Privacy in Caloplate

What happens to your meal photo

When you photograph a meal, the image is downscaled and transmitted via the BUILDFrame service to an AI service provider (Google, image model Gemini), where an image model evaluates what is on the plate. The result returns to your phone the same way.

Service providers working on our behalf are involved: a hosting provider (Netlify) that operates the BUILDFrame service, receives the photo and passes it on, an intermediary for AI requests (OpenRouter; both based in the USA) and the operator of the image model (Google). In the process, the photo may pass through servers in the USA. This transfer is safeguarded: through the EU-U.S. Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses. Anyone who wants to know the recipients in detail and receive a copy of the safeguards can write to info@buildframe.de.

The photo leaves your device in the process. We do not claim otherwise.

Nothing that identifies you is sent with the image: no name, no email address, no device identifier, no advertising ID, no location. The request consists of the image and nothing else.

The image model itself runs in data centers in the European Union. This route is fixed: if it fails, you get an error message — there is no silent fallback to another country.

What stays on your device

Caloplate reads barcodes and nutrition tables on your device — with Apple’s Vision framework. In these two cases no image leaves your phone, whether or not you have allowed the analysis. For a barcode, however, the digits that were read do go out; see “What happens with barcodes and product search” below.

Your name (if you enter it), your diary, your body data, your plan, your weight history, your progress photos, your profile picture and your settings are stored only in the app’s storage on your device. Caloplate does not transmit them. Like the data of any app, they can be part of a backup of your device (iCloud or computer); you control that with Apple.

For every meal you photograph, Caloplate stores a downscaled copy of the photo on your device so you can recognize it in “Today” and in your history. This copy is not transmitted and is deleted together with the meal.

From Apple Health, Caloplate reads only what you allow (see “Health”). These values stay on the device.

If you use the widget, it receives the day’s totals (calories and water) through Apple’s mechanisms on the same device. This does not go through us.

If you use the Apple Watch, the watch app shows the day’s totals (calories, macros, water, workouts) and sends the water you drink and your workouts to your iPhone. This goes directly between the watch and the iPhone through Apple’s connection, not through us. If you allow it, the watch measures your heart rate during a workout and shows it to you – it is not stored, not sent to the iPhone or to us, and not written to Apple Health. The watch keeps no diary; it holds only the last totals it received and the workout that is currently running.

When needed, Caloplate translates food names with Apple’s translation feature on the device and remembers the results on the device.

A short technical trace of your latest analyses (times, kinds of errors, most recently read barcodes) also stays on the device and is not transmitted.

The free allowance — three photo analyses, five days — is remembered on your device in the keychain: two counters and two points in time (your first start and the last time seen), with no name, no identifier and no server. This marker also stays after you delete the app and after “Delete all data”, so that the free allowance does not start over every time. It does not move to another device and is not transmitted.

How long the image is stored

The BUILDFrame service does not store your photo. It receives it, passes it on to the analysis and returns the result; after that, it is gone.

Every request carries two conditions for the providers: your data must not be used to train models, and it must not be stored (zero data retention). If a provider cannot commit to this, the request is refused rather than quietly relaxed.

The privacy terms of the service providers involved apply in addition to this text.

What we log for cost control

For each analysis we record: the time, the model used, the number of tokens, the image size in bytes, the duration and, in case of an error, its type. This serves exclusively to keep an eye on costs and errors. These entries are held in the logs of our hosting provider and are deleted there automatically after 7 days at most.

Not logged: the image, the result, recognized foods and your sender address. Your IP address is used only transiently and in hashed form to limit the number of requests; it is neither stored nor passed on.

Every request also carries an identifier of the app version that is the same for all installations. It only shows that the request comes from the genuine Caloplate app and says nothing about you.

What happens with barcodes and product search

When you scan a barcode, Caloplate reads the digits on your device — and uses them to ask the public product database Open Food Facts what is known about that code. The digits leave your phone for that.

Along with them goes an identifier saying the request comes from Caloplate. It says nothing about who you are.

The photo of the barcode stays on the device. Open Food Facts is a non-profit project in France, so inside the EU; how long it logs requests is decided by Open Food Facts and not by us.

If you would rather send no digits, enter nutrition values by hand — that works without any transmission.

If you type a term of at least three characters into the search, Caloplate additionally asks Open Food Facts for matching branded products. For this too, the search term leaves your phone, likewise only with the identifier that the request comes from Caloplate. If you do not want to send search terms, pick foods from the lists or enter nutrition values by hand.

If you buy Caloplate Pro

A subscription runs entirely through Apple. Caloplate sees no payment data, no card number and no billing address — Apple gets those, not us.

Whether your subscription is active is something the app asks Apple — at start and when you retrieve it. We store nothing about it on a server.

Caloplate keeps no proof of purchase of its own. Whether a subscription is active is answered by Apple alone — from a signed receipt that the system manages on your device. Caloplate reads it and remembers on the device only the last result (active or not, and until when), so the app does not have to wait for Apple at start.

If you do not want this

You can withdraw the analysis at any time. The withdrawal takes effect immediately: after that, no photo leaves your device any more.

Caloplate remains usable afterwards: barcode, nutrition label and everything you enter by hand keep working.

What Caloplate does not do

No ad network. No tracking across apps. No disclosure of your data to third parties for their own purposes and no sale. The transmissions described in this text (photo to the analysis, barcode digits and search terms to Open Food Facts) serve only what you trigger in the app. No profiling of you.

Health

Caloplate estimates. Every number is an estimate. Caloplate is not a medical device and does not replace advice from a doctor or a nutrition specialist.

Apple Health: only if you allow it, Caloplate reads steps, active energy and the time spans of your workouts (when they ran, not which exercises) — to show you your movement, to raise your daily goal if you wish, and to avoid counting a sport you entered by hand twice. During setup, Caloplate also reads your height, weight, birth year and sex if you wish, to pre-fill your details. Caloplate writes nothing to Apple Health. These values stay on your device and are not transmitted. What Caloplate may read, you control at any time in the iOS settings. On the watch, Caloplate reads your heart rate during a workout if you allow it – for display only, without storing it.

Health data is specially protected under Art. 9 GDPR. Caloplate processes it only on the basis of your consent and only on your device.

Who is responsible

The controller for processing your data is Alessandro Gerola. You can reach us at info@buildframe.de.

The full address and all further provider details are in the legal notice.

On what legal basis

We process the photo analysis based on your consent (Art. 6(1)(a) GDPR). You give it before the first photo leaves the device, and you can withdraw it at any time in settings. The withdrawal applies from the moment you declare it; what was processed before remains unaffected.

We base the barcode lookup, the product search and the handling of a subscription on the performance of the contract with you (Art. 6(1)(b) GDPR).

We base the cost control and the marker of the free allowance on our legitimate interest in being able to operate the service and protect it from misuse (Art. 6(1)(f) GDPR).

We process data from Apple Health on the basis of your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR). You give it in the iOS system dialog and can withdraw it there at any time.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interest.

Most of it you can do yourself, without asking us: your diary, your body data, your photos and your history are on your device. Delete a meal in the app and its photo goes with it. With “Delete all data” in the profile you remove everything Caloplate has stored on the device — diary, body data, photos, profile picture, backups and exports. Excepted are the language choice, the subscription status last reported by Apple and the marker of the free allowance. If you delete the app, everything goes with it — except this marker, which stays in the keychain.

For anything else write to info@buildframe.de.

You also have the right to lodge a complaint with a data protection authority — the competent authority is the one at your place of residence, your place of work or the place where you suspect an infringement.