Privacy policy

Last updated 22 October 2026

CheckCal is made by Dobreon sp. z o.o., a company registered in Poland, which is the controller of the personal data described here. Write to support@dobreon.com about anything on this page.

The short version: everything in CheckCal works without an account, reading photographs included. Without one, what leaves your phone is a photo or a meal in words you ask CheckCal to read (after you have agreed to that), a barcode or a search you look up, and the proof of your subscription. With an account, your diary is also kept in our database so it follows you to a new phone.

Without an account

Your day, your meals, weight, workouts, water, targets, scores, reports and Apple Health all live on your phone and work with no account at all. Nothing about them is sent to us.

Three things do leave the phone, each only when you use it:

• A photo, or a meal you describe in words, that you ask CheckCal to read, and only once you have agreed — see Meal photographs, words and AI.
• A barcode you scan or words you search for, which go to Open Food Facts — see Barcodes.
• The proof of your subscription, which Apple signs and our server checks before a photo is read — see Subscriptions.

Signing in is optional

An account does one thing: it keeps a copy of your diary so it reaches your other devices and survives a new phone. Nothing in the app needs one.

We use Firebase Authentication, which is Google, to handle signing in. You can sign in with Apple, with Google, or with an email address and a password. Apple and Google sign-ins involve no password at all. An email account has one, and we never see it: the app hands it to Firebase, which stores only a salted hash, and a forgotten one is reset by a link Firebase emails you. What Firebase holds is your email address, your name if Apple or Google passed it on, the identifier the provider gives us or the password hash, and the times you signed in. Signing in with Google tells Google that you use CheckCal; we receive your email address and name from them and nothing else. If you use Apple's Hide My Email, the only address we ever see is the relay one Apple gives us.

You can sign out in the app under You. Your diary stays on the phone and stops syncing.

What syncing stores, and where

With an account, your diary is kept in Cloud Firestore, Google's database, so it can reach your other devices. That is:

• What you log: foods, portions, meals, water, the workouts you log, your weigh-ins — including the ones that came in from Apple Health — your saved meals, and the targets each day was measured against.
• Your profile from the opening questions: sex for the calorie formula, date of birth, height, weight, activity, goal and eating style.

The database is in Frankfurt, in the European Union. Your diary is stored underneath your account's identifier, and security rules refuse any read or write that crosses from one account into another.

Photographs are not synced and are never stored on our side: the only lasting copy is on your phone.

When you delete something, it is marked deleted rather than removed outright, so the deletion reaches your other devices instead of the item coming back from one of them. The marked item stays in the database until you delete your account.

Meal photographs, words and AI

Reading a meal or a nutrition label from a photograph — or a meal you describe in words, such as “omelette with chicken” — is done by an AI model: Google's, through its Gemini API, and — for one Google's model does not read — Apple's, on its Private Cloud Compute. Before the first photo or description is sent, the app asks whether you agree, and says the same things this section says. You can turn it off at any time in the app under You › Privacy. While it is off, nothing is sent anywhere; a photo you take or a meal you describe meanwhile waits on your phone and is read only once you turn it back on. Adding food by hand, with the figures, never uses AI.

• What is sent: the photo, made smaller (about 1,000 pixels on its longer side) and re-encoded, so it carries no location or other photo data. For a meal you describe instead, the words as they stand in the box, typed or said — see Your voice. If you correct a reading in your own words with Fix something, your words and the list of foods and grams on that plate go with it. With each, the language the app is in, so the names come back in it. Nothing else — not your name, your body or your diary.
• How it travels: from the app to our server, which forwards it to Google and returns the answer. When Google's model does not read it — the day's 30 readings on it are used, or our server or Google is not answering — and your iPhone supports Apple Intelligence, the app sends it straight to Apple's Private Cloud Compute instead. That way it never passes through our server.
• What our server keeps: neither the photo, nor your words, nor the answer. It holds them in memory for the length of the request. What we log is operational only — which model answered, how long it took, how many items came back, whether it was food, whether it was a photo or words, and the app's language — next to the account identifier or subscription number it was for.
• What Google does with it: it reads it under its paid API terms, which do not allow the data to be used to train its models. Google may keep it for a limited time to detect abuse, and it may be processed outside the European Economic Area, including in the United States.
• What Apple does with it: Private Cloud Compute uses it only to answer that one request and does not keep it, and Apple publishes the software that runs there so that independent researchers can check this. It may be processed outside the European Economic Area, including in the United States.
• No other AI: photos and words go to Google's model or Apple's and no other. If that ever changes, the app will ask you again first.
• The copy on your phone stays in the app's own storage and goes when you delete the meal.
• The legal basis is your consent, which you can withdraw in the app at any time.

CheckCal has no access to your photo library. When you choose a photo, the system's picker hands the app that one photo and nothing else. Saving a photo or a share card to your library asks for permission to add to it, not to read it.

Your voice

In «What did you eat?» and «Fix something» you can say the words instead of typing them. The microphone is used only while you have it on, and only after you allow it when iOS asks. Typing always works without it.

• Speech becomes text on your iPhone. On iOS 26 and later, Apple's speech recognition on the phone turns what you say into text, which appears in the box for you to check and change. Only that text is sent, as described above. The recording is not sent anywhere and is not kept.
• Except for a language your iPhone cannot recognise on its own. For such a language — this can include Polish — Apple's speech recognition does the same on Apple's servers. iOS asks your permission for that first and says the speech goes to Apple, which handles it under its own privacy policy for Siri and Dictation. CheckCal and our server never receive the recording, only the text.
• The legal basis is your consent: the microphone and speech recognition permissions, which you can withdraw at any time in the iPhone's Settings.

Counting photographs and words

Each photograph or meal in words Google's model reads costs us money, so our server counts them: there is a limit of 30 a day, photographs and words together, and a limit on how fast they can be asked for. On an iPhone that supports Apple Intelligence, photographs past the daily limit are read by Apple's model instead; those never reach our server and are not counted here. The count is kept per account when you are signed in, and per subscription when you are not. It holds how many photos were read today, how many were refused and why, the times of the last few, and a running total — nothing about the photos or the food.

• An account's count is stored under the account and goes with it when you delete the account.
• A subscription's count is stored under the subscription's transaction number, which Apple assigns and which names nobody. It is deleted automatically 90 days after the last photograph.
• The first time in a day that an account or a subscription reaches the limit, our server sends us an email through Resend, an email service, with that identifier and the limit. Nothing else is in it.

Proving the app is the app

Before a photo is read or you sign in, the server checks that the request comes from CheckCal, unmodified, on a real device. It uses Apple's App Attest: your phone's secure hardware signs a statement, Apple and then Google's App Check confirm it, and our server sees only a yes or a no. It carries nothing about you or your food, no advertising identifier, and it cannot be used to recognise you across apps.

Subscriptions

Subscriptions are sold and processed by Apple. We never see your card or your Apple Account. What our server sees is the transaction Apple signs, which the app sends with each photo so the server can check the subscription rather than take the app's word. The server records which subscription it is and when it runs out. When you are signed in, it also records which account the subscription belongs to; that record goes when you delete the account.

Barcodes and the food database

Scanning a barcode sends the number, and searching the food database sends the words you type, to Open Food Facts, a free public food database run by a French non-profit on servers in the European Union. Nothing else is sent and no account is needed.

Apple Health

Apple Health is used only if you allow it, in the Health permission sheet, and you can change what CheckCal may read and write at any time in the Health app.

• Read: your steps, active energy, workouts and weigh-ins. Steps, active energy and workouts are read on your phone when the day is shown and are not stored or sent anywhere. Weigh-ins that come in from Apple Health are kept in your diary, so they sync to your account like everything else you log when you are signed in.
• Written: a weigh-in you type into CheckCal, so both apps show the same weight. Food and calories are never written to Apple Health.
• Health data is never sent to the AI, never used for advertising or marketing, and never shared with anyone.

Who else handles your data

• Google — through Firebase: signing in, the database in Frankfurt, and App Check; through the Gemini API: reading photos and meals in words, as described above.
• Cloudflare runs our server on its network, in a data centre near you. It records the technical details of each request (IP address, time, size, status) for security, and keeps our server's logs for a few days.
• Resend delivers the limit emails described above.
• Apple handles Sign in with Apple, App Attest and the App Store under its own privacy policy, reads on Private Cloud Compute the photos and words Google's model does not, and turns speech into text on its servers for a language your iPhone cannot recognise itself, as described above.

Each company that processes data for us is bound by an agreement to protect it at least as well as this policy does and to use it only to provide its service to us. Google, Cloudflare and Resend are United States companies, so reading a photo, signing in and the limit emails involve transfers outside the European Economic Area; those rest on the European Commission's standard contractual clauses. A photo read by Apple may also be processed in the United States.

What we never collect

There is no analytics SDK, no crash reporter, no advertising identifier and no third-party tracker of any kind in the app. Nothing you log is sold, shared with advertisers or used to build a profile of you, and we do not use your diary to train anything.

Children

CheckCal is not intended for children. The opening questions do not accept a date of birth under 13 years ago, and a plan to lose weight is offered only from 18 and never to somebody already under a healthy weight.

Your rights, and deleting everything

Under the GDPR you have the right of access, rectification, erasure, restriction, portability and objection, and you can withdraw consent at any time.

• Delete your account in the app under You › Delete account and data. To be sure it is you, you sign in once more; then your records are removed from the database, Sign in with Apple's access is revoked, your identity is removed from Firebase, and everything on the phone is erased. It happens when you tap it and cannot be undone.
• Without an account, You › Erase all data on this phone erases everything the app holds. We hold nothing about you beyond the anonymous photo count described above.
• Withdraw your consent to AI reading under You › Privacy.
• For access, correction or a copy of your data, use You › Export my data or write to support@dobreon.com; we answer within one month.

You may also complain to a supervisory authority. In Poland that is the Urząd Ochrony Danych Osobowych.

Changes

If this policy changes in a way that affects what is sent or kept, we will update the date at the top and describe the change here before the version of the app that makes it ships.