KalorIQ Privacy Policy

Effective date: October 5, 2026 Last updated: October 16, 2026 Provided by: Taylored Labs LLC, Texas, United States

1. Introduction

KalorIQ ("KalorIQ", "we", "us", or "our") is a nutrition and health-tracking application for iOS. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the choices and rights you have. It applies to your use of the KalorIQ app and the related backend services operated by Taylored Labs LLC.

By creating an account and using KalorIQ, you agree to the collection and use of information in accordance with this Privacy Policy.

We do not use third-party advertising networks, and we do not track you across other companies' apps or websites. See Section 5 ("No Third-Party Tracking or Advertising") for details.

2. Data We Collect and Why

The following categories reflect the data types declared in the app's iOS privacy manifest. Every category below is linked to your identity (associated with your account) and is collected for the stated purpose only. None of these categories is used for cross-app or cross-site tracking.

2.1 Name

• What: The name or display name you provide when you create your account or edit your profile.
• Purpose: App functionality — to personalize your experience and to display your identity within social features (friends, followers, shared content) you choose to use.

2.2 Email Address

• What: The email address you use to register and sign in.
• Purpose: App functionality and account management — to create and secure your account, authenticate you, send account- and service-related communications, and support account recovery.

2.3 User ID

• What: A unique account identifier assigned to your KalorIQ account, used internally to associate your data with your account.
• Purpose: App functionality — to store, retrieve, and synchronize your data across sessions and devices, and to attribute requests to your authenticated account.

2.4 Health Data

• What: Health-related information you log in the app, that is read from Apple HealthKit with your permission, or that is imported from a Withings account you connect. This includes nutrition data (calories and macronutrients), body measurements (such as weight, body fat, BMI, lean body mass, muscle mass, bone mass, body water, waist circumference, height), and clinical-style metrics (such as blood glucose, blood pressure, blood oxygen, heart rate, heart rate variability, respiratory rate, body temperature, and sleep).
• Purpose: App functionality — to power your nutrition and health tracking, trends, insights, and goals. See Section 3 ("Apple HealthKit") for the dedicated HealthKit disclosure and Section 2.11 ("Withings") for connected Withings devices.

2.5 Fitness Data

• What: Activity and fitness information such as steps, active and resting energy, exercise minutes, stand hours, walking/running/cycling/swimming distance, flights climbed, VO2 max, mindful minutes, and workout data — logged in the app or read from Apple HealthKit with your permission.
• Purpose: App functionality — to power activity tracking, fitness insights, and goal progress.

2.6 Photos or Videos

• What: Images you choose to add, such as progress photos and profile photos.
• Purpose: App functionality — to display your progress photos and profile image and, where applicable, to share content you explicitly choose to share within social features.

2.7 Purchase History

• What: Records relating to your in-app subscription and purchases (for example, your subscription status and entitlements). Payment is processed by Apple through the App Store; we do not collect or store your full payment card details.
• Purpose: App functionality — to provide and manage subscription features and entitlements.

2.8 Other Diagnostic Data

• What: Diagnostic and crash-related information, including app version and build number, device model, operating system version, and diagnostic log events containing a user identifier and contextual metadata.
• Purpose: App functionality and analytics — to diagnose errors, monitor reliability, and improve the app. See Section 4 ("Diagnostic Logging") for the dedicated disclosure of how diagnostic logs are transmitted.
• Before you create an account: while you go through onboarding, the app records which onboarding screens you reach, along with a random install ID and the app version. This contains no name, email address, or health data. If you create an account, it is linked to that account; if you don't, it is deleted after 180 days. The "Share usage analytics" switch in the app's privacy settings turns it off.

2.9 Text You Publish (Content Checks)

• What: The text you publish for other people to see: your username, profile name, post captions, comments on posts and recipes, the names of meals you share, recipes you publish (unless you keep them private), and foods you add to the shared food database. Food names in your log, your diet name, and your dietary restrictions are checked against the blocked-word list only and are never sent to TypeSafe AI.
• Purpose: App functionality — to keep the community free of abuse. Before the text appears, it is checked against a list of blocked words on our own servers, then sent to our moderation provider, TypeSafe AI, which tells us whether it breaks our Community Rules. Text that is refused is not published, and you can revise it.
• What is sent to TypeSafe AI: only that text and a short description of what kind of text it is. We never send your email address, user identifier, or health data with it. TypeSafe AI processes the text in the United States, does not use it to train its models, and keeps it only as long as reasonably necessary to provide its service. If TypeSafe AI is unavailable, the text is checked against the blocked-word list only.
• Your agreement: we ask before any of your text is sent. You agree when you create your account, and you need to agree to create one. Accounts created before this feature are asked the next time they open the app; until they agree they can keep logging, but cannot post, comment, publish a recipe, add a food to the shared database, or change their username or profile name.

2.10 Photos (Photo Checks)

• What: Photos other people can see, or could see once you share them: your profile photo, photos you add to meals and posts, and recipe photos, including a photo copied from a website when you import a recipe. Progress photos and screenshots you attach to feedback are never sent.
• Purpose: App functionality — to keep explicit, violent, self-harm and hateful images out of KalorIQ. Before a photo is published, it is sent to Amazon Rekognition, an image moderation service from Amazon Web Services (AWS), which tells us whether it shows something our Community Rules don't allow. A refused photo is deleted and never published, and you can choose a different one. If the check is unavailable, the photo isn't published and you can try again shortly.
• What is sent to Amazon Rekognition: only the image. We never send your email address, user identifier, captions, or health data with it. AWS processes the image in the United States, and we have opted out of AWS using it to improve its services.
• Your agreement: the agreement in Section 2.9 covers photos too. Until you agree, you can keep logging, but cannot add a profile, meal, post, or recipe photo.

2.11 Withings (Connected Scales and Blood Pressure Monitors)

• Optional: connecting Withings is up to you. You connect it in the app by signing in to Withings and approving access. Nothing is received from Withings unless you do.
• What we receive: the measurements your Withings devices record: weight, body fat percentage, fat-free (lean) mass, muscle mass, bone mass, body water, and blood pressure (systolic and diastolic). We do not receive heart rate, sleep, activity, or any other Withings data. When you first connect, we import up to two years of past measurements. After that, our servers fetch new measurements directly from Withings over an encrypted (TLS) connection, when Withings notifies us of a new weigh-in and during an hourly check.
• What we store about the connection: your Withings user ID, so incoming measurements reach the right account, and the access tokens Withings issues to us, which are encrypted on our servers. If you ask us for help with a connection problem, we may look up which Withings devices are on your account and when each last synced. We use that only to troubleshoot and do not store it.
• Purpose: App functionality — to show your weight trend and goal progress, your body composition and blood pressure trends, and, if you turn on adaptive targets, to adjust your daily calorie target. While Withings is sending your weight, body fat, or lean mass, the matching readings from Apple Health are set aside so one weigh-in is not counted twice. They come back if you disconnect.
• How we use it: Withings data is treated like HealthKit data under Section 3.4. We never sell it, never use it for advertising or marketing, and never share it with third parties except as needed to provide the service to you or where required by law. It is never sent to TypeSafe AI or any other AI service.
• Disconnecting: you can disconnect Withings in the app at any time. That stops all syncing, deletes the tokens we hold, and tells Withings to stop sending us notifications. Measurements already imported stay in your history, because they are your own readings. They are erased when you delete your account (Section 6.2), or you can ask us to delete them at support@kaloriq.com.
• Withings' own policy: the data held in your Withings account is governed by Withings' privacy policy.

2.12 Performance and Crash Reports

• What: the summaries iOS prepares about how the app ran on your device (Apple's MetricKit). Once a day: time in use (foreground and background), processor and graphics time, network data transferred, display brightness, disk writes, memory use, slowdowns, and how the app was closed, with the device model, iOS version, app version, and whether Low Power Mode was on. When the app crashes, freezes, or uses too much processor time or storage: the type of event, its timing, and the part of the app's code that was running. They contain no name, email address, user identifier, health data, or anything you entered in the app.
• Not linked to you: they are sent without your account details or user identifier.
• Purpose: App functionality and analytics — to measure and reduce the app's battery and data use, and to find and fix crashes and slowdowns.
• Your control: they are sent only while "Share usage analytics" is on in the app's privacy settings. Turning it off stops them, including any not yet sent.

3. Apple HealthKit

KalorIQ integrates with Apple HealthKit so your nutrition and health data can be viewed alongside the rest of your health and fitness ecosystem. HealthKit integration is optional and only operates after you grant the specific permissions iOS requests. You can review and change these permissions at any time in the iOS Settings → Privacy & Security → Health → KalorIQ screen, or within the Health app.

3.1 HealthKit data we read

With your authorization, KalorIQ reads the following categories of data from HealthKit:

• Body measurements: body mass (weight), height, body mass index (BMI), body fat percentage, lean body mass, waist circumference.
• Energy and activity: active energy burned, resting (basal) energy burned, step count, exercise minutes, stand hours, flights climbed, walking/running distance, cycling distance, swimming distance, running workout distance, VO2 max.
• Heart and vitals: heart rate, resting heart rate, heart rate variability (SDNN), respiratory rate, blood oxygen (oxygen saturation), body temperature, blood pressure (systolic and diastolic), blood glucose.
• Sleep and mindfulness: sleep analysis (deep, REM, core/light, and awake stages, and total sleep duration), mindful minutes.
• Nutrition and hydration: dietary water, dietary caffeine.
• Workouts: workout records (used, for example, to derive running distance).

3.2 HealthKit data we write back

With your authorization, and only when HealthKit sync is enabled, KalorIQ writes the following nutrition and hydration data you log in KalorIQ back into HealthKit so it appears in Apple Health alongside data from your other apps:

• Dietary energy consumed (calories)
• Dietary protein
• Dietary carbohydrates
• Dietary total fat
• Dietary water
• Body mass (weight)

If you delete a meal or water log in KalorIQ, the corresponding sample that KalorIQ wrote to HealthKit is also removed.

3.3 HealthKit data is uploaded to KalorIQ servers

HealthKit data that you authorize is uploaded to and stored on KalorIQ's servers operated by Taylored Labs LLC. This is necessary to provide the core functionality of the app: synchronizing your health and fitness history across your devices, generating trends and insights, and computing goal progress. Data is transmitted over an encrypted (TLS) connection and associated with your authenticated account. KalorIQ limits each initial sync to a bounded historical window and synchronizes incrementally thereafter.

3.4 Required statement on use of HealthKit data

In accordance with Apple's App Review Guideline 5.1.3 and the HealthKit terms, we make the following commitments regarding data obtained through the HealthKit API:

• We will never use HealthKit data for advertising or any advertising-related purpose.
• We will never use HealthKit data for marketing.
• We will never use HealthKit data for data mining, or for any purpose other than providing health-management, fitness, and nutrition features to you (the user) for whom the data was collected.
• We will never sell HealthKit data, and we will never share, disclose, or otherwise provide HealthKit data to any third party (including data brokers, advertising platforms, or analytics providers) except as required to provide the service to you, or where required by law.

HealthKit data is used solely to provide and improve the health, fitness, and nutrition features of KalorIQ for you.

4. Diagnostic Logging

To keep the app reliable and to diagnose problems, KalorIQ transmits diagnostic log events to KalorIQ's servers operated by Taylored Labs LLC.

• What is transmitted: structured diagnostic log entries that may include a log level and message, a timestamp, the source file/function/line that emitted the event, your user identifier, and device and app information (device model, operating system version, app version, and build number). Limited, non-identifying contextual fields (such as request identifiers, endpoint names, HTTP methods, and status codes) may also be included.
• Why: to detect, investigate, and fix errors and crashes, monitor service reliability, and improve the app (app functionality and analytics).
• How it is protected: diagnostic logs are sent over an encrypted (TLS) connection. Before transmission, the app applies automated redaction designed to strip sensitive values — such as authentication tokens (bearer/JWT), email addresses, passwords, OAuth codes, and other secrets — from log messages. Diagnostic-context fields use a default-deny allowlist, so values for fields not explicitly permitted (for example, food names, meal names, or health values) are dropped rather than transmitted. Response bodies from sensitive endpoints (such as authentication, email, password, and session endpoints) are excluded from logging.
• Your control: diagnostic log transmission can be disabled within the app via the remote-logging control. Disabling it does not affect the core functionality of the app.

Diagnostic logs are retained only as long as needed for reliability and debugging purposes, consistent with Section 8 ("Data Retention").

5. No Third-Party Tracking or Advertising

KalorIQ does not include third-party advertising SDKs and does not integrate third-party tracking SDKs. Consistent with the app's privacy manifest:

• Tracking is disabled. The app does not track you, and it declares no tracking domains.
• We do not use your data — including your HealthKit data — to serve you advertising.
• We do not link your data with data from other companies' apps or websites for advertising or measurement.
• We do not sell your personal data.

All data described in this policy is collected for app functionality, account management, or analytics/diagnostics for KalorIQ itself, as stated per category in Section 2.

Affiliate links. The KalorIQ app may link to products sold on Amazon, such as glucose sensors. KalorIQ participates in the Amazon Services LLC Associates Program and may earn a commission on qualifying purchases made through those links. Tapping one opens Amazon, whose own privacy policy applies from that point; we do not share any KalorIQ account or health data with Amazon.

6. Account Creation, Deletion, and Data Export

6.1 Account creation

You create a KalorIQ account using your name and email address. Authentication uses secure bearer tokens (see Section 7, "Data Security").

6.2 In-app account deletion (30-day grace period)

You can delete your account directly within the app (in the privacy/account settings) using a type-to-confirm flow. When you request deletion:

• Your profile, nutrition and food logs, nutrition profiles and goals, progress photos and weight history, health measurements (including any imported from Apple HealthKit or Withings), social content (friends, followers, and shared content), and preferences are scheduled for permanent deletion.
• If you connected Withings, the connection is removed when your data is erased, and we tell Withings to stop sending us your measurements.
• A 30-day grace period applies. If you sign in again within those 30 days, your deletion request is cancelled and your account is restored.
• After the 30-day grace period elapses, your data is permanently erased and cannot be recovered.
• Any active subscription is cancelled at the end of the current billing period. Subscriptions are managed by Apple; you may also manage or cancel subscriptions through your Apple ID / App Store settings.

6.3 Data export

You can export a copy of your KalorIQ data from within the app. The export is generated on request and provided to you as a file you can save or share.

7. Data Security

We take reasonable and appropriate technical measures to protect your data:

• Encryption in transit: all communication between the app and KalorIQ's servers uses TLS (HTTPS). App Transport Security is enforced; the app does not permit plaintext connections.
• Secure credential storage: authentication tokens are stored in the iOS Keychain, protected with a device-only accessibility level (kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly), so credentials are not included in backups and remain on the device.
• On-device protection of sensitive data: health-sensitive cached data stored on the device is written to encrypted files using iOS file protection (NSFileProtectionComplete) and is excluded from iCloud/iTunes backups.
• Connected-account tokens: the access tokens Withings issues when you connect your account are encrypted on our servers.
• Redaction of sensitive values in logs: as described in Section 4, sensitive values are redacted before any diagnostic log is transmitted.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you have reason to believe your account is no longer secure, please contact us at support@kaloriq.com.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you the service. When you request account deletion, your data is retained only through the 30-day grace period described in Section 6.2, after which it is permanently erased, except where we are required to retain certain information to comply with legal obligations, resolve disputes, or enforce our agreements. Diagnostic logs are retained only as long as needed for reliability and debugging.

9. Children's Privacy

KalorIQ is not directed to children under the age of 13 (or the minimum age required in your jurisdiction, such as 16 in parts of the EEA/UK). We do not knowingly collect personal data from children under that age. If you believe a child has provided us with personal data, please contact us at support@kaloriq.com and we will take steps to delete such information.

10. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, export, restrict, or delete your personal data, and to object to certain processing. You can exercise several of these rights directly in the app (data export and account deletion), or by contacting us at support@kaloriq.com. We will respond to requests in accordance with applicable law.

11. International Data Transfers

Your data may be processed and stored on servers located in the United States or other jurisdictions. Where required, we implement appropriate safeguards for cross-border transfers of personal data in accordance with applicable law.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice within the app. Your continued use of KalorIQ after the changes take effect constitutes your acceptance of the revised policy.

13. Contact Us

If you have questions or requests regarding this Privacy Policy or your data, contact us at:

• Email: support@kaloriq.com
• Entity: Taylored Labs LLC, Texas, United States