Privacy

In short: your journal lives on your device. Our server only sees what you send for AI analysis, and only while that analysis runs. An account is optional and holds only your email, plan and counters. No ads, no selling data. Here is exactly what goes where.

Who is responsible for your data

The data controller is the operator of kcal.quest. For anything about privacy, email contact@kcal.quest.

What stays on your device

Meals, photos, weights, body entries, your profile and the coach conversation are stored in your browser (IndexedDB and localStorage). We have no database holding your journal and no access to it. Your data does not sync between devices.

What passes through our server

Only when you start an AI feature yourself:

• Meal scan: the photos and description you add.
• Body scan: the photos and, if you enter it, your weight.
• Coach: the latest messages of the conversation plus the summary of your journal it needs to answer: calorie targets, today's meals, recent weights, allergies and preferences. Not your name.

Our server function (hosted on Vercel) passes that to Anthropic's API, receives the result and sends it back to your device. We do not store the photos or the content: they exist in server memory only for the length of the request.

Anthropic

Photos and text are sent to Anthropic's API, which performs the analysis as our processor. Under its policy, API data is deleted within 30 days unless it is flagged for a usage policy violation, in which case it can be kept longer (Anthropic data retention). Under its commercial terms, Anthropic does not train models on API data (Anthropic privacy policy).

Account (optional)

You can use the app without an account. If you make one, we keep: your email address, when the account was created and last used, your plan (free or Pro, and until when) and counters: how many AI analyses you used per day and per month and their estimated cost. There is no password to store: you sign in with a one-time code sent by email. The code is sent by Resend, our transactional email provider, in its EU region. The session is a signed cookie, strictly needed for signing in to work.

Account data is kept in a Redis database (Upstash) for as long as you have the account. Monthly counters are deleted after about 13 months. You can delete the account in Settings with one button, usage history included. The legal basis is the contract, providing the service you ask for (Article 6(1)(b) GDPR).

Without an account, the browser gets a random identifier in a cookie so the daily analysis limit can be counted. It is not linked to you as a person and is used only for that count.

Health data

What you eat, what you weigh and photos of your body are health data under Article 9 GDPR. We process them only with your explicit consent, which you give by starting an analysis. You can withdraw it at any time by not using the AI features and deleting your data in Settings. The body scan is for adults only, and only for photos of yourself.

What we record technically

• AI usage: for each request the server log records which feature was used, the token count, duration and cost. No content, no photos, no IP address.
• Abuse protection: so nobody can exhaust the service, we count requests per IP address. The address is stored only as a keyed cryptographic hash (HMAC), and the counters expire within 24 hours.
• Error reports: when the app crashes, we send the error message, the page address and the browser type so we can fix it. No journal data.
• Visit statistics: Vercel Web Analytics, cookieless, no profiling and no way to tie a visit to a person.

The legal basis for these is our legitimate interest (Article 6(1)(f) GDPR): keeping the service secure and fixing bugs. Our host, Vercel, also keeps its own short-lived infrastructure logs.

Transfers outside the EEA

Anthropic, Vercel, Upstash and Resend are US companies and may process data on servers in the United States. Transfers rely on the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework, depending on the provider.

No ads, no tracking

We use no advertising, no tracking cookies and no pixels. We do not sell or share data with anyone beyond the providers named above.

Your rights

You have the right to access, correct, delete, restrict, port and object to the processing of your data, and to withdraw consent. Because the journal is on your device, you can do most of this yourself: in Settings you can download a full copy (a JSON file) or delete everything with one button. For anything else, email us. You can also complain to your local data protection authority.

Age

kcal.quest is for people aged 18 and over.

Changes

Before paid plans launch we will update this policy. It will then name the company that runs the service and who handles payments. See also the Terms.