded, such as a profile photo or a feedback screenshot,
are listed by storage location rather than included; label photos are listed
with their identifier, date and linked meal. Other people's messages
and reactions, and internal security and debugging records, are not part of the
file; [Your data](https://kallo.fit/en/docs/account/your-data) lists what is left out and why. For a
copy of anything not in the file, email us as above.

## 11. Children

Kallo is not directed to anyone under 13. In Vietnam, processing the personal
data of anyone under 16 requires consent from a parent or legal guardian.

If you believe your child has given us data without the necessary consent,
contact support@kallo.fit and we will delete it.

## 12. Cookies and on-device storage

We use cookies and local storage only as far as necessary:

- Keeping you signed in.
- Remembering your chosen language.
- Remembering interface state, such as whether the sidebar is open or collapsed.
- Keeping a random identifier in local storage so usage events from the same
  browser can be counted as one visitor. It is not shared with advertisers.

We use no advertising cookies and embed no third-party ad-network trackers.

## 13. Automated decision-making

Kallo's nutrition estimates are produced by automated means. Those estimates do
**not** constitute automated decisions producing legal or similarly significant
effects within the meaning of Article 22 GDPR: they are nutritional information,
and they determine no access to services, credit, employment or any other
entitlement.

You can review, edit or delete any individual result both before and after it is
saved. If you would like a human to review how a result was produced, contact
[support@kallo.fit](mailto:support@kallo.fit) and we will explain the main
factors involved.

We do **not** carry out profiling for advertising, credit scoring, insurance
risk assessment, or any purpose beyond delivering the service you requested.

## 14. Do-Not-Track signals

Most web browsers, and some mobile operating systems and applications, include a
Do-Not-Track ("DNT") feature you can use to signal a preference not to have your
browsing activity monitored.

No uniform technology standard for recognising and honouring DNT signals has
been finalised. We therefore **do not respond** to DNT signals or any comparable
automated mechanism. Should a binding standard be adopted, we will update this
policy. California law requires us to disclose this.

## 15. Privacy rights of United States residents

This section applies if you reside in California, Colorado, Connecticut,
Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana,
Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas,
Utah or Virginia.

### Categories of personal data collected

The table below lists the categories of personal data, as classified under
California law, that we have collected in the preceding twelve (12) months.

| Category | Examples | Collected |
| --- | --- | --- |
| A. Identifiers | Display name, email, account identifier, hash of IP address | Yes |
| B. Personal data under the California Customer Records statute | Name, contact details | Yes |
| C. Protected classification characteristics | Age, biological sex | Yes |
| D. Commercial information | Premium subscription history, purchase metadata | Yes |
| E. Biometric information | Fingerprints, voiceprints | No |
| F. Internet or network activity | Server logs, in-app actions | Yes |
| G. Geolocation data | Device location | No |
| H. Audio, visual and sensory information | Avatar, feedback screenshots, nutrition label photos | Yes |
| I. Professional or employment information | Job title, work history | No |
| J. Education information | Student records | No |
| K. Inferences drawn from collected data | Calorie and macro targets, nutrition trends | Yes |
| L. Sensitive personal data | Health data: weight, height, meal log | Yes |

We retain each category above for as long as your account exists, unless the law
requires a different period.

### No sale, no sharing

In the preceding twelve (12) months we have **not sold and not shared** personal
data with third parties for commercial or targeted-advertising purposes within
the meaning of the state laws above. We have no plans to do so.

We do **not** collect or process sensitive personal data for the purpose of
inferring characteristics about you.

### Your rights

Depending on your state of residence, you may have the following rights:

- **Right to know** whether we are processing your personal data.
- **Right to access** your personal data and the categories being processed.
- **Right to correct** inaccuracies.
- **Right to request deletion** of your personal data.
- **Right to obtain a copy** of the data you provided, in a portable format.
- **Right to non-discrimination** for exercising these rights.
- **Right to opt out** of processing for targeted advertising, the sale of
  personal data, or profiling in furtherance of decisions with legal effects.
- **Right to limit** the use and disclosure of sensitive personal data.
- **Right to obtain a list** of third parties to which we have disclosed
  personal data, to the extent your state's law provides.

### How to exercise your rights

Email [support@kallo.fit](mailto:support@kallo.fit). Most actions you can also
take yourself in **Settings**, including downloading a portable copy of your
data with **Export my data**.

**Request verification.** On receiving a request we must verify that you are the
data subject. We use the information in your request solely for that purpose. If
we cannot verify you from the data we already hold, we may ask for additional
information.

**Authorised agents.** You may designate an agent to submit a request on your
behalf. We may deny a request where the agent does not produce valid written
authorisation.

**Appeals.** If we decline your request, you may appeal by emailing
[support@kallo.fit](mailto:support@kallo.fit). We will respond in writing,
setting out the action taken or not taken and the reasons for it. If your appeal
is denied, you may complain to your state attorney general.

**California "Shine The Light" law.** Under California Civil Code Section
1798.83, California residents may request, once a year and free of charge,
information about the categories of personal data (if any) we disclosed to third
parties for their direct marketing purposes. Because we make no such
disclosures, the answer to any such request is "none".

## 16. Complaints to a supervisory authority

If you believe we are processing your personal data unlawfully, you have the
right to complain to a supervisory authority:

- **Vietnam.** The Department of Cybersecurity and High-Tech Crime Prevention
  (A05), Ministry of Public Security, is the authority responsible for personal
  data protection under Decree 13/2023/ND-CP.
- **European Economic Area.** The data protection authority of your member
  state.
- **United Kingdom.** Information Commissioner's Office —
  [ico.org.uk/make-a-complaint](https://ico.org.uk/make-a-complaint), telephone
  0303 123 1113.
- **Switzerland.** The Federal Data Protection and Information Commissioner
  (FDPIC).

We would ask you to contact us first at
[support@kallo.fit](mailto:support@kallo.fit). We will acknowledge a complaint
within 30 days, investigate without undue delay, and inform you of the outcome
with an explanation.

## 17. Data from Google APIs

If you sign in with a Google account, our use of information received from
Google APIs adheres to the
[Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy),
including the
[Limited Use requirements](https://developers.google.com/terms/api-services-user-data-policy#limited-use).

We receive only your email address, display name and avatar from your Google
account, and use them only to create and maintain your Kallo account.

## 18. Changes to this policy

As the service or the law changes, we will update this document and change the
date at the top. For material changes we will give notice in the app or by email
before they take effect.

## 19. Contact

Privacy questions and requests:
[support@kallo.fit](mailto:support@kallo.fit)

Operated by VÕ MINH KHÔI, 88/2 Đ. Đào Duy Anh, Đức Nhuận ward, Ho Chi Minh City 700000, Vietnam.

---

_Source: [https://kallo.fit/en/docs/legal/privacy](https://kallo.fit/en/docs/legal/privacy) · Last updated: 2026-10-25 · Kallo docs index: [https://kallo.fit/llms.txt](https://kallo.fit/llms.txt)_