Privacy

1. Controller

Giuliano Vendra – INNR SOUL
Amselweg 28, 55126 Mainz, Germany
Email: support@progresskcal.com

2. Data on your device

The app stores what you enter locally on your iPhone: meals and nutrition values, your own foods, saved meals and recipes, water, weight, goals and the details used to calculate your goal (sex, age, height, weight, activity). This data is not transferred to me. There is no syncing via iCloud or a server of my own.

If you delete the app or choose “Delete all data” in the app’s settings, this data is removed from your iPhone. Data in Apple Health and your subscription with Apple are not affected. If iCloud Backup is turned on for your iPhone, the data may be part of that backup; Apple’s privacy policy applies to it.

3. Apple Health

If you allow it, the app reads the following data from Apple Health: active energy, steps, workouts (type, start and end, duration, energy, distance, recording device) and your heart rate during workouts. During setup it can also take over your height, weight, date of birth and sex to calculate your calorie goal. The app does not write any data to Apple Health.

This data is only processed on your device. It is not transferred to me or to third parties and is not used for advertising.

The legal basis is your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR). You can withdraw access at any time in the Health app or in your iPhone settings.

4. Food search and barcodes (Open Food Facts)

When you search for a food or scan a barcode, the app sends the search term (together with the app’s language) or the barcode number to Open Food Facts to retrieve the nutrition values. Open Food Facts is a non-profit association based in France.

For technical reasons your IP address is transmitted, as well as the app’s name and version and my contact address (as Open Food Facts asks of apps). No other personal data is sent.

The legal basis is providing the feature you use (Art. 6(1)(b) GDPR). Open Food Facts’ privacy policy: https://world.openfoodfacts.org/privacy

The app does not query any other food database online. The German Nutrient Database (Bundeslebensmittelschlüssel, Max Rubner-Institut) is fully built into the app and searched offline. When you photograph a nutrition label (label scanner or editor), iOS text recognition reads it directly on your iPhone; the photo is not uploaded for this.

5. AI photo (Premium)

With the AI photo you can have a photo of your meal estimated. The feature is available from age 16: if an age under 16 is entered in the app, it takes no photo, does not ask for consent and sends nothing. The app only uses this feature after you have explicitly consented in the app. You can withdraw your consent at any time in the app’s settings (Settings → Privacy → “Food photo (AI)”).

How it works:

• The app downsizes the photo (1024 pixels at most), removes metadata such as the location and sends it encrypted to my server. Apart from the photo, only the app’s language and the proof of purchase (see below) are sent.
• The server runs on Cloudflare, Inc. (USA).
• The server forwards the photo to Google Gemini (Google) for recognition. If Google does not respond in time or returns an error, it uses Claude (Anthropic, PBC, USA) instead.
• The app also sends the Apple-signed proof of purchase of your Premium subscription. The server uses it to check whether Premium is active and to count usage for the usage limit (20 photos a day, 250 a month). For this it only stores the current day and month and the number of photos in them. It does not store the subscription number assigned by Apple (original transaction ID) in plain text, only as a hash (SHA-256 with a secret key), from which the number cannot be worked out. The subscription number contains neither your name nor your Apple ID anyway. If the AI photo is not used for 60 days, the server deletes the counter automatically.

Photos are not stored on my server. For each request the server only logs technical details (result, error code, duration, responding provider, size of the request) – no photos, no IP addresses and no proofs of purchase. Under their terms for the paid API, Google and Anthropic do not use the photos to train their models. Both may store requests for a limited time to detect abuse.

Because photos of meals may allow conclusions about your diet and health, the legal basis is your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR).

Transfers to the USA are based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

6. Purchases and subscriptions

Purchases and subscriptions are handled by Apple through the App Store. I do not receive any payment data. The app only receives information about the purchase from Apple (e.g. which subscription is active) in order to unlock Premium.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). Apple’s privacy policy also applies: https://www.apple.com/legal/privacy/

7. Notifications

Reminders are scheduled as local notifications on your iPhone. No data is sent to a server for this; the app does not use server-based push notifications.

8. Crash reports

If you have turned on “Share with App Developers” in your iPhone settings, Apple provides me with anonymised crash reports and usage statistics. The legal basis is your consent given to Apple (Art. 6(1)(a) GDPR).

9. This website

This website is hosted by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). When you visit it, Cloudflare processes technically necessary data such as your IP address, time, page requested and browser information in order to deliver the site and protect it against attacks.

The legal basis is my legitimate interest in secure operation (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework.

The website sets no cookies and uses no analytics or tracking services. Fonts are loaded from this website, not from Google.

10. Contact by email

If you write to me, I process your email address and the content of your message in order to reply. Emails to support@progresskcal.com are forwarded via Cloudflare Email Routing to my mailbox at Google (Gmail).

From the app you can write to me via “Send feedback” and “Report details”. You send the email yourself with your mail app. “Send feedback” adds the app and iOS version. “Report details” contains the reported nutrition values, the product’s name, brand and barcode and the photo of the nutrition label, and a photo of the front if you choose.

The legal basis is Art. 6(1)(b) or (f) GDPR. I delete the message once it is no longer needed and no statutory retention obligations apply.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Since your entries are only stored on your device, you can exercise most of these rights directly in the app. For anything else, write to support@progresskcal.com.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany.

12. Changes

I update this privacy policy when the app or the legal situation changes. The version published here applies.