Privacy Policy
Last updated: 24 August 2026
CalClick is a nutrition tracking app: you photograph a meal, and the app identifies the ingredients and estimates its calories and nutritional values. Doing that means we hold information about you, and some of it is health information — among the most sensitive data there is. This document explains exactly what we collect, where it goes, how long it stays and what you can do about it.
1. Who is responsible for your data
| Operator | PONPON |
| Privacy contact | support@calclick.app |
The operator is the "database owner" under Israel's Protection of Privacy Law, 5741-1981, as amended — including Amendment 13, in force since August 2025.
2. What this policy covers
The CalClick app for iOS and Android, our website, and any service that links to this document. It does not cover third-party services you reach through us; those have policies of their own.
3. What we collect
3.1 Information you give us
Profile and goals — gender, year of birth or age, height, current weight, target weight, activity level, workouts per week, your desired rate of change, and what you are using the app for (losing, maintaining or gaining weight).
Your food diary — every meal you log: item name, amount and unit, calories, protein, carbohydrates and fat, and sometimes sugar, sodium, saturated fat and dietary fibre, along with the time and date of the meal.
Meal photographs — every photo you take or pick from your library for analysis.
Progress data — weigh-ins over time, progress photos if you take any, water intake, and workouts you log.
Account details — your email address and the sign-in method you chose (Apple, Google, or email and password). We never see or store your password — it is handled entirely by the Google Firebase authentication service.
Your messages to us — the contents of anything you send to support.
3.2 Information collected automatically
Account identifier — every installation gets a random account identifier. Even without signing up, a "guest account" is created for you and everything is stored under it.
Technical information for stability — when an error or crash occurs, a report is sent containing your device model, operating system version, app version, interface language and a technical description of the fault. Crash reports do not contain your meal photographs or your food diary.
Subscription status — whether a subscription is active, which plan, and when it renews.
3.3 Data from the Health app (iOS)
If — and only if — you have explicitly granted permission, we read your weight, step count and active energy burned from Apple's Health app. That data is also stored in your cloud account, so your week does not disappear when you move to a new device and so a coach you have linked sees the full picture.
In line with Apple's rules:
- HealthKit data is never used for advertising, marketing or marketing analytics.
- HealthKit data is not sold and not disclosed to third parties, other than the infrastructure providers listed in section 6 and a coach you chose to share with yourself.
- We write to the Health app only what you asked us to write (weigh-ins and meals).
- You can revoke the permission at any time in iOS Settings → Health.
3.4 What we do not collect
We do not collect your location, your contacts or your payment card details. The app contains no advertising networks, no advertising identifiers and no marketing measurement tools.
4. How we use your data
| Purpose | Legal basis |
|---|---|
| Identifying your meal from a photo and calculating nutritional values | Performing our contract with you |
| Calculating your daily target and progress plan | Performing our contract with you |
| Showing your diary, history and charts | Performing our contract with you |
| Sending the reminders you switched on | Your consent |
| Sharing with a coach you linked | Your explicit consent |
| Managing subscriptions, billing and access | Performing our contract with you |
| Fixing faults and maintaining stability and security | Legitimate interest |
| Meeting legal, accounting and tax obligations | Legal obligation |
We do not train artificial intelligence models on your data, and we do not sell data to anyone. There is no sale of personal information in the sense of California or European privacy law.
5. Meal photos and AI analysis — in detail
This is the most sensitive part of the app, so it gets its own section:
- Your photo is uploaded from your device directly to Google Cloud Storage, into a folder belonging only to your account.
- A server-side service resizes and normalises the image, then sends it for analysis to Google's Gemini model, via Vertex AI.
- Google contractually undertakes not to use Vertex AI customer input or output to train its models. Your photo is not used for training — not by Google and not by us.
- The result — a list of ingredients and nutritional values — comes back to the app, and you can correct any figure before saving.
- The photo is stored in your account so it can appear in your diary. Deleting the meal deletes the photo with it.
Your name, your email address and your identifying details are not attached to the analysis — only the image is.
6. Who we share data with
We do not sell or rent personal information. We pass data only to the providers the service cannot run without, and only as far as necessary:
| Provider | What for | Where |
|---|---|---|
| Google Firebase (Firestore, Storage, Authentication) | Storing your account, diary and photos; authentication | Israel (me-west1) |
| Google Cloud Functions | Server-side image processing and analysis | United States (us-central1) |
| Google Vertex AI (Gemini) | Recognising the food and estimating its values | Google's global infrastructure |
| RevenueCat | Managing subscriptions and validating purchases | United States |
| Apple / Google Play | Processing the payment itself | Per platform |
| Sentry | Error and crash reporting | Germany (European Union) |
Your account and your photos physically reside in Israel. The processing itself — the analysis and the error reports — also takes place outside Israel, with providers bound by standard contractual safeguards (including the European Union's Standard Contractual Clauses).
We will also disclose data where required by law, court order or legal process, or to protect our rights and the safety of our users — and, in a merger, acquisition or transfer of the business, provided the acquirer is bound by this policy.
7. Sharing with a coach
Sharing happens only at your initiative: you generate an invitation code and hand it to whoever you choose.
- A coach has read-only access to your progress data. They cannot edit, add or delete anything.
- You can revoke sharing at any moment, and access closes immediately.
- The invitation code is a key. Give it only to someone you genuinely want to see your data.
8. Guest accounts — what you need to know
You can use the app without signing up. If you do, an anonymous account is created and your data is stored in the cloud under it exactly as it would be for a registered account. The one difference — and it is not a small one — is that there is no way to sign back into it. The account is tied to this installation alone; deleting the app, resetting the device or moving to another device disconnects you from it permanently, and we cannot recover it. If you want your data to follow you, sign up.
9. How long we keep your data
| Type of data | Retention |
|---|---|
| Profile, food diary, weigh-ins | As long as the account is active, until you delete it |
| Meal photographs | Until the meal or the account is deleted |
| Data read from the Health app | As long as the account is active |
| Backups | Up to 30 days after deletion, then removed automatically |
| Error and crash reports | Up to 90 days |
| Billing and subscription records | As required by Israeli tax law — up to 7 years |
10. Security
- All traffic between the app and our servers is encrypted (TLS), and data is encrypted at rest.
- Access is enforced by server-side security rules: each user can read and write only the data under their own account identifier, and a linked coach can only read.
- Employee and contractor access is limited to what the job requires and no more.
No system is completely immune. If a serious security incident affects your data, we will notify you and the Privacy Protection Authority as the law requires.
11. Your rights
Under Israeli privacy law — and, for those of you in the European Union, under the GDPR — you have the right to:
- access the data we hold about you;
- correct data that is inaccurate, incomplete or out of date;
- delete your data and your account;
- withdraw consent — for example by revoking the Health app permission or ending a coach's access;
- receive your data in a readable format, and object to certain processing;
- complain to the Privacy Protection Authority at the Ministry of Justice.
To exercise any of these: support@calclick.app. We respond within 30 days.
12. Deleting your account and your data
- A single meal is deleted straight from the diary, together with its photo.
- The whole account is deleted from inside the app, at the bottom of the Settings screen ("Delete account"). This removes your profile, diary, photos and progress data, and it cannot be undone.
- You can also write to us at support@calclick.app and we will do it for you.
Note: deleting your account does not cancel your subscription — the subscription is managed by your App Store or Google Play account and must be cancelled there.
13. Children
The service is intended for people aged 16 and over. We do not knowingly collect data from children below that age. If we discover that we have, we delete it immediately. A parent who believes their child has given us data is welcome to contact us at support@calclick.app.
14. Notifications and reminders
The reminders you switch on are scheduled and stored on the device itself — they do not pass through any server of ours. You can turn them off at any time, in the app's settings or in your device settings.
15. Changes to this policy
We will update this document as the service changes. A material change will be brought to your attention inside the app at least 7 days in advance, and where the law requires it we will ask for your consent again. The date of the last update appears at the top of this document.
16. Contact us
Questions, requests to exercise your rights, or complaints: support@calclick.app · PONPON