Privacy Policy

Protecting your data matters to us. This policy explains which data Kalouri processes, for which purposes and on which legal basis. You can use Kalouri in two ways: without an account, in which case your diary stays in your browser; or with a Kalouri account, in which case your account data is stored and synchronised in our cloud so that it is available across your devices. The sections below describe both cases.

1. Controller

ELAG International Group Ltd.
Tepeleniou 13, Tepeleniou Court, 2nd Floor, 8010 Paphos, Cyprus
Email: support@kalouri.com

2. Use Without an Account (localStorage)

If you use Kalouri without signing in, your entries, your daily goal, optional profile details (e.g. height and weight for the goal suggestion), your coach and voice settings and your language setting are stored exclusively in your browser’s localStorage. This data is not transmitted to us and does not leave your device — unless you actively use one of the online features described below (e.g. online food search, photo recognition or signing in). You can delete it at any time via your browser settings.

3. Account & Sign-In (Supabase)

To create an account and sign in, we use Supabase, a managed authentication and database service that acts as our processor. When you register, we process your name, email address and a password. The password is stored by Supabase in hashed form; we never see it in plain text. Sign-in works by email and password or by an 8-digit one-time code sent to your email. To keep you signed in, a technically necessary session cookie / token is set. Purpose: providing the user account you requested. Legal basis: Art. 6(1)(b) GDPR (performance of the contract). See also section 12 on third-country transfers.

4. Cloud Storage & Synchronisation (Supabase)

As soon as you are signed in, the data tied to your account is stored in our database at Supabase and synchronised across your devices. Your localStorage remains the immediate, offline-capable copy; while you are signed in, changes are mirrored to Supabase (read when you open a day, written on every change). The following data is processed:

• your daily diary entries (food name, portion, calories, protein, carbs, fat; logged training as calorie burns);
• your training history / workouts (exercises, sets, weights, notes, start and finish times);
• your daily calorie goal and the body metrics from onboarding (e.g. sex, age, height, weight, activity level) used to calculate that goal;
• your exercise/equipment library and last session (for progression);
• foods you add to the community food database (stored with a reference to your account and readable by other users so the entries can be reused);
• your subscription status (see section 5).

Legal basis: Art. 6(1)(b) GDPR (providing the account-based service you requested) and, where applicable, Art. 6(1)(f) GDPR (our legitimate interest in protecting your data against local loss). Provider: Supabase Inc. (USA) as our processor under a data processing agreement (DPA). Your data is stored in the EU (Frankfurt, Germany; AWS region eu-central-1).

5. Subscription & Payment (Stripe)

Kalouri offers a paid subscription (monthly or yearly) and, where applicable, a free trial period. Payments are processed by our live payment provider Stripe. When you start a checkout, a Stripe customer is created using your email address; Stripe processes the payment data you enter (e.g. card details) directly — we do not receive or store your full card number. We store, server-side in your profile, your Stripe customer ID and your subscription status (active state, plan, current period end); these are updated automatically via Stripe webhooks. When a subscription becomes active, we send you a confirmation email. Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (statutory retention of billing records). Statutory retention period for billing/tax records: six years after the end of the year to which they relate (Cyprus Companies Law, Cap. 113, and Cyprus tax law). Provider: Stripe Payments Europe, Limited and, for regulated payment services, Stripe Technology Europe, Limited, both 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe processes payment data as an independent controller for payment processing and fraud prevention (Stripe Privacy Policy: stripe.com/privacy); data may also be processed by Stripe, Inc. in the USA.

6. Food Search (Open Food Facts)

When you search online, your search term is forwarded via our server route to the open database Open Food Facts in order to return matching products. No personal profiles are created. Legal basis: Art. 6(1)(b)/(f) GDPR (app functionality, legitimate interest in a usable search).

7. Photo Recognition (Anthropic)

If you use the photo feature, the image you select (resized client-side) is sent via our server route to the Anthropic API to estimate calories and macros. The image is processed only to answer the respective request and is not permanently stored by us. For signed-in users, we keep a per-day counter of AI requests on the server in order to enforce fair-use limits. Please do not upload photos showing personal or sensitive content. Legal basis: Art. 6(1)(a)/(b) GDPR (your consent through active use of the feature, or performance of the contract). Provider: Anthropic PBC (USA).

8. Training Reminders (Push Notifications)

If you enable training reminders, your browser creates a push subscription (a device-specific endpoint plus encryption keys) which we store at Supabase together with your account and language so that we can send you reminder notifications via your browser’s push service. Your active training program may be mirrored to the server so that a scheduled job can compose the reminder. You can withdraw this at any time by disabling notifications in your browser or operating system. Legal basis: Art. 6(1)(a) GDPR (your consent via the notification permission).

9. Contacting Us & Emails

If you contact us via the contact form or by email, we process the data you provide (name, email address, message content) solely to handle your enquiry. Messages and transactional emails (e.g. the subscription confirmation) are sent over our SMTP mail server. Legal basis: Art. 6(1)(b) or (f) GDPR. Mail provider (also for sign-in codes and password emails): Greenmark IT GmbH (do.de), Leinstraße 3, 31061 Alfeld (Leine), Germany, as our processor. Emails are stored in the mailbox for as long as needed to handle the enquiry and then deleted, unless statutory retention obligations apply.

10. Hosting & Server Logs (Vercel)

The application is hosted by Vercel Inc. When you access the site, technically necessary server logs (e.g. IP address, time, user agent) may be generated, serving security and stability. Legal basis: Art. 6(1)(f) GDPR. Vercel acts as our processor under its data processing agreement (DPA); server logs are kept only briefly.

To prevent abuse of the AI features, we additionally store a salted one-way hash of your IP address together with a daily usage counter. It cannot be converted back into your IP address and is deleted after 7 days. When you accept the training disclaimer, we store proof of your acceptance (version, time, language, text, a random device ID, the user agent and, if you are signed in, your email address). If you delete your account, the email address, device ID and user agent are removed from this record; only the anonymous proof remains. Legal basis: Art. 6(1)(f) GDPR (protection against abuse, documentation of the acceptance).

11. Cookies & Tracking

Kalouri sets no advertising or tracking cookies and does not embed any third-party analytics services. When you sign in, a technically necessary session cookie / token is set to keep you authenticated; without it the login cannot work. Legal basis: Art. 6(1)(f) GDPR (technically necessary).

12. Data Transfers to Third Countries

Some of the providers we use may process data outside the EU/EEA, in particular in the USA: Supabase (company based in the USA; data stored in Frankfurt), Stripe (payments; contracting entity in Ireland), Anthropic (photo recognition) and Vercel (hosting). Open Food Facts (food search) is based in France. Where data is transferred to a third country, this is based on appropriate safeguards pursuant to Art. 44 et seq. GDPR — in particular the EU Standard Contractual Clauses (SCCs) and/or, where available, certification under the EU-US Data Privacy Framework. Only the data required for the respective feature is transmitted. The SCCs are part of the providers’ data processing agreements.

13. Retention & Deletion

We keep account data for as long as your account exists. If you delete your account, the data tied to it (diary, training, profile, daily goal, exercise library, push subscriptions) is deleted along with it. Data we are legally required to keep — in particular billing and tax records related to your subscription — is retained for the applicable statutory periods (six years, see section 5); these records are held by Stripe, not in our app database. You can delete your account yourself at any time in the app (menu → “Delete account”); a running subscription is cancelled at the same time. Alternatively, contact support@kalouri.com. Data stored only on your device (localStorage) can be removed at any time by clearing your browser data.

14. Your Rights

You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future. You may also lodge a complaint with a data protection supervisory authority. To exercise your rights, contact support@kalouri.com.

15. Data Protection Officer

A data protection officer is not legally required and has not been appointed. Privacy enquiries: support@kalouri.com

Last updated: October 2026. This policy does not replace individual legal advice.