Privacy Policy
Last updated: October 9, 2026
This policy explains what information Cal Friend collects, how we use it, who we share it with and the choices you have. It covers the Cal Friend app for iPhone and the calfriend.ai website.
Who we are
Cal Friend is operated by Joseph Tech Solutions (“we” or “us”). We decide how your personal information is used and are responsible for it.
For privacy questions and requests, email privacy@calfriend.ai. For anything else, email support@calfriend.ai.
Information you give us
Account details: your name, email address or phone number, and a password if you sign up with email. Passwords are stored only as a secure hash.
Profile and goals: age, sex, height, weight, activity level, goals and food preferences you enter so we can calculate your plan.
Logs: meals, water, weight, workouts, pantry items and notes you add.
Messages: support chats and group messages, including the photos, files and voice messages you attach.
Purchases: when you subscribe through Apple, we receive the transaction ID, the plan and its dates so we can unlock paid features. We never receive your payment card details.
Signing in
You can sign in with Apple, Google, your phone number or your email address. With Apple or Google, we receive an account identifier, your email address and, if you allow it, your name and profile photo. We use them to create and secure your account and to fill an empty profile.
Phone sign-in sends a one-time code by text message through Twilio.
For each signed-in device we keep a random device key and a device name, so you can see your devices and sign them out. When a new device signs in, we email you. The email may show the approximate place of the sign-in, which we derive from the network and do not store.
Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
Meal photos, voice and text
When you scan a meal, receipt or nutrition label, the photo is sent to our servers and to an AI provider to identify the food and estimate its nutrition.
When you describe a meal by voice, speech recognition runs on your device and only the text is sent to us.
If you send a photo of a packaged product to improve our food database, we review it, and it may be shown to other users with that product.
Health and fitness data
With your permission, the app reads sleep, steps, active energy, workouts and, if you choose, weight from Apple Health. It writes to Apple Health only when you ask it to. Some of this data, such as sleep samples and steps, is used only on your device.
Health data is used only to provide the features of the app. It is never used for advertising or marketing, never sold, and never shared with data brokers.
You can change these permissions at any time in the Health app or in iOS Settings.
Location
Location is optional. If you allow it, the app saves where a meal was logged, and we look up nearby restaurants and stores with Google Places to name the place. Place results are provided by Google Maps, and their use is subject to the Google Maps/Google Earth Additional Terms of Service (https://maps.google.com/help/terms_maps.html) and the Google Privacy Policy (https://policies.google.com/privacy).
If you track a walk or run, the app records its route with GPS and saves it with the workout.
To show the weather on a run, we send its starting point, rounded to about 1 km, to Apple WeatherKit. We do not log that point.
You can turn off location access at any time in iOS Settings.
Contacts and invitations
To help you invite friends, the app can read your contacts on your device. Your contact list is not uploaded.
When you invite someone by email, we store only a one-way hash of the address so we can match the invitation.
Groups and sharing
Members of a group see your name, photo and what you choose to share there, such as progress, messages and challenge results.
Share links for meals and reports can be opened by anyone who has the link, until the link expires or you revoke it.
Nutrition labels you choose to share are checked, and the product facts on them join the shared product catalog. These facts hold no personal data and stay after you delete your account; your label photos are deleted with it. Product photos and missing foods you choose to send us are reviewed and may join the shared product catalog.
AI processing
We use AI models to identify food in photos, read receipts and nutrition labels, estimate workouts, understand meal descriptions and answer support chats. Google Gemini is our main provider. OpenAI is used for support chats and as a backup, and Anthropic or Perplexity may be used as alternatives.
We send only what the task needs, such as the photo or the text. We do not add your name or contact details. The providers process this data on our behalf to return a result to us.
AI estimates can be wrong. You can review and edit every estimate before you save it.
Service providers
We use these providers to run Cal Friend: MongoDB Atlas (database), Fly.io (API servers in Frankfurt, Germany), Cloudflare (website, file storage with R2, email delivery and website analytics), Google (Sign in with Google, Gemini, Places and Firebase Analytics), OpenAI, Anthropic and Perplexity (AI processing), Twilio (text messages), Apple (Sign in with Apple, in-app purchases, push notifications and Apple Health) and GitHub (bug reports created from support chats, without your name or email address).
Food searches sent to USDA FoodData Central, Open Food Facts and data.gov.il include only the search term or barcode.
Each provider receives only what it needs and may use it only to provide its service to us.
We do not sell your information
We do not sell or rent your personal information, and we do not share it for targeted advertising. We do not track you across apps or websites of other companies.
International transfers
Our providers may process information outside your country, including in the European Union and the United States. When the law requires it, we rely on adequacy decisions (the European Commission recognises Israel as providing adequate protection), the EU-US Data Privacy Framework or standard contractual clauses.
Analytics
The app uses Google Analytics for Firebase to measure usage, such as screens viewed, session length, device type and app version. It does not use the advertising identifier (IDFA). We also record product events, such as when a meal is logged, with your account so we can fix problems and improve the app.
The website uses Google Analytics only if you accept cookies, and Cloudflare Web Analytics, which does not use cookies. The Cookie Policy explains the details.
Security
We protect your information with encryption in transit, hashed passwords and session keys, access controls and limited staff access. No system is perfectly secure. If a breach affects your information, we will tell you and the authorities as the law requires.
How long we keep information
We keep your information while your account is active.
Meal scan photos and chat attachments are stored with Cloudflare R2 and deleted 90 days after upload.
When you delete your account, we delete your records and files right away. Copies in backups are removed when those backups expire. We may keep limited records when the law requires it.
Children
Cal Friend is not intended for anyone under 16, and we do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
Legal bases
We process your information to provide the service you asked for, with your consent (for example for health data, location and website analytics cookies), for our legitimate interests (such as security, preventing abuse and improving the service) and to meet legal obligations.
Your rights
Depending on where you live, including under the EU and UK GDPR and the Israeli Privacy Protection Law, you have the right to access, correct, export and delete your information, to object to or restrict some uses, and to withdraw your consent at any time.
In the app, go to Profile, then Privacy and data, to download or delete your data. You can also email privacy@calfriend.ai. We reply within 30 days.
You can also complain to your data protection authority. In Israel, this is the Privacy Protection Authority.
Changes to this policy
If we make material changes, we will tell you in the app or by email before they take effect. The date at the top shows the current version.
Contact
Joseph Tech Solutions, privacy@calfriend.ai.
Have a question about this document?