Privacy policy

Effective date: 2026-10-19

Couch Cal is a photo-first calorie tracker: you snap a photo of a meal (or type it, scan a barcode, or list everything you ate) and an AI estimates the calories. This policy says what personal data the app and the website collect, why, who else touches it, how long it is kept, and how you delete it. It is written to be read, not skimmed.

Couch Cal is a product of Comotoca (comotoca.com), Spain (“we”). Contact for anything in this policy: contact@couchcal.com. It covers the website and web app at couchcal.com and app.couchcal.com and the iOS app (com.couchcal.app).

What we collect

Account. Your name and email address, whether the email is verified, and either a password (stored only as a salted hash; we cannot read it) or, if you sign in with Apple or Google, the identifier the provider sends us for you and the email it shares. Email verification and password reset use one-time links sent to your address; their tokens expire.
Profile and settings. What you enter to work out your calorie target (age, gender, height, weight, goal weight, activity level, goal, and deficit mode), your units, your timezone, your notification preferences, and your weight entries if you log them.
Meals. For each meal: the photo (or two), the description or note you typed, the barcode if you scanned one, the calorie estimate and the AI’s short reasoning, which AI provider made the estimate, how many coins it cost, and the time you logged it. If you allow location, the meal can also carry the coordinates where you logged it, and places you save keep their name, coordinates, city, and country. Pinned meals are linked to places.
Purchases. Your subscription status, plan, period end, and the provider’s subscription identifier. If you subscribe on iOS, Apple sends us signed records of the purchase and later events (renewal, cancellation, expiry, refund). If you subscribe on the web, Polar does the same. We never see your payment card.
Sessions and logs. Signing in gives your device a token that lasts seven days. The web app keeps it in your browser’s local storage and sets no cookies, with one exception: while you sign in with Google, our server sets a short-lived cookie (ten minutes) that checks the sign-in came from your browser. Our server logs requests and operational messages (they can include your account id or email address) to run the service and investigate abuse. Your IP address is used to rate-limit sign-in, sign-up, and password-reset requests, and is logged when one of them is refused or fails.

We run no analytics or advertising SDK and no tracking, and we do not collect contacts. Camera, photo library, and location are used only when you grant them, for the reasons the app states when it asks.

Apple Health (iOS only)

This is exactly what the iOS app does with Health data, and nothing else:

Writes: each logged meal’s calories to Health as dietary energy, and updates or removes that entry when you edit or delete the meal.
Reads active energy burned: once you have granted access, the app reads today’s active energy total and sends that one number per day to our server (POST /api/health/activity), which stores it with the date. The server uses it to adjust your calorie target only if you have turned the activity adjustment on in Settings.
Reads body mass: the app reads your most recent weight from Health and sends it to our server as a weight entry, so your weight history and calorie target stay current.

We use Health data only to run these features. We do not use it for advertising or sell it, we do not send it to the AI providers, and we do not share it with anyone else. You can change or revoke access at any time in the Health app; deleting your account removes the activity and weight entries we hold (data already written into Health stays on your device, under your control).

Why

We process this data to provide the service you asked for (your account, estimates, your subscription), to keep it secure, and to meet legal obligations such as keeping records of paid transactions. Your meals, weight, and activity are data concerning health, so the legal basis for storing them is your explicit consent, given by ticking the box at signup or agreeing on the consent screen the app shows if you signed up another way; withdraw it by deleting your account. Where consent is the basis for anything else (location, Health, camera, photos, a provider sign-in), you give it by granting the permission or using the feature and withdraw it by turning it off or deleting the account.

Who else touches the data

AI providers. To estimate a meal, the server sends its photo(s) and/or text, your optional note, and the city and country of the meal’s location (not the coordinates) to one of three providers: Anthropic, Google (Gemini), or OpenAI. If one fails the next is tried. We send no name, email, or account id with the request.
Open Food Facts (openfoodfacts.org) receives the barcode number when you scan one, to look up the product.
OpenStreetMap Nominatim (nominatim.openstreetmap.org) receives coordinates of a meal or place to turn them into a city and country.
DigitalOcean, LLC hosts our server, database, and photo storage on a single server.
Resend, Inc. delivers our transactional email (verification and password-reset links). It receives your email address and the message.
Polar (polar.sh) processes web subscriptions. It receives your email address and our account id for you, plus the payment details you enter at its checkout.
Apple when you use Sign in with Apple, subscribe through the App Store, or use Health; its privacy policy applies to what it collects.
Google only if you sign in with Google, as the issuer of the identity token.

We do not sell personal data, share it for advertising, or give it to anyone else except as required by law. If we add a provider, we name it here before it receives data.

International transfer

Our providers (the AI providers, DigitalOcean, Resend, Polar, Apple) may process data outside the country you live in, including in the United States. Where the law requires a safeguard, we rely on our providers’ standard contractual clauses.

How long

Your account, meals, photos, places, weight, activity, and subscription records stay until you delete the meal or the account. Records of paid transactions may be kept, detached from your account, for the period tax and commercial law require. Sign-in tokens expire after seven days.

Your rights and controls

See and change your profile, meals, and places in the app at any time.
Export the last 7 or 30 days of your meals from the app (PDF or JSON), or email us for everything, including a copy of your data in a machine-readable form.
Delete your account yourself, immediately, in Settings in the app or on the web. Deletion removes your account, meals, places, pinned meals, weight and activity entries, sign-in identities, and subscription record, and deletes your meal photos from our server. An active subscription is not canceled by deleting the account: cancel it with Polar or in your Apple ID settings, or it keeps renewing.
Correct, restrict, or object: email us. You may also complain to a data-protection authority; ours is the Spanish Data Protection Agency (AEPD, aepd.es), and if you live elsewhere in the EU/EEA or the UK you may use your own.

Children

Couch Cal is not directed at children under 14, or under the age at which your country lets you consent to an online service without a parent. We do not knowingly collect data from children; if you believe a child has an account, email us and we will delete it.

Security

Connections use TLS and passwords are stored as salted hashes. No system is perfectly secure, and we will notify affected users of a breach as the law requires.

Changes

We will post changes on this page and update the effective date. A change that reduces your rights or widens what we collect is announced in the app or by email before it takes effect.

Contact

contact@couchcal.com