Privacy policy

Last updated 21 October 2026

CheckCal is made by Dobreon sp. z o.o., a company registered in Poland, which is the controller of the personal data described here. Write to support@dobreon.com about anything on this page.

The short version: everything in CheckCal works without an account, reading photographs included. Without one, what leaves your phone is a photo or a meal in words you ask CheckCal to read (after you have agreed to that), a barcode or a search you look up, the proof of your subscription, and whether an Apple Ads ad brought you to the app. With an account, your diary is also kept in our database so it follows you to a new phone, and you can write to us in the app and read our replies there.

Without an account

Your day, your meals, weight, workouts, water, targets, scores, reports and Apple Health all live on your phone and work with no account at all. Nothing about them is sent to us.

Three things leave the phone only when you use them:

• A photo, or a meal you describe in words, that you ask CheckCal to read, and only once you have agreed (see Meal photographs, words and AI).
• A barcode you scan or words you search for, which go to Open Food Facts (see Barcodes).
• The proof of your subscription, which Apple signs and our server checks before a photo is read (see Subscriptions).

And one says how CheckCal itself is doing, never anything about you: which Apple Ads ad, if any, brought you to the app, asked of Apple once after you install it (see Apple Ads).

Signing in is optional

An account does two things: it keeps a copy of your diary so it reaches your other devices and survives a new phone, and it lets you chat with us in the app, because a reply needs somewhere to find you (see Writing to us in the app). Nothing else in the app needs one, and you can always write to support@dobreon.com instead.

We use Firebase Authentication, which is Google, to handle signing in. You can sign in with Apple, with Google, or with an email address and a password. Apple and Google sign-ins involve no password at all. An email account has one, and we never see it: the app hands it to Firebase, which stores only a salted hash, and a forgotten one is reset by a link Firebase emails you. What Firebase holds is your email address, your name if Apple or Google passed it on, the identifier the provider gives us or the password hash, and the times you signed in. Signing in with Google tells Google that you use CheckCal; we receive your email address and name from them and nothing else. If you use Apple's Hide My Email, the only address we ever see is the relay one Apple gives us.

You can sign out in the app under You. Your diary stays on the phone and stops syncing.

What syncing stores, and where

With an account, your diary is kept in Cloud Firestore, Google's database, so it can reach your other devices. That is:

• What you log: foods, portions, meals, water, the workouts you log, your weigh-ins (including the ones that came in from Apple Health), your saved meals, and the targets each day was measured against.
• Your profile from the opening questions: sex for the calorie formula, date of birth, height, weight, activity, goal and eating style.

The database is in Frankfurt, in the European Union. Your diary is stored underneath your account's identifier, and security rules refuse any read or write that crosses from one account into another.

Photographs are not synced and are never stored on our side: the only lasting copy is on your phone.

When you delete something, it is marked deleted rather than removed outright, so the deletion reaches your other devices instead of the item coming back from one of them. The marked item stays in the database until you delete your account.

Meal photographs, words and AI

Reading a meal or a nutrition label from a photograph (or a meal you describe in words, such as “omelette with chicken”) is done by an AI model: Google's, through its Gemini API, and (for one Google's model does not read) Apple's, on its Private Cloud Compute. Before the first photo or description is sent, the app asks whether you agree, and says the same things this section says. You can turn it off at any time in the app under You › Privacy. While it is off, nothing is sent anywhere; a photo you take or a meal you describe meanwhile waits on your phone and is read only once you turn it back on. Adding food by hand, with the figures, never uses AI.

• What is sent: the photo, made smaller (about 1,000 pixels on its longer side) and re-encoded, so it carries no location or other photo data. For a meal you describe instead, the words as they stand in the box, typed or said (see Your voice). If you correct a reading in your own words with Fix something, your words and the list of foods and grams on that plate go with it. With each, the language the app is in, so the names come back in it. Nothing else: not your name, your body or your diary.
• How it travels: from the app to our server, which forwards it to Google and returns the answer. When Google's model does not read it (the day's 30 readings on it are used, or our server or Google is not answering) and your iPhone supports Apple Intelligence, the app sends it straight to Apple's Private Cloud Compute instead. That way it never passes through our server.
• What our server keeps: neither the photo, nor your words, nor the answer. It holds them in memory for the length of the request. What we log is operational only (which model answered, how long it took, how many items came back, whether it was food, whether it was a photo or words, and the app's language), next to the account identifier or subscription number it was for.
• What Google does with it: it reads it under its paid API terms, which do not allow the data to be used to train its models. Google may keep it for a limited time to detect abuse, and it may be processed outside the European Economic Area, including in the United States.
• What Apple does with it: Private Cloud Compute uses it only to answer that one request and does not keep it, and Apple publishes the software that runs there so that independent researchers can check this. It may be processed outside the European Economic Area, including in the United States.
• No other AI: photos and words go to Google's model or Apple's and no other. If that ever changes, the app will ask you again first.
• The copy on your phone stays in the app's own storage and goes when you delete the meal.
• The legal basis is your consent, which you can withdraw in the app at any time.

CheckCal has no access to your photo library. When you choose a photo, the system's picker hands the app that one photo and nothing else. Saving a photo or a share card to your library asks for permission to add to it, not to read it.

Your voice

In «What did you eat?» and «Fix something» you can say the words instead of typing them. The microphone is used only while you have it on, and only after you allow it when iOS asks. Typing always works without it.

• Speech becomes text on your iPhone. On iOS 26 and later, Apple's speech recognition on the phone turns what you say into text, which appears in the box for you to check and change. Only that text is sent, as described above. The recording is not sent anywhere and is not kept.
• Except for a language your iPhone cannot recognise on its own. For such a language (this can include Polish), Apple's speech recognition does the same on Apple's servers. iOS asks your permission for that first and says the speech goes to Apple, which handles it under its own privacy policy for Siri and Dictation. CheckCal and our server never receive the recording, only the text.
• The legal basis is your consent: the microphone and speech recognition permissions, which you can withdraw at any time in the iPhone's Settings.

Counting photographs and words

Each photograph or meal in words Google's model reads costs us money, so our server counts them: there is a limit of 30 a day, photographs and words together, and a limit on how fast they can be asked for. On an iPhone that supports Apple Intelligence, photographs past the daily limit are read by Apple's model instead; those never reach our server and are not counted here. The count is kept per account when you are signed in, and per subscription when you are not. It holds how many photos were read today, how many were refused and why, the times of the last few, and a running total. Nothing about the photos or the food.

• An account's count is stored under the account and goes with it when you delete the account.
• A subscription's count is stored under the subscription's transaction number, which Apple assigns and which names nobody. It is deleted automatically 90 days after the last photograph.
• The first time in a day that an account or a subscription reaches the limit, our server sends us an email through Resend, an email service, with that identifier and the limit. Nothing else is in it.

Proving the app is the app

Before a photo is read or you sign in, the server checks that the request comes from CheckCal, unmodified, on a real device. It uses Apple's App Attest: your phone's secure hardware signs a statement, Apple and then Google's App Check confirm it, and our server sees only a yes or a no. It carries nothing about you or your food, no advertising identifier, and it cannot be used to recognise you across apps.

Subscriptions

Subscriptions are sold and processed by Apple. We never see your card or your Apple Account. What our server sees is the transaction Apple signs, which the app sends with each photo so the server can check the subscription rather than take the app's word. The server records which subscription it is and when it runs out. When you are signed in, it also records which account the subscription belongs to; that record goes when you delete the account.

Apple Ads

We advertise CheckCal in the App Store with Apple Ads, and we want to know which of those ads bring people who go on to subscribe, so we stop paying for the ones that do not. For that we use Apple's own attribution, AdServices, which needs no advertising identifier and no permission to track you, because it does not track you across apps or websites.

• What is sent: once, in the first day after you install the app, it asks Apple's AdServices for a token and sends it to our server, which asks Apple what it means. Apple answers whether an Apple Ads ad brought you, and if so which campaign, ad group, keyword and ad, the country or region the campaign ran in, and when the ad was tapped or seen.
• What our server keeps: that answer, next to a random number the app made when it was installed. The number is not your account, not a device identifier and not your Apple Account, and your phone forgets it when the app is deleted. If you subscribe, the subscription's transaction number, which Apple assigns and which names nobody, is kept beside it, so we can count how many people each ad brought went on to pay. Whether a subscription was paid for is asked of Apple when we count, not kept.
• Nothing else: no name, no email, nothing you log, no photo. A subscription somebody else bought for you is not counted against your ad.
• Where and how long: in the same database in Frankfurt, deleted automatically 400 days after the install.
• The legal basis is our legitimate interest in knowing which of our ads work. You can object by writing to support@dobreon.com.

Barcodes and the food database

Scanning a barcode sends the number, and searching the food database sends the words you type, to Open Food Facts, a free public food database run by a French non-profit on servers in the European Union. Nothing else is sent and no account is needed.

Apple Health

Apple Health is used only if you allow it, in the Health permission sheet, and you can change what CheckCal may read and write at any time in the Health app.

• Read: your steps, active energy, workouts and weigh-ins. Steps, active energy and workouts are read on your phone when the day is shown and are not stored or sent anywhere. Weigh-ins that come in from Apple Health are kept in your diary, so they sync to your account like everything else you log when you are signed in.
• Written: a weigh-in you type into CheckCal, so both apps show the same weight. Food and calories are never written to Apple Health.
• Health data is never sent to the AI, never used for advertising or marketing, and never shared with anyone.

Writing to us in the app

Signed in, you can write to the people who make CheckCal under You › Chat with us, and our replies appear there. Before your first message, the app asks whether you agree to what this section says, and there is nowhere to type until you do.

• What is sent: the words you send. With your first message, and again when one of them changes, the app adds the app's version and build, your iPhone's model, the iOS version, the app's language and your plan (free, monthly or yearly), so we do not have to ask. Never your name, your email address, your diary or anything else you have not written in a message.
• Where it is kept: in the same database in Frankfurt, under your account, so the conversation reaches your other devices; a copy stays on your phone. Beside it we keep when you agreed and to which wording, as the record of your consent.
• Who reads it: the people who make CheckCal, in Slack, where each conversation is a thread in our private support channel. Slack keeps the messages there for us under its data processing agreement. You do not need to tell us anything about your health to get help; if you do, we use it only to answer you.
• How long: until you delete your account, which deletes the conversation from our database and from Slack, or until you ask us to delete it.
• Limits: to stop the chat being misused, our server counts how many messages each account sends in a day. The count holds numbers and times, nothing you wrote.
• The legal basis is answering what you asked us, which is part of providing the app to you. What you tell us about your health is a special category of data, and for that the basis is your explicit consent (Article 9(2)(a) GDPR), which you give in the app before your first message by tapping Agree and write. You can withdraw it at any time by asking us, in the chat or at support@dobreon.com, to delete the conversation, or by deleting your account. Withdrawing does not affect what we did before.

The app has no notifications for replies yet: it looks for them while the chat is open and when you come back to the app.

Who else handles your data

• Google, through Firebase: signing in, the database in Frankfurt, and App Check; through the Gemini API: reading photos and meals in words, as described above.
• Vercel hosts our server in the United States. It records the technical details of each request (IP address, time, size, status) for security, and keeps our server's logs for a short time.
• Resend delivers the limit emails described above.
• Slack carries the support chat to the people who answer it, as described above.
• Apple handles Sign in with Apple, App Attest, the App Store and Apple Ads attribution under its own privacy policy, reads on Private Cloud Compute the photos and words Google's model does not, and turns speech into text on its servers for a language your iPhone cannot recognise itself, as described above.

Each company that processes data for us is bound by an agreement to protect it at least as well as this policy does and to use it only to provide its service to us. Google, Vercel, Resend and Slack are United States companies, so reading a photo, signing in, the limit emails and the support chat involve transfers outside the European Economic Area; those rest on the European Commission's standard contractual clauses. A photo read by Apple may also be processed in the United States.

What we never collect

There is no analytics SDK, no crash reporter, no advertising identifier and no third-party tracker of any kind in the app. The Apple Ads answer above is Apple's, about an ad, not about you. Nothing you log is sold, shared with advertisers or used to build a profile of you, and we do not use your diary to train anything.

Children

CheckCal is not intended for children. The opening questions do not accept a date of birth under 13 years ago, and a plan to lose weight is offered only from 18 and never to somebody already under a healthy weight.

Your rights, and deleting everything

Under the GDPR you have the right of access, rectification, erasure, restriction, portability and objection, and you can withdraw consent at any time.

• Delete your account in the app under You › Delete account and data. To be sure it is you, you sign in once more; then your records are removed from the database, along with any conversation with us in the app and its copy in Slack, Sign in with Apple's access is revoked, your identity is removed from Firebase, and everything on the phone is erased. It happens when you tap it and cannot be undone.
• Without an account, You › Erase all data on this phone erases everything the app holds. We hold nothing about you beyond the anonymous photo count and the install's Apple Ads answer described above.
• Withdraw your consent to AI reading under You › Privacy.
• For access, correction or a copy of your data, use You › Export my data or write to support@dobreon.com; we answer within one month.

You may also complain to a supervisory authority. In Poland that is the Urząd Ochrony Danych Osobowych.

Changes

If this policy changes in a way that affects what is sent or kept, we will update the date at the top and describe the change here before the version of the app that makes it ships.