Privacy Policy
Last updated: June 13, 2026
Your privacy matters to us. This policy explains what information Avocaldo collects, how we use it, who we share it with, and the choices you have. Avocaldo is a wellness and nutrition tracking app — not a medical device.
1. Introduction & Data Controller
This Privacy Policy describes how Avocaldo ("we," "us," or "our") collects, uses, stores, and shares information when you use the Avocaldo mobile application and our website at avocaldo.app (collectively, the "Service"). The data controller responsible for your personal data is: Ilija Dimitrijevic Serbia Email: support@avocaldo.app If you have questions about this Privacy Policy or our data practices, please contact us at the email address above.
2. Scope
This Privacy Policy applies to the Avocaldo mobile app (iOS and Android) and the Avocaldo marketing website. It does not apply to third-party websites or services that may be linked from our Service. We encourage you to review the privacy policies of any third-party services you use.
3. Information We Collect
We collect the following categories of information: Account & contact information: email address, display name, and authentication provider identifiers when you sign up via email, Apple Sign In, or Google Sign In. If you register with email, we also process your password (stored in hashed form by our authentication provider). Profile & health-related information: gender, age, height, weight, goal weight, fitness goal (e.g., lose weight, maintain, gain muscle), training frequency, workout type, dietary preference (classic, vegetarian, vegan), weight-change rate, and calculated nutrition targets (daily calories, protein, carbohydrates, fats, and TDEE). Meal & nutrition logs: meal names, ingredient lists, estimated macronutrients, calorie totals, meal health ratings (1–5), serving quantities, and timestamps. Weight logs: weight values you manually record and associated timestamps. Photos: images of food you capture with your camera or select from your photo library for AI meal analysis. Subscription information: subscription status and purchase history processed through RevenueCat and the Apple App Store or Google Play. We do not receive or store your full payment card details. Technical data: authentication session tokens stored locally on your device, and records of AI usage for rate-limiting purposes. We do NOT collect: Apple HealthKit data, Google Fit data, precise location, contacts, advertising identifiers, or analytics tracking data. We do not use your data for advertising or cross-app tracking.
4. How We Use Your Information
We use the information we collect to: • Provide, operate, and maintain the Service, including AI-powered meal recognition and nutrition tracking • Calculate and personalize your daily calorie and macro targets • Process and manage your subscription • Store your meal history, weight logs, and progress analytics • Authenticate your account and keep it secure • Enforce rate limits and prevent abuse of AI features • Respond to support requests and communicate service updates • Comply with legal obligations We do not use your health, fitness, or nutrition data for advertising, marketing, or data mining purposes. We do not sell your personal information.
5. Legal Bases for Processing (EEA/UK)
If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases: Performance of a contract: to provide the Service you request, including account management, meal tracking, and subscription fulfillment. Legitimate interests: to secure and improve the Service, prevent fraud and abuse, and enforce our Terms of Service — balanced against your rights and freedoms. Consent: where required for accessing your device camera or photo library. You may withdraw consent by revoking permissions in your device settings, though this may limit certain features. Legal obligation: where we are required to retain or disclose data by applicable law.
6. AI & Photo Processing
When you scan a meal, the photo is transmitted from your device to our Supabase Edge Function, which sends the image to Google Gemini for AI analysis. The AI returns estimated food items and nutritional content. Ingredient lookups by name are also processed through Google Gemini via the same infrastructure. Meal photos are stored on Cloudflare R2 (object storage) for up to seven (7) days from the date of capture, after which they are permanently deleted (see Section 9). During AI processing, image data is transmitted securely over encrypted connections. We do not use your photos or health data to train AI models for advertising purposes. Google's processing of data through Gemini is governed by Google's privacy policies and terms. We configure our use of Gemini solely to deliver the meal analysis feature to you. By using the meal scanning feature, you acknowledge that your food photos and related data will be processed by Google Gemini as a subprocessors on our behalf.
7. Third-Party Service Providers
We use the following third-party processors to operate the Service. Each processes data only as necessary to provide their service to us: • Supabase (database, authentication, edge functions) — hosted in the EU (eu-north region). Privacy: https://supabase.com/privacy • Google Gemini (AI food and ingredient analysis). Privacy: https://policies.google.com/privacy • Cloudflare R2 (meal photo storage). Privacy: https://www.cloudflare.com/privacypolicy/ • RevenueCat (subscription management). Privacy: https://www.revenuecat.com/privacy • Apple (Sign in with Apple, App Store purchases). Privacy: https://www.apple.com/legal/privacy/ • Google (Google Sign In, Google Play purchases). Privacy: https://policies.google.com/privacy We require our service providers to protect your data consistent with this Privacy Policy and applicable law. We do not authorize them to use your data for their own marketing purposes.
8. Data Sharing & Disclosure
We do not sell, rent, or trade your personal information. We do not share your data with data brokers or use it for targeted advertising. We may disclose information only in the following circumstances: • To service providers listed in Section 7, under contractual obligations to protect your data • To comply with applicable law, regulation, legal process, or enforceable government request • To protect the rights, safety, and security of Avocaldo, our users, or the public • In connection with a merger, acquisition, or sale of assets, with notice to you where required by law Health and fitness data collected through Avocaldo is used solely to provide benefits directly to you within the app. It is not shared with third parties for advertising or marketing.
9. Photo Retention
Meal photos uploaded to our storage are retained for a maximum of seven (7) days from the date they were captured or uploaded, after which they are permanently deleted from Cloudflare R2. Nutritional data associated with the meal (ingredients, macros, meal name) may remain in your account unless you delete the meal or your account. When you delete your account, all associated meal photos are deleted promptly from our storage systems, in addition to the scheduled 7-day retention.
10. Other Data Retention
We retain your account information, profile data, meal logs (without photos after the 7-day period), and weight logs for as long as your account is active. When you delete a meal in the app, the meal record is marked as deleted and hidden from your view. When you delete your account through Account settings, we delete your profile, meal logs, weight logs, AI usage records, and authentication account. Deletion is generally completed within 30 days. We may retain minimal information where required by law or for legitimate legal purposes (e.g., resolving disputes or enforcing our Terms).
11. Data Security
We implement industry-standard technical and organizational measures to protect your information, including encryption in transit (TLS/HTTPS) and encryption at rest through our infrastructure providers. Authentication credentials are hashed and managed by Supabase. No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. Please use a strong, unique password and keep your login credentials confidential.
12. Your Rights
Depending on your location, you may have the following rights regarding your personal data: EEA/UK (GDPR): right of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection to processing, and the right to lodge a complaint with your local supervisory authority. California (CCPA/CPRA): right to know what personal information we collect, right to delete personal information, right to correct inaccurate information, and right to non-discrimination for exercising your rights. We do not sell personal information. You can exercise most rights directly in the app (edit profile, delete meals, delete account) or by contacting support@avocaldo.app. We will respond within the timeframe required by applicable law.
13. Account Deletion
You may delete your account at any time from the Account tab in the app by selecting "Delete account" and confirming. Account deletion permanently removes your profile, meal logs, weight logs, stored photos, and authentication credentials. After deletion, you will be signed out and returned to the onboarding screen. Subscription management remains with Apple or Google — cancel any active subscription through your device account settings to avoid future charges.
14. International Data Transfers
Your primary data is stored in the European Union (Supabase eu-north region). Some of our subprocessors, including Google, Cloudflare, and RevenueCat, may process data in the United States or other countries. Where personal data is transferred outside the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, or equivalent mechanisms, to ensure your data receives adequate protection.
15. Children's Privacy
Avocaldo is not directed to children under 13 years of age, and we do not knowingly collect personal information from anyone under 13. If you are under 13, please do not use the Service. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal data, please contact privacy@avocaldo.app.
16. Camera & Photo Permissions
The app requests access to your device camera and photo library solely to capture or select food images for meal scanning. You can revoke these permissions at any time in your device settings. Without camera or photo access, the meal scanning feature will not be available. iOS permission descriptions: camera access is used to scan food items; photo library access is used to select food images.
17. Website Cookies
The Avocaldo marketing website (avocaldo.app) does not use advertising cookies or third-party tracking. If we introduce analytics on the website in the future, we will update this policy and, where required, obtain your consent.
18. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by email before the changes take effect. The "Last updated" date at the top of this page indicates when the policy was last revised. Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.
19. Contact Us
For support and privacy-related questions, requests, or complaints, contact us at: support@avocaldo.app