Version: November 1, 2026. Effective date: November 10, 2026
Who is responsible
Cahier Digital Inc. operates Calozi. Privacy questions and requests should be addressed to Privacy Officer — Cahier Digital Inc. at support@calozi.app. Mailing address: 111-686 Grande Allée Est, Québec, QC G1R 2K5, Canada.
This policy covers the Calozi app, website and related support. Initial app availability is in the United States and Canada. English, French and Spanish versions describe the same practices; translation does not expand store availability.
Information and purposes
| Category | What we handle and why |
|---|---|
| Account | Email, account identifier, authentication/session records, policy agreement, AI and optional analytics consent choices, and sign-in messages, for account access, security, recovery and honoring your choices. Legacy accounts may lack an email; this does not make them anonymous to our systems. |
| Profile and goals | Name, birth date, height, calculation context such as gender, weight, target weight, activity preferences and onboarding answers, to calculate and personalize goals. |
| Tracking | Meals, nutrients, portions, water, exercise, weight history, saved foods, meal images and progress photos, for your tracking and cloud recovery. |
| Optional AI | Photos, descriptions, corrections, recordings, transcripts and results needed for the analysis or transcription you request. |
| Subscription | Store and account identifiers, products, transactions, trial/renewal/expiry and verification status, to verify membership, restore purchases, handle billing questions and prepare subscription reports. Store checkout does not provide us with your full payment-card details. |
| Operations | Request identifiers, timestamps, error/security records, search queries, corrections, barcodes, selections and random search-session identifiers, for delivery, abuse prevention and food-catalog quality. Infrastructure providers also process network/device information such as IP addresses and request metadata. |
| Optional analytics and error reports | Limited app interactions, subscription outcomes and amounts, technical context and sanitized errors, with your separate permission, to understand usage and improve the app. Details and controls appear below. |
| Support | Email, messages and attachments you choose to send, and device/app details included in support drafts, to handle your request. |
Avoid putting unnecessary sensitive information or other people's information in photos, messages or AI prompts. Food and activity information may reveal or allow inferences about health. We treat it as sensitive where applicable law requires.
Device storage and cloud recovery
Calozi stores tracking information on your device. When signed into your account and connected, it synchronizes tracking records and private meal/progress photos through Supabase. Account-linked backups can contain the health-related information you enter. Offline or failed synchronization can delay recovery.
Photos are prepared to less than 1 MB before transmission. Requested AI analysis begins immediately; successful results save automatically on your device. Permanent photo backup becomes eligible two minutes after an entry is saved, without requiring review or a Save action. Editing pauses that backup and restarts the delay when editing ends. Backup may wait longer if the app is suspended or offline. Meal details can synchronize before their photo. Pending analyses and discarded photos are not added to permanent photo storage. Each account includes 10 GB (10,000,000,000 bytes) of photo backup. At capacity, new photo backups wait; meal details can continue synchronizing. Deleting an entry removes its app-owned local photo and, after the deletion synchronizes, schedules removal of its cloud photo unless another saved entry still uses it. Cloud removal is retried independently of your device, and storage is freed after removal completes. This does not delete your camera-roll original or change the separate retention terms for AI processing described below.
Photo backup is separate from sending an image to AI. Your tracking information is not published as a public profile. Signing out, uninstalling or losing a device does not itself delete the cloud account.
Optional AI processing
Calozi requests permission before sending content for AI features. Through our backend, OpenAI receives the content needed for your request: meal or nutrition-label photos, descriptions and corrections for nutrition estimates; recordings for transcription and resulting text for analysis; or exercise descriptions to identify activities and duration.
Your weight is not sent to OpenAI for exercise identification; energy calculations use reference values and recorded weight within Calozi. Progress-photo backup is separate from AI submission.
Our backend stores request metadata and caches results and transcripts for retries, duplicate-request handling and service protection. Processing can occur even if you do not save the result. Recordings are sent for transcription and are not included in your cloud tracking backup.
OpenAI's published API terms and data controls describe its processing. API content is not used for model training by default unless the API customer opts in. Standard analysis-endpoint abuse monitoring can retain content for up to 30 days, with exceptions described by OpenAI for legal or safety needs; its audio-transcription endpoint has different retention controls. Calozi requests that analysis responses not be stored as response history, but this is not a promise of zero retention. See OpenAI's API data controls.
You can decline AI and use manual logging with an active membership. In the app, open Profile → Privacy & data → Withdraw AI consent to block new AI requests for your account across devices. Requests already submitted may finish. You can enable AI again only after the consent prompt. Contact support@calozi.app for other consent withdrawals or assistance. Withdrawal does not undo earlier processing or automatically delete existing records. These terms do not grant a general license to publish your private content or train general-purpose AI models with it.
Apple Health and device permissions
With your permission, supported iOS builds read steps and active energy from Apple Health to display activity and optionally adjust your calorie budget. These readings and permission flags stay on the device and are not included in Calozi's cloud tracking backup or sent to OpenAI by this integration.
If you enable nutrition export, Calozi writes calories, protein, carbohydrate and fat from logged meals to Apple Health. The original meal can also be backed up in Calozi. Apple operates Apple Health and its own synchronization.
You can change permissions in Apple Health or device settings. Disconnecting stops future access/export; it does not remove entries already exported. Those entries can be managed in Apple Health.
Camera/photos support images and barcodes; microphone access supports voice input. Reminders use locally scheduled device notifications. Change permissions in device settings; the affected feature may stop working.
Website and food search
The supplied website pages do not set tracking cookies, run advertising pixels or use a dedicated analytics tool. Web hosting and network services process ordinary request information to deliver and protect pages. Email links open your email application; they do not automatically send a message.
The app also has operational search telemetry, separate from optional usage sharing. Food searches use our imported catalog hosted through Supabase. A dataset credited as a source is not automatically a recipient of your searches. Random search-session identifiers are not stored with an account identifier in the catalog event table, but queries and other metadata can still contain personal information; do not include personal details in food searches.
We do not sell personal information or share it for cross-context behavioral advertising. We do not use Apple Health information for advertising. Adding a new analytics or advertising purpose would require reviewing these disclosures and obtaining consent where required.
Optional analytics and error reporting
With your separate, optional permission after adult eligibility is established, Calozi sends limited usage events to PostHog and sanitized application error reports to Sentry, using their United States services. We use these reports to understand setup completion, subscription-offer conversion, returning use and feature usage, and to find failures and improve reliability and performance.
PostHog events can include:
- App activity: visits, named screens, setup steps and completion without your answers, logging methods, saves/edits/deletions, reminder-setting changes and notification opens detected by the app.
- Membership: subscription offers viewed, monthly/annual plan selections, trial eligibility, purchase/restore and access-verification outcomes, and subscription events such as trials, renewals, cancellations, expiry and billing issues. Selected purchase and renewal events include the transaction amount in US dollars when supplied by our billing provider; payment-card details and purchase receipts are not included.
- Service quality: whether logging, search, barcode lookup, AI analysis, backup or recovery succeeded, failed or was cancelled; limited error categories, search-result counts and processing times for measured operations.
- Technical context: event date/time, app version, platform, language, membership-access state, production/test context, and random analytics, session and event identifiers.
A random analytics identifier lets us recognize returning use. Its connection to your account stays in our private database; PostHog does not receive your Calozi account ID. This is pseudonymous information, not completely anonymous information. Usage can indicate that you use a health-related feature, even though the contents of your health records are excluded.
Sentry reports contain the error time, app version, production/test context and sanitized code locations needed to find the fault. They exclude original error messages, activity breadcrumbs, request contents, and account or stable device identifiers. We configure Sentry to remove stored IP addresses and inferred geographic values from reports. Sentry and network services still receive connection information needed to deliver requests. Native crash collection, automatic performance tracing, profiling and session recording are disabled.
These analytics and error reports exclude food and exercise descriptions, photos, audio, search text, barcode digits, weight, health values, names, email and birth dates. These exclusions apply to the reports, not to the information Calozi processes to provide tracking, search, AI or billing as described elsewhere in this policy. We do not record sessions, collect advertising identifiers or track you across other companies’ apps through these tools. Our server sends PostHog events without your network address and disables location enrichment.
Your choice: sharing starts off. Declining or postponing does not change your membership access or price. Change the choice in Privacy & data; permission for AI is separate. We do not send a history of activity from before permission. Withdrawal immediately stops new reports and clears pending usage events on that device. Once the withdrawal reaches our server, it rejects new usage events for your account. Other active, connected devices check once per minute or when returning to the foreground. If saving your choice fails or you are offline, sharing stays off on that device and the app retries the withdrawal; the account-wide change and deletion request take effect when the server receives it. Requests already sent may finish.
Withdrawal or account deletion queues deletion of the prior PostHog identifier and its events. Opting in again uses a new identifier. Provider deletion is asynchronous; it is not completed merely because the app confirms your choice. Sentry reports contain no account or stable device identifier that lets us match them to a particular account for deletion; they expire under the retention period below.
The device retry queue holds at most 200 usage events for up to 24 hours; pending server delivery expires after seven days. Under our current service plans, PostHog events are retained for one year and Sentry reports for 30 days unless deleted earlier. We retain limited delivery receipts for 90 days and the minimal records needed to complete or demonstrate erasure requests.
Recipients and processing locations
We use information for the purposes above, to respond to rights requests and to meet legal obligations. Access is limited to people and providers who need it for those purposes.
- Supabase: account authentication, database, private photos and backend services. Our current primary database region is Canada (Central). Edge processing, support and infrastructure can involve other locations.
- OpenAI: content submitted for optional AI, as described above. International processing can occur, including in the United States.
- RevenueCat: account/purchase identifiers, device/technical and transaction information used for subscription verification and restoration. Its services process data in the United States. Calozi does not send meal photos, recordings or food logs to RevenueCat for billing.
- PostHog and Sentry: optional product measurement and application error diagnosis described above, using their United States services. Our server sends PostHog events without your network address and disables geolocation enrichment. Sentry and network services necessarily receive connection information to deliver reports.
- Apple and Google: purchases, renewal, refunds and platform services on supported stores, under their own terms. Apple also operates Apple Health.
- Email, hosting and network providers: deliver sign-in/support messages and website requests. Support email is handled through Google Workspace. Our website uses Netlify hosting, which processes ordinary website requests and network metadata.
- Professional advisers or public authorities: only where reasonably necessary and lawful for accounting, legal obligations, valid legal requests, security or a dispute.
A business transfer may involve information subject to applicable protections, required notice and consent. We do not treat a transfer as permission to change health-data purposes without meeting applicable requirements.
Information may leave Quebec or Canada. Foreign laws can permit lawful access by courts or authorities. We assess transfers and use appropriate agreements and safeguards where required. Contact the Privacy Officer for information about relevant providers or safeguards.
Retention, deletion and security
We keep information only for the purposes described, applicable legal obligations and legitimate, documented dispute/security needs. We consider sensitivity, necessity, your deletion requests and legal requirements when determining retention.
| Records | Retention and deletion approach |
|---|---|
| Account, tracking information and photos | Kept to provide your account, history and recovery until deleted or no longer needed. Deleted records can temporarily leave synchronization markers or conflict copies. Account deletion removes associated active records and private photos through the deletion process. |
| AI results, transcripts and request metadata | Cached for retries and service protection. An hourly cleanup job expires production and TestFlight request caches older than 24 hours, after any active processing lease ends. Request-time cleanup also runs. Failed cleanup jobs can delay removal until a successful retry; this is not a promise of deletion at an exact minute. Account-linked records are included in cloud account deletion. |
| Food-search events | Raw events are retained for up to 90 days for search quality and abuse prevention, then expired by the cleanup job. A cleanup failure can delay expiry until a successful retry. Because these events use a random session rather than an account identifier, identifying a particular person's events may require additional information. |
| Infrastructure/security logs | Kept according to the provider's configured logging service and as needed to diagnose incidents and protect the service. We do not promise that deleting an account immediately erases independently maintained security logs. |
| Recovery backups | Copies can remain in isolated recovery systems until expiry or required deletion. We restrict their use to recovery/security, honor applicable deadlines, and reapply completed deletions if information is restored. |
| Support, billing and legal records | Kept while resolving the request or transaction and for the period needed to satisfy recordkeeping, dispute or legal duties. Retention exceptions are limited to the information needed for those purposes. Stores independently control their purchase records. |
In-app deletion attempts to remove active cloud records and photos, then clears local tracking data on that device after success. If deletion fails, the app reports failure so you can retry or contact support. The separate account-deletion page explains requests, limits and timing.
We use access controls and encrypted network connections to protect information. Device protection depends in part on your device settings. Calozi is not an end-to-end encrypted service. No system can guarantee absolute security. Contact support promptly about suspected unauthorized access.
Your choices and privacy requests
Email support@calozi.app, addressed to the Privacy Officer, for access, a copy, correction, deletion, withdrawal of consent or a complaint. Describe your request without sending passwords, sign-in codes or unnecessary health information. We may verify your identity or an authorized agent's authority using proportionate information. You do not need to buy a subscription or create a new account to make a request.
We respond within applicable deadlines and explain a lawful refusal, extension or available appeal. Withdrawal may affect a feature; it does not cancel a subscription.
Quebec: Qualifying rights include access, correction and portability of computerized information. We respond in writing to written access/correction requests within 30 days of receipt. You may seek review through the Commission d'accès à l'information du Québec, subject to legal deadlines.
Other Canadian and United States residents: Rights vary with applicable law and may include access, portability, correction, deletion, withdrawal, authorized-agent requests, appeals and opt-outs of specified processing. We will not unlawfully discriminate for exercising those rights. Appeal a refusal where an appeal right applies by emailing support@calozi.app with subject "Privacy appeal." You may also contact the competent privacy regulator or state attorney general.
Washington: See our separate Consumer Health Data Privacy Policy for health-data categories, sources, disclosures, consent and rights.
Children and minimum age
Calozi is intended only for people aged 18 and above. Parental permission does not make an underage person eligible. If we learn that someone under 18 provided personal information, we investigate, restrict use and take steps to remove the account and associated information in accordance with law. Report an underage account to support@calozi.app.
Changes and contact
We update this policy and provide appropriate notice of material changes, obtaining consent where required for new purposes.
Privacy Officer — Cahier Digital Inc. Email: support@calozi.app. Mailing address: 111-686 Grande Allée Est, Québec, QC G1R 2K5, Canada.