Last Updated: 20/08/2026
1. Who We Are
CalBuddy is operated by CALBUDDY TECHNOLOGIES LTD. (“CalBuddy”, “we”, “us”, “our”), a company registered in Israel.
We are the controller of the personal data described in this policy. If you have any question about it, or want to exercise any of the rights described in Section 13, write to app@calbuddy.co.il.
2. What This Policy Covers
This policy explains what personal data the CalBuddy mobile app and website collect, why we collect it, who we share it with, how long we keep it, and what control you have over it.
Please read it carefully. CalBuddy is a nutrition and weight-management app, which means some of the information you give us - your weight, your body measurements, your goals and the photographs of your meals - is health-related information. Under Israeli law this is treated as data of especially high sensitivity, and we handle it accordingly.
By using CalBuddy you consent to the collection and use of your information as described here. Where we rely on your consent, you can withdraw it at any time (Section 13).
3. Information We Collect
3.1 How we identify you
CalBuddy does not require you to create an account, log in, or give us your name or email address to use the app. When you first open the app, a random anonymous identifier is generated on your device. Everything you do in the app - your profile, your logs, your photographs and your subscription - is stored against that identifier. We do not link it to your name, email address or phone number, and we have no way of doing so from the data we hold.
3.2 Information you give us
Category: Examples
Profile and health details: Age or date of birth, gender, height, current and target weight, desired pace of weight change, activity level, diet type, fitness goals, usual meal times
Content you create: Photographs of meals, scanned product barcodes, logged foods and portions, saved meal templates, weight entries and optional notes, activity entries, corrections you make to AI results
Website purchases: If you buy a subscription through our website, the email address you enter at checkout and your answers to the quiz on the website
Communications: Emails and support messages you send us, and their contents
3.3 Information collected automatically
Category: Examples
Device and technical data: Device model, operating system and version, app version, language, time zone, IP address and the approximate location derived from it
Push notification token: A token issued by your device that lets us send notifications to it
Advertising identifier: IDFA (iOS) or GAID (Android), collected only where you have permitted it - see Section 7
Install and attribution data: Which advertisement, campaign or link brought you to the app, install and first-open timestamps
Usage data: Screens viewed, features used, actions taken in the app, session length, funnel and retention events
Session recordings: Interactions with app screens, recorded and replayed for usability analysis - see Section 6.3
Diagnostic data: Crash reports, error logs and the technical state of the app at the moment of a failure
3.4 Information we receive from others
Source: What we receive
Apple and Google: Subscription and purchase events (start, renewal, cancellation, refund). We never receive your payment card details.
RevenueCat: Consolidated subscription status, plan, trial state and entitlement information
Singular: Attribution data telling us which marketing source your install came from
3.5 Device permissions and Apple Health
Permission: Why we ask
Camera and photo library: To photograph or select meals and scan barcodes for analysis
Notifications: To send meal-logging reminders, progress updates and occasional service messages
App tracking (iOS): To use your advertising identifier for measurement and attribution - see Section 7
Apple Health (optional): To read your step count and activity so they can be reflected in your daily targets
Apple Health data is read on your device. We do not copy your HealthKit data to our servers; only the activity entries that the app itself creates in your log are stored.
You can withdraw any of these permissions at any time in your device settings. The app remains usable without camera, notification or Health access, with reduced functionality.
4. How We Use Your Information
We use your information to:
• Analyse the meals you photograph or scan, and estimate their nutritional content.
• Track your dietary intake, weight and activity, and your progress toward your goals over time.
• Generate personalised targets and recommendations based on the details you provide.
• Provide, operate, maintain and improve the app, and fix problems in it.
• Manage your subscription, trial and billing status, and provide customer support.
• Understand how users find CalBuddy and measure the performance of our marketing.
• Send you reminders and service communications, and - where you have agreed - marketing messages.
• Comply with our legal, tax and accounting obligations, and enforce our Terms of Use.
We do not use your meal photographs or your health information to train artificial intelligence models, and we do not permit our AI providers to do so.
5. Meal Photographs and AI Analysis
When you photograph a meal, describe it in text, or scan a barcode:
• The image, text or barcode is sent to a third-party AI model for nutritional analysis. We currently use the Google Gemini API and, as a fallback, the OpenAI API, routed through the Vercel AI Gateway. We send only the image or text and the minimum context needed for the analysis - your anonymous identifier, name or contact details are not sent with it.
• Under both Google’s and OpenAI’s API terms, content you submit is not used to train their models, and any vendor-side retention is limited to a short abuse-monitoring window (currently up to 30 days for OpenAI).
• Barcodes may additionally be checked against the Open Food Facts database to retrieve product information.
• Meal photographs are stored on our servers, linked to your anonymous identifier, so that your meal history remains available to you. They are kept until you delete your data or ask us to delete it (Sections 11 and 14).
AI-generated nutritional estimates are exactly that - estimates. They are not medical or dietary advice, and you should not rely on them for the management of any medical condition.
6. Analytics, Diagnostics and Session Recording
We use the following tools to understand how CalBuddy is used and to keep it working properly.
6.1 PostHog - product analytics
PostHog records in-app events (screens viewed, features used, onboarding steps completed, subscription events) together with your anonymous identifier and technical device data. The answers you give during onboarding (such as your weight or goals) are not sent to PostHog - only the fact that a step was completed. We use it to understand which parts of the app work and which do not.
6.2 Sentry - crash and error reporting
Sentry captures crashes and errors, including the app version, device model, operating system, IP address and a technical trace of the actions leading to the failure. We use it solely to diagnose and fix defects.
6.3 Microsoft Clarity - session recording and heatmaps
We partner with Microsoft Clarity to capture how you use and interact with CalBuddy through behavioural metrics, heatmaps and session replay, in order to improve our product. This means your interactions with app screens may be recorded and replayed by us in aggregate and individually for usability analysis. Usage data is captured using cookies and similar tracking technologies.
We configure Clarity to mask text input fields so that free-text you type is not captured in recordings. For more information about how Microsoft collects and uses this data, see the Microsoft Privacy Statement (https://www.microsoft.com/privacy/privacystatement).
If you would prefer not to be included in session recording, contact us at app@calbuddy.co.il and we will exclude your installation.
7. Advertising, Attribution and Tracking
We advertise CalBuddy on platforms including Meta (Facebook and Instagram), TikTok and Google, and we need to know which of those advertisements actually work.
• We use Singular as our mobile measurement partner. Singular collects your device identifier (IDFA or GAID, where permitted), IP address, install source and certain in-app events such as onboarding completion, trial start and subscription purchase.
• Singular then transmits these attribution and conversion signals back to the advertising platforms (Meta, TikTok, Google and similar networks) so that those platforms can attribute installs and optimise campaign delivery. These signals consist of device-level identifiers and event indicators.
• On our website, we use the Meta Pixel and similar tags, together with campaign parameters in the link you clicked (such as UTM and click identifiers), to measure which advertisements lead to website purchases.
To be clear about the limits of this:
• We do not sell your personal data.
• We do not send your photographs, weight, health information or any of your nutrition data to advertising platforms.
• What is shared is limited to device identifiers, IP address and the fact that a defined event (such as an install, trial or purchase) occurred.
This activity may be considered “tracking” under Apple’s App Tracking Transparency framework. On iOS we ask for your permission before accessing your advertising identifier, and if you decline, we do not use it. You can change your choice at any time in your device settings, and on Android you can reset or delete your advertising ID in the Google settings menu.
8. Subscriptions and Payments
CalBuddy subscriptions are purchased through the Apple App Store, Google Play, or our website. Store payments are processed entirely by Apple and Google - we never receive or store your payment card details.
We use RevenueCat to manage subscription entitlements. RevenueCat receives your anonymous identifier along with purchase, renewal, trial and cancellation events, and tells our app whether your subscription is active.
Where you purchase through our website, payment is handled by RevenueCat Web Billing and its payment processor. In that case RevenueCat holds the email address you entered at checkout, to send receipts and to let you redeem the purchase in the app. We receive confirmation of the transaction and its status - never full card details.
9. Who We Share Your Information With
We share personal data only with the service providers we need to operate CalBuddy, and only to the extent required. Each is bound to protect it and to use it only on our instructions.
Provider: Purpose: What it receives
Supabase: Database, file storage and backend functions: All profile, health, log and photo data, keyed to your anonymous identifier
Google (Gemini API) and OpenAI, via Vercel AI Gateway: Meal and barcode analysis: Meal images, meal descriptions and barcodes
Open Food Facts: Product nutrition lookup: Barcodes
Singular: Marketing attribution and measurement: Device identifiers, IP address, install and conversion events
Meta, TikTok, Google: Advertising measurement and optimisation: Device identifiers and conversion events, via Singular and website tags
RevenueCat: Subscription management and web billing: Anonymous identifier, purchase and subscription events; checkout email for website purchases
Apple, Google: App distribution and billing: Purchase data
Expo: Push notification delivery and app build infrastructure: Push token and the content of notifications sent to you
PostHog: Product analytics: Anonymous identifier, in-app events, device data
Sentry: Crash and error reporting: Device and technical data, IP address, error traces
Microsoft Clarity: Session recording and heatmaps: Interaction data, session recordings, device data
Google Workspace: Customer support email: The contents of messages you send us
We may also disclose personal data:
• where required by law, court order, or a lawful request from a competent authority;
• where necessary to establish, exercise or defend legal claims, or to enforce our Terms of Use;
• to protect the rights, safety or property of CalBuddy, our users or the public; and
• in connection with a merger, acquisition, financing or sale of assets, in which case any acquirer will remain bound by this policy and we will notify you of any material change.
We do not sell your personal data, and we do not share it with unrelated third parties for their own marketing purposes.
10. Where Your Data Is Stored and Processed
Your profile, log and photo data is stored in our Supabase database and storage on servers located in Frankfurt, Germany (European Union).
Our service providers operate internationally, and personal data described in this policy is also processed on servers located in the European Union and the United States, depending on the provider. This includes Google, OpenAI, Vercel, Singular, RevenueCat, Expo, PostHog, Sentry, Microsoft and the advertising platforms named above.
Where personal data is transferred outside Israel, we do so on the basis of your consent and because the transfer is necessary to provide the service you have requested, and we require each recipient to apply protections consistent with this policy and with applicable Israeli data protection law.
11. How Long We Keep Your Information
Data: Retention period
Profile, health, nutrition, weight and activity data: Until you delete your data (Section 14)
Meal photographs: Until you delete your data. Photographs are not deleted automatically.
Database backups: Deleted data persists in encrypted backups for up to 7 days before being overwritten
Session recordings (Clarity): Up to 30 days
Product analytics (PostHog): Up to 12 months after your last activity
Crash and error data (Sentry): Approximately 90 days
Attribution data (Singular): Up to 12 months
Subscription, billing and tax records: Up to 7 years, as required by Israeli tax and accounting law
Website checkout email and quiz answers: While your lead or subscription is active, then deleted or anonymised
Support correspondence: Up to 24 months
When a retention period expires, data is deleted or irreversibly anonymised.
12. Security
We take the security of your data seriously, and treat health-related information as requiring heightened protection.
• Pseudonymisation by design: your health data is stored only against a random anonymous identifier, never against your name or contact details.
• Encryption: data is encrypted at rest using AES-256 and in transit using TLS.
• Access control: we apply role-based access control, so that only personnel who need access to personal data in order to do their job have it.
• Backups: encrypted backups are performed daily to protect against data loss.
• Monitoring: access to production systems is logged and monitored.
No system is perfectly secure, and we cannot guarantee absolute security. If a security incident occurs that affects your personal data, we will notify the Israeli Privacy Protection Authority where required by law, and will inform affected users without undue delay where the incident is likely to create a risk to them.
13. Your Rights and Choices
You have the right to:
• Access the personal data we hold about you, and receive a copy of it.
• Correct data that is inaccurate or incomplete - most of this can be done directly in the app’s settings.
• Delete your data (Section 14).
• Withdraw consent at any time, including consent to health-data processing, tracking, session recording or marketing. Withdrawing consent does not affect processing carried out before the withdrawal, and some withdrawals will mean we can no longer provide the service.
• Object to direct marketing at any time, by using the unsubscribe link in any marketing email, turning off notifications in your device settings, or writing to us.
• Complain to the Israeli Privacy Protection Authority (הרשות להגנת הפרטיות) if you believe we have handled your data unlawfully.
To exercise any of these rights, email app@calbuddy.co.il. We will respond within 30 days. Because your data is held only against an anonymous identifier, we may ask you to send the request from within the app, or to provide that identifier (shown in the app’s settings), so that we can locate your data.
14. Deleting Your Data
You can delete your data at any time:
• In the app: use the delete option in the app’s settings. This removes your profile, health data, meal logs and photographs from our active systems.
• By email: write to app@calbuddy.co.il and we will delete your data for you.
Residual copies persist in encrypted backups for up to 7 days, and we retain billing and tax records for the period required by law. Deleting your data does not automatically cancel a subscription purchased through the App Store or Google Play - you must cancel that through your store account. If you uninstall the app without deleting your data, your data remains stored against your anonymous identifier until you ask us to delete it.
15. Children
CalBuddy is intended for individuals aged 16 and over. We do not knowingly collect personal data from anyone under 16. If we learn that we have collected data from a child under 16, we will delete it promptly. If you believe a child has provided us with personal data, contact app@calbuddy.co.il.
16. Communications
We send two kinds of messages:
• Service messages - push reminders, subscription and account notices, and important changes to the app. These are part of the service; you can control reminders in the app and notifications in your device settings.
• Marketing messages - occasional push notifications or emails about features, offers or content. We send these only where permitted, and every marketing email contains an unsubscribe link. Opting out of marketing does not stop service messages.
17. Changes to This Policy
We may update this Privacy Policy from time to time.
• For minor or clarifying changes, the updated policy takes effect when posted, and the “Last Updated” date at the top will change.
• For material changes - particularly changes to what we collect, who we share it with, or how health data is used - we will give notice in the app or by email at least 7 days before the change takes effect, and where the law requires it we will ask for your consent again.
18. Contact Us
For any question about this policy, your data, or to exercise your rights:
CALBUDDY TECHNOLOGIES LTD.
Email: app@calbuddy.co.il
