Privacy Policy

Calotank is designed to collect as little data as possible. Daily logs are stored on your device. When you choose an optional AI feature, only the data needed to provide it and prevent abuse is sent to the service providers described below. Calotank does not use advertising tracking, build advertising profiles or sell personal data.

1. Data controller

The data controller is the publisher of the Calotank app, Touko Aunio. Privacy contact: calotankapp@gmail.com.

2. Data processed

Local entries and device backups

Calotank stores meals, activities, weight entries, goals, calorie budget, flex balance, streak and app settings locally on your device. Calotank does not synchronize these logs to a Calotank account or its own cloud database. Your operating system’s backup may nevertheless include app data, depending on your backup settings. These backups are managed through your device and backup service settings.

Optional AI features

When you request a Premium AI estimate, the data processed may include your meal or activity description, submitted photo, duration and profile details needed for the estimate, such as weight, height, age and the sex used by the calculation.

When you use Calotank Assistant included in Premium, OpenAI receives the message you write, up to the eight most recent messages in the same open chat, the device’s local date and time with its UTC offset, and a current, limited summary of today’s meal and activity entries and calorie amounts, calorie budget, flex balance and end-of-day projection, streak, Joker Day status and saved day rhythm. The summary also includes only your latest valid weight entry and when it was logged, target weight, calorie plan mode and any target weekly loss pace. Your full logging or weight history is not sent to the Assistant. Chat history is not stored in Calotank’s persistent storage: starting a new chat, a change of day or restarting the app clears the chat held in the app.

The AI request is sent to OpenAI through Calotank’s gateway hosted on Vercel. In the mobile app, the gateway receives RevenueCat’s app-specific user ID to verify Premium access. Only Assistant requests sent to OpenAI include a pseudonymous SHA-256 safety ID derived from it; the raw RevenueCat ID is not sent to OpenAI. The Calotank gateway does not store ordinary request content after sending the response. As part of its default API abuse-monitoring process, OpenAI may retain request and response content, including text and images, for up to 30 days, unless longer retention is required by law or reasonably necessary to protect OpenAI’s services or third parties from harm. Network service providers may also process an IP address and other technical request data to deliver and secure the service.

You can withdraw AI data-sharing permission at any time under Settings → More settings → App → AI data-sharing permission. The next AI use will ask for permission again.

If a user explicitly reports an Assistant response and confirms the submission, the selected reason, that response, the related user message and optional details are forwarded to Calotank’s configured feedback channel to investigate the issue. A report is not sent without the user’s explicit confirmation.

Purchase data

Apple or Google processes the payment, depending on the app store you use. RevenueCat processes an app-specific pseudonymous user identifier, subscription products, subscription status and purchase history to unlock and restore Premium, administer subscriptions, prevent abuse and provide purchase and subscription analytics. Calotank does not receive your payment card details.

Website visits

When you visit Calotank’s public website, the providers involved in delivering and protecting the site may process customary technical request data, such as your IP address, browser and device information, requested URL and request time. This data is used to deliver the site, defend against malicious traffic and diagnose errors. Cloudflare sets the strictly necessary __cf_bm security cookie for bot detection. It expires after 30 minutes of continuous inactivity.

Website calorie calculator

The web calculator’s age, weight, height, sex coefficient, activity inputs and result are processed only in browser memory. They are not saved or sent to a server or the Calotank app. You can clear them using the calculator’s Clear button. With your permission, we measure page visits and clicks, but never calculator inputs or results.

Protein calculator

Weight, height, age, situation and goal, meal split and results are processed only in browser memory. They are not stored or sent to a server or the app. Reloading restores example settings. With your permission, we measure page visits and clicks, but never calculator inputs or results.

Exercise calories burned calculator

Weight, activity, pace or effort, duration and results are processed only in browser memory. They are not saved or sent to a server or the app. Reloading restores the example settings. With your permission, we measure page visits and clicks, but never calculator inputs or results.

Food-specific calculators

Food counts, portion sizes, preparation choices and results are processed only in browser memory. They are not stored or sent to a server or the app. Reloading restores the example settings. With your permission, we measure page visits and clicks, but never calculator inputs or results.

Food calorie calculator

Food search terms, selected foods, portion amounts, portion nutrition and the weight entered for the activity comparison are processed only in browser memory. The browser downloads a public food dataset for searching, but searches and portion entries are not sent to a server, Fineli or the Calotank app. Entries are not persistently stored. Reloading clears your entries. A public example link can prefill the food and its example portion again; no body measurements are passed in that link. With your permission, we measure page visits and clicks, but never calculator inputs or results.

Optional website analytics and cookies

Only with your permission, we load Google Analytics 4 to measure website use and marketing performance. Data includes pages viewed, visit source and campaign, site language, technical browser and device details, approximate location, engagement time, scrolling and important clicks, such as contacting us, switching language, opening FAQs and visiting the App Store or Google Play. Random cookie identifiers help distinguish visitors and sessions. Google processes the connection’s IP address for purposes including approximate location and service protection. Google states that individual IP addresses of EU, Swiss and UK visitors are not logged or stored. IP addresses from other regions may also be processed to prevent spam; Google states that raw IP addresses are discarded after use. See Google’s guidance on EU, Swiss and UK data and IP handling in other regions.

Website analytics does not receive your app’s meal, weight, health, AI chat or purchase data. We remove query strings and fragments from page-view URLs and only allow restricted campaign identifiers. We do not use Google Signals, user-ID-based cross-device tracking or advertising personalization. Website analytics alone does not tell us whether someone installed the app or purchased Premium.

Accepting and rejecting analytics are equally easy, and the site works with either choice. Before acceptance or after rejection, Google Analytics is not loaded and no measurement requests are sent to it. Your choice is stored in your browser’s local storage as calotank-analytics-consent-v2 and is valid for 180 days. An expired choice is removed when the website next reads it. Acceptance allows the _ga and _ga_BCT6HNE8MY cookies to distinguish visitors and sessions for up to 180 days, without automatically extending that expiry.

You can change your choice or withdraw permission using Cookie settings in every page’s footer. Withdrawal stops future measurement, deletes these analytics cookies and reloads the page. It does not retroactively erase data already processed. Learn more: How Google uses information from its partners’ sites.

3. Purposes and legal bases

• Local data is processed to provide the app features you request.
• An AI request is processed to provide the estimate or Assistant response you requested, secure the service and prevent abuse. AI is optional and any data that may qualify as health data is processed based on your explicit choice to submit it to an AI feature.
• An Assistant response report is processed only with your separate confirmation to investigate an error or safety concern and improve the service.
• Purchase and subscription data is processed to perform the purchase agreement, manage Premium access, restore purchases, provide purchase and subscription analytics and meet legal obligations.
• Website technical request data is processed under legitimate interests to deliver and secure the site and diagnose errors.
• Optional website analytics and its cookies rely on your consent. Storing your consent choice is necessary to respect that choice.
• Limited technical data is processed under legitimate interests to secure the service, enforce usage limits, diagnose failures and prevent abuse.

4. Service providers and international transfers

• Apple – App Store payments and subscription management.
• Google – Google Ireland Limited and Google’s service providers provide optional Google Analytics website analytics. Google Play handles Premium payments and subscription management in the Android app.
• RevenueCat – subscription and Premium entitlement verification and purchase and subscription analytics.
• Vercel – the Calotank mobile app backend, secure forwarding of AI requests and confirmed response reports, and technical runtime logs.
• OpenAI – optional AI estimates and Assistant responses, and abuse monitoring.
• Cloudflare – public website hosting, delivery and protection, including the necessary security cookie.

Providers may process data outside the European Economic Area. Transfers then rely on safeguards identified by the provider, such as a European Commission adequacy decision or the EU Standard Contractual Clauses.

5. Retention and deletion

Local data remains on your device until you erase it in the app’s settings or remove the app’s data from the device. Copies in earlier device backups may remain afterward; their retention and deletion are managed in your backup service settings. An Assistant chat stays only in app memory while the chat is open and is cleared when a new chat starts, the day changes or the app restarts. The Calotank backend does not retain ordinary AI request content after the response is completed. A response report sent with separate confirmation is retained in the feedback channel only for as long as reasonably needed to investigate the issue. To enforce usage limits, the server processes a pseudonymous SHA-256 hash of a purchase or other request identifier and request timestamps in memory. The daily limit counts requests within the previous 24 hours. An active identifier may remain longer. Expired entries are cleaned up when new requests arrive, so they may remain in memory beyond 24 hours. They are not written to a persistent database for this purpose, and process memory is cleared when the server process ends.

OpenAI may retain request and response content, such as text or a photo, in default safety and abuse-monitoring logs for up to 30 days, and longer in the exceptional cases described above. Vercel production runtime logs contain limited technical request data and are not intentionally configured to log request content. Their availability and retention depend on the service plan in use and Vercel’s retention policies. Apple, Google and RevenueCat retain purchase and subscription records under their own legal, security and contractual retention periods.

Cloudflare’s strictly necessary __cf_bm security cookie expires after 30 minutes of continuous inactivity. Website technical request and security data is retained according to the provider’s own security and retention practices.

Analytics consent is valid for 180 days. The expired consent record is removed from browser local storage when the website next reads it. The analytics cookies listed above are set to expire within 180 days. User and event data on Google’s servers is retained according to the Analytics property’s retention settings. Aggregated statistical reports are not subject to the same event-level retention limit and may be used longer to improve the site. You can request deletion from the controller using the contact address above.

6. Your rights

You may have rights to access, correct or erase personal data, restrict or object to processing, receive portable data and withdraw consent. Most Calotank data exists only on your device, so the controller cannot view or recover it. Contact the email above to exercise applicable rights.

You may lodge a complaint with the Office of the Data Protection Ombudsman in Finland or your local data protection authority.

7. Health data, children and safety

Calotank provides indicative everyday calorie metrics, not medical advice. The calorie-budget calculator is intended for adults. Do not submit information to an AI estimate that you do not want the service providers to process.

8. Changes and contact

This notice will be updated if the app's data practices change materially. The latest version is published on this page with its update date. Questions and requests: calotankapp@gmail.com.