Privacy Policy
123 Cal · Effective 30 September 2026
123 Cal is a calorie and protein tracker for iPhone and Apple Watch, operated by 123 Cal ("we", "us"). This policy explains what the app does with your information. It is written to describe the app as it actually works, not as a generic template.
The short version: 123 Cal has no accounts and no login. Your food diary, your photos, and your body measurements stay on your device. A meal photo leaves your phone only at the moment you scan it, purely so it can be estimated, and it is not stored on our servers afterwards. We never sell your data and we never use your Apple Health data for advertising.
Information kept only on your device
- Your profile: the name you optionally enter, plus sex, age, height, weight, goal weight, activity level and workouts per week. These are used to calculate your calorie and protein targets. They are stored on your device and are never transmitted to us.
- Your food diary: meals, calories, macros, water, streaks and the photos attached to each meal. Stored on your device, and shared with your Apple Watch and the Home Screen widget through Apple's on-device mechanisms.
Deleting the app removes all of this. You can also erase your diary at any time from Menu, "Delete all logged meals".
Meal photos and descriptions
When you scan a meal, the photo (or the text description you typed) is sent over an encrypted connection to our processing service, which forwards it to OpenAI's API to produce a nutrition estimate. Before the first remote analysis, the app shows this disclosure and asks for your permission. You can decline and keep using barcode and food search, or withdraw permission in Menu, Privacy controls. The estimate comes straight back to your phone.
- We do not store the image, keep a copy, or log its contents. Our service holds it in memory only for the seconds the request takes.
- The image is not linked to your name, an account, or an advertising profile, because the app has none.
- OpenAI processes the request under its API terms. Data sent through the API is not used to train its models by default.
- The photo itself is saved locally on your phone so it can appear next to the meal in your diary.
Barcode lookups
When you scan a packaged-food barcode, the app sends only the barcode number directly from your device to Open Food Facts to retrieve crowd-sourced product nutrition. No name, account, diary entry, photo, or Apple Health data is sent. Open Food Facts data is licensed under the Open Database License (ODbL).
Apple Health
Apple Health integration is entirely optional and off until you turn it on and grant permission.
- Written to Health (only when you enable it): the calories, protein, carbohydrates, fat, fiber and water from meals you log.
- Read from Health (only when you grant it): body weight, height, date of birth, biological sex, active energy, exercise time, walking/running distance, steps, resting heart rate, heart rate, heart-rate variability, sleep, and workouts. Profile values prefill your nutrition quiz; the remaining values keep your plan current and show activity, sleep, and general-wellness trends.
Health data is processed on your device only. It is never sent to our servers, never shared with third parties, never used for advertising or marketing, and never used for any purpose other than showing you your own information inside 123 Cal. You can withdraw access at any time in the iOS Health app under Sharing, Apps.
Analytics
Starting with version 1.3, app usage is shared with Mixpanel automatically to help us understand onboarding, feature use, errors, subscription purchases, and return visits and the source of our own advertising installs. Earlier releases do not include this product analytics.
Collection starts when you use the app unless you previously turned sharing off. You can turn off “Share app usage” in Menu at any time. Turning it off stops collection and clears unsent events; it does not delete events already received. Contact us to request help with deletion.
Events contain a random installation identifier, app and operating-system versions, device model, app language, screen or feature names, general error categories, request duration, subscription product identifiers, paywall experiment assignments, and Apple Ads campaign, ad group and keyword identifiers when available. A random analytics identifier can be shared with Superwall to associate usage and subscription outcomes; it does not contain your name or email. We do not send meal names, photos, descriptions, calories, macros, goals, body measurements, Apple Health values, names, or email addresses to Mixpanel. IP-based geolocation, automatic screen capture, and session replay are disabled. This data is used for product analytics and measuring our own acquisition campaigns. We do not use it to target personalized ads or track you across other companies’ apps or websites.
Subscriptions
Subscriptions are sold and processed by Apple. We never see or receive your payment card details. We use Superwall to display and manage subscription offers and receive Apple's subscription notifications. These can include transaction identifiers, product identifiers, dates, prices, trial status, renewals and refunds.
Our subscription notification filter runs on Cloudflare separately from food analysis. It inspects notifications in memory without storing or logging their raw contents. For optional subscription analytics, it is designed to send only a random analytics identifier, event category and time, product identifier, amount in US dollars and a duplicate-detection digest to EU Mixpanel. Raw Apple transaction identifiers and contact details are not forwarded to Mixpanel. Production forwarding is currently disabled while we verify opt-out handling and receipt delivery. Sandbox verification records are excluded from production reports.
What we do not do
- We do not sell or rent your personal information.
- We do not track you across other companies' apps or websites, and we do not share data with advertising networks or data brokers.
- We do not require an account, an email address, or a phone number.
Legal bases for processing (EEA/UK)
- Performance of a contract: estimating your meals and providing the tracking features you asked for.
- Consent: access to Apple Health data, which you grant explicitly and can withdraw at any time.
- Legitimate interests: abuse prevention and service security, to keep the scanning service reliable.
Where your data is processed
Our processing service runs on Cloudflare's global network and nutrition estimation is performed by OpenAI in the United States. Where personal data is transferred outside the EEA or UK, it is covered by Standard Contractual Clauses or an equivalent safeguard.
Retention
Diary entries, photos and profile data remain on your device until you delete them or delete the app. Scan requests are not retained by us once the response is returned.
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal information, to receive a copy of it, and to lodge a complaint with your data protection authority (in Spain, the Agencia Española de Protección de Datos). Because most of your data never leaves your device, you can exercise deletion directly in the app. For anything related to a scan request, email us and we will action the request.
Children
123 Cal is not directed at children under 13, and we do not knowingly collect their information. If you are under 16 in the EEA, use the app only with the consent of a parent or guardian.
Health disclaimer
123 Cal provides estimates for general wellness purposes. It is not a medical device and does not provide medical advice, diagnosis or treatment. Talk to a qualified professional before making significant changes to your diet.
Changes
If this policy changes materially, we will update this page and revise the effective date above.
Contact
123 Cal, support@123cal.app