Last updated: 4 October 2026
CAL5 ("the app") is a food, exercise and nutrition tracker. This policy explains exactly what happens to your information. It is written to be accurate rather than reassuring; where data does leave your phone, it says so plainly.
All of the following stays in the app's private storage on your phone and is never uploaded:
| Data | Purpose |
|---|---|
| Meals, calories, macronutrients, ingredients | Your food diary |
| Fibre, sugar and sodium figures | Micronutrient totals |
| Meal photos | Shown alongside each logged meal |
| Your food library — saved foods, saved meals, scanned barcodes | Re-logging something without scanning it again |
| Exercise entries (activity, duration, estimated calories) | Your exercise log |
| Weight entries | Progress chart |
| Progress photos | Before/after comparison |
| Water intake | Daily hydration total |
| Badges and logging streak | Progress milestones |
| Name and profile photo, if you set them | Shown on your own home screen |
| Height, year of birth, sex, activity level, goal and pace | Calculating your daily targets |
| App preferences (theme, units, language, calorie rollover, whether exercise is credited back) | Remembering your settings |
| Cached analysis results | So the same photo always returns the same numbers |
Uninstalling the app, or using Profile → Delete account & all data, permanently deletes all of it. Because there is no server-side copy, we cannot restore it for you. Deleting your Groups account is a separate action — see "Groups and your account" below — because the two hold different things in different places.
When you scan food, take a photo of a nutrition label, or use "Fix Results", the image and any note you added are sent over an encrypted connection to our proxy server (Cloudflare Workers), which forwards them to the Google Gemini API for analysis. The nutrition estimate comes back to your phone.
If you describe what you ate in words instead of photographing it ("two roti canai and a teh tarik"), that text follows the same path as a photo, and is likewise not stored by us.
If you describe a workout in words, that text is sent along with your body weight in kilograms, because energy burn cannot be estimated without it. Your weight is used to build that single request and is never written to our logs. The run and weight-lifting calculators do not send anything — they are estimated on your phone.
If you scan a barcode, the numeric product code is sent to Open Food Facts, a free public food database, to look up that product. No personal information is included. If that product has no published nutrition data, its name is passed to the analysis service described above so the entry is not logged as zero calories.
If you search the food database by name, the words you type are sent directly from your phone to Open Food Facts — not through our server. Because the request goes straight there, Open Food Facts receives your device's IP address, as any website you visit would. We do not see these searches and we do not log them.
Open Food Facts handles that request under its own privacy policy. No name, email, device identifier or anything from your food diary is attached, because the app has none to attach.
The same is true of the barcode lookups described above: they also go directly from your phone.
Nothing in this section happens unless you create an account. The app is fully usable without one, and the diary features never require one.
If you do create an account, the following is stored on our server, which is Supabase (PostgreSQL hosting, Singapore region) acting as our processor:
| Data | Why | Who can see it |
|---|---|---|
| Email address | Signing you in | You and us |
| Display name you choose | Attributing what you post | Every signed-in member |
| Posts, replies and reactions you write | They are the feature | Members of that group |
| Which groups you have joined | Showing you their contents | Members of that group |
| Reports you file, and accounts you block | Keeping the groups usable | Us only; a blocked person is never told |
Your food diary, meal photos, weight history and progress photos are not uploaded when you create an account. They remain on your phone exactly as described above.
Anything you post is visible to other members, so treat it as public. We review reported content and remove what breaks the rules; posts are also screened automatically against a list of prohibited terms before they appear.
The app contains no analytics SDK, no advertising SDK, no crash reporter, and no social login. We do not sell, rent or share your information with anyone.
Deleting your account is in the app: Groups → Account → Delete account & group data. It removes your account, your display name, your posts, your replies and your group memberships from our server, and it cannot be undone. It does not touch your diary, which was never on the server; to erase that too, use Profile → Delete account & all data.
An account can be suspended if it is used to abuse other members. Suspension does not delete it, because the reports that led to the decision have to be reviewable.
Weight, calorie intake, exercise and body measurements are health-related information. They are stored only on your device. The single exception is the body weight sent with a typed exercise description, described above. Nothing health-related is uploaded by the Groups feature — but anything you choose to type into a post is, like any other post.
You can choose to connect CAL5 to Apple Health (iPhone) or Health Connect (Android, which is also how Samsung Health, Google Fit and Fitbit data reach other apps). It is off until you turn it on in Settings.
When it is on, CAL5 writes the meals (calories, protein, carbohydrate, fat, and fibre, sugar and sodium when known), weigh-ins and exercise calories you log, and reads your step counts, workouts recorded by other apps or a watch, and weigh-ins from other apps such as a smart scale.
This exchange happens entirely on your device. Data read from Apple Health or Health Connect is stored only in CAL5 on your phone. It is never sent to our server, to the AI service, to the Groups service or to anyone else, never used for advertising or marketing, and never sold. You can stop syncing in CAL5's Settings at any time, and change or withdraw CAL5's access in Apple Health or Health Connect. Turning sync off leaves what was already written in your health app, where you can delete it.
| Permission | Why |
|---|---|
| Camera | Photographing meals, nutrition labels and barcodes |
| Photo library | Analysing a picture you already took, and saving progress photos |
Both are optional. Declining them limits the relevant feature but the rest of the app continues to work — food can still be logged by typing it.
CAL5 is not directed at children under 13 and we do not knowingly collect information from them.
Calorie, nutrition and exercise-burn figures are AI estimates, not laboratory measurements. They are useful as a consistent yardstick, not as exact truth. Each meal carries a confidence rating for exactly this reason. CAL5 is not a medical device and does not provide medical advice. Do not use it to make clinical decisions. Speak to a doctor or dietitian before making significant changes to your diet, particularly if you are pregnant, breastfeeding, or managing a medical condition such as diabetes or an eating disorder.
Your diary never leaves your device, so there is nothing of it for us to retrieve, correct or export — you control all of it directly in the app. If you have created a Groups account, the information listed in section 6 is held by us: you can change your display name in the app, and delete the account and everything attached to it from the same screen.
If you are in Malaysia, this is intended to be consistent with the Personal Data Protection Act 2010 (PDPA). If you are in the EEA or UK, our lawful basis for processing the photo or text you submit is performance of the service you have requested.
Nutrition and exercise figures are produced by Google's Gemini models. Packaged product data comes from Open Food Facts, licensed under the Open Database License.
If this policy changes materially, the "Last updated" date above will change and the revised policy will be published at this address.
Questions about privacy, or a request relating to your data:
jasonsoh91@gmail.com