Privacy policy

Last updated 28 September 2026

CheckCal is made by Dobreon sp. z o.o., a company registered in Poland, which is the controller of the personal data described here. Write to support@dobreon.com about anything on this page.

The short version: everything in CheckCal works without an account, reading photographs included. Without one, what leaves your phone is a photo you ask CheckCal to read (after you have agreed to that), a barcode or a search you look up, and the proof of your subscription. With an account, your diary is also kept in our database so it follows you to a new phone.

Without an account

Your day, your meals, weight, workouts, water, targets, scores, reports and Apple Health all live on your phone and work with no account at all. Nothing about them is sent to us.

Three things do leave the phone, each only when you use it:

• A photo you ask CheckCal to read, and only once you have agreed — see Meal photographs and AI.
• A barcode you scan or words you search for, which go to Open Food Facts — see Barcodes.
• The proof of your subscription, which Apple signs and our server checks before a photo is read — see Subscriptions.

Signing in is optional

An account does one thing: it keeps a copy of your diary so it reaches your other devices and survives a new phone. Nothing in the app needs one.

We use Firebase Authentication, which is Google, to handle signing in. You can sign in with Apple, with Google, or with an email address and a password. Apple and Google sign-ins involve no password at all. An email account has one, and we never see it: the app hands it to Firebase, which stores only a salted hash, and a forgotten one is reset by a link Firebase emails you. What Firebase holds is your email address, your name if Apple or Google passed it on, the identifier the provider gives us or the password hash, and the times you signed in. Signing in with Google tells Google that you use CheckCal; we receive your email address and name from them and nothing else. If you use Apple's Hide My Email, the only address we ever see is the relay one Apple gives us.

You can sign out in the app under You. Your diary stays on the phone and stops syncing.

What syncing stores, and where

With an account, your diary is kept in Cloud Firestore, Google's database, so it can reach your other devices. That is:

• What you log: foods, portions, meals, water, the workouts you log, your weigh-ins — including the ones that came in from Apple Health — your saved meals, and the targets each day was measured against.
• Your profile from the opening questions: sex for the calorie formula, date of birth, height, weight, activity, goal and eating style.

The database is in Frankfurt, in the European Union. Your diary is stored underneath your account's identifier, and security rules refuse any read or write that crosses from one account into another.

Photographs are not synced and are never stored on our side: the only lasting copy is on your phone.

When you delete something, it is marked deleted rather than removed outright, so the deletion reaches your other devices instead of the item coming back from one of them. The marked item stays in the database until you delete your account.

Meal photographs and AI

Reading a meal or a nutrition label from a photograph is done by an AI model: Google's, through its Gemini API, and — for a photo Google's model does not read — Apple's, on its Private Cloud Compute. Before the first photo is sent, the app asks whether you agree, and says the same things this section says. You can turn it off at any time in the app under You › Privacy. While it is off, no photo is sent anywhere; a photo you take meanwhile waits on your phone and is read only once you turn it back on.

• What is sent: the photo, made smaller (about 1,000 pixels on its longer side) and re-encoded, so it carries no location or other photo data. If you correct a reading in your own words with Fix something, your words and the list of foods and grams on that plate go with it. Nothing else — not your name, your body or your diary.
• How it travels: from the app to our server, which forwards it to Google and returns the answer. When Google's model does not read it — the day's 30 photographs on it are used, or our server or Google is not answering — and your iPhone supports Apple Intelligence, the app sends it straight to Apple's Private Cloud Compute instead. That way it never passes through our server.
• What our server keeps: neither the photo nor the answer. It holds the photo in memory for the length of the request. What we log is operational only — which model answered, how long it took, how many items came back, whether it was food — next to the account identifier or subscription number it was for.
• What Google does with it: it reads it under its paid API terms, which do not allow the data to be used to train its models. Google may keep it for a limited time to detect abuse, and it may be processed outside the European Economic Area, including in the United States.
• What Apple does with it: Private Cloud Compute uses it only to answer that one request and does not keep it, and Apple publishes the software that runs there so that independent researchers can check this. It may be processed outside the European Economic Area, including in the United States.
• No other AI: photos go to Google's model or Apple's and no other. If that ever changes, the app will ask you again first.
• The copy on your phone stays in the app's own storage and goes when you delete the meal.
• The legal basis is your consent, which you can withdraw in the app at any time.

CheckCal has no access to your photo library. When you choose a photo, the system's picker hands the app that one photo and nothing else. Saving a photo or a share card to your library asks for permission to add to it, not to read it.

Counting photographs

Each photograph Google's model reads costs us money, so our server counts them: there is a limit of 30 a day and a limit on how fast they can be asked for. On an iPhone that supports Apple Intelligence, photographs past the daily limit are read by Apple's model instead; those never reach our server and are not counted here. The count is kept per account when you are signed in, and per subscription when you are not. It holds how many photos were read today, how many were refused and why, the times of the last few, and a running total — nothing about the photos or the food.

• An account's count is stored under the account and goes with it when you delete the account.
• A subscription's count is stored under the subscription's transaction number, which Apple assigns and which names nobody. It is deleted automatically 90 days after the last photograph.
• The first time in a day that an account or a subscription reaches the limit, our server sends us an email through Resend, an email service, with that identifier and the limit. Nothing else is in it.

Proving the app is the app

Before a photo is read or you sign in, the server checks that the request comes from CheckCal, unmodified, on a real device. It uses Apple's App Attest: your phone's secure hardware signs a statement, Apple and then Google's App Check confirm it, and our server sees only a yes or a no. It carries nothing about you or your food, no advertising identifier, and it cannot be used to recognise you across apps.

Subscriptions

Subscriptions are sold and processed by Apple. We never see your card or your Apple Account. What our server sees is the transaction Apple signs, which the app sends with each photo so the server can check the subscription rather than take the app's word. The server records which subscription it is and when it runs out. When you are signed in, it also records which account the subscription belongs to; that record goes when you delete the account.

Barcodes and the food database

Scanning a barcode sends the number, and searching the food database sends the words you type, to Open Food Facts, a free public food database run by a French non-profit on servers in the European Union. Nothing else is sent and no account is needed.

Apple Health

Apple Health is used only if you allow it, in the Health permission sheet, and you can change what CheckCal may read and write at any time in the Health app.

• Read: your steps, active energy, workouts and weigh-ins. Steps, active energy and workouts are read on your phone when the day is shown and are not stored or sent anywhere. Weigh-ins that come in from Apple Health are kept in your diary, so they sync to your account like everything else you log when you are signed in.
• Written: a weigh-in you type into CheckCal, so both apps show the same weight. Food and calories are never written to Apple Health.
• Health data is never sent to the AI, never used for advertising or marketing, and never shared with anyone.

Who else handles your data

• Google — through Firebase: signing in, the database in Frankfurt, and App Check; through the Gemini API: reading photos, as described above.
• Vercel hosts our server in the United States. It records the technical details of each request — IP address, time, size, status — for security, and keeps our server's logs for a short time.
• Resend delivers the limit emails described above.
• Apple handles Sign in with Apple, App Attest and the App Store under its own privacy policy, and reads on Private Cloud Compute the photos Google's model does not, as described above.

Each company that processes data for us is bound by an agreement to protect it at least as well as this policy does and to use it only to provide its service to us. Google, Vercel and Resend are United States companies, so reading a photo, signing in and the limit emails involve transfers outside the European Economic Area; those rest on the European Commission's standard contractual clauses. A photo read by Apple may also be processed in the United States.

What we never collect

There is no analytics SDK, no crash reporter, no advertising identifier and no third-party tracker of any kind in the app. Nothing you log is sold, shared with advertisers or used to build a profile of you, and we do not use your diary to train anything.

Children

CheckCal is not intended for children. The opening questions do not accept a date of birth under 13 years ago, and a plan to lose weight is offered only from 18 and never to somebody already under a healthy weight.

Your rights, and deleting everything

Under the GDPR you have the right of access, rectification, erasure, restriction, portability and objection, and you can withdraw consent at any time.

• Delete your account in the app under You › Delete account and data. To be sure it is you, you sign in once more; then your records are removed from the database, Sign in with Apple's access is revoked, your identity is removed from Firebase, and everything on the phone is erased. It happens when you tap it and cannot be undone.
• Without an account, You › Erase all data on this phone erases everything the app holds. We hold nothing about you beyond the anonymous photo count described above.
• Withdraw your consent to AI reading under You › Privacy.
• For access, correction or a copy of your data, use You › Export my data or write to support@dobreon.com; we answer within one month.

You may also complain to a supervisory authority. In Poland that is the Urząd Ochrony Danych Osobowych.

Changes

If this policy changes in a way that affects what is sent or kept, we will update the date at the top and describe the change here before the version of the app that makes it ships.