Privacy Policy

Account Data

When registering and using the Kairo app, we collect the following data:

• Email address
• First and last name
• Profile picture (optional)
• Display name

This data is processed based on Art. 6(1)(b) GDPR for the performance of our contract with you.

Health and Biometric Data

To calculate your personal nutrition goals, we collect the following sensitive data:

• Biological sex
• Date of birth
• Height
• Current weight
• Target weight
• Activity level
• Fitness goal (lose weight, maintain, build muscle, gain weight)
• Desired rate of weight change

This health data falls under Art. 9(1) GDPR (special categories of personal data). Processing is based exclusively on your explicit, separate consent pursuant to Art. 9(2)(a) GDPR. This consent is obtained separately and with full information during the initial app setup. You can revoke this consent at any time in the app settings or by contacting us. Revocation does not affect the lawfulness of processing carried out prior to revocation. Upon revocation, the affected health data will be deleted, which will however prevent the calculation of personalized nutrition goals.

From this data, we calculate your Basal Metabolic Rate (BMR) and Total Daily Energy Expenditure (TDEE) to determine optimal calorie and macronutrient goals.

Meal Data

When you log meals in the app, we store:

• Meal name
• Calories and macronutrients (protein, carbohydrates, fat)
• Meal type (breakfast, lunch, dinner, snack)
• Portion size and quantity
• Meal notes
• Meal photos (if taken)
• Logging timestamps

Processing is based on Art. 6(1)(b) GDPR for contract performance and Art. 9(2)(a) GDPR for health data.

AI Image Analysis

When you take a photo of a meal, it is transmitted to the Google Gemini AI service for food recognition and nutritional calculation:

• The image is transmitted as base64-encoded data to Google Gemini 2.0 Flash
• Google analyzes the image and recognizes foods, ingredients, and estimated quantities
• Analysis results are cached to avoid repeated API requests
• Images are stored anonymized using a hash method

Transmission is based on Art. 6(1)(b) GDPR for contract performance. Google processes data according to their privacy policy.

https://policies.google.com/privacy

Apple HealthKit Integration

With your explicit consent, Kairo can sync with Apple HealthKit:

Data read:

• Active calories burned
• Basal energy burned

Data written:

• Dietary calories consumed
• Dietary protein, carbohydrates, and fat

This processing only occurs after your explicit consent via the iOS permission dialog. You can revoke this permission at any time in iOS Settings.

HealthKit data is processed locally on your device and is not transmitted to our servers unless required for app functionality.

Supabase (Database & Backend)

We use Supabase as our backend infrastructure for storing and managing your data.

Provider: Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992

Supabase hosts our PostgreSQL database and processes all app data. Our database is hosted in an EU region. Row-level security policies ensure users can only access their own data. A Data Processing Agreement (DPA) pursuant to Art. 28 GDPR has been concluded.

Clerk (Authentication)

We use Clerk for user authentication.

Provider: Clerk Inc., 660 4th Street #515, San Francisco, CA 94107, USA

Clerk processes your login data (email, name, profile picture) and securely manages authentication tokens. Passwords are never stored by us. Clerk is certified under the EU-US Data Privacy Framework (DPF). A DPA pursuant to Art. 28 GDPR has been concluded.

Google Gemini (AI Image Analysis)

We use the paid Google Gemini API (Gemini 2.0 Flash) for food recognition in photos.

Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

When you take a meal photo, the image is transmitted as base64-encoded data to the Google Gemini API and analyzed using artificial intelligence. Since we use the paid API, your data is NOT used by Google for AI model training. Google retains transmitted data for a maximum of 30 days for abuse and security monitoring and automatically deletes it afterwards. Google is certified under the EU-US Data Privacy Framework (DPF). A DPA pursuant to Art. 28 GDPR has been concluded.

Data processed:

• Meal photos (base64-encoded)
• Analysis results generated by the AI model (recognized foods, estimated nutritional values)

Transmission is based on Art. 6(1)(b) GDPR for contract performance.

PostHog (Analytics)

We use PostHog analytics to improve our app.

Provider: PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA

PostHog collects anonymized usage data such as app usage, feature interactions, and performance metrics. We use EU hosting (eu.posthog.com), so your data is processed within the EU. A DPA pursuant to Art. 28 GDPR has been concluded.

Data collected includes:

• App features and screens used
• Meal tracking events (anonymized)
• Device information
• App performance metrics

Processing is based on our legitimate interest (Art. 6(1)(f) GDPR) in improving our service. PostHog stores an anonymous device ID for session recognition on your device.

Sentry (Error Monitoring)

We use Sentry for detecting and fixing app errors.

Provider: Functional Software Inc. (Sentry), 132 Hawthorne Street, San Francisco, CA 94107, USA

Sentry captures error reports, stack traces, and diagnostic information when problems occur. We use Sentry's EU data processing. A DPA pursuant to Art. 28 GDPR has been concluded.

When errors occur, the following data may be transmitted:

• Error details and stack traces
• Device type and operating system
• App version and session information
• IP address (for diagnostics)

Processing is based on our legitimate interest (Art. 6(1)(f) GDPR) in providing a stable service. Access to terminal device information is technically necessary pursuant to § 25(2) No. 2 TDDDG.

Superwall (Subscriptions)

We use Superwall for managing in-app purchases and subscriptions.

Provider: Superwall Inc., 2261 Market Street #4561, San Francisco, CA 94114, USA

Superwall processes subscription status, purchase history, and entitlements. Payment data is processed directly by Apple and never shared with us. A DPA pursuant to Art. 28 GDPR has been concluded.

Data processed:

• Subscription status and expiration date
• Purchase transaction IDs
• Trial information
• App user ID
• Email address
• Name (first and last name)

AppsFlyer (Attribution & Analytics)

We use AppsFlyer to measure the effectiveness of our marketing campaigns.

Provider: AppsFlyer Ltd., 14 Maskit Street, Herzliya, Israel

AppsFlyer collects attribution data to track through which channel you discovered the app. A DPA pursuant to Art. 28 GDPR has been concluded.

Data collected includes:

• Device identifiers (IDFA, if consent is given)
• IP address (anonymized)
• Installation time and app events
• Campaign and source attribution

Processing is based on your consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG). You can refuse consent via the iOS App Tracking Transparency dialog or withdraw it later in iOS Settings.

Opt-out: You can disable personalized tracking in iOS Settings under Privacy > Tracking.

Expo Push Notifications

We use the Expo Push Notification Service for sending push notifications.

Provider: 650 Industries Inc. (Expo), 140 2nd Street, Floor 4, San Francisco, CA 94105, USA

When you enable push notifications, a device-bound push token is generated and transmitted to the Expo service. Expo forwards notifications to Apple Push Notification Service (APNs). A DPA pursuant to Art. 28 GDPR has been concluded.

Data processed:

• Expo push token (device-bound)
• Notification content
• Delivery timestamp

Processing is based on your consent (Art. 6(1)(a) GDPR), which you grant via the iOS permission dialog. You can disable push notifications at any time in iOS Settings.

Hosting

This website is hosted by Vercel Inc.

Provider: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA

When you visit our website, your data is processed on Vercel servers. Personal data may be transferred to the USA. Data transfer is based on EU Standard Contractual Clauses.

Server Log Files

The hosting provider automatically collects and stores information in server log files that your browser transmits:

• Browser type and version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

This data is collected based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of its website.