Privacy Policy

1. Preamble

This privacy policy (the “Policy”) describes how the KCalories application (the “App”) collects, uses, retains, shares and protects your personal data, in accordance with the General Data Protection Regulation (Regulation EU 2016/679, the “GDPR”) and applicable French data-protection law (Loi Informatique et Libertés n° 78-17, as amended).

The App is designed to help you track your nutrition, hydration, physical activity and weight goals. To deliver these services, the App processes health data within the meaning of Article 9 GDPR. Such data benefits from heightened protection and is processed solely on the basis of your explicit consent.

We are committed to processing your data lawfully, fairly, transparently, proportionately and securely, and to ensuring that you can exercise all the rights conferred upon you by the regulation.

2. Data controller

The data controller within the meaning of Article 4(7) GDPR is the publisher of the Application, acting in an individual capacity. The full legal identity and, where applicable, the registration number (e.g. SIREN) of the controller, together with the postal address, are available on request at the contact address below.

For any question regarding this Policy, the exercise of your rights, or to report a personal data breach:

• Privacy contact: privacy@kcaloriesapp.com
• General support: support@kcaloriesapp.com

At this stage, the Application is not operated by an organisation required to appoint a Data Protection Officer (DPO) within the meaning of Article 37 GDPR ; the data controller can be reached directly at the addresses above. Any change to this obligation will be reflected in an updated version of this Policy.

3. Scope and purposes of processing

The App processes your personal data only for the purposes described below. No data is used for advertising profiling, resale to third parties, or automated decision-making producing legal effects within the meaning of Article 22 GDPR.

The only advertising-related measurement we carry out concerns the effectiveness of our own acquisition campaigns: it is Apple-mediated and aggregated (SKAdNetwork, Apple Search Ads), or — for in-app and web audience measurement — subject to your consent (Google, Meta, and the cookieless Vercel Web Analytics, which we hold to the same opt-in even though it would qualify for the audience-measurement exemption). It uses no advertising identifier (IDFA), no individual profiling, no fingerprinting.

4. Categories of data processed in detail

4.1 Identification and profile data

• Firebase user identifier (anonymous by default).
• Display name and avatar, both optional.
• Unique friend code generated server-side, shareable.
• SHA-256 fingerprint of the user identifier, used solely for support purposes to allow lookup without exposing the raw ID.

4.2 Health data (Article 9 GDPR)

The App processes the following special categories of data, which benefit from heightened protection:

• Body measurements: current and historical weight, height, age, sex.
• Goals and derived metrics: daily calorie goal, macronutrient goals, estimated energy expenditure (TDEE), target weight.
• Food tracking: logged meals, quantities, food types, derived nutritional values (calories, protein, carbs, fat, micronutrients where available).
• Hydration: water volume consumed.
• Physical activity: step count, active calories (if you enable HealthKit synchronisation).
• Dietary mode: declared diet (omnivore, vegetarian, vegan, etc.).
• Declared allergens: the list of regulatory allergens (among the 14 categories of Annex II to EU Regulation No. 1169/2011) you choose to declare, and your preference to be alerted on traces. This declaration is optional; in its absence, no allergen data is processed.
• Meal photos: if you choose to add them.

Processing of this data is always based on your explicit consent (Article 9(2)(a) GDPR), evidenced by your acceptance of this Policy and by the granular choices you make in the App (whether to enable HealthKit, whether to submit a photo, etc.).

4.3 Technical data and persistent identifiers

• Firebase Cloud Messaging (FCM) token for push notification delivery (only if you grant permission).
• Device metadata: model, iOS version, local device identifier used to differentiate your installs without serving as an advertising identifier (IDFA is not collected).
• Time zone, language and theme preferences.
• Notification preferences (enabled categories, time slots).

4.4 Behavioural and technical data

• Anonymised or pseudonymised usage events (e.g. screen view, meal added, barcode scanned).
• Local barcode scan history (stored only on your device, except for server-side aggregate statistics).
• Free-text food search queries (used in aggregate to assess food-database quality).
• The acquisition channel you declare during onboarding (“How did you discover the app?”) and a boolean flag indicating whether a referral code was entered. Both are attached to your profile, used only in aggregate on our internal dashboard (never by name) and deleted entirely with your account. The referral code itself is not stored on your profile.
• Technical error logs and crash reports. Crash reports are sent to Firebase Crashlytics; technical errors (app-side, server-side and back-office) are sent to Sentry for reliability monitoring. The context sent to Sentry is limited to technical information (the route or endpoint involved, HTTP method and status code, app version and environment) and an opaque user identifier (Firebase UID) to correlate incidents; query parameters, authentication headers, cookies and request bodies are stripped before sending, and no health data is transmitted to Sentry.
• Campaign attribution: an Apple AdServices token (Apple Search Ads), resolved server-side into a campaign source, and an SKAdNetwork conversion value (funnel stage, aggregated by Apple) — attached to your account, with no IDFA, no cross-app identifier.
• Activation flag: a ‘first time active (≥ 3 days out of 7)’ timestamp, derived from your already-collected activity — no new raw data.

4.5 Social data (when you enable these features)

• Friend list: identifiers, relationship status, date added.
• Pending friend requests.
• SHA-256 fingerprint of phone numbers from your address book (computed locally, transmitted for matching, never stored in plaintext) — only if you enable contact-based discovery.
• Aggregated activity feed (visibility per your settings).
• Challenges (creation, participation, leaderboards).
• Shared grocery lists (recipients of the lists see their content by design).
• Visibility settings: who can see your diary, weight, statistics.

4.6 Photos

• Avatar: if you add one, the photo is stored in Firebase Storage and associated with your user ID.
• Meal photos: used locally on your device.
• Grocery photos: if you add any, they are stored locally and, if you share the corresponding list, in Firestore.

No biometric processing within the meaning of Article 9 GDPR is applied to these photos. No facial recognition or biometric identification is performed.

4.7 Data we do not collect

For transparency, please note that the App does not collect:

• precise or background geolocation data;
• any advertising identifier (IDFA) or fingerprint for advertising purposes;
• plaintext phone numbers (only their hash, and only if you enable contact-based discovery);
• genetic, biometric identification, political, philosophical, religious, trade-union, sexual life or sexual orientation data within the meaning of Article 9 GDPR.

5. Legal bases for processing

In accordance with Articles 6 and 9 GDPR, every processing operation carried out by the App is based on one of the following legal bases:

• Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)): the principal basis for health data, HealthKit synchronisation, push notifications, social features and list sharing, as well as audience measurement (analytics) and all web measurement (Meta, Google, and the cookieless Vercel Web Analytics) — none of which loads before your opt-in.
• Performance of a contract (Art. 6(1)(b)): for what is strictly necessary to provide the tracking service (technical account creation, local storage of tracking).
• Legitimate interest (Art. 6(1)(f)): for the technical security of the App (AppCheck, abuse prevention), stability (anonymised crash reports) and the aggregated, identifier-free attribution of our acquisition campaigns (Apple Search Ads, SKAdNetwork — Apple-mediated). A balancing test is available upon request.

You may withdraw your consent at any time without affecting the lawfulness of prior processing (Article 7(3) GDPR). Withdrawal can be made through the App settings (notifications, HealthKit, social features) or by deleting your account.

6. Recipients and processors

Your data may be shared with the following recipients, strictly limited to the purposes described:

Key commitment: we do not sell or rent your data to any third party. The only signals shared for advertising-measurement purposes are aggregated and Apple-mediated (SKAdNetwork, Apple Search Ads), or subject to your consent for web measurement (Google, Meta) — with no IDFA, no individual profiling, no data brokerage.

Note: should any new processor become involved, this section will be updated before any such activation.

7. Transfers outside the European Union

Several processors are located in the United States (notably Google/Firebase, Apple and Vercel, the website host), so your data may be transferred outside the European Economic Area.

In addition, some processors host your data within the European Union while belonging to a non-EU group (for example Sentry, whose data is hosted in Germany but whose operating company is established in the United States). Any residual access from a third country is governed by the Standard Contractual Clauses set out in their data-processing agreement (DPA).

These transfers are governed by:

• the Standard Contractual Clauses (SCC) adopted by the European Commission (Implementing Decision 2021/914);
• the EU–US Data Privacy Framework where the processor is certified;
• the technical and organisational supplementary measures implemented by the processors (encryption in transit, encryption at rest, strict access controls).

The advertising-measurement signals shared with Google (Google Ads) and Meta (United States) are governed by the Standard Contractual Clauses and, for web measurement, conditional on your consent; they remain aggregated and IDFA-free.

You may contact us at privacy@kcaloriesapp.com to obtain a copy of the safeguards applicable to a specific transfer of your data.

8. Retention periods

At the end of these periods, data is either permanently deleted or irreversibly anonymised.

9. Security

We implement appropriate technical and organisational measures to protect your data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access:

• Encryption in transit: all communications with our servers and processors use TLS 1.2 or higher.
• Encryption at rest: data stored in Firebase / Google Cloud benefits from default AES-256 encryption. Sensitive tokens on the device are stored in the iOS Keychain, itself encrypted by the operating system.
• App authenticity: Firebase AppCheck continuously verifies that requests originate from a legitimate App instance.
• Access partitioning: Firestore security rules restrict access to user data to its sole owner; backend Cloud Functions enforce server-side checks.
• No password authentication in the current version (anonymous authentication delegated to Firebase): therefore no password is stored.
• One-way hashing of phone numbers (SHA-256) when you use contact discovery.
• Incident monitoring: error tracking and automatic alerts on anomaly.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we undertake to notify the CNIL within seventy-two (72) hours pursuant to Article 33 GDPR, and to inform you where Article 34 so requires.

10. Your rights

In accordance with Articles 15 to 22 GDPR, you have the following rights over your personal data:

• Right of access (Art. 15): obtain confirmation that data concerning you is processed and obtain a copy.
• Right to rectification (Art. 16): correct inaccurate or incomplete data.
• Right to erasure (Art. 17, “right to be forgotten”): obtain the erasure of your data under the conditions set out in the GDPR.
• Right to restriction (Art. 18): request the temporary suspension of processing.
• Right to data portability (Art. 20): retrieve your data in a structured, commonly used and machine-readable format.
• Right to object (Art. 21): object, on grounds relating to your particular situation, to processing based on legitimate interest.
• Right to withdraw your consent (Art. 7(3)): at any time, without affecting the lawfulness of prior processing.
• Right to set post-mortem directives on the fate of your data after your death, in accordance with Article 85 of the French data-protection law.

The attribution data and the activation flag described in sections 3 and 4 are included in the export of your data (right of access / portability) and in the erasure of your account (right to erasure).

Exercising your rights:

• Built-in account deletion: from Settings → Delete account. This action triggers the irreversible deletion of all your personal data in our systems (subject to mandatory legal retention periods).
• Granular opt-outs: from settings, you can disable notifications, HealthKit synchronisation, social features and analytics at any time.
• Written request: for any other right, write to privacy@kcaloriesapp.com. We will respond within one (1) month, extendable by two (2) months in case of complexity or multiple requests (Art. 12(3) GDPR).

Complaint to the CNIL: if you believe that the processing of your data does not comply with the regulation, you may lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL):

3 Place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07 https://www.cnil.fr

11. Minors

The App is not intended for persons under the age of sixteen (16). No registration is accepted for users below this age without the explicit consent of the holders of parental responsibility, in accordance with Article 8 GDPR.

If you are a parent or guardian and notice that a minor under your responsibility uses the App without your consent, please contact us at privacy@kcaloriesapp.com so we can delete the account.

12. Cookies and persistent identifiers

The App is a native mobile application and does not use cookies within the meaning of Directive 2002/58/EC (“ePrivacy”) — this paragraph concerns the native app itself; our public website (kcaloriesapp.com) is addressed at the end of this section. The app uses the following native iOS storage mechanisms:

• Keychain: for secure storage of the Firebase authentication token and the FCM token.
• UserDefaults: for non-sensitive user preferences (theme, language, time zone, notification preferences, accepted version of this Policy).
• Local app storage: for offline food tracking, including data pending synchronisation (see section 8 for retention).
• Image cache: for avatars, meal photos and product images.

None of these mechanisms is used for advertising tracking.

SKAdNetwork (Apple) is an aggregated, Apple-mediated advertising-measurement mechanism: no cookie, no IDFA, no cross-app identifier — it does not require your consent (no personal data is processed by us). The in-app audience measurement (Firebase / Google Analytics 4) and the web measurement (Google, Meta, and the cookieless Vercel Web Analytics) are off by default and loaded only after your consent (the site’s dedicated banner / the in-app setting), withdrawable at any time.

13. Automated decision-making and profiling

The App does not make any solely automated decisions producing legal effects or significantly affecting your situation within the meaning of Article 22 GDPR.

Nutritional calculations (energy needs, macronutrient goals) are provided for guidance and support only and do not substitute for medical advice in any way. The App does not provide medical advice and shall not replace consultation with a qualified healthcare professional.

14. Changes to this Policy

We may amend this Policy to reflect a regulatory development, the addition of a feature or processor, or the implementation of a CNIL recommendation.

In the event of a substantial change, you will be notified upon opening the App, and a fresh consent will be requested where the nature of the changes so requires. Previous versions remain available on request to privacy@kcaloriesapp.com.

The last updated date appears at the top of this Policy.

15. Download and local retention

At any time, you may download this Policy as a PDF from the screen displaying it in the App, in order to keep a copy. The generated PDF mirrors exactly the version displayed, with its update date and version number.

16. Contact

For any question, request to exercise your rights or prior complaint:

• Privacy email: privacy@kcaloriesapp.com
• Support email: support@kcaloriesapp.com
• Complaint to the CNIL: https://www.cnil.fr/en/plaintes

End of document.