Privacy Policy

This policy explains what information the Calorie Deficit & Food Tracker app (“the app”, “we”) handles, why, who we share it with, and the choices you have. The app is published by Metko Labs, Turkey (“we”, “us”). We wrote it to match exactly what the app does.

1. Summary

• Your profile, food, exercise and weight logs are stored only on your device. We have no copy.
• The app uses an anonymous account (no name, email or password).
• When you use AI food analysis, the meal description you type is sent to our server and to OpenAI to calculate nutrition. When you scan a barcode, only the barcode number is sent.
• Free users see ads from Google AdMob. In the EEA, UK and Switzerland you are asked for consent first; the app asks for permission to track only through Apple’s system prompt. Premium removes ads.
• We use Firebase Analytics and Crashlytics to understand usage and fix crashes, and RevenueCat to manage subscriptions.
• We do not sell your personal information.

2. Data stored on your device

Everything you enter to plan and track your diet stays in a local database inside the app on your iPhone or iPad: your name (as you typed it), age, gender, height, current, starting and goal weight, activity level, goal, units, and your food, exercise and weight entries, favourites and custom foods and exercises. Settings (units, appearance) and ad-frequency counters are stored in the app’s local settings. This data is not uploaded to us and is not synced between devices. It is included in your device backups (iCloud or computer) under Apple’s terms.

Free-use counters. How many of your free AI analyses and free barcode scans you have used (two numbers and the date the counter was created; no meal text, barcode numbers or other content) is stored in your device’s keychain, with a copy in the app’s local settings. The keychain entry stays on this device: it is not synced through iCloud Keychain, not uploaded to us and not moved to a new device. It remains on the device after the app is deleted, so the free allowance can’t be reset by reinstalling the app; it is removed when the device is erased.

3. Anonymous account

When the app starts it signs in to Google Firebase Authentication anonymously. This creates a random identifier (“anonymous account id”) stored in your device’s keychain. It is not linked to your name, email or Apple Account. We use it to secure calls to our server functions, for the server’s daily safety counter (section 5), as the user id for analytics and crash reports, and as the customer id for subscriptions (so a purchase stays linked to your installation).

4. AI food analysis and barcode lookup

AI food analysis

When you tap “Analyze Food”, the text you typed (for example “2 eggs and toast”) is sent with your anonymous account id and whether Premium is active to our server function hosted on Google Cloud (Firebase Cloud Functions, region us-central1). The function sends only the text to OpenAI (not your account id) to estimate calories and macronutrients and returns the result to the app. We instruct OpenAI not to store the request and its response for later use (store: false); under OpenAI’s API data policy, API data is not used to train models and may be kept for up to 30 days for abuse monitoring. The analysed meal and its nutrition are then saved on your device only. Please don’t type personal details into the meal description.

Barcode lookup

When you scan a barcode, the camera image is processed on your device to read the number. Only the barcode number (with your anonymous account id and whether Premium is active) is sent to our server function, which looks it up in public food databases (USDA Branded Foods and Open Food Facts data hosted in Google BigQuery) and returns the nutrition values.

5. Free usage limits

Free users can use AI food analysis 30 times and barcode lookup 30 times in total on each device (only successful uses count; there is no daily reset). The app counts these uses on your device (section 2); the count is not sent to us. Premium users have no limit. To prevent abuse, our server also keeps a daily safety counter per anonymous account id in Google Cloud Firestore: for each function, the number of successful calls on that day (UTC), the date and when the counter was last updated. Counters are kept for Premium users too, but Premium users are never limited. The server relies on the Premium status sent by the app (see section 16 on how requests are verified); it does not look up your subscription with any other service. Counters contain no meal text or barcode numbers and are deleted automatically after 30 days.

6. Analytics and crash reports

• Firebase Analytics (Google): app usage events, including a “food added” event with the food’s name, calories and meal type, device and app information (model, OS and app version, language, approximate region derived from your IP address), linked to your anonymous account id. If you allow tracking in Apple’s prompt, Google may also receive your device’s advertising identifier (IDFA).
• Firebase Crashlytics (Google): crash and error reports (stack traces, device and app state, anonymous account id) so we can fix problems. We don’t put personal data into error reports.

7. Purchases and subscriptions

Subscriptions (Premium) are sold and charged by Apple through the App Store; we never see your payment details. We use RevenueCat to validate purchases and know whether Premium is active. RevenueCat receives your anonymous account id, purchase and subscription information (products, dates, status, storefront, App Store receipts/transactions), device and app information and your IP address. You can manage or cancel a subscription in the Settings app → your name → Subscriptions, or from the app’s Profile → Manage Subscription.

8. Apple Ads attribution

If you installed the app after seeing an Apple Search Ads advertisement, Apple’s AdServices framework can provide an attribution token. The app sends this token to RevenueCat, which asks Apple which campaign (if any) led to the install, so we can measure our own Apple Ads campaigns. This works without the tracking permission and does not use your advertising identifier; Apple returns only campaign-level information. Detailed attribution data is available to us only if you allowed tracking.

9. Advertising, consent and tracking

Free users see ads served by Google AdMob: an occasional full-screen ad after saving an analysed food. Premium users see no ads, and the ads software is not started for them.

• Consent (EEA, UK, Switzerland): before any ad is requested, Google’s User Messaging Platform asks for your consent choices. You can change them at any time in Profile → Ad Privacy Choices (shown where this applies).
• Tracking (all regions): the app shows Apple’s “Allow … to track” prompt once. Only if you allow it, Google may use your device’s advertising identifier (IDFA) to personalise and measure ads. If you don’t, you still get ads (non-personalised or based on context); no feature depends on your answer. You can change it in Settings → Privacy & Security → Tracking.
• Google may receive device and app information, IP address (coarse location), ad interactions and diagnostics. See how Google uses information from apps that use its services.

10. Camera

The camera is used only to scan barcodes, after you grant permission. Images are processed on your device and are not stored or uploaded.

11. Service providers

12. What we don’t collect

We don’t ask for your email, phone number, real-name account, contacts, photos, precise location or health records, and the app doesn’t read Apple Health. Your logs and body measurements are not uploaded. We don’t sell personal information or share it for cross-context behavioural advertising except through the ads described in section 9, which you can control.

13. Retention and deletion

• On your device: kept until you delete entries or delete the app. Deleting the app removes the local database and settings (the keychain item with the anonymous account id may remain on the device).
• Free-use counters (keychain): kept on the device, also after the app is deleted, until the device is erased (Settings → General → Transfer or Reset → Erase All Content and Settings). They contain only the two numbers of used free uses and a date.
• Server safety counters (Firestore): kept only as long as needed for the server’s daily safety limit and deleted automatically 30 days after the day they count.
• Analytics: Firebase Analytics user-level and event-level data is kept for 2 months (Google Analytics default retention); Crashlytics crash reports for 90 days.
• Subscriptions: RevenueCat keeps purchase records as long as needed to provide the service and for legal and accounting obligations.
• To ask us to delete data linked to your anonymous account id, contact us (section 19). Because the account is anonymous, please include the request from the device (we will tell you how to find the id).

14. Your rights (GDPR, UK GDPR, CCPA/CPRA)

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict processing, to withdraw consent at any time (Profile → Ad Privacy Choices; Settings → Tracking), and to complain to your data-protection authority. California residents may request to know and delete personal information and to opt out of “sale” or “sharing”; we don’t sell personal information, and you can opt out of ad tracking as described in section 9. We won’t treat you differently for exercising your rights.

Legal bases (EEA/UK): performance of our contract with you (app functions, AI and barcode lookups, subscriptions), legitimate interests (security, usage limits, analytics, crash reports, measuring our own ad campaigns), and consent (personalised ads and tracking).

15. International transfers

Our providers may process data in the United States and other countries. Where required, transfers rely on the providers’ Standard Contractual Clauses or the EU–US Data Privacy Framework.

16. Security

Data sent to our server functions and providers is encrypted in transit (HTTPS). Server functions accept only requests from signed-in (anonymous) app installations. In addition, Firebase App Check verifies that each request comes from a genuine copy of the app on a real Apple device, using Apple’s App Attest service: the device creates a key in its secure hardware and Apple attests that it belongs to our app. This device attestation contains no personal information (no name, email, advertising identifier or app data); requests without a valid App Check token are rejected. Data on your device is protected by iOS data protection when your device is locked with a passcode.

17. Children

The app is not directed to children under 13 (or the minimum age in your country) and we don’t knowingly collect their personal information. If you believe a child has used the app, contact us and we will help delete related data.

18. Changes to this policy

This policy describes version 1.9 of the app and later. Earlier versions send the same kinds of data to the same providers, but use earlier server functions that do not use App Check, do not keep daily usage counters on our server and do not ask OpenAI to skip storing the request; please update the app to benefit from these protections. Versions 1.9 to 2.0 counted free uses per day in the app’s local settings and offered optional ads for extra uses; from the next update the free allowance is counted for the device as described in sections 2 and 5, and those ads are gone.

We will update this page when the app’s data practices change and change the “Last updated” date above. Significant changes will be highlighted in the app’s release notes.

19. Contact

Metko Labs, Turkey
Email: info@metkolabs.com
This policy: https://www.metko.org/caloriedeficit/privacy.html