Privacy Policy

Last updated: October 20, 2026

This Privacy Policy explains what information AI Calorie Camera ("the App," "we," "us") collects, how we use it, and the choices you have. The App is operated by Stellandra, the trading name of Qinqin Zhang, who is responsible for your personal data. You can reach us at support@stellandra.com.

Information We Collect

We collect only what the App needs to work. You can start using the App as an anonymous account, in which case we do not collect your email or name.

Account information: your email address and display name, and — if you sign in with Apple or Google — the identifier returned by that provider. Anonymous accounts have none of these until you choose to register or upgrade.
Health & nutrition data: your meal logs (food name, calories, protein, carbs, fat, fiber, sugar, sodium, meal type, serving size, date, and — when the AI or you list them — the foods in the meal and their weight in grams), including any corrections you make to an AI estimate, which we use to improve future estimates for you; your weight records; your fasting records (start time, end time, and target duration); the exercise you log by hand (type, minutes, calories burned, and date); your diet restrictions (allergies or foods you avoid, and any ingredients you add to watch for); and your body profile and goals (sex, date of birth, height, activity level, goal, target weight, weekly goal). You enter your meals, fasts, exercise and profile yourself. Your weight is entered by you, imported from Apple Health if you turn on weight sync — see "Apple Health" below — or imported from a MyFitnessPal export file if you choose to.
Food photos: when you scan a meal, the photo is sent for real-time AI analysis and is not stored by us — see "How Your Food Photos Are Handled" below. If you turn on meal-photo sharing with a partner, a smaller copy of the photo is stored for 7 days — see "Sharing With a Partner" below.
Partner sharing: if you connect with a partner, we keep the connection, what you choose to share, the name you choose to show your partner, any nickname or label you give your partner, and any block or report — see "Sharing With a Partner" below.
AI coach: your conversation with the coach, the notes it remembers about you if memory is on, your coach profile (the picture you chose from our preset illustrations, the name you gave the coach, and the name you asked it to call you), and the meal plans it makes for you — see "AI Coach" below.
Usage counters: the number of AI scans and coach messages you use per day, used to enforce free-tier limits and your subscription entitlement.
Subscription status: whether you have an active subscription, managed through RevenueCat and the App Store.
Device identifier: a random identifier the App generates on your device the first time you open it (not your hardware ID, not an advertising ID), used to limit abuse of the free tier, to measure how the App is used, and to link the Apple Watch app to your iPhone — see "Device Identifier" below.
Technical settings: your time zone (to calculate your daily totals correctly), language, and unit preference.

How We Use Your Information

To recognize food and estimate nutrition, and to transcribe the numbers printed on a nutrition facts panel you photograph.
To track your meals, weight, exercise and fasting, and to generate your reports, streaks, and badges.
To calculate your calorie and macro targets from your profile.
To run the AI coach: answer your messages using your own records, draft meals and meal plans for you to confirm, and remember the notes you allow it to keep.
To show the items you choose to a partner you connect with.
To manage your account, sign-in, and subscription; to enforce free-tier limits and prevent abuse of our AI services; and to send you a password-reset email if you request one.
With your permission, to send you reminder notifications. These are scheduled locally on your device; you can turn them off at any time in your device settings.

We do not show ads in the App, and we do not use advertising identifiers or cross-app tracking. We do not ask for App Tracking Transparency permission for advertising. We do not use your health data for advertising or marketing.

How Your Food Photos Are Handled

When you scan a meal, your photo is sent to Google (Gemini AI) for real-time analysis to identify the food and estimate its nutrition. The image itself is processed in the moment and is not stored by us — we do not save the photos you scan to our servers or any file storage. (The one exception is a separate, smaller copy that is stored only if you choose to share meal photos with a partner — see "Sharing With a Partner.") To keep AI costs down, our server keeps a one-way fingerprint (a SHA-256 hash) of the image together with the nutrition result for up to 30 days; this fingerprint cannot be turned back into your photo and is not linked to your account. Only the nutrition values you choose to save are kept with your meal log.

So that you can look at a meal again, the App keeps a copy of the scanned photo on your device only, for 30 days, and a small thumbnail after that. These copies are never uploaded to us.

How Your Nutrition Label Photos Are Handled

When you photograph a packaged food's Nutrition Facts panel, the photo is sent to Google (Gemini AI) to transcribe the numbers printed on it — it only copies what is printed and does not estimate a value that isn't there. The photo is processed in the moment and is not stored by us in any form: unlike a scanned meal photo, we do not keep even a one-way fingerprint of it. Only the numbers you review and choose to save are kept with your meal log.

AI Coach

The AI coach is an AI, not a person. It answers questions about your food, weight and exercise using your own records, and it can draft meals and meal plans for you to confirm. Coach answers are AI-generated, may be wrong, and are not medical advice.

Who can use it. The coach is only for people 18 and older. Before you first open it, the App asks for your year and month of birth (unless you have already confirmed them) and saves them to your profile. If your profile says you are under 18, or has no date of birth, the coach does not answer.

Your agreement. Before the coach first sends anything, the App shows what is sent and asks for your agreement.

Voice. If you hold the microphone button to talk instead of typing, what you say is turned into text on your iPhone; the audio is not saved or sent anywhere, and only the text you choose to send leaves your iPhone.

What is sent to Google (Gemini AI). When you chat with the coach: your message and up to your last 10 exchanges with it; your profile (sex, age — not your date of birth — height, activity level, goal, target weight, weekly goal, and daily targets); the weights you entered yourself, including your latest one; your meals today and in the last 7 days and your daily totals for the last 30 days; any other day or weight period the coach looks up to answer you; the notes it remembers about you; and the name you asked it to call you. When the coach saves a note, that note is also checked by Google's AI to make sure it is not health information. When you describe a meal in a sentence: that sentence. When you ask for a meal plan or swap a dish: your daily targets, the names of foods you logged in the last 7 days, any preferences you type, the ingredients on your diet-restrictions list (without saying why you avoid them), and your app language. Your email, your account ID, and any data from Apple Health are never sent to Google.

Your health information. Your weight, body profile, meals and diet restrictions are health information. We use them in the coach only to answer you and to make the meals and plans you ask for. We do not use them for advertising or marketing, and we do not sell them.

What we keep. Your conversation — your messages, with email addresses, links and long numbers removed, and the coach's replies — is stored with your account for 90 days and then deleted automatically. A copy of your messages, with the same details removed, is kept for the same 90 days; we read these only to see how well the coach answers and to improve the App. Your current meal plan is kept with your account; when you make a new plan, the old one is deleted 28 days later.

Things the coach remembers. If memory is on, the coach saves short notes you tell it — your routine, food you like or dislike, what you are working towards, your situation (for example, travelling for work), and what to call you. It keeps up to 30 notes, each a sentence long, until you delete them or turn memory off; a note about something temporary stops being used after the date it ends. It does not save notes about illnesses, symptoms, medicines, procedures, doctor visits, pregnancy or eating disorders; allergies and foods you avoid go to your diet-restrictions list instead, which you confirm yourself. You can see, edit and delete every note in the coach profile. Turning memory off means the coach no longer reads or saves notes.

On your phone. The last 7 days of your conversation and your coach profile are also kept on your phone, so you can see them when you are offline. Clearing your chat removes the conversation from your phone too, and everything is removed from your phone when you sign out, delete your account, or switch accounts.

Your choices. You can stop using the coach at any time. Clear chat in the coach profile deletes your conversation (and, if you choose, the notes too). Profile › Delete my coach questions deletes your conversation and the copies of your messages. All of it is erased if you delete your account.

Safety and crisis support. Questions about medical treatment, and messages that suggest a risk to your health around eating, receive a fixed safety reply instead of an AI answer. If a message suggests you may be thinking about suicide or self-harm, or about hurting someone else, the coach does not write its own reply: it shows a fixed message with a crisis line and the emergency number for your region. This works even when you have used up your free messages and does not count against them. To spot these messages, we first check every message against a fixed list of phrases on our own servers; when our safety limits allow, the message is also checked by Google's AI. Each time a crisis message is shown, we record that it happened — the date, the language, the region, and which check caught it — but not the words you wrote. That record is kept with your account like other usage events and is erased if you delete your account. The message itself stays in your conversation like any other message, and is deleted after 90 days or when you clear it.

If your profile says you are under 18, the coach does not answer, but a message that matches our crisis phrases still gets the crisis message. That check happens only on our own servers: the message is not sent to Google or any other AI, and it is not stored. If your profile has no date of birth, a message is checked the same way and may also be checked by Google's AI for signs of crisis; it is not stored.

Read how this works in our Crisis Referral Protocol.

Sharing With a Partner

You can connect with one other person using an invite code. You must be at least 13, based on the date of birth in your profile. You choose which of these your partner sees, and you can change it at any time: your daily calories, your streak, your meals, your meal photos, and your weight change. You can also give your partner a nickname and a relationship label; these are kept with the connection.

The name your partner sees. Your partner sees the name you choose to show them. If you have not chosen one, they see your account name instead — the display name on your account. You can change the name your partner sees at any time in Sharing settings; changing it does not change your account name. Anyone who holds your invite code can see this name, and which items you are sharing, on the screen where they decide whether to connect — before they agree and before you are connected. An invite code works once and expires.

Meal photos. If you share meal photos, after you save a meal the App uploads a smaller copy of that photo. Before your partner can see it, our server sends that copy to Google (Gemini AI) to check that it shows food and no people, text, nudity or violence; if the check fails or cannot be completed, the photo is not shared. When you turn meal-photo sharing on, the App asks whether to also share your own meals from the last 7 days whose photos are still on your phone; only if you agree, it uploads those copies too. Meals older than 7 days are never shared. Shared copies are kept in our cloud storage for 7 days, and your partner sees them through links that expire after 5 minutes. A shared copy is deleted right away if you disconnect, block or report your partner, turn off photo sharing, or delete that meal.

Reports. If you report your partner, we keep the report (the reason, what was reported, and whether you also blocked them) and send it to our support inbox so we can review it. If either of you deletes your account, the connection ends, both of your shared photos are deleted, and your name is removed from any report.

Your partner can take screenshots of what you share, and we cannot take those back.

Apple Watch

The Apple Watch app shows how many calories you have left today and your 3 most recent foods, and can log one of them again. It gets this directly from our servers with a separate sign-in token that your iPhone gives it. That token can only do those two things, expires after 30 days, and stops working when you sign out on your iPhone. The Watch app does not use the camera, AI, or Apple Health, and collects no other data.

Third-Party Services

We share data only with the service providers that make the App function. We do not sell your data, and we do not share it for advertising.

Google (Gemini AI): receives your meal photo (for the moment of analysis); any food name or meal description you ask us to estimate, including a whole meal described in your own words; the Nutrition Facts panel photos you take; the coach information described in "AI Coach" above; and, if you share meal photos with a partner, the smaller shared copy for the safety check described in "Sharing With a Partner." Your email and account ID are not sent with any of these.
USDA FoodData Central: when our own food database doesn't have a food the coach or a meal plan needs, our server looks up the food's name in the US Department of Agriculture's public database. Only the food name is sent — nothing about you.
Open Food Facts: when you scan a barcode, our server looks that product number up in the Open Food Facts database. Only the barcode number leaves our server — not your account, your device identifier, or anything else about you. Product information comes back under the Open Database License (ODbL 1.0), and the App shows that notice next to any product it finds.
Google Firebase Authentication: verifies your sign-in when you use Sign in with Apple or Sign in with Google.
RevenueCat: manages subscriptions and verifies purchases. It receives our random account ID for you, not your email or health data. On iPhone it also receives Apple's ad-attribution token, which tells us whether the App was installed from an Apple Search Ads campaign.
Apple App Store: processes in-app purchases for subscriptions.
Resend: delivers transactional email — used only to send a password-reset link when you request one, and partner reports to our support inbox.
Cloudflare (R2 storage): stores the smaller meal-photo copies you choose to share with a partner, in a private bucket, until they are deleted as described in "Sharing With a Partner."
Railway: hosts our backend and database, acting as a processor on our behalf.

Device Identifier

The first time you open AI Calorie Camera, the App generates a random identifier (a version-4 UUID) and stores it in your device's secure storage. This happens whether you use an anonymous account or sign in with email, Apple, or Google; if the identifier is missing when you sign in, the App creates it then. The App sends it to our server for these purposes:

To keep one anonymous account per device, so the free AI-scan quota cannot be farmed by repeatedly creating new anonymous accounts.
To confirm that an anonymous account belongs to this device before its data is moved into the account you signed in with.
With the App's usage events (for example, opening the App), to measure how the App is used. When you are signed in, these events are also linked to your account.
If you use the Apple Watch app, to tie the Watch's sign-in token to this iPhone, so that the token can be cancelled if the App is reinstalled.

This identifier is not an advertising identifier, is not used for tracking across apps, and is not shared with any third party. Signing in, registering, or upgrading an anonymous account does not remove it.

Apple Health

If you grant permission, the App reads two kinds of data from Apple Health:

Workouts and active energy: used to show what you burned that day. This stays on your iPhone — it is not uploaded to our servers or sent to any AI.
Weight: only if you turn on weight sync from the weight page. We import your most recent daily weight sample from Apple Health and save it to your account, so your weight trend and calorie goal stay up to date. We do not read body fat percentage, BMI, or any other body measurement from Apple Health.

Weight imported from Apple Health is stored the same way as weight you enter by hand — see "Health & nutrition data" above — and is erased if you delete your account. It is never sent to Google (Gemini AI) or any other AI, and is not used for advertising. If you delete a day's imported weight in the App, that day will not be re-imported by a later sync.

Data Storage & Security

Your account and nutrition data are stored on our backend database (hosted on Railway), and shared partner photos are stored in our cloud storage. Passwords are never stored in plain text — they are protected using bcrypt hashing. Connections to our servers use encryption in transit (HTTPS). Your authentication tokens are kept in your device's secure storage. We retain your data while your account is active and delete it as described below when you delete your account.

Your Rights and Choices

You can do most of this yourself in the App:

Access and portability: view your data at any time, and export it from Profile.
Correct: edit your profile, meals, weight, exercise, diet restrictions and the coach's notes.
Delete: delete individual records, clear your coach conversation, or delete your account at any time via Profile › Delete Account (see below).
Withdraw consent: where we rely on your consent, you can withdraw it at any time, as easily as you gave it — for the coach, turn off memory and clear your chat in the coach profile, and stop using the coach. Withdrawing does not affect what we did before.

You also have the right to ask us to restrict how we use your data, and you can object at any time to our use of your data based on legitimate interests (see "Legal Bases" below). To use any of these rights, or if something can't be done in the App, email support@stellandra.com. We reply within one month.

Account Deletion & Data Retention

You can delete your account at any time via Profile › Delete Account. The App asks you to confirm first, and then the deletion is permanent — it cannot be undone. We do not deactivate the account or keep a copy you can restore.

Deleting your account erases these records from our database: your meal logs, including the corrections you made to AI estimates; your meal plans; your daily summaries; your weight records, including any imported from Apple Health or MyFitnessPal; your exercise records; your fasting records; your diet restrictions; your AI coach conversation, the copies of your messages, the notes the coach remembers and your coach profile; your body profile and goals; your partner connections, invites, blocks, sharing settings and shared photos; your streaks, badges, and usage counters; and the usage events recorded under your account and under the anonymous device identifier that preceded it. Your email address, display name, password, and Apple/Google sign-in identifiers are erased with them. If you signed in with Apple or Google, we also delete your user record at our authentication provider (Firebase) — unless that same sign-in is still in use by another Stellandra app account of yours, in which case we only detach it from this account. On your device, the meal-photo thumbnails are deleted and you are signed out. Because we do not store the food photos you scan on our servers, there are none to delete there; any shared partner photo copies are deleted with the account.

Four things are kept. None of them contains your meals, weight, or profile:

Purchase records. Your subscription record (product, store, billing period, status, price) and the raw purchase notifications RevenueCat sends us. These still carry your account identifier. We keep them because refunds, chargebacks, and billing disputes have to be answerable after the account is gone.
An emptied account row. The account row itself stays, with every personal field cleared — no email, no name, no password, no Apple or Google identifier, no device identifier — so the purchase records above still resolve and the identifier is never handed to anyone else.
A deletion record. The date of the deletion and how many rows were removed from each table. Numbers only.
Error reports. Any error or crash reports we had already recorded stay as operating records, with the account reference cleared.

If you would like assistance with deletion, contact us at support@stellandra.com.

Legal Bases

We use your personal data on these bases:

To provide the App and the features you choose to use — your account, logging, reports, the AI coach and its memory, partner sharing, and your subscription: because it is necessary to provide the service you asked for.
To keep the App secure, prevent abuse of the free tier, show crisis support, and understand and improve how the App and the coach work (usage events, and reading the copies of coach messages): our legitimate interests in running a safe, working and improving service. You can object to this.
Your health information, and anything you tell the coach that reveals your religious beliefs (for example, that you keep halal or kosher), when used by the AI coach: your explicit consent, which you give when you tap I agree on the coach screen. You can withdraw it as described above.
Purchase and billing records: to comply with legal obligations, and our legitimate interest in answering refunds and disputes.

You don't have to give us any personal data, but without your profile we can't calculate your targets, and without your meal logs the App can't track them.

If you are in the UK. The legal bases above are, under the UK GDPR, Article 6(1)(b), 6(1)(f), 9(2)(a) and 6(1)(c) respectively. If you are unhappy with how we use your data, please tell us first at support@stellandra.com; you also have the right to complain to the Information Commissioner's Office (ico.org.uk).

We Do Not Sell Your Data

We do not sell or rent your personal information to anyone, and we do not share it with advertisers.

Children's Privacy

AI Calorie Camera is a general wellness app rated for ages 9+ and is not directed to children. Fasting and the AI coach — including its memory — are only for people 18 and older, based on the date of birth in your profile; AI companion chatbots may not be suitable for some minors. Partner sharing requires you to be at least 13. We do not knowingly collect personal information from children under the age required by your local law. If you believe a child has provided us personal information, contact us and we will remove it.

Changes to This Policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date above, and if a change affects what the AI coach sends or keeps, the App will ask for your agreement again.

Contact Us

If you have questions about this Privacy Policy, contact us at support@stellandra.com.