Privacy Policy
Version 2026-09-20.4 · Updated 20 September 2026
Kaffa records what you eat and how you train. That is health information about you, and this document says plainly what we hold, why, where it is, and how to get rid of it.
1. Who is responsible
The controller under the GDPR is Mohammad Areesheh, Munich, Germany — hello@kaffa.fit. The full postal address is in the Impressum. There is no Data Protection Officer; the service is below the threshold that requires one.
2. What we hold
| Data | Why | Legal basis |
|---|---|---|
| An account identifier, created after agreement when connected; optional email and Apple or Google identity when you connect a login, including basic provider profile claims such as Google name/avatar when supplied | So your logs belong to you; a connected login lets you recover successfully synced data on another installation | Art. 6(1)(b) — performing the contract |
| Profile: sex, date of birth, height, activity level, goal, working hours | Calculating your energy needs and targets | Art. 9(2)(a) — your explicit consent |
| Food logs, including any notes you type | The core function of the app | Art. 9(2)(a) — your explicit consent |
| Recipe drafts you choose to keep: names, ingredients, unfinished amount text and cooking instructions | Resuming unfinished recipes on this device and, after sync, another signed-in device. Drafts are private and do not log food. This storage does not include audio, transcripts or AI-generated nutrition. | Art. 9(2)(a) — your explicit consent |
| Saved meals and your custom portion names | Letting you log the same meal or serving again, including through Siri on iOS | Art. 9(2)(a) — your explicit consent |
| Foods you add: names, brand, barcode and nutrition figures | Your private catalogue, and review for possible inclusion in the shared catalogue | Art. 9(2)(a) — your explicit consent |
| A nutrition-label photograph you deliberately submit, its image hash, and the figures transcribed from it | Preparing a custom food for you to review and confirm | Art. 9(2)(a) — your separate explicit consent to AI photo processing |
| A photograph of a meal you deliberately take or choose, including anything else visible in the frame, optional food/preparation details you enter, plus the foods and portion ranges read from it | Suggesting what is on the plate and roughly how much, for you to confirm or change before anything is logged | Art. 9(2)(a) — your separate explicit consent to AI photo processing |
| Plan text, one PDF or up to six plan images you select; age band, activity level, eight weeks of aggregate training metrics, exercise names, an exact-input hash, and the structured draft | Preparing a personalized or imported training plan for you to resolve, review and save | Art. 9(2)(a) — your separate explicit consent to AI training-plan processing |
| Barcode numbers sent for product lookup | Finding the product you scanned | Art. 9(2)(a) — your explicit consent |
| Body measurements: weight, body fat, waist | Showing trends over time | Art. 9(2)(a) — your explicit consent |
| Health-store data you choose to sync: steps, active energy, weigh-ins and body fat | Showing daily activity, and importing a weigh-in or a body-fat reading without retyping it | Art. 9(2)(a) — your explicit consent plus the device permission |
| Foods you pin as favourites | Offering them first, so logging takes one tap | Art. 9(2)(a) — your explicit consent |
| Water you log | The core function of the app | Art. 9(2)(a) — your explicit consent |
| Workout logs: sessions, exercises, sets; optional saved backup exercises and machine setup notes | The core function of the app | Art. 9(2)(a) — your explicit consent |
| A record of which version of these documents you accepted, and when | Proving consent, as the GDPR requires us to | Art. 6(1)(c) — legal obligation |
| Crash diagnostics: device model, OS version, stack traces | Fixing crashes | Art. 6(1)(f) — legitimate interest in a working app |
Saved backup exercises and machine setup notes (such as seat, pad and handle positions) are saved in the encrypted local diary and copied to your private account on Supabase when diary saving is enabled. This includes choices already saved on your device. Successfully saved choices can return when you sign in to the same account on another installation. They are not sent to AI services or included in shared workout-plan exports. You can replace or remove a saved backup and edit or clear a setup note from the exercise’s menu; that clear is saved to your account when connected.
Health data is a special category under Art. 9. We rely on your explicit consent for the health journal, estimates and progress features. You can withdraw this consent in Privacy settings. This pauses health features on this device immediately, including imports, ordinary diary sync and AI processing. Account and privacy controls remain available. Withdrawal does not affect processing that already happened. AI photo processing and AI training-plan processing are separate choices; refusing either does not disable manual entry, deterministic plan-file import, the normal plan builder, or another non-AI feature.
Before using health features, you agree to the Terms of Service, acknowledge the Privacy Policy and health disclaimer, and explicitly choose health-data processing. We keep a dated, account-specific record of these choices, the document versions, disclosure revision and language, and later withdrawals. An anonymous account is created after agreement when connected. A returning account uses its own consent history; another account's choices do not carry over.
Your choice is saved on this device even offline. It reaches your account when connected, and other devices update when they reconnect. Health data is sent only after the account has confirmed the current consent. Withdrawing does not automatically delete existing records or copies previously sent to Apple Health, Health Connect or other services. Optional AI choices are also switched off and require a separate choice before using them again. To request a copy or deletion of existing records, contact hello@kaffa.fit; account and privacy controls remain available without enabling the health journal.
2a. The camera
Kaffa asks for the camera so you can scan a barcode on food packaging. In that barcode flow, no picture is saved or sent: the barcode is read on the device, and only the resulting number is sent to look the product up.
Product lookups go to Open Food Facts through our own server, so Open Food Facts receives the barcode and not your device or your address.
Nutrition-label scanning is a separate action. If you choose it and have separately allowed AI photo processing, the label image is sent through our authenticated Supabase function to OpenAI for transcription. Kaffa receives the camera's temporary app-cache file, reads it into memory and deletes that temporary file after reading, including when processing fails. A capture recovered after Android restarts the app is deleted at startup and is never uploaded automatically. The image is not written to our database or server file storage. We keep a SHA-256 image hash and the validated transcription so an identical scan can be reused for your account. You must review and confirm every figure before it becomes a private food.
Photographing a meal is different from photographing a label, and we ask for it separately. A label is printed packaging. A plate can have anything else of yours in the frame — your home, your table, the people you are eating with — so the app says so before the camera opens and you decide what to point it at. If you choose it and have separately allowed AI photo processing, the photograph is sent through our authenticated Supabase function to OpenAI, which identifies the foods and estimates how much of each is there. You can also add optional food and preparation details, such as cooking method, sauce ingredients, or oil used. Those details and the previous food names for this photo are sent with the image when you ask to update its suggestions. Details remain in memory for the review and are not saved as a diary note or as raw text in our database. We retain a hash of the request and the validated food/portion suggestions, including any food information inferred from the details, to support account-scoped caching and your confirmed corrections. It is never asked for calories: those come from our own food database, from the food you confirm. Nothing is logged until you confirm it, and a photograph we cannot read still saves as your record of having eaten.
The app takes one intentional photograph. It strips image metadata and resizes the image before processing. A photo provides a portion estimate, not a measured weight; the app keeps a range until you enter an amount. Unlike a label photograph, the meal photograph is stored on your device alongside the meal, so you can see what you ate. It stays there until you delete that meal or the app, and it is not uploaded to our database or server file storage.
You can refuse the camera or AI-photo consent and keep using everything else. Manual food entry and barcode lookup remain available without AI.
A food you add stays private in the app while it is pending. Authorised curators can inspect the submitted food data. If they verify it, the link to your account is removed and the food data becomes part of the shared catalogue; your meal logs remain private.
2b. Apple Health and Health Connect
Health access begins only when you ask to connect and grant the specific device permission. Nothing is read before that, and if you never connect, nothing in this section applies to you.
Once you have connected and a sync has completed, Kaffa also refreshes when you open the app, at most once every fifteen minutes. It reads nothing while the app is closed and runs no background timer. This changed on 3 September 2026, and it affects how often the same data is read rather than which data — the Health screen shows the time of the last sync.
Steps and active energy are reduced on your device to a daily total and remain there. A weigh-in or a body-fat percentage you choose to import is stored with your other body measurements and therefore syncs to your account. Body fat is read because a smart scale writes it alongside the weight it already shares; Kaffa never writes body fat back. We do not retain the health app, device identifier, platform sample ID, or exact source timestamp.
Kaffa can also write a weight or meal that you entered in Kaffa back to the device health store. It replaces only data Kaffa wrote, never another app's data, and never writes an imported weigh-in back to its source.
2c. Siri and Shortcuts
On iOS, Kaffa makes at most 100 saved-meal names and their random identifiers available to Apple's App Intents system so Siri and the Shortcuts app can understand a request such as “log my usual lunch.” This small catalogue is stored in Kaffa's on-device App Group. It contains no meal items, calories, nutrition figures, account credentials or history.
2d. AI training-plan drafts and document import
If you separately allow AI training-plan processing, Kaffa can prepare a new plan from a written brief or transcribe a plan from text, one PDF, or up to six JPEG, PNG or WebP images you deliberately select. Files are resized where appropriate, verified on your device and again on the server, held in memory for the request, and sent inline through our authenticated Supabase function to OpenAI. Kaffa does not write the raw document to its database, file storage, or OpenAI's persistent Files API.
To personalize the draft, Kaffa sends only your age band and activity level; aggregate totals from the previous eight weeks for sessions, frequency, active weeks, duration, working sets by muscle, cardio and mobility; up to 20 exercise-frequency summaries; and the localized exercise catalogue including your custom exercise names. It does not send your exact birth date, sex, height, weight, body goals, notes, database row identifiers, exact timestamps, or raw set logs.
Kaffa retains an exact-input SHA-256 hash and the validated structured draft for same-account retry and abuse/spend control, not the raw source. An unfamiliar imported movement is never silently substituted: you must choose an existing movement with the same target type or explicitly create it. Every result opens in the normal builder and no plan is saved until you review it and tap Save.
Selecting a meal through Siri queues only its identifier and opens Kaffa. Kaffa then writes the meal locally through the same offline log used by an in-app tap. Kaffa does not request microphone access and does not receive or retain the recording of your Siri request; Siri is an Apple platform service controlled by your device and Apple settings. Apple states that it may extract anonymised App Shortcut data, including localised phrases, display values, intent titles and descriptions, to improve the App Shortcuts experience. A saved-meal name is a display value in this feature.
3. What we do not do
We do not sell your data. We do not use it for advertising, and we do not share it with anyone for advertising. There are no advertising or tracking SDKs in the app. If Apple Health or Health Connect data ever reaches us, Apple's and Google's rules forbid those uses too, and we accept that.
We do not use nutrition-label photos, meal photographs, plan documents, transcriptions, structured drafts or your corrections to train or improve a model. OpenAI states that data sent through its API is not used to train its models. Any future use of confirmed corrections for model improvement would require a separate consent that is not part of either AI processing purpose.
Body photo comparisons
You may choose photographs from your device's photo library and assign a date to compare them in Progress. Kaffa stores a resized copy in this device's encrypted diary for the account that added it. Image metadata, including location metadata, is removed from the saved copy. Body photos are never uploaded, synced, included in meal-photo recovery, or sent to AI providers. They are excluded from device backups and transfers along with the diary. Deleting the app or losing the device can permanently lose them. You can delete individual body photos in Progress; deleting a copy in Kaffa does not delete the original photograph in your device's photo library.
4. Where your data is
Your account and logs are stored in the European Union — Supabase, eu-west-1 (Ireland). Your diary works offline on your phone. Successfully synced records can be restored by signing into the same connected account. A guest account has no guaranteed recovery after reinstalling. Changes still waiting on your device and device-only settings are not recovered from Supabase if you delete the app or lose the device. Where photo backup is enabled and you have accepted its disclosure, meal photos that have finished saving online can also be recovered through the same account.
Optional Sign in with Apple or Google sends identity credentials to Supabase Auth. The selected provider handles authentication under its own terms; we do not send it your food, workout or body logs for sign-in. Apple may provide a private relay email. The app does not request your name from Apple or extra Google API permissions.
Sign-in sessions and email-link verifiers are kept in iOS Keychain or encrypted Android storage. When you open an existing account from a guest diary, the app can retain that guest's credential separately on this device so you can reopen it. This credential is not a cloud backup. The local diary database, including unsent changes and local settings, is separately encrypted with a key held on this device. Existing diaries are converted only after an encrypted copy has been checked. The encrypted database is excluded from phone backups and device transfers because its key does not move with it. Successfully synced records can be recovered through the same Kaffa account; deleting the app can lose unsent changes. Saved meal photos are also kept inside the encrypted local diary. Older photo files are removed only after their encrypted copies have been checked. If an older photo cannot be associated with one account, it is retained encrypted without being shown through another account. When photo backup is enabled after acceptance of this disclosure, copies of saved meal photos are encrypted by Kaffa's server and stored privately in Supabase Storage. The server's encryption keys are kept separately from the database and stored photo files. Authorized Kaffa services can decrypt these copies to restore them to your account. Deleting a meal queues removal of its online photo copy, unless another saved meal still uses it; interrupted removals retry when the app reconnects. Photos that have not finished saving online cannot be recovered after the device copy is lost. Basic photo backup and recovery do not require a paid subscription. Photo backup is separate from AI processing and does not send the photo to an AI provider. Supabase provides transport and infrastructure encryption; this release does not provide end-to-end encryption of logs or additional application-level encryption of hosted diary fields.
AI allowances and subscription verification
Recipe conversation controls are staged and are not yet enabled. When you opt into recipe assistance after its release, we keep a conversation and turn identifier, language, whether you are recording or developing a recipe, request fingerprint, revision, turn count, timing, cancellation state and a link to its spending record. This metadata prevents duplicate work and limits costs. It contains no recipe wording, answers, audio or transcript. The recipe-assistance setting defaults to off. Turning it off stops new requests; work already sent may still have a charge to reconcile.
When funded AI features are enabled, we record account and job identifiers, request fingerprints, the model used, token counts, reserved and measured costs, and provider request references. These records enforce shared spending limits, detect misuse and reconcile charges. They do not contain the original meal photograph, recipe, training document or conversation. Before generation, the same consented input may be sent to OpenAI to count its input tokens.
For paid access, we send your Kaffa account identifier to RevenueCat to verify the subscription, product, purchase reference and expiry. We do not send your diary or AI input to RevenueCat. When you open the optional subscription flow with a connected account, RevenueCat's native SDK loads store prices, handles purchases and restoration, and keeps its own local subscription cache. Its requests include technical app/device and network metadata needed to operate the service. Kaffa disables optional SDK diagnostics and advertising-identifier collection and does not supply your email. We keep reviewed net subscription proceeds, service-period dates, the funded allowance and purchase references needed to verify access, and a keyed fingerprint of each funded purchase period to prevent allocating the same allowance twice.
Processors
| Who | What they handle | Where |
|---|---|---|
| Supabase | Accounts, database, file storage | eu-west-1 (Ireland) |
| Apple / Google identity services | Optional authentication and provider identity/email; not Kaffa health logs | Provider infrastructure, not limited to the Supabase database region |
| RevenueCat (when paid AI access is enabled) | Account identifier and subscription, purchase and entitlement verification; no diary content | Provider infrastructure; processing location, transfer safeguards and retention must be verified before activation |
| Sentry | Crash diagnostics | EU region |
| Vercel | This website only — no app data | Global edge network |
| OpenAI | Nutrition-label photos/transcription, meal photographs and the foods read from them, and selected training-plan documents, minimized plan context and structured drafts, and recipe text/draft assistance, only after the corresponding separate consent | API processing infrastructure; the exact processing location depends on project configuration and has not been independently verified for the private pilot |
Where a processor operates outside the EU, an applicable transfer safeguard such as the European Commission's Standard Contractual Clauses must be in force before that processing is activated. The provider agreements and exact OpenAI processing location remain public-launch checks. This notice does not claim they are already complete. Recipe text assistance is limited to the private development pilot; public subscriptions and voice assistance are not enabled.
Requests to OpenAI use the Responses API with store: false, so
the generated response is not stored for later API retrieval. That setting
is not the same as Zero Data Retention. Under OpenAI's default controls,
abuse-monitoring logs may include submitted images, documents, text,
minimized context or structured output and may be kept for up to 30 days.
Shorter retention requires an approved and verified
Zero Data Retention or Modified Abuse Monitoring setting. OpenAI may retain
an image longer when a safety system flags it or when required by law.
5. How long we keep it
Optional recipe and meal text assistance
After a separate opt-in, we send your current recipe or meal draft, latest written answer, previous question, language and whether you are recording or developing a recipe or describing a meal through our authenticated function to OpenAI. The same input may be sent for token counting before generation. We do not include your diary, profile, account identifier or earlier conversation transcript. Kaffa holds these texts in temporary memory and does not store a conversation history. You choose whether to save an editable recipe or confirm a meal in your diary. Nothing is logged as a meal automatically. This permission does not include audio.
You can turn recipe assistance off in its sharing controls. Withdrawing core
health-data consent also turns it off. Requests already sent may finish and
remain subject to OpenAI's default abuse-monitoring retention of up to 30 days.
Requests use store: false; this is not Zero Data Retention.
Optional recipe and meal voice assistance — implemented, not enabled
Voice assistance requires its own opt-in and microphone permission. During an active call, live audio is sent directly over WebRTC to OpenAI to hold the conversation. Our authenticated server receives reflected audio, which it discards immediately, and temporary transcript fragments. Relevant recipe or meal context and spoken answers are processed transiently by our server and the delegated recipe assistant. Kaffa's voice control database stores identifiers, call times and cumulative duration, not audio recordings, transcripts or recipe/meal wording. You still review the recipe or meal before saving or logging. Text permission does not include voice. Muting stops microphone input; it does not end the call. Leaving the app or choosing to type ends voice. We do not automatically reconnect.
Withdrawing voice permission requests that the call end; charges and work already sent may still need to finish or be reconciled. Withdrawing text or core health-data permission also clears voice permission. Provider retention and audio-routing details must be verified before this feature and disclosure become effective; disabling session storage is not a zero-retention promise.
When you save a recipe from Discover, we keep its recipe reference with your account and the timestamps needed to sync or remove it. Saving a recipe does not send anything to an AI provider. Removing a saved recipe retains a deletion marker for sync; account deletion removes your saved-recipe records. Your export includes the public recipe and ingredient details needed to understand those references.
If you choose to adapt an existing recipe with AI, the same separate recipe assistance consent applies. We send a bounded copy of the recipe's name, ingredient descriptions and amounts, servings and method with your changes. We do not send database recipe or food identifiers or nutrition values. Your original recipe remains unchanged; you review and save the new version.
Unfinished recipe drafts remain until you save them as a recipe or discard them. Saving or discarding clears the draft's editable content. Minimal draft identifiers, source/completion references and synchronization timestamps remain until account deletion so an offline device cannot restore discarded work. Your account export includes your drafts; account deletion removes them.
| What | How long |
|---|---|
| Your logs and profile | Until you delete them or your account |
| Deleted entries | Marked deleted immediately, purged from the server within 90 days |
| AI request-rate metadata | Up to one day, removed by the operations maintenance worker |
| Recipe conversation and turn metadata, including empty processing-job records | Up to seven days after the conversation's 30-minute expiry, removed by the maintenance worker. Included in your account export and deleted with your account. The separate financial records retain outstanding obligations under the policy below. |
| Voice-session control metadata (planned) | Closed and financially resolved sessions are removed after seven days by maintenance. Unresolved sessions and their provider handles remain until closure and financial reconciliation. Your export includes your session metadata without internal worker credentials. Account deletion removes account attribution and requests closure; it does not erase an unresolved supplier obligation. |
| AI spending records and funded allocation fingerprints | Resolved operational history for up to two years after its last update; unresolved charges remain until reconciliation. Account deletion removes account attribution, raw product/purchase references, job links and request fingerprints while preserving financial obligations and allocation deduplication records. |
| Consent records | Kept while the account exists; deleted with the account |
| Crash diagnostics | 90 days |
| Raw nutrition-label photo in Kaffa | Temporarily in the app cache and memory for capture and request processing, then explicitly deleted; never written to our database or server file storage |
| Nutrition-label image or transcription in OpenAI abuse-monitoring logs | Up to 30 days under default controls; shorter only after a verified retention-control approval, with limited safety or legal exceptions |
| Nutrition-label hash and validated transcription | Until you delete your account |
| Body comparison photograph on your device | Until you delete the photo in Progress or uninstall the app. No cloud copy or recovery. |
| Meal photograph on your device | Kept with the meal until you delete that meal or uninstall the app; deleting the meal deletes the photograph |
| Second angle of a meal | Used for the estimate and discarded; never stored |
| Meal photograph in OpenAI abuse-monitoring logs | Up to 30 days under default controls; shorter only after a verified retention-control approval, with limited safety or legal exceptions |
| Meal photograph hash, the foods read from it and your corrections | Until you delete your account |
| Raw training-plan text, PDF or images in Kaffa | In app/Edge Function memory only for validation and request processing; never written to our database or server file storage |
| Training-plan input/output in OpenAI abuse-monitoring logs | Up to 30 days under default controls; shorter only after a verified retention-control approval, with limited safety or legal exceptions |
| Training-plan exact-input hash and validated structured draft | Until you delete your account |
Deleting your account deletes your profile and every log attached to it, including nutrition-label and training-plan ingestion jobs and anything in file storage. It is not a flag on a row we keep. Financial spending records follow the separate retention rule above: deleting your account removes their account attribution and direct purchase references without cancelling charges already incurred. We do not claim the remaining provider evidence and allocation fingerprints are irreversibly anonymous.
6. Your rights
Under the GDPR you may ask for a copy of your data (Art. 15), correct it (Art. 16), delete it (Art. 17), restrict or object to processing (Art. 18, 21), take it elsewhere in a machine-readable form (Art. 20), and withdraw consent at any time (Art. 7(3)).
Export and deletion are built into the app, so you do not have to ask us. If you no longer have the app, use our account deletion request page. For anything else, write to hello@kaffa.fit.
You may also complain to a supervisory authority. Ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.
7. Age
Kaffa is for people aged 16 and over. We do not knowingly collect data from anyone younger. If you believe a child has given us data, write to us and we will delete it.
8. Changes
Every version of this policy has a date, and the app records which version you accepted. If we change something that affects how we handle your data, we will ask you to accept the new version rather than change it quietly.