Privacy Policy — CaloBee

In short: we collect what CaloBee needs to work and use it only to run the app for you. We never sell your data and there are no ads. Your photos, messages and some profile details go to an AI provider only after you say yes inside the app, and you can say no again at any time. You can delete your account, photos included, inside the app.

1. Who we are

CaloBee ("we", "us") provides the CaloBee mobile app (the "App") and the website calobee.app, and is responsible for the personal data described in this policy. Contact: support@calobee.app.

2. Data we collect

Data	What it includes, and why
Account	Email address, your name, the ID from the sign-in method you use (email, Apple or Google) and, for email sign-up, a password (stored only as a hash) and the 6-digit code we email you to verify the address. Used to create and protect your account.
Profile and goals	Date of birth, sex, height, weight, activity level, your goal and calorie and protein targets, plus food preferences, allergies and health notes you choose to enter (for example diabetes, sensitive stomach, food allergy, vegetarian) and how you describe your body type. Used to calculate targets and personalise advice. Health notes are sensitive data.
Food photos and scans	Photos you take or choose (meals, nutrition labels, InBody printouts), barcodes you scan, the resulting estimates and any changes you make.
Chat with Bee	Messages you send and Bee's replies (including the fixed replies Bee gives to requests it will not answer), photos you attach, and a short summary of older conversation so Bee keeps context. Chat is kept for at most 12 months (see section 7).
Diary and planning	Meals you log, favourites, water, weight entries, meal plans, pantry items and shopping lists.
What Bee knows about you	Preferences and facts you state or confirm, and patterns inferred from your meals (such as foods you eat often, where you usually eat, cooking time and budget). You can see, edit and remove these in the App; items you remove are no longer used.
Apple Health (optional)	If you allow it, the App reads steps, sleep, weight, active energy and workouts from Apple Health. It only reads; it never writes to Apple Health. Your phone turns this into daily totals and averages, and only those totals and averages (plus your latest weight and the kinds of workouts you do) are sent to our servers. The App may refresh them in the background.
Subscription status	Your plan, renewal or expiry date and whether you are in a trial, received from the App Store through RevenueCat. We never see your card or Apple payment details.
Push notifications (optional)	Only if you switch on CaloBee notifications in Settings: your phone's push token (an identifier issued by Apple's or Google's notification service), together with your account ID, app language and app version, so we can deliver notifications such as "your scan has been analysed" to your phone. A notification's text passes through Apple's or Google's notification service to reach your phone. Our notification service keeps no notification text, only counts and delivery status.
Technical data	IP address and standard request logs (on our servers and at Cloudflare), sign-in session records, your language and time-zone settings, and a count of your Bee chats and of refused attempts (times only, no message text, kept 30 days) used to apply the daily chat limit and the chat pause described in section 4. Error reports can include the app version, device model and OS version; sensitive fields are removed from them. Activity in the App: the screens you open, the buttons you tap (with the text shown on them), when a scan starts, finishes or fails, and the app version, linked to your account; used to find the cause when something goes wrong (for example a meal logged twice). Never what you type.
Brag links (optional)	Only if you create a brag link for a meal: a public page at calobee.app/s/ with a short random code, showing a copy of that meal's photo, its name, calories, nutrients, ingredients, health score and Bee's tip, plus a title if you write one. It shows no name, email or other account details, is hidden from search engines, and we count how many times it is opened. Anyone who has the link can see it. Brag images made in the App are created on your phone and go only where you send them; we do not store them.
Places you ate at (optional)	Only if you tag a meal with a place: the place's name, its address if you type one, and which meals you ate there. A place you add is offered to other people only once at least 3 different people used it, and never with your name. A place's location is saved only when you turn on “I’m at this place” while adding it (rounded to about 11 m).
Meal ratings (optional)	Only if you rate one of your meals: the stars and the tags you pick from a fixed list (such as Tasty, Healthy), stored with that meal. Other people see only the average and the tag shares of a dish or place once at least 5 different people rated it, never who rated. No comments, messages or photos are shared. Deleting the meal or your account deletes the rating.
Messages and feedback	Emails you send us and reports you file about AI answers. If you send feedback or a bug report from the App: what you write, an optional star rating, optional photos or short videos, an optional contact email (only if you tick “Bee may contact me”), and details such as the screen, app version, device OS and language. Used to answer you and to fix problems.

Voice input is optional. If you use the microphone in chat, your phone's speech recognition turns your speech into text, and we receive only the text you send, not the audio.

Reminders are optional. If you switch on meal, water or streak reminders, the App schedules notifications on your phone (local notifications), which need no server. Notifications from CaloBee, such as when a scan has been analysed, are a separate switch, off by default (see the table above). The server also sends habit reminders (to the App's notification list, and to your phone if CaloBee notifications are on): from the times you usually log lunch and dinner in your diary, it reminds you when that meal is not logged yet, sends a weekly summary on Sunday evening and, if you turn it on, an end-of-day summary. Each can be turned off in Settings → Notifications, and they use only your diary.

Your phone's location is used only when you tap “Find places around you” while tagging a meal, and only if you allow it: it is sent once to find places nearby and is not stored, server logs included. We do not ask for your contacts, we do not use advertising identifiers, and we do not track you across other companies' apps or websites. Photos can carry metadata that your phone adds, such as when a photo was taken and, for photos from your library, sometimes where. We remove this metadata, including any location, from the photos you scan, send in chat or use as your profile picture before we store them. Photos and videos you attach to feedback or a bug report are stored as you send them, so they can still contain such details. The website calobee.app uses no cookies, analytics or advertising scripts of its own. Like any website, it receives your IP address and browser details in server logs.

3. How we use your data

To provide the App: estimate nutrition from photos, answer your questions, keep your diary and plans, and show trends and weekly reviews.
To personalise: use your goals, preferences, allergies and habits so suggestions fit you, for example avoiding foods you are allergic to.
To run and protect the service: sign-in, email verification, daily usage limits, abuse prevention and troubleshooting.
To manage subscriptions, answer support requests and fix problems you report.
To keep AI safe and accurate: review answers you report, and measure and improve accuracy as described in section 4.
To meet legal obligations.

Where the law requires your consent, we ask for it inside the App, for example before sharing data with AI or reading Apple Health. We do not use your data for advertising and we never sell it.

4. AI and your consent

CaloBee uses AI models from third-party AI providers to analyse photos and to power Bee. Requests go through CaloBee's own AI gateway, which forwards them to the AI provider we use. The provider processes them under its own terms of service and privacy policy, which may allow it to keep requests for a limited time, for example for safety and abuse monitoring.

What can be sent to the AI provider

photos you scan or send in chat: meals, nutrition labels and InBody printouts;
your messages to Bee, plus earlier messages and the running summary of your chat history;
your goal, daily calorie target and activity level;
the meals you logged today and a summary of what you ate recently, such as foods you eat often and how closely you follow your targets;
allergies, health conditions, body type and diet preferences you entered or confirmed, and your eating context (where you eat, cooking time, budget);
the name on your account, so Bee can greet you.

What is never sent: raw Apple Health data (only a calorie target adjusted for activity, and an activity level, both calculated on our side), your email address, your password and your payment details.

Your consent. Before your first AI use, the App asks for your permission. You can withdraw it at any time in Settings → Security & privacy → AI data sharing. After that, scanning and chatting stop working until you allow it again.

Purpose. We use this data to produce estimates, coaching and suggestions for you, and to check and improve the AI as described below. We never use it for advertising.

Logs and quality checks

We may keep a technical log of AI requests (the prompt, the answer, the model, token counts and errors) to fix problems and control costs. Allergy and health-condition details that we add to a prompt are removed from the stored log. The log is linked to your account, is deleted with it, and is in any case purged after 90 days. Only authorised staff can see it.
We may test the AI on samples of real content, for example a food photo and its nutrition result or a chat message, to measure accuracy and improve prompts. Samples are stored apart from your account details (without your name, email or account ID) and are removed when you delete your account.
Authorised CaloBee staff may review chat conversations, including messages Bee declined, to keep the service safe and to improve Bee's answers. Access is limited by role and recorded in an audit log.
Bee declines requests outside food and nutrition and requests that try to override its rules, and answers them with a fixed message. If this is repeated, chat with Bee can be paused for 24 hours; our staff can lift the pause.
People viewing a brag link (Khoe mâm) can react (😋 ❤️ 👏) without signing in. We store only the reaction, its time and a one-way hash (of the IP address, browser, link and day, with a server secret) so each person reacts once per kind per day; we do not store the IP address and never tell the link owner who reacted.
We may combine food names and calorie estimates from many users into aggregated statistics, only for foods logged by many different people, to improve our food catalogue. These statistics are not linked to you.

AI can be wrong. Estimates and suggestions are generated by AI and can be inaccurate. Use "Report response" in chat to flag an answer that is wrong, harmful or offensive. CaloBee staff review reports.

5. Who we share data with

We never sell personal data and we do not share it with advertisers. These providers help us run CaloBee:

AI providers: companies that supply the AI models behind photo analysis and Bee. They receive the AI data listed in section 4, only with your consent.
Cloudflare: network protection and delivery for our website and API, and private storage (R2) for your photos and the files you attach to feedback. Sees traffic details such as your IP address, and stores those files.
Hosting provider in Vietnam: the servers that run our database, API and AI gateway. Holds the data in section 2.
RevenueCat: subscription status and receipt checks. Receives your CaloBee account ID, purchase and subscription events, and standard technical data such as device type, OS version and IP address.
Apple and Google: Sign in with Apple or Google, App Store billing, the speech recognition built into your phone, and, if you switch on CaloBee notifications, their notification services (Apple Push Notification service and Firebase Cloud Messaging), which receive your phone's push token and the text of each notification in order to deliver it, as described by each provider.
CaloBee notification service (run by us): sends notifications to those services. Keeps your account ID, push token, app language and version, and counts and delivery status of notifications sent; it keeps no notification text.
Resend: sends our verification and password-reset emails. Receives your email address and the code.
People you send a brag link to: anyone who has a brag link you created can open that page (see section 2).
Open Food Facts: barcode lookups. Receives only the barcode number.
GlitchTip (run by us): error reports with sensitive fields removed.
Google ML Kit: barcode scanning on your device. The scan is processed on your device; the library may send technical diagnostics to Google.

We may also disclose data when the law requires it or to protect rights and safety, and to a successor if CaloBee's business is transferred. In that case we would tell you, and this policy would keep applying.

6. Where your data is processed

Our servers are in Vietnam. Several providers above, including our AI providers, Cloudflare, RevenueCat, Resend, Apple and Google, process data in other countries. When you allow AI data sharing and use the App, you understand that your data may be transferred to and processed outside Vietnam by these providers. We choose providers that publish data-protection commitments and we send them only the data needed for each purpose.

7. How long we keep data

Your account and content (profile, photos, diary, plans, what Bee remembers, activity totals, feedback and bug reports with their attachments): until you delete your account.
Chat with Bee (messages, replies and chat photos): for at most 12 months after each message, then erased for good. If you use "Clear chat history", the messages disappear from the App and Bee no longer sees or remembers them (its conversation summary is deleted), but they are kept until you delete your account or the 12 months run out, and then erased. Deleting your account erases all of it, including cleared messages, at once.
After you delete your account in the App: your account and its content, including chat messages you had cleared, are deleted immediately, including your photos in our storage; the exceptions are listed below. We also revoke the Sign in with Apple connection and ask RevenueCat to erase your customer record.
Push token: removed from our notification service when you switch notifications off, sign out or delete your account. A token that stops working (for example after you uninstall the App) is removed automatically.
Brag links: until you delete the link in Settings → My brag links, delete the meal it shows, or delete your account. Deleting removes its page and photo copy within minutes; copies that people or link-preview services already saved are outside our control.
Backups: database backups are kept for about 7 days, so deleted data disappears from them within that time.
Records we may keep: minimal purchase and subscription-event records (identified by an internal ID and, in some provider notifications, your email) and security or audit logs, for as long as needed for accounting, fraud prevention, dispute handling and legal obligations.
AI request logs: up to 90 days (see section 4).
Chat usage counts (times only, see section 2): 30 days.
Error reports: kept for up to 90 days, with sensitive fields removed.
Activity in the App (see section 2): 30 days.
Emails to us: as long as needed to handle your request and keep records.

8. Your rights and choices

In the App:

See and edit your information: Profile → Personal info and Profile → Goal & macros. Profile → Bee knows you shows what Bee remembers, and you can edit or remove items. Settings → Eating habits covers where you eat, cooking time and budget.
Withdraw AI consent: Settings → Security & privacy → AI data sharing.
Clear chat history: in the chat screen's menu. The messages are hidden from the App and from Bee, which forgets the conversation; they are erased for good when you delete your account or after 12 months (section 7).
Delete scan history: Settings → Security & privacy → Delete scan history. This removes all your scans and their photos.
Disconnect Apple Health: Profile → Activity & exercise → Disconnect. This stops syncing and removes your activity summary. Daily totals already saved are removed when you delete your account.
Delete your account: Settings → Delete account, or Settings → Security & privacy → Danger zone → Delete account. Deleting your account does not cancel an App Store subscription. Cancel it in your Apple Account settings.
Reminders and notifications: switch each reminder, and CaloBee notifications, on or off in Settings → Notifications.
Brag links: Settings → My brag links lists every link you created; rename or delete any of them there.
Phone permissions: Camera, Photos, Microphone, Speech Recognition, Health and Notifications can be changed at any time in your phone's Settings.

By email: write to support@calobee.app from the email address of your account to ask for a copy of your data, a correction, to restrict or object to processing, or to delete your account if you cannot use the App (see calobee.app/delete-account-en.html). We reply within 30 days. You also have the rights given by applicable Vietnamese law, including the right to complain to the competent authority.

9. Children

CaloBee is not intended for anyone under 16. We do not knowingly collect data from children under 16. If we learn that we have, we will delete it. If you believe a child has an account, contact us.

10. Security

Data travels over encrypted connections (TLS).
Passwords are stored only as hashes. Your sign-in tokens are kept in your phone's secure storage.
Photos are stored privately and shown through time-limited signed links.
Access to account data is limited to authorised staff by role, and many administrator actions are recorded in an audit log.
No system is perfectly secure. If a breach affects you, we will notify you as the law requires.

11. Health information and medical advice

We treat what you tell us about your health, such as allergies, conditions and Apple Health totals, as sensitive. We use it only to personalise CaloBee for you, never for advertising, and we never sell it. CaloBee provides AI estimates and general suggestions. It is not medical advice. Ask a healthcare professional before making medical decisions.

12. Changes to this policy

If we make material changes, we will notify you in the App, or by email, at least 14 days before they take effect. If you do not agree, you can delete your account before then.

13. Contact

Questions or requests: support@calobee.app. This policy is governed by the laws of Vietnam.