Privacy Policy

This privacy policy is prepared by the CALRIO team operating the CALRIO mobile application and the calrio.app website. The data controller is the developer that publishes CALRIO.

Contact: info@calrio.app

Detailed data controller information, including trade name, address and tax details, is provided upon request via the email address above.

Under GDPR Article 6 and Turkish Law No. 6698 (KVKK) Article 5, each type of data has a separate legal basis:

• Account information (email, name, birth year, gender — optional): Performance of a contract (GDPR Art. 6(1)(b)).
• Authentication information: You can access CALRIO via anonymous sign-in, email one-time code (OTP), Sign in with Google, or Sign in with Apple. In this context we process your email address, the identity token provided by the identity provider (Google/Apple) and minimal account information. If you started anonymously, your anonymous account is linked to your chosen sign-in method so you can move to a permanent account without losing your data. These operations fall under performance of a contract (GDPR Art. 6(1)(b) / KVKK Art. 5/2-c).
• Nutrition and calorie entries (food logs, calories, macros, water intake, personal goals): Performance of a contract — you use the app for this exact purpose.
• Health-related special category data (body measurements, weight, height, health/fitness goals, daily meal and diet logs, progress photos): Processed solely on the basis of your explicit consent (GDPR Art. 9(2)(a) / KVKK Art. 6). See the Your Health and Special Category Data section for details.
• Usage and device data (screen times, device model, OS version, language preference — anonymised): Legitimate interests for app stability and security (GDPR Art. 6(1)(f)).
• Crash and diagnostic data (Firebase Crashlytics): Crash stack traces, device state and basic device identifiers generated when the app crashes are processed on the basis of legitimate interests to ensure app stability and fix errors (GDPR Art. 6(1)(f) / KVKK Art. 5/2-f). This data is retained for up to 90 days.
• AI feature usage logs (linked to your account: number of AI scans, provider used, response latency and timestamp — not the analysed image or content): Processed on the basis of legitimate interests for cost management, abuse prevention and service stability (GDPR Art. 6(1)(f) / KVKK Art. 5/2-f). These logs are retained for up to 90 days.
• AI Camera (meal) photos: Processed for the food analysis you trigger. These photos are processed only temporarily for analysis, deleted immediately once analysis completes, and are never permanently written to Firebase Storage.
• Progress photos: Processed only when you choose to save them, and subject to your explicit consent. These photos are stored in the EU (europe-west1) region of Firebase Storage for as long as your account is active. They are permanently removed when you delete the photo or your account.
• Camera and photo library (gallery) access: The camera permission is used so you can take meal and progress photos; the photo library (gallery) permission is used so you can select an existing photo from your device. These permissions are triggered only when you initiate the relevant action; no background access takes place.

Your body measurements, weight, health and fitness goals, daily meal/diet logs and progress photos are special category (health-related) personal data within the meaning of GDPR Article 9 and Article 6 of Turkish Law No. 6698 (KVKK). We process this data solely on the basis of your explicit consent (GDPR Art. 9(2)(a)); performance of a contract alone is not a valid legal basis for this data.

You give this explicit consent inside the app, in a step separate from your acceptance of the Terms of Use and Privacy Policy, of your own free will. If you do not give explicit consent, you may continue to use the core tracking features; however, features that require explicit consent (for example storing progress photos or AI food analysis) will not be available.

You may withdraw your explicit consent at any time by turning off the relevant toggle in the in-app settings or by contacting info@calrio.app. Withdrawal does not affect processing carried out before the date of withdrawal.

CALRIO transfers certain data to infrastructure providers outside Turkey/the EEA in order to deliver the service. The transfer abroad of health-related special category data (for example the photo you submit for AI food analysis) relies on the separate explicit consent you give inside the app. Other transfers are carried out to deliver the service and under appropriate safeguards (Standard Contractual Clauses / SCCs) within the scope of KVKK Article 9 and GDPR Chapter V. You may withdraw your explicit consent at any time.

• OpenAI (USA) and/or Google Gemini (USA):AI food recognition. The photo you submit is processed on the infrastructure of the provider used solely for analysis and is not permanently retained by the provider after analysis; the provider's standard security logs may be kept for a limited period (up to 30 days). Which provider is actually used in production may change over time; this policy is updated to reflect the current provider.
• Zoho / ZeptoMail (EU): Sending account verification (OTP) emails. Only your email address and the verification code are processed; the data is held within the EU.
• Google Firebase / Firestore / Cloud Storage: Data storage, authentication and analytics. Your data is stored primarily in the EU (europe-west1) region; only certain sub-services may involve a limited transfer to the USA. Google operates under EU Standard Contractual Clauses (SCCs).
• RevenueCat (USA): Subscription management and free-trial tracking. Subscription status, transaction ID, the app user ID assigned by RevenueCat, and purchase history are shared.
• Apple App Store / Google Play (USA): Payment processing. Payment details are processed exclusively by the respective store; they are never transmitted to us.

CALRIO's AI food recognition feature estimates calories and nutritional values from photos. What you should know about this process:

• AI output is for informational purposes only; it does not constitute medical or dietitian advice.
• You can manually edit or reject any result; every entry in the app can be modified by the user.
• To contest an AI decision or request human review, contact info@calrio.app.

• Account data: Retained for as long as your account is active.
• Account deletion: Your request is processed immediately; all your data is permanently deleted and this action cannot be undone.
• Subscription data: Retained for a 90-day grace period after cancellation or lapse, and deleted at the end of that period. (Billing/accounting records are additionally retained for 5 years as required by applicable tax law.)
• Anonymous accounts: Anonymous accounts that remain inactive for 90 days are deleted by an automatic purge mechanism; active or premium anonymous accounts are excluded from this purge.
• AI Camera photos: Deleted immediately after analysis completes.
• Progress photos: Retained for as long as your account is active; removed when you delete the photo or your account.
• Crash/diagnostic data (Crashlytics): Up to 90 days.
• AI usage logs: Up to 90 days.
• Anonymous usage analytics: 13 months (Firebase Analytics default).

Individuals under 13 years of age may not use CALRIO. Because CALRIO processes health-related data (weight, body measurements, progress photos), if the digital consent age in your country is higher than 13 (in the European Union this can be up to 16 depending on the country), that higher age applies. Users below that age may use the app only with the consent and supervision of a parent/guardian.

You must state your age accurately at registration; if an account belonging to a minor is identified, the account will be deleted and the data permanently removed. Parents may notify us at info@calrio.app.

Through the newsletter form on our website we collect your email address only with your explicit consent; the form only captures your email address and sends a notification to info@calrio.app. This is handled through the ZeptoMail (Zoho, EU) email infrastructure.

Apart from that, on this site we only store your theme preference (light/dark) in browser local storage; we do not use analytics, marketing, or third-party cookies.

You can manage the explicit consents you give for AI food analysis, progress-photo storage, analytics and international transfers through separate (granular) toggles in the in-app settings, and turn off any of them. You do not need to delete the app to withdraw a consent; withdrawing consent is as easy as giving it (GDPR Art. 7(3)). When you turn off a toggle, only the processing for that specific feature stops.

To protect your data we apply technical and organizational measures such as TLS encryption in transit, server-side encryption at rest, role-based access control, and Firebase Security Rules (KVKK Art. 12 / GDPR Art. 32).

Under GDPR you have the following rights:

• Right to know whether your personal data is being processed
• Right to access your data and receive a copy
• Right to rectification of inaccurate or incomplete data
• Right to erasure — via in-app "Delete My Account" in one step or by email
• Right to data portability (JSON export)
• Right to object to automated decisions
• Right to lodge a complaint with your supervisory authority (e.g. KVKK for Turkey, or your local data protection authority)

Requests sent to info@calrio.app will be responded to within 30 days.

The data controller is established in Turkey. Users located in the European Union may contact info@calrio.app for any data protection questions and requests. EU-based users also have the right to lodge a complaint with the competent data protection authority in their country. If the scope of processing triggers an obligation to appoint an EU representative under GDPR Article 27, the representative's details will be published in this policy.

For questions about this privacy policy: info@calrio.app

Material changes (e.g., explicit consent for special category data, new data processors) are announced to users via an in-app notification before they take effect.